Dune/docs/IMPLEMENTATION_STATUS.md

Dune implementation status

15 October 2026 — Native Guild price counter retains Richese one-counter source

Removed the explicit Richese Secret Ally exclusion from native rate cancellation, without canceling the absent faction's Nexus advantage. The original signed receipt now retains the unpaid rate frame and actual settled tariff. Five physical native counters cost one billed counter: sand1 if allowed, full2 if canceled. Original Advanced interception stays first; no rounded stronghold discount or independent purchased price is invented as a native cancelable saving.

The selected existing no-debt/spent-card policy releases an unfunded full2 without delivery or payment, leaves ordinary full-price shipment/movement available and keeps the declared Nexus spent without refund/reusable coupon. A still-held card survives an earlier rate cancellation. Its shared human/ AI quote now honors that cancellation instead of showing false affordability; five can still use the legal stronghold1 alternative. No strategic tuning.

All source scenarios start with printed original setup, conserved undealt Spice/Nexus entropy, a real paid Ecaz Karama and an actual Ecaz/Moritani alliance leaving Guild unallied for its real Richese draw. No played hands, wallets, armies, phases or decisions are staged. Actual optional bribes reduce only their original sender's available wallet.

Affected thirteen-file 92/92 passes, including seven new behavior cases. Eleven actual original-action runtime/policy paths pass, including four existing profiles spending the held card on a legal full-rate alternative. Four real styled390×844 GameTable journeys prove Junction5/fee2, unfunded release then ordinary one-counter replacement, still-held source sand2 disabled then five-force stronghold1, and independent purchased1. Exact physical counters/card costs and original turn completion are observed. Viewport/scroll width390, no browser error or application exception. Two transient stale-node tool errors after successful transitions were resolved with fresh state/accessibility without replay.

Only an owned memory-only host started/stopped. No worker, D1, authenticated saved room, human server, deployed revision or mode gate was exercised or changed. Outside-Git source/runtime/table proof and four initial scenes remain under /tmp/dune-richese-native-rate-*20261015*. The full goal and final assurance remain unfinished. Source and selected policy, runtime and limitations. Final npm run check:quick and production build pass, with existing module-register, large-chunk and Unknown-route warnings. Thirteen current local links and430 checklist evidence paths resolve; both five-facet Homeworld/Nexus checklists remain Partial.

15 October 2026 — Explicit purchased-price choice for immune Junction

Removed the earlier purchased-price/Junction composition fence without canceling or repricing the Homeworld source. Original half/full fee and normal payees remain: no quarter price and no card bank-only overlay. Accepting with a separate grant requires forfeitPurchasedRate: true; actual controls explain that it ends unused and its played card is not refunded. The independently legal ordinary purchased route stays available. This is a conservative selected product composition, not a publisher worked timing example.

Original card-first/offer-first orders bind the active grant in their existing declaration identity. Missing/false/stale acknowledgment rejects without mutation. Unfunded, declined and deferred acceptance preserves the grant; only actual delivery consumes it. Existing Guild Betrayal keeps the same offered invoice through Use/Pass. Original movement remains available. Pure Junction tariff and offer rules are intentionally unchanged.

Affected eleven-file 131/131 passes, including twelve new meaningful regressions. Fourteen actual runtime/policy paths pass: eleven original-action, three explicitly controlled (second physical card native denial plus existing Betrayal Use/Pass). All four original policies execute the immune full quote without strategic tuning or calibration.

Four real styled390×844 GameTable journeys use original-action scenes: full3; poor2 rejecting full3 then actual sponsor replacement half2; ordinary purchased2 instead; full6 native arrival with Guild6→12 and subsequent ordinary movement. Exact counters and the original spent card remain, no refund; successful shipment consumes the grant once. Viewport and scroll width390, no application exception; one initial Vite dependency fetch aborted during optimization.

Only an owned memory-only host was started/stopped. No worker, D1, authenticated saved room, human server, deployment or publication gate was exercised or changed. Outside-Git source/API/table JSON and four initial scenes are retained under /tmp/dune-junction-purchased-*20261015*. The full goal, remaining rule combinations and final assurance remain open. Source choice, runtime contract and scope. Final npm run check:quick and production build pass; existing module-register, large-chunk and Unknown-route warnings remain. Sixteen current local links and429 evidence paths resolve; both five-facet checklists remain Partial, with no complete-mode claim.

15 October 2026 — Separate native permission, independent typed price and loan approval

Native cross/return now uses a distinct unpaid guildTransportPermission response before rate/payment, with original exact groups and typed world sources. The conservative provisional denial scope is that original shipment opportunity; signed Cunning second opportunity is distinct. Ordinary reserve/ movement and common World→foreign World remain legal alternatives; immune Junction transport does not inherit the native ban. Existing rate-only saved receipts retain their original absent-field signature and do not replay a new earlier window. No recovery certification is implied.

The authorized supplied Advanced PDF physical16 Karama section permits any player’s half-normal Force Shipment paid to bank. Native typed routes now honor the independent played price without granting a route or stacking explicit Nexus. Original own/donor invoice goes wholly to bank; actual completion consumes the grant. Shared existing provisional special-stop refund returns the exact physical purchase card to its owner and preserves resources/ movement while using shipment. No unrelated grant is cleared.

Allied Richese native price cancellation bills one marker, never zero/five materialized units. Recipient-funded full2 is distinct from supplier whole-fee1 approval: even a wealthy supplier needs a new full-price offer and recipient consent. Controlled release preserves its prior three-marker and both wallets. Real reapproval then materializes old Richese3 and Guild5, spending only the new supplier2 under existing provisional bank-only precedence.

Mobile smoke found fresh lender UI/AI still inferred its recipient’s price from its own view. Both now use authorized-pair richeseNoField.allyPricing; the shared pure helper takes explicit source booleans, not an ambiguous whole Game/View. No private wallet is added. Implementation/default tactical first-candidate and flag-cleanup pins were removed rather than re-pinned; optional reoffer was not forced or strategically tuned.

Twenty main runtime/policy paths pass:15 original-action and five controlled, including exact source denial/alternatives, permission then rate cancellation, four original gifted routes, loan reapproval, refund and Cunning. Four additional controlled planning probes choose no optional reoffer here but execute legal recipient shipments. Actual minimum AI remains legal, not calibrated.

Five styled390px GameTable journeys pass: original native prevention then immune Junction2 and ground move; original actual Ecaz gift→three-force world purchase2 with Guild6 unchanged; controlled supplier1 release→fresh full2 offer/consent; controlled second-card special-stop/refund then movement; original typed return permission allowed then full3 rate cancellation with approved donor1 unchanged. No horizontal overflow/application exception; one initial Vite dependency fetch aborted. The owned in-memory QA reload retained exact captured synthetic states to exercise the corrected projection; no real room, D1, human server or deployed revision was restarted or changed.

An already-purchased card with Junction sponsorship retains its prior separate composition gate and an explicit next task. Complete combinations, source refinement, comprehensive assurance and public starts remain open. Canonical contract. Affected25-file 263/263 passes on the corrected quote bridge: the237-case related selection plus26 module/typed producer cases on the same frozen implementation. The earlier tactical/default assumptions were deleted, not re-pinned; no broad persistence/privacy campaign was added. Final npm run check:quick, production build and the20+4 runtime probes pass on the final source. Existing module-register deprecation, chunk-size and Unknown-route warnings remain. Eleven current links and both canonical five-facet evidence sets resolve; owned QA services/tab are stopped.

15 October 2026 — Native rate source composition and typed Homeworlds

Removed blanket physical-module rate exclusions in favor of actual native price/source eligibility. Ordinary Smuggler bills paid counters only; own No-Field bills one marker, never hidden value, retaining its independent free companion and authenticated private proof. Real original training overrides select undealt offers and actual training, not played assignments.

Native Guild world-to-world, Arrakis-to-foreign-world and Junction return use their existing typed quote/settlement with optional native cancellation context. Actual owner quotes, bot budgets and conditional instructions follow full tariff after cancellation. Original manual and automatic interception feed the prepayment rate window. Cunning's typed frame retains its exact event, price and second allowance through allow/cancel/unaffordable replacement.

Source immunity remains explicit: genuine Junction-sponsored half/full transport survives native cancellation; non-Guild world-to-world stays full and independent Guild Secret Ally stays half. Deferred Guild Betrayal exposed premature rate cleanup: retain full-price authorization until payment/ delivery, then release it. Six controlled reserve/cross/world Use/Pass cases verify one actual full invoice without replay or a false early-paid log. Skills/No-Field validators now accept their real rate continuation; the shared quiet fixture supplies the original Ambassador event instead of an invalid eventless decline. A new donor expectation was corrected: pledge already debited its wallet, so settlement consumes escrow without another debit.

Affected18-file 198/198, including32 new source cases, passes. 21 actual runtime/policy paths pass:17 original-action paths and four explicitly controlled Cunning/No-Field paths. All four actual original Homeworld policies pass in this position, not cancel. Redundant quote-forwarding/default pins and a new unrelated private-projection loop were removed, not re-pinned.

Four actual styled390px GameTable journeys pass: original composed Smuggler pays4 for three physical/two paid counters then moves once; original native return preserves donor1 and deposits3 into Junction; poor original world invoice preserves all sources/escrow on cancellation then ships2 at full2; controlled No-Field pays2 for one marker plus its free companion, then reveals five into six board/14 reserves without another payment. Original turn ownership resumes, with no overflow/browser errors. Three original scenes and one explicitly controlled scene, not worker/D1/authenticated saved rooms.

No real saved/deployed game, database, mode/publication gate or provider permission changed. Allied No-Field/special receipt and native permission cancellation integration, full combinations and final assurance remain open. Canonical current contract. Final npm run check:quick and production build pass; existing module-register, chunk-size and Unknown-route warnings remain. The frozen21 runtime paths pass again after final source typing, plus a separate controlled deferred full3 Betrayal Use completion. Seven current local links and five-facet evidence targets resolve. Owned QA host/tab are closed; proof remains outside Git.

15 October 2026 — Native Guild rate admission and Cunning receipts

Removed classic-only expansion/Nexus exclusions from native rate admission, retaining physical-module and special price/source gates. The action-only Ecaz/Moritani/Guild producer demonstrates the old immediate paid transport3 and new prepayment half2/full3 response. Original contribution and price validation, provisional no-debt withdrawal and full-price replacement remain.

Expanded admission exposed Cunning's old !shipped rate guard: its original first shipment is rightly still recorded. Both rate validators now reuse shipmentAvailable. Cunning's reserve frame binds the temporary rate event and actual settlement; unaffordable cancellation releases only the current uncommitted frame. Existing interception and rate windows are recognized, without reopening the first shipment, ordinary movement or spent Nexus.

Affected nine-file 101/101 passes: seven action-only native reserve/cross/ return cases, six controlled Cunning reserve/cross allow/cancel/unaffordable cases and existing rate/transport/Cunning/Betrayal/own-arrival regressions. Five original API/policy paths pass. All four actual policies pass the new native rate window and pay rounded two in this position, not cancel. A separate controlled Cunning smoke reproduces/fixes the true-shipped failure.

Three actual styled390px GameTable journeys exercise full-price cancellation, unaffordable withdrawal/full-price replacement and Cunning reserve repricing through Finish Guild turn. First transport pays Mori12→9/Guild6→9; the poor source stays6/spice3 until its replacement3 pays full3. Cunning retains first Arrakeen5, adds Carthag3 and ends at14 spice/12 reserves. No overflow/ browser errors. Two scenes use the original action-only native fixture; Cunning uses its explicitly controlled older final-setup fixture.

Homeworlds, Skills, Discovery, Tech, Strongholds and special borrowed/free sources remain separately bounded. No saved/deployed room, reset, provider permission, comprehensive assurance or public-start gate changed. Canonical contract. Final npm run check:quick and production build pass after expressing the validated non-declined receipt type without removing optional release. Existing module-register/chunk/Unknown-route warnings remain; six current local links and the five-facet canonical evidence targets resolve.

15 October 2026 — Native Guild/BG own-arrival continuations

Direct native Guild transport's engine already committed income before queued entry, but its bot candidate predicted that future income as busy. The native original owner view now agrees with the executable path. Ordinary shipment also stops predicting its future BG accompaniment as an active decision; shared movement preflight retains resulting Intrusion without calling it an already-pending control. No second queue, timing adapter or price/state schema.

Existing settlement handles income allow/cancel, Intrusion accept/decline/ cancel, and accompaniment accept/decline/cancel before the original entry. A real companion joining retained BG fighters creates its own child offer: decline keeps the live token for the original entrant; trigger consumes it without recreating an offer. Advisors remain exempt. Existing child-first/ live-token composition is provisional, not a publisher priority ruling. Actual response/decision/Terror/Ambassador controls, pre-entry fighter choice, storm protection and unsupported paired/profile guards remain.

Two genuine original-action fixtures use original setup, actual Guild alliance, paid token placement, real Karama custody, and prior BG movement/stance. No played wallet, hand, army, leader, phase or decision is assigned. Obsolete predicted-control rejection/fallback and wording pins were removed, not re-pinned. Affected six-file 55/55 and 20 original API/policy scenarios pass. All four Ecaz policies acquire Duke after Guild income; all four BG policies convert then accompany. Retained-fighter human/scripted evidence is distinct.

Four actual styled390px GameTable journeys use original controls for native transport with income canceled, peaceful accompaniment, accepted Intrusion, and declined Intrusion with distinct BG-child then Emperor offers. Original payment/force transfers happen once; original movement resumes, including actual Carthag→Arsunt moves. No horizontal overflow/application browser errors. A browser observation node race occurred after the final action committed; fresh state confirmed it and no action was replayed. Proof is in-memory loopback, not worker/D1/authenticated saved-room/deployed acceptance. The separate Guild native-rate Karama expansion/Nexus admission gate remains tracked next work. No reset, real-game write or public gate change. Final npm run check:quick and production build pass; existing module-register deprecation, chunk-size and Unknown-route warnings remain. Ten current-section local links and canonical checklist evidence targets resolve. Canonical contract.

15 October 2026 — Physical Traitor replacements, retired zone and legal recycling

Original Moritani Mentat replacement accepts the actual Ix Hero Traitor as a physical card, not a faction leader disc/target. Native Ix play retires Dominic4 and draws one Hero; native controlled leaders and five-disc identity stay unchanged. The actual owned phase-opening initialization still precedes automatic retirement: phase8 alone is not a completed Mentat draw.

Added optional NexusTraitorSnapshot.removed, derived only from actual replaced Mori victim cards. Full canonical census retains existing Loyalty exclusion; removed cards cannot enter reserve/hands/Face Dancers or fund draw/return. Exchange sources and Face Dancer receipts conditionally bind this physical zone, preserving old absent-field grammar. Betrayal's whole serialized source already carries it; replacement rejects a source-permanent card without parsing that inventory for a still-due/null draw. Rihani's full before/state preserves the zone and rejects rewriting it. No Game marker field is imported from a helper: engine application only changes actual reserve/hands/Face Dancers.

Removed the false coupling between a historical replacement ID and permanent live ownership/unique historical draw. Original Harkonnen Secret Ally may return Hasimir6, keep newly drawn Esmar3 and restore the original Mori placement. A real later turn-three paid battle/retirement draws the same physical Hasimir again. First receipt/signature and older Nexus source stay unchanged after a second public marker; one live card and both permanent victims remain conserved. Current actor/card authorization, physical census, revealed-until-Mentat rule, native target, once-use and normal-call forfeiture remain.

Three failing-before observations identify the role-only Hero parser, missing retired-card census and historical-live-ownership guard in actual native play. Shared helper/engine consumers and original native producers are integrated without a save-schema migration, second deck or fabricated card. Shared fixture options direct only original undealt reserve prefix and actual closing Nexus singleton; return-shuffle entropy and conserved unplayed Spice ordering are disclosed. No raw played reserve/hand/wallet/forces/leader/phase/ battle or ledger assignment produces the accepted native paths.

Focused nine-file76/76 passes. The broader affected15-file union exposed obsolete old ownership/uniqueness assertions and fixtures skipping original borrowed Voice before Prescience/plans. Those fixtures now use the existing canonical native preparation actions, leaving requested native Prescience available. No rules or bot legality is weakened. Repaired affected15-file 134/134 passes. Removed markup/wiring/wording pins, unnecessary casts and their unused imports.

Eleven original API/policy scenarios pass: Hero/next Storm, four final Ready paths through original owned initialization, real old-card return, native repeated draw, and four mandatory-return policies. All four return policies keep Hasimir in that position; the human/scripted return gives it back. No strategic tuning or calibration claim.

Actual styled390px GameTable performs final Collection readiness and private Hero inspection; draws two Secret Ally cards; native checkboxes return Hasimir6 plus Caid3, keep Esmar3 and restore/pass Mori placement; original continuation reaches next Storm. A separate genuine recycled chronology reveals Esmar3 and shows one Hasimir6 after second Mentat, with both public markers and unchanged older Nexus history. No horizontal overflow/browser errors. The first UI return uses live randomness; the separately generated recycled chronology discloses its original return-shuffle entropy.

This implements printed card mechanics, not a new privacy/custody/recovery campaign. Receipt consistency does not authenticate every alleged past save. No saved/deployed rooms, public gates or existing game state are changed; full combinations, assurance, exceptional targets and full goal remain open. Final types/lint and production build pass after reference integration. Existing module.register deprecation, large-chunk and Unknown-route warnings remain. Canonical source, controls and scope.

15 October 2026 — Canonical Moritani winning discs, Auditor targets and Guild entry

Separated canonical played-disc identity from the victorious player's printed faction. The engine's existing actual surviving pre-release leader reference still binds the real plan/control/outcome; the shared helper no longer insists on that victor's ordinary native disc. A cached printed catalog avoids repeated leader construction/scans and includes the actual optional Auditor and its matching physical Traitor. Targets remain native opposing printed-faction identities, different from the played disc; captured/Ghola target guards remain. Shared Duke still has no Traitor, Auditor remains CHOAM-only/not capturable or foreign-Ghola eligible, and Cheap Hero is not a physical opposing leader disc. Original signature/state version, once-use, game-long normal-call forfeiture and physical automatic Mentat retirement/distinct replacement remain.

Three original native producers and seven consumer regressions cover:

• Ecaz/Moritani/Guild: paid reusable Ambassador, actual Guild-funded shipments, Ecaz Duke6 acquisition/win, native Sanya Ecaz4 reveal and original replacement.
• E1/E3 Moritani/Tleilaxu/Guild/Emperor: original projectiles kill Staban Tuek5 and a different Tleilaxu native; the real next Revival returns that foreign Guild disc for three. Its later Tleilaxu win opens native Zoal3, never a Guild target/copied-five bounty; the surviving ghola retains actual Tleilaxu custody.
• E2/E3 CHOAM: Auditor2 winner → Frankos4; different CHOAM winner → actual held Auditor Traitor2; played-Auditor card excluded → private Continue without card/death/bounty/faction use. Real Mentat draws distinct Hasimir privately.

The original Ecaz producer reproduced a stale Guild-income preflight exception. quoteShipmentArrival predicted an earned future receipt as a busy control, although commit already queues entry behind its original income/counter window. Removed that prediction and its dead calculation, not any payment or actual busy-control validation. The ordinary bot preflight matches; native Guild transport, BG/other reactions and unsupported composition guards remain separate. No new queue, receipt, action, persistence field or general priority ruling.

Removed old native-only/other-faction and future-Guild rejection pins rather than re-pinning them. Removed wording/forwarding/bare-not-throw coverage. One new fixture assertion confused a declared shipment's intermediate after with its actual settled transfer; deleted the incidental assertion while retaining real resulting army and physical-custody checks. Rejected real played-Auditor/foreign targets preserve the input.

Verification: affected15-file 134/134, types/lint and 25 original engine/API/policy scenarios pass, including all four owner profiles in all five actual positions. Actual styled390px GameTable completes original Ship from reserves → Guild Allow shipment → income1 → Ecaz Duke acquisition; Moritani12→11/reserves14→13, Guild6→7, queue clears once. Actual original Duke6/Sanya4, foreign Guild5/Zoal3, Auditor2/Frankos4, Auditor target2 and played-Auditor Continue controls are exercised. Original physical Mentat replacements remain private, and the surviving borrowed/shared discs retain their own original return/custody behavior.

Final Guild/Ghola surfaces have390px scrollWidth and no browser errors. An earlier rejected Guild fixture exposed a temporary QA-client .seats.map failure on invalid metadata; response handling was repaired before final surface proof. A separately admitted Emperor-third-seat witness also passed, but was not substituted for the ultimately fixed original Guild composition. Only original undealt entropy and conserved unplayed Spice/Nexus order are directed. No hand, wallet, force, leader, phase or battle is staged.

No saved/deployed rooms touched; no new recovery/privacy/custody campaign, strategic tuning, public mode enablement or complete-faction acceptance. Exceptional targets, direct Guild transport/BG arrival gates, private-step UX and the full project goal remain unfinished. Final types/lint and production build pass after reference integration. Existing module.register deprecation, large-chunk and Unknown-route warnings remain. Source and canonical behavior.

15 October 2026 — Native Moritani/Harkonnen and actual captive Duke

Connected original standalone, paired and mixed-family no-Skills E3 Nexus Advanced Harkonnen, retaining existing optional-module envelopes. Native capture/Keep/Execute and actual later two-stronghold qualification supply Moritani's same-disc captive takeover. It clears capture permanently, preserves native identity/death/use and original one-battle/current-turn tenure; no captor restoration. Original Karama can cancel with the real card. Public qualification uses the public snapshot, not hidden execution status. Allowed resolution publishes actual unavailability without Moritani revival. These custody/visibility choices are labelled provisional compositions.

Advanced Moritani now binds the actual surviving pre-release battle reference: Harkonnen can win with its native, captured foreign/Moritani or shared Duke disc while the eligible assassination cards stay native Harkonnen identities. Game-long normal-call forfeiture, printed/dead bounty, once-per-faction use and original distinct physical Mentat replacement remain. Last-native Harkonnen death uses original captive cleanup. Non-Harkonnen borrowed/shared winners, exceptional targets and private-step UX remain separate.

Random Terror uses a focused canonical living effective-control pool: native/captive/ordinary foreign Ghola/shared Duke/optional Advanced Auditor once, with capture precedence and no battle-use filter. No pool/count is projected or used for offer availability. Actual victim becomes public, printed bounty remains Zoal3/Duke6, original death/custody/skills cleanup resumes arrival. Empty revelation spends with no RNG/victim/bounty. These are provisional product policies, not a publisher exceptional-pool FAQ.

Removed obsolete Harkonnen rejection and hidden-pool availability tests, not re-pinned. The affected run exposed a mixed-family fixture probing plans before original preparation finished; it now consumes the actual preparation sequence rather than cloning a ready-looking posture or weakening legality. The captured-disc physical census now includes original face-up retired Moritani Traitors, matching the existing canonical zone.

Verification: affected22-file union 195/195, types/lint and production build pass; actual prototype CLI help passes. Fourteen original API/policy paths cover takeover/use/expiry, private execution/no resurrection, original Karama/captive-Duke winner/native Harkonnen assassination/Mentat replacement, Terror Duke death6, controlled empty boundary and all four legal response/ Terror policies. Easy reveals; other Terror profiles form the accepted alliance, and all Harkonnen counter profiles pass. No strategy claim.

Actual styled390px production GameTable completes original final movement, shows Duke6 Ready then removes him after original battle use; cancels with original Karama, reveals actual Beast Rabban4 for four Bank spice, displays original private Esmar Tuek replacement and reveals original Terror against captive Duke for six. Actual executed Duke stays dead2 after qualification. No overflow/browser errors. The QA host scopes the original Terror permutation, not the effect; the client sends no target. Empty-pool preceding Guild deaths are explicitly staged, while its actual arrival/token/continuation are original.

Ecaz-only revival, Ambassador captured/dead/Ghola exclusions, native five-disc inventory, Skills/Harkonnen/shared-training, unrelated non-Nexus and public gates remain. No saved/deployed rooms touched. Existing module.register deprecation, large-chunk and Unknown-route warnings remain. Full combinations, assurance, administration, calibration and final acceptance remain unfinished. Canonical source/policy.

14 October 2026 — Ecaz identity-tracked repeated native cohorts

Replaced the blanket repeated-six-disc guard with explicit provisional native identity accounting. Actual five-Tanks opening includes Duke; the original unavailable-native-roster exception stays separate. Completed native returns preserve the remaining cohort, a late first death need not equal its global generation, and a returned identity waits for completion plus another opening. Duke's independent death counter neither indexes nor holds native cohorts.

Paid completion, own/foreign Ghola and first-death Ambassador returns record actual native use; a first capture execution retains its face-down exclusion. Independent Duke normal/Ghola/Nexus resurrection preserves a satisfied opening. Pending normal requests do not commit the new cohort. The absent-Tleilaxu waiver is explicit and local rather than a fabricated copied cycle. Removed obsolete cycleBlock producer/UI/caller and its guard test, not re-pinned. Ordinary slot, printed prices, prevention/payment/income, separate card costs, native five-disc identity, Duke history and Ecaz-only set-aside return remain.

The optional server-only cohort field preserves exact old ordinary-discard signature grammar when absent. No schema migration, saved-room reset or historical assurance campaign is introduced. Provisional accounting is labelled, not presented as a publisher's missing six-disc example or user numeric ruling.

The mixed-death rejection fails before/passes after. Affected19-file union 230/230 and types/lint/build pass. Original native setup, physical shipments and poison battles create five native deaths, a paid return and its repeat, then an independently completed four-native cohort with original Ghola, four repeat deaths and the same Tanked Duke. The never-killed fifth native survives and the second cohort is used inside turn ten. Original private15/25-spice bribes become spendable at Mentat; no wallet/death/history assignment funds this proof. The fixture selects its next battlefield after the actual Storm to avoid running a skipped-battle chronology past the original game end.

Actual API and canonical-styled390px production controls pay11→8 for the unreturned native while the repeat stays dead, and12→10 in the second cohort while Whitmore stays alive/deaths0 and Duke stays Tanked/deaths1. One ordinary leader slot is spent. All four policies in both original positions use actual Cunning, ordinary force revival and a paid native return; Cunning's independent Duke resurrection retains the open native permission. No overflow/browser errors or saved/deployed room mutation. Proof JSON stays outside Git; broader combination/recovery review, calibration and deployed/ publication acceptance remain open. Final build retains the existing module-deprecation, chunk-size and route classification warnings. Canonical policy, source and current evidence.

14 October 2026 — Original quiet-phase Ecaz Cunning

Removed the artificial Battle-only availability fence from printed current-turn Cunning. The original shared no-phase Nexus guard still blocks auctions, Battle, responses, Ambassador placement/arrival, revival and pending physical continuations; no public pause or interrupt is introduced. Private owner action, minimal legal bot adapter and actual table now reuse that source quote in any original quiet phase. Current chooser, phase, wallet, forces, ordinary leader slot and native continuation stay unchanged.

New physical plays use strict version3 ordinary/captured custody with actual phase-bound events/history. Earlier unversioned/version2 Battle-only records retain exact keys, signature and phase grammar. Two actual prior native QA receipt formats are accepted unchanged. This is contract compatibility, not a new saved-room/recovery assurance campaign. Current-turn unused expiry, one-battle release, provisional return policy and Ecaz-only revival remain; no new roster/Skills/foreign-Ghola gate is opened.

The actual Revival rejection fails before and passes after. Affected19-file union189/189, types/lint/build and thirty-one native API scenarios pass: both captured/returned-Tanks sources at actual Storm, Charity, Revival, Shipment, Collection and Mentat boundaries, all four minimal profiles in Revival/ Shipment, native unused expiries and real Revival→Shipment→Battle release. Actual canonical-styled390px controls spend in Revival10→10, revive the executed Duke at deaths2 without an ordinary slot, and act during Harkonnen's Shipment without stealing it. Original Ecaz placement and Guild timing must finish through their own controls first. Native suffix reaches Collection or unused turn expiry once. No overflow/browser errors or saved/deployed room mutation.

Deleted obsolete phase-only/blanket Harkonnen and incidental retained-hand pins rather than preventing newly legal early AI play. Initial smoke placement expectation was corrected to original end-Revival, not an invented Shipment decision. Isolated QA host mirrors real PostCSS/public assets and registers routing before the SPA fallback; initial host omissions were corrected, not application rules suppressed. Proof JSON remains outside Git. Final shared-Duke/capture/Ambassador internal guidance matches the bounded support. Final build retains existing module-deprecation, chunk-size and route-classification warnings. Broader combination/recovery review, calibration and deployed/publication acceptance remain open. Canonical source and actual proof.

14 October 2026 — Original captured Duke and legal Ecaz Ghola composition

Connected the existing standalone Ecaz/classic no-Skills Nexus profile to Advanced Harkonnen's real capture lottery, including an eligible surviving just-used losing Duke across one-battle release. Keep preserves prior tenure; Execute pays original two spice and returns the same dead disc to Ecaz Tanks with at least two deaths. Real captive battle use and all-native-Harkonnen-dead return are connected. Original private capture/execution snapshots stay server-only; projected custody and private action tokens retain native secrecy.

Actual Cunning liberates the shared captive or returns the Tanked disc, spending one physical Nexus without spice, forces or ordinary revival slot. Provisional return policy removes captivity permanently, then sets aside on one-battle use or unused turn expiry. Original early captive return restores only unused valid prior tenure. Capture ordering/return are recommended product composition, not newly retrieved publisher or numerical user rulings.

Binding Ecaz-only revival remains. Actual Ecaz Ghola returns the same Duke alive and set aside before a separate Cunning acquisition; no forbidden Tleilaxu-owned foreign Ghola is manufactured. Native five-disc rosters, no Duke Traitor, strength6 and physical death history remain. No broader paired, Skills/training, arbitrary-phase or mode gate is opened.

Frozen related13-file union127/127, types/lint/build pass. Actual production GameTable at390px retains a real captive, spends Cunning, seals Duke6 and resolves the original battle/inspection suffix into Collection with Duke set aside once. Used-captive Execute pays2; actual Ghola controls return the dead Duke before separate Cunning. No overflow/browser errors or saved/ deployed room mutation. Initial smoke assumptions about automatic empty Battle closure were corrected with real pending battles, not engine pauses. Thirteen actual native API scenarios pass: unused/just-used Keep/Execute and subsequent Cunning, liberated battle use, unused expiry, captive use, all-five-native-dead return and real Ecaz Ghola then separate Cunning. Smoke assertions distinguish original execution bounty from later Collection income and choose a genuinely unrelated audience, not the captor. Obsolete SSR wording/action-copy, incidental defaults and obsolete blanket capture gates are deleted, not re-pinned. Proof receipts remain outside Git; existing build warnings remain. Broad assurance, calibration and complete combination/deployed/publication acceptance stay open. Canonical current source and evidence.

14 October 2026 — Emperor Nexus original native bank admission

Removed the classic-only prototype bank fence in favor of existing canonical native Nexus public profile envelopes. Uniform winner payment remains private- face independent; actual unallied holder proves its positive full own price, spends one real Nexus and receives one original normal bank lot with unchanged wallet. Original card capacity, paid/Karama alternatives, native Harkonnen bonus and Atreides next inspection stay. No bank-created income or Richese seller/cache route is invented. The no-version bank receipt/event/signature stays unchanged.

Exact previously accepted classic condition is reused, not duplicated or silently narrowed. The old guard is explicitly named for strict historical physical revival evidence; that source never broadens or replays forces. New native aliases do not open unsupported packets or combinations. Existing minimal bank adapter and production controls are reused without new actions.

Affected16-file union217/217 and types/lint/build pass. Thirty-six actual native API profiles cover every six natives in Basic/Advanced Pay/Use plus Advanced Homeworld/Tech Pay/Use, retaining original card/module inventory and next-lot inspection. Actual390px Richese5→5 and Ecaz12→12 preserve Homeworld/Tech; Basic Tleilaxu5→5 and irrelevant Guild-Nexus CHOAM Pay14→12 keep original costs, one card and index0→1. Actual Atreides surface sees the next Maula Pistol. No overflow/browser errors or saved/deployed rooms touched.

Fixture assumptions forcing a cancellation response with no canceling card or a universal five-disc CHOAM roster ignoring native Auditor are removed, not re-pinned. Native automatic bonus/inspection remains. Pure field/action/ default assertions are removed; later actual purchases prove historical receipt acceptance. QA static-root omission was corrected to serve existing bundled art/fonts; this is not complete presentation acceptance. Proof receipts remain outside Git; existing build classification/chunk warnings stay. Full combinations, broad assurance, AI calibration and deployed/publication acceptance remain open. Canonical native source/proof.

14 October 2026 — Emperor Nexus joint native special acquisition

Connected original Advanced Richese special Karama purchase to the printed Emperor Nexus purchase panel without adding a Bidding qualifier. Private joint action carries exact flags/event through the native normalized intent; actual purchase commit spends original Karama plus Nexus, retains three own uncommitted spice, transfers one exact unreserved cache card and sets native once-use. No bank payment, reimbursement, ally bonus, fake auction or automatic public pause. Original timing/enclosing controls, full-hand exchange and final-cache continuation stay native. Version-four signed source history binds both physical IDs, actual phase/price and unchanged wallet; future state is not compared to old snapshots. Ordinary paid special acquisition is unchanged.

Genuine native setup deals Richese Karama, real other-seat pact and closing draw supply Emperor, and original paid/unbid acquisitions produce full-hand/ final-cache sources. Last-cache chronology now records actual physical stock removal, including original automatic unbid disposal when hand is full, instead of pinning a nonexistent extra acknowledgement. Easy's existing six-spice budget is reached by a real one-spice seller sale; no money or strategy is changed. Source fixture types reflect native Homeworld shape and actual transition snapshots. Receipt/action/chronology/default echo pins are deleted. Existing native Kull producer excludes Richese; no unsupported frame is staged.

Affected13-file union112/112 and types/lint/build pass. Twelve actual API profiles cover phases2/4/5, paid/joint paths, full hand, final cache and intersection; depletion reaches original ordinary Bidding without an empty compulsory lot. Four actual390px surfaces prove keep5→5, full-hand4→4 at spice3, final-cache1→0 at turn9 and paid5→2 with Guild Nexus retained. One original Karama cost, actual Nexus cost, one cache card and once-use remain; no overflow/errors. No saved/deployed room touched. Proof receipts stay outside Git; existing build route/chunk warnings remain. Full combinations, broad assurance, AI calibration and deployed/publication acceptance stay unfinished. Canonical composition/proof.

14 October 2026 — Emperor Nexus original Ambassador purchase

Connected the existing fixed-three Richese Ambassador purchase classification to the printed Emperor Nexus purchase panel without inventing a Bidding-only condition. Uniform original-beneficiary Pay/eligible Use follows committed trigger, not hidden face/funds/hand capacity. No new beneficiary veto, bank payment, reimbursement or fake auction. Original conditional unavailable Pay consumes no spice/card and keeps the token spent. Actual unallied holder alone can prove/retain three own spice; allied beneficiaries cannot Use.

Version-three signed receipts retain source entry/token/entrant, actual phase, buyer, physical drawn card and unchanged price. Malformed original source is a hard error; private inability only disables Use. Original phase/resume authority also governs source-bound Homeworld arrivals. Draw/recycle happens once at commit, never at offer. Original entrant active, movement/spice suffix and native bonus stay original; actual Truthtrance discard restores the same decision. Minimal profiles share the legal projection. Table decision headings now name Ambassador/seller payment and compulsory funding instead of battle spoils.

Affected13-file union111/111, types/lint/build and eight Basic/Advanced actual shipment/worm API profiles pass. Four real390px surfaces prove Basic Use11→11, Advanced Pay11→8, irrelevant Guild-card Pay and Advanced phase-one worm Use11→11, one original card and native movement/spice controls, no overflow/errors. Native allied Harkonnen paid acquisition gets its bonus once, automatically when nobody can cancel. Fixture-only nonexistent False Wall South Spice Card, retained-after-alliance Nexus and forced-response assumptions were removed. Source now uses real Rock Outcroppings blow and legal native Fremen reinforcement. Copied-action/receipt/default/wording pins are deleted, not re-pinned. Temporary QA alias mistakes were fixed against installed Vinext shims; clean final surfaces are recorded separately from those failed harness boots.

CHOAM closing market only sells to bank/trades; no direct purchase producer is invented. Other real acquisition sources, full combinations, broad assurance and deployed acceptance remain open. No saved/deployed room touched. Proof receipts remain outside Git; existing build classification/chunk warnings stay. Canonical source and policy.

14 October 2026 — Emperor Nexus original Richese purchase retention

Connected original positive Richese cache and Advanced Black Market sold lots through uniform winning-buyer Pay/actual eligible Emperor Nexus Use after original Richese Betrayal. Recommended visibly provisional seller-unpaid composition retains the full personally affordable price without bank money, paid invoice or refund. Basic/Advanced cache and legal self-cache work; original self-Black remains blocked. Original Betrayal self-discard leaves no acquisition or Emperor Nexus disposal; bank diversion retains provenance but receives nothing on zero-payment Use.

Strict version-two purchase receipts preserve source, seller, round, lot, price, physical card and unchanged wallet; old bank receipt remains distinct. Original Truthtrance discard restores the same decision. Actual stock removal, hand limits, native Harkonnen bonus and source successor continue once. Original paid Richese tests/drivers now execute actual public buyer Pay instead of stopping at the new confirmation. Incidental wording/action-copy pins are removed rather than replaced. Minimal bots use the shared private legal offer.

Affected10-file union108/108 and types/lint/build pass. Twenty actual native API profiles cover Basic/Advanced cache Pay/Use, Advanced Black Market Pay/Use, original Betrayal pass/bank diversion and legal self-cache. Initial throwaway completion predicate incorrectly required no decision at the genuine Black Market declaration successor; corrected to original lot/sale completion. Actual390px four surfaces retain original wallets, deliver one original lot, and finish native Harkonnen bonus/round without overflow/errors. No saved or deployed room touched. Direct CHOAM/Ambassador sources, complete combinations, assurance and publication remain open. Proof receipts stay outside Git; existing build route-classification/chunk-size warnings remain. Canonical policy/proof.

14 October 2026 — Emperor Nexus original extra-return continuation

Replaced direct physical transfer with a fixed-three source entering original pending revival after actual Nexus disposal. Version-two requested/returned/ denied receipts retain strict event/index/signature and actual typed delta; old completed records remain evidence without replay. Ordinary total/free and native Emperor allied-extra usage stay unchanged. Independent-source policy keeps native Tleilaxu prevention/income, ignores ordinary free-rate repricing/ Recruits doubling, and grants no leader/missing provider/refund. Denial keeps both spent cards without physical return, income or Tech. Native owner sees the provisional source on its original clearance control.

Original typed reserve, once-only Axlotl and Homeworld paths now accept the source. Native Cyborg count caps survive; new Fedaykin can deploy through Southern Hemisphere. Tleilax ordinary Free Revival placement is not fabricated for an independently zero-cost grant. Signed snapshots settle before later native income/placement; later pools/wallets need not equal old snapshots.

Genuine setup, real paid shipments/battles, worm/pact/closing draw and Revival produce classic, Tleilaxu, Ix and Fedaykin sources. Wrong Card.kind Karama selection was repaired with a conserved original undealt effect selector. Test-only constructor expansion admission, mismatched post-declaration ledger and orphaned source fixtures were repaired without changing legality. A false postbattle wallet pin ignored automatic Collection and was deleted. Native Ix requests an actually affordable follow-on, without minting spice. Legal Fremen reinforcement uses Sietch Tabr and native zero-support dial6/5; initial out-of- range and paid-support assumptions were corrected in the producer only. Obsolete guard, SSR wording, action-copy and decision/default pins are deleted, not re-pinned; current consumers require completed physical receipts.

Affected16-file union266/266 and types/lint/build pass. Fourteen actual API profiles reach Movement, including native Homeworld deposits and Basic/Advanced Fedaykin source placement. Actual390px Allow returns3/free-income1/Axlotl1 without ordinary usage; normal3 then costs2 and pays native income2 without repeating bank/Tech bonuses. Prevent spends both cards and commits denied with unchanged pools/wallets/Tech. Actual returned star places once at Sietch Tabr14: Tanks5→2/reserves4→7→6, ordinary/free0, spice3, native income1. No overflow or browser errors; no saved/deployed room is touched. Original publication, whole-mode, broader combinations and assurance gates remain. Canonical source contract. Owned QA host/tab/scaffolding is removed; API/phone receipts remain outside Git. Existing build route-classification/chunk-size warnings remain.

14 October 2026 — Emperor Nexus original compulsory purchase

Connected original positive normal-auction allied obligation through a neutral public possible-holder storm-order queue and owner-private actual Emperor Nexus Use. Explicit provisional full-price funding reuses matching prepaid aid and debits only missing native own-wallet credit before original purchase. No new bid, oversized gift, bank-created subsidy or future-income funding. Fully prepaid/underfunded Use blocks before disposal; all-pass preserves the ordinary funded winner decision. Source receipt binds original lot/price, mutual alliance, declared split, escrow/wallet and frozen public membership. Native Emperor income remains cancelable separately, never refunding acquisition.

Genuine four-seat Basic/Advanced original setup, undealt starting cards, first-turn flow, real later worm/pact/closing draw and Guild price2 auction produce the source. Initial strict receipt whitelist omitted winner; repaired. A new pending fence prematurely stopped native Truthtrance discard settlement; it now permits the original discard/Semuta suffix before resuming the same event. Regression passes; unrelated rules are unchanged. Wording, action-copy and fixture-provenance pins are removed rather than updated. Minimal Easy policy performs actual neutral Pass then Use; strategic AI stays deferred.

Affected10-file union155/155, types/lint/build pass. Four genuine API profiles with allow/cancel/prepaid credit restore original next-lot Atreides inspection. Actual390px neutral Continue→holder Use→original income allow/cancel preserves buyer6, prepaid1/missing1, one actual card and one Nexus. Emperor10→9→8→10 for allow, or remains8 after cancellation; original lot1 resumes once without refund. No horizontal overflow/browser errors; no saved/deployed room targeted. Special seller lots and final combinations/rules/assurance remain open. Canonical contract. Owned QA host/tab/scaffolding is removed; API/phone proof receipts remain outside Git. Final build retains existing route-classification/chunk-size warnings.

14 October 2026 — Fremen Nexus fixed ordinary free quota

Recommended provisional composition replaces the early-only direct transfer with a physical singleton activation and phase/turn-bound ordinary quota3. Normal revival owns partial/typed returns and original pending decisions, prevention, free-income, Tech and native Homeworld deposit/deployment. Prior actual free usage counts; prior paid returns keep their price and total usage. No forces/leader/spice move on activation, and no total limit grows. Higher native rates survive; Recruits doubles only its native rate and keeps its original minimum-seven ceiling. Useless or unknown-ledger grants reject. Strict old receipt adoption retains physical facts without gameplay replay. Removed direct-transfer action/selector; all affected module consumers migrate.

Genuine Basic/Advanced classic and single-native-Tleilaxu chronology covers partial1+2, late2+1, previously paid expanded returns, expiry, native income, original typed caps and actual legal AI. Obsolete wiring/wording/early-only pins are removed rather than updated. The frozen20-file union passes329/329; types/lint pass. Four API profiles retain original costs/card inventory and reach Shipment and Movement after late activation. Actual390px GameTable enables quota, requests1 then2 and hands each to original Tleilaxu Allow: Tanks8→5/reserves10→13/free3, spice13 unchanged, native income1 once, one Nexus discard, no horizontal overflow or browser errors. No saved room is reset, touched or deployed. Wider combinations/final assurance remain due. Canonical contract. Final UI build passes with existing route-classification/chunk-size warnings. Owned QA host/tab/scaffolding is removed; API and phone proofs remain outside Git.

14 October 2026 — Native BG Cunning fresh and storm card exceptions

Recommended provisional interpretation: printed any/all permission is an in-place card exception for freshly accompanied and storm-bound/separated advisor territories during native BG's own Advanced action. Only the Cunning uncertainty guards are removed; dead storm-only helper/imports are deleted. Quotes count public presence without allocating receipt groups. Original declarations still bind exact locations/counts/locked stance, one physical Nexus and one native Karama window. Ordinary flip/arrival, movement, casualties, allied capacity and battle geometry remain unchanged.

Two disjoint genuine native slices retain real setup, card draws, reserve payments/free accompaniment and original Advanced storm cards. An initial dial assumption was corrected without changing the producer: actual identity card draws reach sheltered Arrakeen storm10 and rock separation storm7. The Storm fixture's setup-only action routing was repaired by requiring playing status before dials; no phase/board/force/hand state was fabricated. Fresh Shield Wall2 locks at turn2; real Karama cancels old+fresh groups as one batch, and the previously forbidden ordinary fighter arrival works after Cunning. Both storm geometries retain ordinary move/flip/battle blocks.

Unresolved-guard, wording, action-copy, fixture-provenance and incidental phase/null assertions were deleted, not re-pinned. The related10-file union passes65/65; types/lint pass. Actual390px GameTable declares/allows fresh Shield Wall2, moves one to Imperial Basin9 and hands over to Battle; allows Arrakeen2 in place under storm10; and cancels False Wall East5/9 as one batch. One Nexus remains spent; conversion costs/pools/usage stay unchanged.

Live proof found an existing movement-control bug: Arrakeen10→Polar Sink was offered during storm10 although authoritative movement rejected unchanged. Controls now share projected geometric distance and native range, including selected-origin elites and owned marker routes. Blocked origin/cross-storm detour is disabled with an accessible reason; no special Cunning bypass or engine-rule relaxation. Selected-elite input accepts immutable tuples without copies. Before/after live proof and three native API receipts stay outside Git. An earlier Fremen-fixture Storm description was corrected to distinguish Basic dials from the unchanged Advanced card producer; behavior is unchanged. Final foreground compiler/lint and app build pass, retaining existing warnings. Native API receipts observe fresh distance1/range1 and battle Shield Wall, unreachable bound origin/range3 with no battle, and separated distance2/range1 with no battle. One physical Nexus spends in every actual declaration. Owned service/scaffold removed, tabs released/auto-closed; final source-bound receipts remain outside Git. Three surfaces have no overflow/browser errors. Broader modules/markers, saved assurance, calibrated AI, complete modes and deployed acceptance remain open.

14 October 2026 — Absent-Fremen Nexus pre-devour protection

Explicit recommended interpretation: independent printed protection, without inventing an absent native Karama provider or a ride. The original public threatened/unallied/held-Nexus membership determines one frozen storm-order queue; private face determines only Use. Both passes and one physical-card declaration precede all original devouring. Protect only that owner; original other losses, spice removal, replacement blow and Nexus resume once.

Disjoint public-source and native-proof slices were integrated by one owner. Occurrence UUID/turn/territory/pile/index or summon parent, ordered cursor, spent owner and current decision are bound before settlement. Public quotes read no No-Field denomination. Existing protected-victim skipping retains protected markers; unprotected native materialization stays unchanged. Unrelated dynamic groups do not block the actual printed worm territory. Completed receipts tolerate later legitimate physical-card reshuffling. Original Great Maker worm protection now preserves its original vote and delays the replacement until that vote finishes.

The native fixture initially selected a storm-caught Cielago South sector; its real shipment correctly failed. It now chooses original Hagga Basin12 through actual paid shipment, with no storm/phase/force/hand rewrite. Setup, natural worm/alliance/closing draw, free Advanced BG accompaniment, collection and the next accepted worm are original producers; only conserved undealt deck order and scoped scalar entropy are staged. Fixture-trace/copy assertions were removed. Shared continuation helpers and exhaustive decision catalogs now recognize the new protection and preceding borrowed Voice queues.

Related9-file union86/86 and actual390px table pass. Neutral Continue leaves all groups/spice intact; holder Use preserves Emperor1/reserves19/Tanks0/ spice10, moves BG advisor1 to Tanks, removes four source spice and spends one Nexus. No ride; original Accept spice blow accepts the resumed Sihaya card. No overflow/errors. Four legal profiles execute own Use or neutral Pass. Stale Nexus table prose was corrected to list the connected effects and supply-only Moritani Cunning rather than claiming Grumman remained unavailable. Final types/lint and build pass, retaining existing build warnings. Four actual Basic/Advanced normal/Great Maker API runs preserve source4→0, owner1/Tanks0/reserves19/spice10 and one discard; the Maker retains vote→ complete before Sihaya, with no ride. Owned host/tab/scaffold removed; source-bound phone/API receipts remain outside Git. Broader module/marker continuations, comprehensive assurance, full modes, calibration and deployed acceptance remain open.

14 October 2026 — Bene Gesserit Secret Ally borrowed Voice

Recommended interpretation: one Karama-cancellable named Voice advantage, not blanket Nexus immunity. A uniform attacker-first two-combatant queue opens in fresh absent-BG Nexus battles before native/Nexus inspection and sealed plans. Owner-only actual-card controls use canonical categories and target/ mode/compulsion restrictions. Cardless combatants only Continue; Use spends the physical card and binds the original command. All-pass preserves it.

Pure source frame and genuine native chronology were delegated as disjoint slices; one owner integrated engine, quote, cancellation source, UI and bots. Native BG response validation remains unchanged; borrowed responses require their actual declared combatant source. Original Karama removes only Voice, keeps the spent Nexus/receipt and resumes Prescience. No legacy preparation retrofit/reset. Fixture continuation now settles original Guild interception and Advanced KH responses rather than bypassing them; deterministic initial seats replace repeated candidate-game construction. Wording, fixture-trace and incidental nonempty assertions were removed.

Related4-file union50/50; types/lint and build pass. Actual390×844 GameTable neutral Continue→holder projectile requirement→auctioned Karama cancellation →native Prescience decline→enabled Seal battle plan. Source canceled, command removed, one Nexus discarded, original force/spice balances unchanged. Final document width390 and browser errors empty after repairing isolated QA alias/environment configuration. Proof outside Git; no saved game touched. Broader special-command/module interactions, comprehensive assurance, complete rules and deployed acceptance remain open.

14 October 2026 — Tleilaxu Secret Ally free-leader/paid-force revival

Recommended-option priority closes the earlier whole-effect gate under an explicit provisional policy: mandatory free own leader/ordinary leader slot, zero-to-five physical counters at one bank spice each, shared ordinary ceiling expanded to at least five. Prior returns count; card-first and ordinary-first agree. Larger native/Recruits allowance is not reduced; fixed group never doubles. Only unopened roster eligibility is waived; original cycles, repeated-death/face-down, actual typed caps and special custody are retained.

Two disjoint implementation/native-proof slices were integrated by one owner. The pure quote reuses canonical leader/counter eligibility; the engine binds actual held card/event, pays the bank once, returns the real leader through original skill/custody handling, deposits exact counters and records per-phase source permission. Homeworld signed return accepts the new Nexus source. Owner-only controls and four minimal legal profiles use the same offered selection. Wording/forwarding/fixture-trace assertions were removed rather than re-pinned.

Native fixtures retain genuine setup, starting cards, Emperor shipment, real weapon death/eight-counter exchange, worm alliance and actual original Nexus draw. Only original unplayed deck order and producer entropy are staged. Ignored immutable Ready results and Advanced Guild interception were repaired in the fixture, never by fabricating phases, hands, deaths, wallets or forces.

Final nine-file union141/141; types/lint and app build pass. Actual390×844 table returns Dr. Yueh with deaths1 and cycle0 unchanged, spice11→6, Tanks8→3/reserves10→15, ordinary returns5 and leader slot consumed. One physical Nexus goes to discard, the offer disappears and Ready stays enabled. No overflow or browser errors. All four legal policies execute that actual five-counter return; not strategic calibration. Owned hosts/tabs/ scaffolding removed; proof outside Git. Existing build warnings remain. Ecaz six-disc/Advanced-Harkonnen Duke candidate restrictions, combined modules, full rules, assurance and deployed acceptance remain open.

14 October 2026 — Persistent original Atomics hand-limit targets

Recommended-option priority: the permanent one-card reduction stays on Moritani and its ally at detonation. Breaks, later Nexus pacts and Enemy of My Enemy acceptance do not transfer it to a new ally. An unallied activation has no future ally target. This is explicit provisional interpretation, not a new publisher ruling or separately answered numerical user question.

Removed both Nexus pre/post-quote guards, Terror offer/accept guards, bot/UI filters and dead alliance-status/test-only hand-limit helpers. The original Aftermath receipt and player penalties remain the authoritative custody. Fresh policy is activation-targets; old active unresolved records migrate immutably before action/view/automatic integrity without replaying casualties or card losses. Unknown policies and forged target custody still fail closed. Wording-pinned static-markup tests were removed rather than re-pinned.

Genuine Basic/Advanced four-seat fixtures preserve original setup, forces, wallets, cards, token placement, worm pacts, paid arrival and detonation. Only unplayed original Spice Card order is staged. Later real Nexus and Robbery-triggered Enemy of My Enemy both produce Moritani/Emperor alliances while limits remain Moritani3/former Atreides3/new Emperor4 and original Moritani6/Emperor1 Tanks losses remain. Unallied activation, exact legacy target adoption, corruption rejection and four legal acceptance policies pass.

Final six-file union112/112, types/lint/build pass. Actual390×844 table break/offer/accept controls form the later pact; former Atreides still has capacity3, Emperor4, and the public notice states the provisional permanent targets. No horizontal overflow or browser errors. Owned host/tab/scaffold removed; proof outside Git. Existing build warnings remain. Bounded classic-plus-Moritani mode, other Atomics compositions, complete modes, assurance and deployed acceptance remain open.

14 October 2026 — Native Basic shared Ecaz Orgiz settlement

BEFORE: a genuine Basic equal split paid the real lot but withheld Orgiz: Ecaz9/Guild10 instead of8/11. AFTER: quoteSharedOrgiz replaces the Advanced-only quote and hook. Both modes use actual bilateral receipts. Advanced charges once per territory. Basic counts original positive source-map reductions in that territory, excluding unchanged/empty/unrelated keys. Positive foreign recipients are considered Ecaz first, then ally; self, zero shares and empty purses are skipped. Every transfer updates available balances and checks cumulative income overflow. Existing allocation events retain their one-time ownership; no saved schema or compatibility alias is introduced.

Genuine Basic/Advanced fixtures preserve original armies, wallets, cards, alliance and phases. Cases cover equal/full/zero shares, acceptance timing, wrong actor and stale replay. Pure boundaries cover multiple Basic source deposits versus one Advanced territory, exhausted-recipient fallback, self exclusion, zero-share old wallets and cumulative overflow without mutation. One invalid empty-key test fixture was corrected to an actual board sector.

Final six-file union80/80, types/lint and app build pass. Actual390×844 Basic table: Use equal split settles the real Red Chasm lot4 and then transfers1, changing Ecaz7/Guild8→8/11, leaving phase7 with no decision and enabled Ready. No horizontal overflow or browser errors. Easy/Medium/Hard/Brutal each complete that Basic split through a real legal engine action; this is not calibration. Owned hosts/tabs/scaffolding removed; proof outside Git. Existing build warnings remain. Ordering and Basic's positive-deposit mapping are provisional; combined modules, full modes, assurance and deployed acceptance remain open.

14 October 2026 — Canonical positive Collection receipts for Orgiz

The original ordinary quote now emits deposits with actual positive player/location/amount receipts. It excludes city awards and shared escrow; zero-take forces are not collectors. Discovery consumes that original source instead of inferring a unique collector from occupancy. collectorAt and the whole-territory ambiguity guard were removed. Basic groups by positive deposit; Advanced groups by territory, retaining source-key event order and original storm-order owner/payer selection. Self and empty purses are skipped.

Native Basic/Advanced Ecaz/Guild rock scenarios use genuine setup, token lottery/reveal/entry, alliance, departure and paid shipments. Both collect2 from original Sihaya Ridge spice, or the first actual collector consumes the whole6-spice pile and the later co-present force takes0. The latter cannot pay solely because it has an old wallet. Actual Storm face1 is selected at the original forecast producer after turn-two Storm, not assigned to a later forecast or source. Shared desert allocation keeps its original separate path.

Final six-file union72/72, types/lint and app build pass. Actual390px table: Finish shipment & movement produces phase7 with two2-spice ordinary source receipts, Ecaz8/Guild14 from7/10, exactly one Orgiz transfer, no decision and enabled Ready. No horizontal overflow or browser errors. Local proof is outside Git; owned hosts/tabs/scaffolding were removed. DEP0205, large-chunk and route-classification warnings remain. Basic shared-allocation settlement, full modules, assurance and deployed acceptance remain open.

14 October 2026 — Cistern/Orgiz multi-occupant and shared-lot Collection

Recommended-option priority: Advanced Orgiz now chooses one definite actual foreign collected-sector payer per territory in original storm order, skipping self and empty purses. Multiple source keys never multiply a territory charge. Owners also resolve in original storm order; an earlier owner can exhaust a purse, so later owners consider the next eligible actual collector. A sector with an ambiguous collector still withholds its territory effect.

Cistern pays every fighter occupant two bank spice after ordinary advisor releases. Basic Orgiz keeps the provisional positive-deposit mapping. Shared Advanced Ecaz desert lots wait for actual bilateral allocation, then consider positive foreign recipients Ecaz first, ally second. No debt is created. Occupant/payer ordering is a provisional recommended interpretation, not a new publisher ruling or separately answered numerical user question.

Evidence correction for 388c5fa: its shared fixture directly repositioned armies/spice, fabricated alliance/phase fields and cleared physical hands. It was not a genuine native route. Its claimed app-build success was also not observed. Those claims are superseded, not used as current acceptance.

The replacement preserves original forces, wallets, cards, alliances and phases. Original unplayed desert-card order and the actual token lottery are the only staging. Real setup, token reveal, free entry, worm alliance, Ecaz departure and fresh paid Ecaz/Guild shipments produce the original shared allocation. Rock terrain cannot create that lot. The third-party Collector fixture now uses a definite Emperor shipment to an actual empty non-storm deposit rather than catching arbitrary failures or selecting an Orgiz owner. Wording and deterministic-copy assertions were removed. Meaningful cases cover payer order/depletion, self/zero-share exclusion, acceptance timing, wrong actor and stale allocation.

Current final three-file union27/27; types/lint and app build pass. Actual 390×844 GameTable proof: original Funeral Plain lot4, proposal4/0 leaves Ecaz7/Guild11 unchanged; Guild acceptance produces Ecaz10/Guild12 and one Orgiz transfer, no remaining decision and enabled Ready. No horizontal overflow; a fresh settled surface has no application errors. Initial temporary QA middleware order was corrected before interaction. Local proof is outside Git; owned hosts/tabs/scaffolding were removed. Existing DEP0205, large-chunk and route-classification build warnings remain. Ambiguous collected-sector payers, full modes, combined-module and deployed acceptance remain open.

14 October 2026 — recommended physical Jacurutu dial and cumulative station queue

The choose-recommended-option priority removes another clarification stop. The prototype selects defeated-player physical dial allocation at Jacurutu and one cumulative Testing Station adjustment per non-advisor occupant in original storm order. Both controls label these provisional implementation interpretations; the printed source does not supply their choice timing/contested-order FAQ. No separate numerical user answer or new publisher ruling is claimed.

Jacurutu's owned event preserves exact canonical ordinary/elite/paid readings before battle mutation. Selection must match all four fields; actual Harass returns bind their already selected commitment and retreat/withdrawal counters never enter Tanks income. Unique readings stay automatic. Both1/0 readings spend the same support and produce the same original two losing Tanks/one elite, winner losses and original subsequent city Collection; all four configured minimal policies produce a legal selection.

Testing Station adds a signed two-owner queue while preserving original sole frame signatures. Source/base/from/token and one ordered delta per owner stay bound. The first action updates current pending movement without traversal; the final action traverses once. Cumulative0..40 bounds, actor/event/replay rejection and printed Weather exclusion are exercised.

Native fixtures use real original setup, printed blow/supply lottery, paid shipment, Collection inspect/reveal, next-turn entry and actual battle or worm alliance. Owner removed a child’s arbitrary conserved starting-force relocation; every original starting army remains intact. The station fixture also had to choose Keep on its earlier real sole opportunity and finish Advanced Guild interception before checking the allied arrival. Initial wallet expectations omitted ordinary city Collection; the repaired tests preserve that original quote separately rather than changing the engine’s payout. A Weather fixture assumed seat order, while actual storm order made its second occupant Ecaz2; the meaningful assertion now preserves its actual original garrison. Wording, markup, log-growth and staging-copy assertions were deleted, not re-pinned.

Actual390px Jacurutu earns1: Emperor6→5, Atreides9→10 (−2 support,+1 reward, +2 original city), Guild13→14 from original Collection. Actual station Guild+1 changes pending2→3 without moving storm3; Ecaz−1 traverses once to5, enters Spice Blow and preserves original2/1 garrisons. Browser errors empty; no root overflow. Private proof /tmp/dune-discovery-choice-ui-proof.json. Native throwaways and isolated host/tab/scaffold are removed.

Final related12-file union104/104, types/lint and app build pass with existing module-registration, chunk-size and route-classification warnings. The exhaustive decision registries are migrated. Comprehensive assurance, other pending Discovery effects, complete modes and deployed acceptance remain open.

14 October 2026 — classic Homeworld final Bank income and ruled accounting

The user selected whole-invoice low Guild/Emperor rounding, first eligible Bureaucrat contribution primary-first internally, and same-payer/same-invoice combination of redirected2 with other actual final Bank portions. No distinct payers/invoices pool and no funding or eligibility identity is newly projected. Recommended options are selected without further clarification questions.

BEFORE fresh Homeworld normal Banker admission rejected; original occupied 5+3 rejected the comparative rounding guard before costs. AFTER the separate classic banker-income --homeworlds path reuses actual occupation/all14 setup, admits original odd funding and preserves original price, escrow, force sources and recipient continuations. The old comparison export, table warning and AI exclusion are removed without aliases. Expansions, Nexus, Discovery, Tech, Strongholds and other overlays stay excluded from this new income branch.

Final receipts supply actual retained Bank amounts. Low unoccupied5+3 gives 3/1 and no grant; tax2 gives4/1 and one unavailable spice. Occupied allowed income banks0 (tax variant only2); cancellation banks native4, not full8, and preserves occupied4. Genuine odd11, first-eligible fallback, later same- phase payment and replay rejection retain physical native stock and full debits. Actual world-to-world4 and half-rate sponsored board-return4 are Bank fees, not Guild income. Actual Kaitain capital4 after original eleven-force shipment supports a later Guild eight-spice Treachery purchase: native4/Bank4/front1.

Actual isolated HWBANKQA v8 CLI reaches native setup/income-v1. Actual390px Bureaucrat Redirect2 settles4/1, wallet11/front1; native city Collection makes13, and the last original Ready for next phase enters Mentat and makes 14/front0, credit1 once. Browser errors empty; no root overflow. A text wait for title-case Mentat timed out because the actual heading is uppercase; fresh accessibility/server evidence proves the click succeeded without replay. Private local proof: /tmp/dune-homeworld-banker-ui-proof.json.

Frozen related18-file union292/292, types/lint and production app build pass. Build retains module-registration, chunk-size and unknown-route warnings. Pure accounting21 cases and new native14 cases also passed earlier; no comprehensive recovery/privacy/custody campaign or deployed acceptance is claimed. Fixtures, docs/checklist and obsolete rounding-rejection tests are migrated. The user PDF and all existing saves remain untouched.

14 October 2026 — ruled Grumman hidden return and Cunning addition

Four user decisions resolve the earlier Moritani boundaries: Cunning enhances supply placement only; HMS stays excluded; Grumman Cunning preserves an actual ordinary stacked-addition prerequisite; an unrevealed removal returns to rotated hidden supply. All remain user interpretations, not publisher rulings.

BEFORE genuine Basic setups without/with Nexus reached turn2 Collection after63/69 original actions, native population14 and a real first-Mentat Robbery placement in Arrakeen. Removal rejected the custody-zone guard without mutation. Native Grumman Cunning to Red Chasm likewise rejected the ordinary stronghold-only destination while holding the actual Moritani card.

AFTER removal uses original returnTerror and hidden ID rotation, pays4 once, preserves the six faces/other placements and leaves placementTurn independent. The old public ID/source location stays historical, not live supply identity. High-Grumman Cunning reuses physical supply validation and adds a source- discriminated phase7 receipt with original Grumman event and ordinary prerequisite. Its atomic completion consumes the actual Nexus and pays4; Mentat receipts/events and original cancellation remain unchanged. The source bridge validates the real completed current Collection frame and its historical location authority after later turns. No extra Karama window.

Native Basic/Advanced addition, failed selection/replay, prerequisite loss, four existing legal policies, a later real one-force Guild Polar shipment/ Terror entry, and subsequent unrevealed Cunning-token return are exercised. The original other board token remains, and only the selected live Cunning authorization retires on return. Native removal permits later genuine Mentat redeployment of the same physical face under a new hidden supply ID. Initial new behavior tests14/14 pass. A child receipt-mutation test used an unnarrowed type-query union; explicit Grumman discriminant types repair it without production change. One old persisted removal-veto assertion is removed; its independent SQL decline behavior remains.

Actual390px GameTable returns Robbery from Arrakeen, pays12→16, rotates all six available IDs and leaves Mentat usage1. Separate actual Cunning checkbox/destination controls place an available Sneak Attack at Red Chasm, spend the Moritani card, pay12→16 and close the original choice with a phase7 Grumman source/prerequisite receipt. Browser errors empty, no root overflow. /tmp/dune-ruled-grumman-ui-proof.json records local source/action results. Owned tab/host/scaffold removed. No saved room, production server or mode gate changed; comprehensive assurance remains deferred.

Final frozen14-file union92/92 and npm run check:quick pass. App build passes with existing module-registration, large-chunk and unknown-route classification warnings. The first union used a nonexistent terror-location filename fragment and ran no tests; its corrected selection first had62/63 pass with the obsolete persisted removal-veto failure, then passes after that guard assertion is deleted. Independent persisted decline coverage remains. No complete-mode, broad-suite or deployed acceptance claim follows.

13 October 2026 — documented Skills CLI admission repaired

Actual tools/start-prototype.ts --profile guild-betrayal --leader-skills rejected before room access with the obsolete Semuta-only validation. startPrototypeRoom already admitted the documented classic Guild Betrayal and Homeworld occupation Skill combinations. Match that existing fence in the CLI; no initializer, rule or supported profile is widened.

Actual isolated CLI starts GUILDCLI v8 and HWCLIQA0 v8 both succeed through private backup and native setup. Both retain all14 Skill Cards in the original offers/deck; Guild retains Nexus deck12, while Homeworld retains native custody and occupation preview. Evidence remains outside Git at /tmp/dune-skills-cli-20261013. Existing saved games are untouched. Prototype-room56/56 and npm run check:quick pass. No build, deployed, full-module or recovery-assurance claim follows.

13 October 2026 — classic Nexus normal Banker income

The current fresh Banker entry rejected classic Nexus before native offers. The classic Nexus skill predicate now admits its explicit income overlay without enabling other native-family overlays. The original initializer passes Nexus setup and original optional Tech3+/Advanced Strongholds2+ paths. Both CLI and room-option validation admit banker-income --nexus-cards. No printed payment, receipt, deferred-currency or collection rule changes.

Native Guild self-shipment pays4/wallet5→1 and leaves Atreides front1 with no available-wallet increase. Actual paid3 earns none; Emperor-to-Guild4 remains player income. Native Advanced Guild timing and selected original modules continue; actual Heighliners income settles at phase end, never another bank invoice. The fixture's initial eight-force Polar shipment exceeded Guild's original wallet; use the printed four-force/four-spice shipment instead, with no wallet or force fabrication. An incidental empty-collection count pin is removed: native Mentat records its epoch even when there is no grant.

The seven-file related union passes158/158 and types/lint pass before adding the explicit separate-Tech-credit regression. Actual isolated CLI BANKERQA v8 reaches native leaderSkills, all14 in original deck/offers, Nexus deck12 and income-v1. Actual390px table shows deferred1 at wallet10; the last ordinary Collection Ready enters real Mentat and credits10→11, removing the notice with no extra action. Browser errors empty, no root overflow. /tmp/dune-classic-nexus-banker-ui-proof.json retains evidence. Owned UI tab/host/scaffold removed; no live room or saved database changed. The existing separate opt-in and provisional earned-custody/per-payer policies remain. Homeworlds, Discovery, native-family Nexus, Betrayal, complete-mode and deployed acceptance remain outside this checkpoint.

Final seven-file union159/159 and npm run check:quick pass. The additional native Advanced Emperor-to-Guild receipt proves phase-end Heighliners1, independent ordinary Collection, zero Banker sources and unchanged Banker wallet at Mentat. No full-suite or deployed acceptance was run for this slice.

13 October 2026 — storm-aware occupation fixture and obsolete guidance tests

The observed Advanced occupied-Guild receipt failure was in the fixture: Arsunt11 was selected regardless of the real storm. Select the first printed Arsunt sector outside the current storm instead. Both original sectors remain available for the scenario; no storm entropy, force stock, payment ledger or production rule is altered.

Twenty actual Advanced native receipt programs pass exact original payer6/ donor2 debits, native3/occupied3/Bank2 and qualification retention. This includes an actual storm11 receipt using Arsunt12. The two affected test files pass10/10; npm run check:quick passes.

tests/reference.test.ts no longer pins prose, incidental checklist status, source-text links or test-only evidence filenames. Developer evidence paths legitimately include helpers, controls and contracts. Keep the meaningful public navigation invariant: all phase/faction topics are discoverable and every related topic resolves. Behavioral rule/automation tests are untouched. No broad-suite, publication or deployed acceptance claim follows.

13 October 2026 — captured Leader Skill replacement ruling

The user resolved the previously gated captured-card replacement question: the original faction keeps its existing Skill assignment while its trained leader is captured, so reviving a different eligible own leader is legal and simply draws no replacement card while that assignment exists. This is the selected reading of the authorized supplied Advanced physical p21 condition "if you have no Leader Skill Card"; it is not a new publisher ruling. The captor's lower-band-only use, the captive's card movement and death-return are unchanged.

The engine's earlier guard vetoed the whole ordinary/Ghola revival instead of only the replacement offer. leaderSkillRevivalBlocked/requireLeaderSkillRevival, the gholaLeaders early return, the view revival.leaders: [] filter and the beginRevival/Ghola/Emperor-special-Karama call sites are removed. offerRevivedLeaderSkill is unchanged: one assignment per owner still suppresses a second offer or draw.

Program-level BEFORE: on the pre-cutover revision the rejected-action assertions at tests/advanced-native-skills.test.ts:258 and tests/leader-skills-capture.test.ts:322 required ordinary revival to throw /replacement-skill ruling/, and both passed then. The ordinary case was also re-confirmed from a throwaway pre-cutover git worktree at HEAD: the projected ordinary and Ghola targets were empty and both reviveLeader and the held Ghola card rejected with the replacement-skill ruling, state unchanged.

AFTER (bounded changed-path smoke, no fabricated state):

• tests/leader-skills-capture.test.ts (6/6): a captured skilled leader keeps its public assignment while another own dead leader revives for its exact printed cost, with no draw/offer and a conserved all14 deck; the Collection Medium bot plays the held Ghola to revive a dead disc, no replacement offer.
• tests/advanced-native-skills.test.ts: a captured native trainer keeps its physical skill while another own leader revives with no replacement offer.
• tests/captured-skill-revival.test.ts (fixture-captured-skill-revival.ts): native classic Atreides/Harkonnen setup; four real battles genuinely kill atreides-2/3/4 and atreides-0; the fourth is a real Capture + Keep of the trained atreides-1; next-turn Revival offers atreides-0. Ordinary paid revival (spice 10→5) and the held Ghola free revival both succeed, no draw or offer, intact assignment {owner a, leader atreides-1, skill sandmaster, controller h, captured true}. Living captive, wrong actor, cross-phase, second-leader and consumed-Ghola attempts reject without mutation; one exact Easy bot ordinary target is proposed.
• tests/captured-skill-special-revival.test.ts (fixture-captured-skill-special-revival.ts): native classic Emperor/ Harkonnen/Guild setup; paid Carthag deployment and a sealed projectile battle genuinely kill untrained emperor-1 while a real Capture + Keep retains trained emperor-0; next-turn Revival's free Emperor special Karama revives emperor-1 (wallet 8→8, specialKaramaUsed true, Karama discarded once, no replacement offer, unchanged captive/assignment/deck) and reaches the native phase5 suffix. Wrong captive/foreign target, wrong phase/actor, mixed forces-plus-leader, replay and once-use reject immutably with one exact Easy bot Special action.
• Related 16-file union 145/145; the two new files 4/4; tsc --noEmit and oxlint clean.

Docs updated: RULE_DECISIONS.md (new user decision), LEADER_SKILLS_CAPTURE.md, LEADER_SKILLS_RULES.md (boundary resolved), NEXUS_CARD_RULES.md and CURRENT_STATUS.md. The Ambassador free-revival route was unavailable in the genuine classic three-seat position and remains unexercised. No expanded-slice, complete-mode, save/deployed or assurance claim follows.

Actual390px browser follow-through uses original GameTable against an isolated in-memory native fixture host. The paid leader selector shows four eligible dead Atreides discs and excludes captured Lady Jessica; selecting Thufir and pressing Revive leader pays10→5. The held Ghola target selector revives Thufir for10→10 and removes the physical card. Emperor's actual Revive Captain Aramsham with special Karama button revives for8→8, records the once-use and removes the physical cost. All three preserve the living captive, original controller and byte-identical Skill state without an offer. Fresh rendered controls and screenshots confirm the completed paths. No root390px overflow; browser errors empty after temporary React/shim host configuration was corrected. /tmp/dune-captured-revival-ui-proof.json retains local before/after/action evidence. The owned tab, host and source scaffold are removed; no saved room, production server or storage was changed.

13 October 2026 — ordinary skill legality in Guild Betrayal

The previous composition dealt all14 cards but only admitted Bureaucrat to its quote union. Original ordinaryLeaderSkillModeSupported omitted the new Guild Betrayal profile, which also withheld Mentat naming and rejected optional Sandmaster collection while allowing the same ordinary move.

The exact composition now joins ordinary skill legality. Its predicate checks native Guild and rejects Homeworlds/Tech/Strongholds/Semuta in addition to existing unrelated-overlay guards; no broader profile is enabled. Existing ordinary quote consumers retain their rule calculations. Actual prototype dispatch now supports --profile guild-betrayal --leader-skills; an isolated in-memory room reaches original setup/offers/Nexus/cursor without touching saves. The shared original trained-setup fixture is reusable for an actual chosen trainer card; no offer or assignment is replaced.

Native BEFORE Sandmaster: original BG fighter1 Polar Sink/reserves19, printed Hagga Basin6. Ordinary ground movement succeeds; identical collecting request rejects immutably. One real original paid shipment/all-pass Betrayal prefix stays bound. AFTER: exactly one spice debited and credited, original counter moved, ordinary moved count1; native endMovement legitimately collects another2, ending wallet8/pile3. The child post-Collection assertion expecting5 failed after the actual skill path succeeded; no production rule was changed for it.

Native BEFORE Mentat: paid two-force deployment cost2 (BG5→3) against original Atreides army, living trained native disc. Battle skipped Mentat naming and opened original posture. AFTER: owner names Crysknife, target privately shows the held card, entitled history records it and original posture/powers resume. The child target plan incorrectly selected a face-up trained Warmaster; consumer regression uses a real living untrained target disc and accepts both native card-free plans, preserving held cards/resources.

Actual390px owner question and target Show Crysknife privately controls retain the weapon and restore original posture. Owner history contains the answer; outside history stays empty, paid wallets unchanged. Artifact /tmp/dune-betrayal-mentat-3232.json; recorded browser errors empty. Only owned QA host/tab/scaffold are removed.

Initial frozen42-case union had40 pass/two fixture assertions fail: nonexistent assignment.controller and native automatic Collection creating zero pile keys. Those representation/default pins are removed rather than re-pinned; the abandoned request instead preserves its actual printed pile and trainer cash. Final42/42 and types/lint pass. This proves the bounded connected paths, not all skill combinations, strategic AI, full games, recovery or deployed acceptance. Final frozen related union68/68 across five files, types/lint and app build pass with unchanged module-registration/chunk/route-classification warnings.

13 October 2026 — actual Advanced occupied receipt coverage

Native Advanced Emperor and Guild programs settle actual gross8 into native3, occupied3 and Bureaucrat Bank2 with original paid8/shares intact. Both preserve the original retained qualification from the real prior invasion.

Advanced Emperor departure explicitly selects every native pool: Kaitain15 normal and Salusa5 elite, paying20 and committing20 with5 elites. Existing Basic twenty-normal departure remains. Advanced Guild uses native Harkonnen prep and a fifth BG occupier; original Guild timing remains flexible. The foreign invasion occurs turn2, so a literal turn2 Spice predicate was already past and traversed until the native turn10 Guild win. A relative next-turn boundary now waits for actual turn3 worm/alliance and payment; no phase, victory or wallet is changed. Temporary diagnostics are removed.

Four meaningful Advanced allowance/diversion cases assert original typed withdrawal, full payer debits, occupied allocation, retained source, actual next lot or committed shipment. Frozen two-file21/21 and types/lint pass. Actual native programs cover both families; the earlier390px Basic surface proves the unchanged controls. No production change, new strategy, saved-game audit, deployment, complete-game or complete-mode certification is claimed.

13 October 2026 — actual occupied income and Leader Skills

Corrected the previous task completion claim:9b83b61 proved plain Homeworld allied receipts, not the ruled occupied split. The original occupation entry now accepts a second explicit Skills argument for classic rosters only, reusing native Skills initialization and original occupation ledgers. CLI --profile homeworld-occupation --leader-skills reaches this same entry; an isolated in-memory prototype dispatch proves persisted setup with real offers and the original ledger. No existing room or database is converted/reset.

Redirected occupation sources preserve full original paid amounts/contributions with optional bankDiversion:2; allocatable source amount is gross−2. The old implementation instead shaved one payer share and rejected multiple shares. Historical undiverted receipt shape remains unchanged. Original Guild rounding is checked against full original shares, not rewritten post-diversion shares. The two-odd low/occupied Junction boundary remains guarded before costs.

Two native Basic fixtures use real paid funding, departures, invasions and worm alliances: Emperor shipping funds Guild's original15-reserve departure before Harkonnen invades Junction; a real ten-spice lot funds Emperor's twenty-counter departure before Guild invades empty Kaitain. Source history, armies and wallets are never assigned. Guild6+2 and Emperor5+3 gross8 redirect to Bank2/native3/occupied3; decline splits4+4. Original Karama cancels native income only, leaves occupied4 and creates no Bureaucrat offer/use.

Actual390px GameTable proof starts at the original paid Emperor receipt, redirects as Atreides, keeps3 as Guild occupier, and allows the original Harkonnen bonus: lot1, E8/H0/G16/A10, one use, original paid8 and5+3 contributions intact. Artifact /tmp/dune-occupied-bureaucrat-3231.json. A fresh AX observation failed after accepted Seat selection; recovered state confirms selection with no gameplay action replay. Recorded browser errors are empty. Caption now describes the remaining Homeworld allocation instead of promising native gross−2 cash. Parent actual Guild program separately proves paid8/shares6+2/remaining6, native3/occupied3 and one use with the original delivered forces.

Focused84/84 across four unit files and types/lint pass. Both modes' fresh entry are exercised; actual occupied scenarios are Basic. These are bounded rule/control proofs, not Advanced retention, deployed, saved-game or complete-mode acceptance. Final frozen union110/110 across seven affected unit files, types/lint and app build pass with unchanged warnings. Real CLI help lists the new explicit occupation+Skills option; only owned QA host/tab/scaffold were removed.

13 October 2026 — Guild Nexus Betrayal Bureaucrat receipt

The user ruled that a Betrayal receipt still carries Bureaucrat: the holder receives the fee minus two and exactly two goes to the Bank. Neither printed card addresses the other, so this is an explicit ruling rather than a source derivation. A new bounded composition implements it: guildBetrayalNexusLeaderSkillsProfile (classic Nexus plus Leader Skills plus the Betrayal preview) is admitted by bureaucratPaymentModeSupported, bureaucratAlliedFundingModeSupported and guildBetrayalModeSupported, and initializeGuildBetrayalLeaderSkillsGameForAudit deals the composition from a fresh classic native-Guild lobby. No other Betrayal or preview composition is admitted, and existing no-skills Betrayal behavior is unchanged.

On an accepted Use the engine completes the original native shipment and records the unchanged full-fee receipt first, then stamps a shipment Bureaucrat source from the invoice's own payment legs (shipper ownPayment, donor allyPayment only when a donor exists) with the holder as payee, and offers a new signed guildBetrayal continuation. Redirect subtracts exactly two from the holder's already-credited receipt; decline leaves the full fee. No offer when the holder is the shipper, no individual leg reaches five, or the skill was already used this phase. The continuation integrity check requires the completed receipt with the same event, recipient and full price.

The new fixture composes the bounded setup (Bene Gesserit prediction then the real leader-skill choices, Bureaucrat trained on a seat distinct from shipper and holder) and reuses the shared betrayal fixture for the genuine funded shipment. Thirty-five consumer cases cover both modes and 5+0/5+3/3+5/5+5/0+5 invoice legs with redirect and decline, unchanged invoice/payer/donor debits, escrow consumption, physical shipment, receipt/history and single Nexus discard, replay and double-completion rejection, the no-offer boundaries, private projection (gross and holder only, payer null), stale/cross-actor and re-signed malformed-continuation rejection, and all four owner bots. The shared fixture holdGuildFixtureFace now assigns distinct conserved Nexus faces to each additional unallied seat; the first extra keeps the established fremen assignment, so existing expectations are unchanged.

Two actual390px GameTable flows redirect two: a single-leg five (holder 14→12 while the shipper still pays five, one use, original continuation resumed) and an allied 5+3 (holder 17→15 with a private payer-null prompt and the donor's escrow consumed once). One click was retried after a stale accessibility node; no action was applied twice. Artifact outside Git /tmp/dune-betrayal-bureaucrat-3230.json.

The affected union462/462 across twenty-four files, types/lint and the app build pass with unchanged build warnings. A guidance string initially used a plain apostrophe inside a single-quoted literal and broke the parse; it was corrected to the file's typographic apostrophe. No source rule, strategy, public-start, save/deployed or full-mode claim is opened by this bounded proof.

13 October 2026 — Homeworld allied income and two Bureaucrat rulings

bureaucratAlliedFundingModeSupported now returns homeworldLeaderSkillsProfile for Homeworlds games, so qualifying allied-funded ordinary auction and Guild-shipment income in Homeworlds + Leader Skills compositions offer the one-time two-spice redirection. Nothing broader opened: multi-expansion, preview overlays and the occupation/Betrayal previews remain excluded.

The new fixture reuses the genuine classic Homeworld Skills setup (Bureaucrat trained on Atreides, native Guild seated, real Storm/Mentat/worm/alliance). Only original unplayed entropy and card custody are staged. Fifty-three consumer cases cover both modes and both income types: 5+3/3+5/5+5/fully donor-funded five, decline/redirect, sub-five nonpooling, trainer and payee exclusion without masking an eligible payer, private gross-only invoices with payer null and no shares, stale/cross-actor rejection, all four owner bots, once-per-phase use with a real second auction lot, and original Karama cancellation for both income types (canceled gross reaches the Bank, delivery and army commitment survive, and no Bureaucrat offer/use occurs). A negative malformed-save case pins the existing fence message for the occupation preview.

Two actual390px GameTable flows redirect two: Basic auction5+3 (Emperor8→14, Harkonnen10→5, Guild5→2, one use, original bonus and next lot) and Basic shipment3+5 (Guild5→11, Harkonnen10→7 with eight reserves committed at Habbanya17 beside Carthag11, Emperor8→3, one use). One click was not recorded after a stale accessibility node and was retried; no action was replayed twice. Artifact outside Git /tmp/dune-homeworld-bureaucrat-3229.json.

Two user rulings are recorded in docs/BUREAUCRAT_PAYMENTS.md and the source index: (1) Bureaucrat's two comes off the gross before any Homeworld occupation percentage split; (2) a Guild Nexus Betrayal receipt still carries Bureaucrat, so the holder receives the fee minus two. Neither is exercisable yet: the occupied-percentage preview requires no Leader Skills (initializeHomeworldOccupationGameForAudit, homeworldOccupiedIncomeIntegrity), and the Betrayal preview excludes Leader Skills in guildBetrayalModeSupported and every profile predicate. Both are recorded as exact boundaries with code citations, not silent omissions; opening either is a separate composition change.

The affected union369/369 across sixteen files, types/lint and the app build pass with unchanged build warnings. No source rule, strategy, public-start, save/deployed or full-mode claim is opened by this bounded proof.

13 October 2026 — native paired E1 Bureaucrat funding

Before this slice the no-Homeworlds paired E1 Nexus profile was absent from Bureaucrat mode support, so a funded auction or shipment rejected at the mode guard ('Bureaucrat with other optional modules is still being integrated.'), byte-identical after a real pledge. A genuine paid revival produced no offer and no error: stampBureaucratPayment early-returns when mode support is false and the revival path never calls the contributor check. Both gates now admit the paired E1 Nexus profile only; single-native E1, preview overlays, multi-expansion and Homeworld allied funding stay excluded.

A read-only review confirmed no revival-source change is needed: the source is stamped from the payer's actual revival.cost, so the separate one-spice free-revival award is excluded; the source is phase 4, single-payer, seated Tleilaxu. Axlotl accrual is a separate deferred token; Face Dance has no player-to-player payment; foreign-ghola acquisition is Tleilaxu-paid and yields no payer income.

The new fixture reuses the genuine paired-Ix setup (real Storm, Mentat, conserved worm, real alliance, native closing draws) and scopes only the native all14 shuffle order and original unplayed card custody. A classic seat genuinely trains Bureaucrat. Forty-nine consumer cases pass across both modes: auction and shipment 5+3/3+5/5+5/fully donor-funded five, decline/redirect, sub-five nonpooling, owner/payee exclusion without masking an eligible payer, public gross/payee with payer null and no shares, stale/cross-actor rejection, four minimal bots, one physical use per phase, a single-payer bribe regression, and the revival cases (qualifying price, below-five no-offer, Karama-canceled no-offer). The genuine Guild Nexus card is exercised: a Guild-authored shipment costs the bank and has no third-party payer, so it yields no receipt; Guild Secret Ally is unreachable because that offer requires a game without a Guild faction. Recorded, not fabricated.

Two actual390px GameTable flows: Basic allied shipment5+3 redirects2 (Guild5→11, Harkonnen10→5 with eight reserves committed at Habbanya17, Ixians10→7, one use) and Basic paid revival (Atreides10→4 for cost6, Tleilaxu5→10 = paid6 + separate free award1 − 2, one use; the private prompt shows the payer only to the owner). Browser errors are empty apart from the known Vite optimizer abort for next_image.js. Artifact outside Git /tmp/dune-e1-bureaucrat-3228.json. Frozen union + types/lint/build pass with unchanged build warnings. No source rule, strategy, Homeworld funding, public-start, save/deployed or full-mode claim is opened by this bounded proof.

13 October 2026 — native paired E3 Bureaucrat funding

The paired E3 Nexus skill profile was already admitted to Bureaucrat mode support before this slice, so a funded E3 payment was never blocked by a module guard: both payment families and both modes rejected at the allied-funding guard, byte-identical after a real Moritani→Ecaz pledge5. The gate now admits no-Homeworlds single-Ecaz paired E3; all prior admissions (empty-expansion classic/nexus, single-CHOAM plain or paired) are preserved, and Ix paired, Discovery, Tech, Stronghold, multi-expansion and Homeworld allied funding stay excluded. Ix paired is deferred deliberately: enabling it would newly admit the existing revival payment stamp in an Ixian-native Tleilaxu composition whose Bureaucrat handling is not yet source-reviewed.

The new fixture retains the original paired E3 roster and native setup. A real turn-two Great Maker worm forms the actual Ecaz/Moritani alliance; only original unplayed Spice ordering and, for the cancellation case, one unplayed card in a real hand are controlled. Boundary wallets Basic: Ecaz12/Moritani12/Guild5/ Atreides10/Emperor10; Advanced differs only at Guild6 and Atreides12. Atreides genuinely trains Bureaucrat.

Forty-six consumer cases pass: both families and modes, 5+3/3+5/5+5/fully donor-funded five, decline/redirect, sub-five nonpooling, trainer and payee exclusion without masking an eligible payer, public gross/payee with payer null and no shares, stale/cross-actor rejection, four minimal bots, original Emperor-income cancellation (banked gross, no offer/use) and a real bribe-to- Mentat phase refresh. Guild-as-ally makes a Guild-payee exclusion shipment free by native rule, so payee exclusion is covered through the Emperor auction payee.

Two actual390px GameTable flows use the genuine paid snapshots. Basic allied auction5+3 redirects2: Emperor10→16, Ecaz12→7, Moritani12→9, one use, next lot at Guild. Advanced allied shipment3+5 redirects2: Guild6→12, Ecaz12→9 with eight reserves committed at Habbanya17 beside Imperial Basin6, Moritani12→7, Atreides12 unchanged, one use. Browser errors are empty; artifact outside Git /tmp/dune-e3-bureaucrat-3227.json. The frozen union203/203 across nine files and types/lint/build pass with unchanged build warnings. No source rule, strategy, Homeworld funding, public-start, save/deployed or full-mode claim is opened by this bounded proof.

13 October 2026 — native paired E2 Bureaucrat funding

The earlier mode guard excluded genuine paired E2 Nexus skill games before their allied-funding guard. Existing original paired CHOAM/Richese Nexus profile is now admitted specifically without Homeworlds; allied funding support is centralized for supported classic or E2 profiles. Source receipts, single-payer signatures, physical card use and private projection are unchanged. Qualifying E1/E3 and Homeworld allied/split-recipient composition stay separate; no new public start, constructor prerequisite or recovery certification follows.

The new common fixture retains all native six-seat setup armies and wallets: C26/R5/H7 Basic or9 Advanced/F6/E10/G5 Basic or6 Advanced before actual pledges. Native C actually trains Bureaucrat; actual H→F bribe3, first Mentat F3→6, second worm and mutual alliance precede T2 funding. Only original unplayed cards/entropy/custody are controlled. Both shipment before programs and five auction before branches (normal/cache both modes, Advanced Black Market) rejected immutably after pledge5 at the original mode guard. The auction program initially expected the later funding guard; its expectation was wrong, and the final actual branches identify the earlier message rather than invent a different rejection.

One genuine Advanced5+5 Guild after program retains original interception, Karama allowance and payment order: C26/R5/H4/F1/E10/G6 before credit, G14 after redirect, one use, original ten reserves at Habbanya17 beside Carthag10, then original Finish→Fremen. One Advanced5+5 silent cache after program uses the actual Richese seller-credit callback: H4/F1/R5→13/E10/C26; Residual Poison once plus native treachery-7 bonus, then original five-card normal pool index0. No Richese-income Karama window is fabricated. Ordinary Emperor cancellation banks the original gross; free Karama purchases stay normal-only, and Basic has no Black Market.

Four parent actual programs additionally cover Basic ordinary5+3 and cache3+5 redirection, Advanced entirely F-funded5 Black Market allowance and a real H/C alliance where only excluded trainer5 funds an H3 cache payment. That last payment proceeds with no offer/use, C21/R13/H6/F6, one purchase/bonus. Two real last-cache programs preserve pending CHOAM market and actual Done: Revival4, R13/H2 Basic or4 Advanced/F1/C26, unchanged purchase/bonus, one prior use and renewed phase opportunity; no phase assignment or second debit occurs.

Three actual390px GameTable flows start after actual native commitment. Advanced Guild3+5 resolves printed allowance then redirect: G6→12/H6/F1/C26, eight reserves at Habbanya17, original Finish→Fremen. Basic cache5+3 allows8: R5→13/H2/F3/C26, original Residual Poison and one bonus, original normal lot0/R. Advanced wholly donor-funded5 Black Market redirects2: R5→8/H9/F1/C26, one original treachery-1 transfer and bonus7; original Richese declaration then actual cache-first control reaches cache selection without another cost. Browser errors are empty; artifact /tmp/dune-paired-bureaucrat-3226.json. Only owned isolated host/tab/scaffold is cleaned; existing games/services remain.

Initial frozen union157 cases had155 pass and two incorrect direct-to-Revival pins fail: original CHOAM market remains pending. The incidental pin is deleted, and that same consumer path now completes real closing with money/cards/use assertions. One fixture event narrowing is repaired; focused two-case iteration and types pass. The next union exposed an exact sealed-log comparison coupled to independent public Storm bidder order (156/157). It is removed, not re-pinned; private gross/payee/null-payer fields and actual acquisition/payment remain checked. Focused sealed privacy1/1 and final157/157 across eight files pass. The affected old shared-gate/bare-not-throw echo test and its dead imports are removed rather than replaced with another wiring assertion. Final types/lint and app build pass. The first lint run found the unused offer initializer left by that removed case; the import is deleted. Existing module registration deprecation, chunk-size and static route-classification warnings remain unchanged. The app guide and source-ruling boundary match this scope.

13 October 2026 — qualifying classic allied Bureaucrat receipts

Supported classic no-Homeworlds auction and shipment funding now retains each actual positive private payer share in the original signed internal receipt. Eligibility is per other payer at least5, excluding trainer and recipient; gross prices cannot pool below-five shares. Exactly2 goes to Bank from one gross recipient credit, including both-five. Original full debits, committed cards/forces, Karama-before-credit ordering and physical once-per-phase use remain. A canceled gross receipt creates no Bureaucrat offer/use. Single-payer receipts gain no new signature fields. New private receipts project public gross/payee with payer null, never shares or selected qualifying payer; the owned control explains unchanged contribution costs. Existing legal bot choices need only recipient/alliance, not private payer details. Qualifying expansion-faction funding and split-recipient Homeworld cases keep their integration guards; gifts remain explicitly excluded.

The new shared fixture preserves native five-seat classic armies and wallets. Actual first-turn bribe3, original Mentat collection, second-turn worm and mutual alliance fund real Fremen pledges. Only conserved unplayed card ordering or custody is staged. Both modes and all three qualifying splits rejected immutably before at the exact old guard: six shipment plus six auction programs. The former threshold fixture folded original board armies into reserves; its duplicated below-five and superseded guard tests are deleted, not repinned.

Children each exercised one actual after scenario: five-plus-five shipment in both modes (G5/6→13/14 on redirect,15/16 on decline, unchanged on cancellation; H2/4,F1,B10/12 and native ten-reserve deployment), and Advanced five-plus-five auction (E10→18,H4,F1,B12, original purchased treachery-6 before choice and one native treachery-11 bonus afterwards). Parent actual programs prove fully allied-funded five in both modes and families: H pays zero/F6→1; Guild credits3 or Emperor10→13, original five shipped reserves or purchase/ one bonus remain. No wallet, phase, force or alliance is assigned.

Two actual390px GameTable flows use original income allowance and new owned control. Basic five-plus-three redirects2: G5→11,H2,F3,B10, original eight reserves commit beside Carthag10, Finish hands Movement to Fremen once. Advanced three-plus-five allows8: E10→18,H6,F1,B12; original one purchase and one bonus precede original next-lot inspection allowance, native lot1/F. Artifact: /tmp/dune-native-bureaucrat-3225.json. The isolated host initially failed its virtual React-refresh self import; the resolver was corrected. Native styling came from the actual new app stylesheet. One stale accessibility-node failure followed accepted allowance; authoritative state was inspected without replay. A generic network-idle wait timed out; direct controls and fresh state/screenshots supplied proof. No production or saved-game/full-mode claim follows.

Initial frozen feedback ran69 cases:67 passed, an obsolete qualifying guard and an incorrect unchanged-wallet expectation across native Advanced Collection failed. Both implementation/incidental pins were removed, not repinned. Four fixture typing issues were repaired; two copy-only renderer tests and dead image-alias hooks were removed. The repaired focused two-case iteration passes; types pass. Final focused union66/66 across five files, types/lint and app build pass with unchanged deprecation, chunk-size and route-classification warnings. The new native consumer files register44 cases plus one contributor-quote regression. Original aid bounds, owner/payee exclusions, cancellation, stale choices, original card/force costs, four legal bots and real phase refresh are covered. Broader assurance remains deferred until all rules.

13 October 2026 — original Homeworld battle-reward Karama costs

Only existing karamaBattleDiscard is newly admitted by the Homeworld Semuta gate. Its existing native capture/Auditor/force-income validator, original resource/casualty/owner commitments and reward order remain; Ix/Moritani stay outside this roster. No signing, price or profile cutover.

Two genuine thin/full capture before programs use original Advanced R/C/E/A/H Homeworld setup. E's actual two-normal Kaitain shipment enters native Carthag11 for2; H's funded dial1/support1 defeats E's original weak leader/dial0 with no weapons. H keeps9/Tanks1, E loses2/reserves18, both leaders live and no bounty occurs. H owns and accepts native captureOffer; printed E Karama spent without Semuta before original denial. The first reported E6 balance included incidental prior native cleanup; it is not a shipping-income rule or fixed wallet claim. The final fixture uses real spending-free Bidding readiness: original E10→8, H10→9 support, half1 rounds0.

Four genuine thin/full CHOAM before programs use original Advanced R/E/C/A. E4 Red Chasm7 shipment8 and C1 shipment2 establish original forces. Actual E Fenring6 dial2/support2 pays2 and keeps two survivors/Tanks2; C loses1. Native one-spice income quotes half of that eligible two-spice payment. Canceling it leaves C8/E0. The audit variant uses actual E Crysknife against C's Snooper, kills original Auditor2 and awards original bounty2 (E2). Native income first credits C8→9, then C declares its audit; printed E Karama spends without Semuta and denies audit before payment/inspection. No phase/wealth/force/leader/receipt assignment establishes any of these.

Thirteen parent after/negative programs exercise thin/full claim/pass for capture and both CHOAM scopes, plus a true Basic no-capture companion. Current original leaders/Traitors, custody, context, casualties, wallets and physical unplayed card stay committed. Original Collection quotes precede the last close and credit once: H9→11/E8; canceled income C8/E0→4; canceled audit C9/E2→6. Actual two E survivors collect4 from the original eight-spice blow, leaving4. No recovered cost restores its canceled reward or replay.

Three actual390px flows start at native H captureOffer, C unpaid income or dead-Auditor owner offer. H chooses Capture a leader; C chooses Audit opposing hand; E's real Cancel with Karama, then R's4/4 Commit, completes denial. Capture samples/transfers no disc; canceled force income preserves E support debit2; audit keeps C's earlier1 and E's bounty2 without payment/inspection. Each uses original C Finish control to phase7 with the quoted balances. Artifact outside Git: /tmp/dune-homeworld-native-reward-3224.json. One fresh DOM observation failed after accepted capture close; fresh server state showed phase7 and four original actions accepted. No action was replayed. The managed tab's recorded errors were empty; the tool failure remains recorded. Only owned service/tab/root files were stopped/removed. No saved/deployed/ natural-full-game or completed mode is certified.

Parent removed no-module Tech/default and receipt-count echoes. Four-profile CHOAM tests now apply the real proposed close and assert actual Collection, instead of pinning the bot's action object. The initial frozen TypeScript failure was the fixture's union Decision event access; a captured native choamAudit discriminator narrows it without casts or a rule change. Frozen types/lint pass. The first unit run failed four income rows that pinned zero bounty to null; the real quote can represent a zero amount. That representation assertion was deleted, not re-pinned; actual paid/bounty balances remain asserted. Final affected eight-file union passes117/117, including31 new consumer cases. Only failed check dependencies were retried. Build passes with unchanged module.register deprecation, client chunks over500kB and static route-classification warnings. No broader/deployed proof.

13 October 2026 — original shared-benefit cancellation costs

Only existing karamaBgCharityDiscard and karamaEmperorShareDiscard are newly admitted in the Homeworld Semuta profile. Existing faction, phase, consumed claim, allied response and printed-card validators remain. No signing, pricing, roster or public-mode cutover.

Two actual Advanced BG before programs (thin/full) use five original R/C/E/A/B Homeworld participants, genuine prediction/Harg Pass setup and first ten-spice CHOAM income (C2→12). Wealthy BG5 claims its native extra2; claimTurn1 is consumed before the response. Emperor's original printed Karama discarded once/no offer and denied the same benefit, BG5/C12 intact. The actual Basic BG5 claim returns its original unavailable error unchanged, without a response, cost or fabricated poverty.

Four actual Emperor before programs use original R/C/E/A setup, an actual three-normal Atreides shipment to Red Chasm7 for6, native turn closure, printed Weather6 on the second Storm and real1→7 movement. The three deployed counters enter Tanks; original Arrakeen10 remains. An actual unplayed worm opens turn2 Nexus and E/A form a genuine mutual alliance. Native E10 can declare gift3 or extra revival2 in the proper phase. Printed A Karama disposed without an offer and canceled the original benefit: no transfer/ return/extra allowance, Areserves7/Tanks3 and BasicA4/AdvancedA6 preserved. No old force-staging creator, clock, wallet, Tank or alliance assignment is used by these new native programs.

Twenty-one parent after/negative programs cover thin/full claim/pass for Advanced BG, both modes/two Emperor benefits, plus the Basic guard. BG5/C12 and claim1 stay consumed through original Bidding. Emperor gift leaves E10/A4 or6; revival denial retains the real three Tanks and empty extra ledger. Original ordinary revival then returns3/reserves10/Tanks0, free2 plus one paid force for2 (BasicA2/AdvancedA4), and original Movement becomes usable. Storm7, original alliance turn2, Arrakeen10 and physical card custody remain; no Weather, worm or benefit is replayed.

Three actual390px control flows start BEFORE the actual declaration, not just its cancellation. Advanced BG claims2 atwealth5, E cancels, R exchanges at4/4; BG5/C12/claim1 remain. Basic E declares gift3 through Share wealth, A cancels and R exchanges4/4; E10/A4 and actual casualty/ally state stay. Advanced E declares extra2, A cancels and R exchanges4/4; extra ledger stays empty, A6/reserves7/Tanks3. A's real ordinary Revive3 then passes the original CHOAM free-revival owner control and pays2: A4/reserves10/Tanks0, revived3/ free2, Arrakeen10 unchanged. UI stops at original Revival; runtime covers the original later phase3/5 controls. Artifact outside Git: /tmp/dune-homeworld-native-shared-3223.json. The owned browser reported no errors; only its service/tab/root files were closed/removed. No saved room, deployed revision or completed mode is certified.

Parent removed fixture-only BG setup status/prediction pins and non-empty cancel-card assertions. The shared-cost assertion now accepts exact-card custody in discard or the claimant's hand; the alliance stamp compares with the real alliance snapshot, not the preceding storm snapshot. Ordinary return regressions check the real3/free2 outcome rather than a permissive upper bound. One worker expanded its runtime checks into960 fixture constructions, 14 repeated harnesses and parser diagnostics. Parent stopped those sweeps and does not count them as integration proof; frozen owner checks govern. Frozen checks pass types/lint and175/175 across seven related unit files, including28 new cases. Initial Basic BG failed an Advanced Harg Pass setup pin; that location/reserve/population assumption was removed from both modes, not re-pinned. Actual original resource preservation and charity eligibility remain asserted. Only the failed unit union was rerun. Build passes with unchanged module.register deprecation, client chunks over500kB and Vinext static route-classification warnings. No broader/deployed certification.

13 October 2026 — native economic Karama costs

Only the existing karamaCharityDiscard, karamaInflationDiscard, karamaPurchaseDiscard and karamaPaymentDiscard are newly admitted by the Homeworld Semuta gate. Original response/lot/capacity/physical-card validators remain; no signing, price, profile or publication cutover.

Four genuine Basic/Advanced opening-income/Inflation before programs spend the original Emperor's printed Karama once with no offer. First phase2 CHOAM2 stays2 when its native2×4=8 income is canceled. Original Mentat Inflation cancellation leaves C10, attemptTurn1, no token/used state. Advanced A12 is the actual earlier stronghold Collection, not assigned wealth. Four genuine normal-lot purchase/payment before programs use original Richese Declaration-last, actual Atreides inspection, bid/pass and payment controls. A real winning11-spice bid exceeds A's10 wallet but uses the held printed Karama for free payment. The original lot arrives once, all wallets stay r5/e10/c10/a10, normalCount3 persists and native Bidding reaches phase5.

Eighteen parent after programs cover both modes, each cost's claim/pass with full Richese hands and both Inflation sides. CHOAM denial stays2 into phase3; canceled Inflation still permits ordinary next-turn8 income (C18), never sixteen/zero. Purchase/payment holds the original lot through Semuta and delivers it once at zero price, without income/share/refund or bonus draw. Both original normal pool and compulsory cache finish, cacheRemaining8, while all original wallets remain unchanged.

Four actual390px flows use native Cancel with Karama, Take current auction card or Spend Karama controls and exchange at4/4. Basic opening income remains2; Advanced Inflation keeps attempt1/no token and the original C Ready control. Basic purchase acquires original Weather after the cost; Advanced payment shows bid11, disabled spice payment at A10 and acquires original Poison Tooth after the cost. Normal index0→1 and pool3 remain. The UI proofs stop at native response/next-lot controls; runtime completes the original later queues. Artifact outside Git: /tmp/dune-homeworld-native-economic-3222.json. The owned browser reported no errors; only its service/tab/root files were stopped/removed. No saved room, deployment or full mode is certified.

The initial frozen union passed types/lint but failed five fixture assumptions. Four auction cases assumed a following response where the native next lot was already ready; that response-only step was removed, not re-pinned. One actual Advanced Medium next actor legally declared Gamont while the economic helper required every response absent. A real conserved-card reproduction observed the original CHOAM Worthless response. The helper now settles that different native response while still rejecting the original unretired Karama cost/ denied response, then follows the same closing controls. A deterministic consumer regression proves A10→9/reserves11, A12 unchanged, native C18 and no Inflation token. The separate actual post-fix program observes the same result. No production exception was suppressed or bot strategy changed.

The original Collection quote is taken before the last native Movement close: clean phase7 has already credited Collection, and an empty/full-hand phase6 may be auto-skipped. No clock/wealth rewind supplies that quote. Initial uninitialized-attempt and absent-sale input pins were removed. Existing direct purchase capacity versus winning-payment spent-card exchange, cache/normal- method Black Market exclusions and printed-only/no-Kull limits remain. Final frozen checks pass types/lint and176/176 across seven related unit files, including68 new consumer cases. The application build passes with unchanged module.register deprecation, client chunks over500kB and Vinext static route-classification limitations. No broad assurance/deployed check is substituted for the actual native cost/control proof.

13 October 2026 — clean Homeworld preparation and remaining chooser costs

Only existing residualPoisonDiscard, saphoAggressorDiscard and saphoBattleOrderDiscard are admitted by the Homeworld Semuta gate. Original death selection, event/readiness, participant, finite-order and private-card validators remain unchanged. No payment/profile/signature cutover or interpretation of the still-pending late timing.

Two actual Basic/Advanced Poison before programs conserve the printed Richese cache card into CHOAM and use native paid E1/C4 shipments to Red Chasm7 (cost2/8). One actual random eligible Emperor disc enters Tanks, no bounty or force delta; the used card disposed without an offer. The initial Advanced call had an unsettled original interaction and committed no card/death; the fixture resolves that real owner control, not a suppressed guard.

Six actual Sapho before programs cover early C aggressor and remaining first/ last in both modes. The chooser programs additionally ship original R1 into Arrakeen10 for1 and resolve the real R/A battle: R1Tanks, A10 retained, the native Caladan reinforcement explicitly declined. With only e/c eligible, C is already last and cannot legally spend Sapho for that position. Parent adapted last to genuine Emperor card ownership, without new geometry or rules. C-first priority is c/r/e/a; E-last is r/c/a/e; physical order stays r/e/c/a. The original E attacker/C defender pair remains; C chooses next in either mode.

Ten parent Poison programs cover eight thin/full claim/pass branches and two actual opponent-ready guards. JSON/resume preserves the one random victim record, wallets and deployments. Original living-disc plans then kill a different combat leader, not the Poison victim; C keeps3/reserves16/Tanks1, E has one lost force/reserves19, and real Collection takes6 from the printed8. Fourteen parent Sapho programs cover both modes, early/first/last claim/pass and two already-ready opponent branches. Original equal-value, zero-dial battles give C's changed aggressor the tie and four survivors/collection8, while chooser reordering leaves native E the tie and one survivor/collection2. All24 parent programs reach phase7 turn1 without repeated opportunity.

Five actual390px flows use native Poison in both modes, Advanced early aggressor, Basic first and Advanced Emperor-last. Poison exchanges at4/4 after Caid/Burseg's native death; one victim/deaths1, no bounty or counter delta, both original readiness controls close the same event. Early Sapho keeps E attacker/C defender/E chooser, changes ordinary tie priority toC, exchanges at4/4 and closes original readiness. First/last exchange at4/4 after the already-completed R/A prefix; C's real Fight Emperor control opens E attacker/C defender/C chooser. Advanced last then declines the original Atreides foreknowledge offer and uses both native readiness controls. These UI proofs stop before plans; runtime evidence covers actual phase7. Artifacts outside Git: /tmp/dune-homeworld-native-preparation-3221.json, /tmp/dune-homeworld-native-chooser-3221.json.

The clean producer keeps Poison unoffered after an opponent readiness while the native death still occurs. Sapho's existing early contract instead allows the other combatant already ready; that recorded readiness stays. Inspections, closed preparation, late Sapho and Advanced Harkonnen captive disclosure remain guarded. No historical/save/full-mode or deployed claim. Only the owned QA server was restarted for the final gate/fixture code; first-three-flow evidence was retained separately rather than overwritten. The owned browser reported no errors. Owned services/tab/root files were removed/stopped; unrelated services and saved games remain untouched.

One worker ran its permanent20-case file despite the no-checks contract, then withdrew that result as integration proof and froze. Another returned local pass counts while denying permanent checks. Parent does not count either claim as frozen integration verification. Root removed fixture/input echoes and non-empty event/queue pins, corrected the native chooser lookup, and retained explicit two-ready-opponent regressions and actual resource/tie outcomes. Parent frozen verification: types and lint pass; seven related unit files pass92/92, including62 new cases. The initial lint failed one unused type import; after removal only lint and the not-yet-run tests were retried. Build passes with the unchanged module.register deprecation, client chunks over500kB and static route-classification warnings. No broader assurance or deployed check was substituted for this local changed-path evidence.

13 October 2026 — original Homeworld battle discard producers

The Homeworld Semuta gate now admits only the existing battleResolved, winnerMandatoryDiscard and battleCleanup producers in addition to its previous costs. Their original source/reward/queue/casualty validators remain; no signature, combat calculation, profile, payment or publication cutover.

Two genuine losing-batch before programs use actual Emperor4 and CHOAM1 native shipments to Red Chasm7, priced8/2. Both sides play distinct original projectile/Shield pairs; accepted Emperor victory discards CHOAM's two played cards without an offer under the old gate. Four genuine winning-cost before programs use Emperor1/CHOAM4 shipments priced2/8, actual CHOAM projectile and printed Hero or original leader, and the real Emperor Worthless. Native killed Hasimir Fenring6 provides six original income. Mandatory Hero and later selected projectile likewise disposed without Semuta before admission.

Fourteen parent after programs exercise both rules modes, each losing-card choice or pass, and mandatory/selected winner claim/pass at Richese's full hand. All reach native Collection with original three winner survivors/reserves16/ Tanks1 and one loser in Tanks/reserves19. Exact discarded custody changes only for the chosen physical card; accepted combat and leader death do not repeat. Four additional parent programs deliberately position the original Red Chasm Spice Card first, producing the printed eight-spice deposit. Original post- cleanup Collection takes six once, leaving two; CHOAM8→14 Basic and7→13 Advanced.

The first parent after probe incorrectly expected the battle's8-spice balance to remain8 after Collection and failed14≠8. That was a proof error, not a production income defect. The new winner tests had the same constant-resource assumption; they now use the shared native Collection quote and a deterministic physical eight-spice blow, preserving original resources except that legitimate credit. Actor/source trace-count echoes were removed, not re-pinned.

Three actual390px controls resolve the real final Traitor pass or selected winner disposal, commit Semuta at4/4, and use original cleanup/market controls to Collection. Losing Maula Pistol and Shield appear only in the committed exact selection; mandatory Hero follows all four passes of the earlier losing Worthless; the selected Crysknife leaves the original Shield held. No accepted combat or phase closure was replayed. Artifact outside Git: /tmp/dune-homeworld-native-battle-3220.json.

Owned QA hosting initially returned404 because middleware followed Vite's terminal handler, then failed real next/image resolution and missing Vinext environment definitions. The temporary server used the actual installed image shim and ordinary development definitions, not a replacement component. Optimizer aborts remain recorded. The optional local action-notice toggle was turned off through its normal control after the first battle notice. One fresh DOM observation failed after the selected-card phase closure; server state showed phase7 and all three original actions accepted, so none was repeated. Only owned services/tab/root files were stopped/removed. No saved room, deployment, natural full game or completed Homeworld mode is certified. Frozen verification: types and lint pass; five focused unit files pass118/118, including48 new consumer cases. Initial TypeScript failures were fixture reaction/chooser/amount narrowing; the subsequent lint failure required explicit two-card comparison. Only the failed check dependency was retried. The application build passes with module.register deprecation, client chunks over500kB and Vinext static route-classification limitations unchanged.

13 October 2026 — Homeworld carried-flight and finite Sapho disposal

The producer gate additionally admits existing ornithopterDiscard, saphoAuctionDiscard and saphoMovementDiscard kinds. The native range, cohort, original groups, queue, funding and event validators remain unchanged. No signature, price, physical-order or optional-profile cutover.

Original Homeworld CHOAM/Richese/classic setup and paid native shipment provide one/two CHOAM counters. Real first/final moves use the printed range- three or two-group card, and an empty original cohort can end early. Six before programs disposed once without Semuta. Twelve parent after claim/pass programs retain moved1/2/1, counter custody and the original arrival/turn suffix to Collection. The existing prior-move/Hajr, advanced advisor and active Homeworld-transfer guards remain.

Real Richese Declaration/cache/method controls provide a Once Around lot with an earlier one-spice bid. Clean no-Guild unstarted turns provide Movement order. Original physical Sapho is conservatively positioned for a non-Richese unacted holder. Eight before programs changed only their finite queue and disposed without an offer. Sixteen parent after programs preserve earlier funding/acquisition/income or one original paid shipment/ground move through the same reordered turns. Cyclic/silent, partly completed, first-versus-Guild and late battle timing remain excluded; no pending source question is settled.

Three actual390px card controls complete range3, a second original group and empty-cohort early end. All recover the physical card at4/4 without repeating movement or shipment: paid C8/6/8, reserves19/18/19, moved1/2/1 and the same original next Atreides turn. Four actual390px Sapho controls change first/last, commit Semuta at4/4 and use original actor controls. Both finite lots keep Emperor's original10→9 invoice/card and Richese5→6 credit. First Movement uses one real native shipment and ground move; last Movement consumes original r/c/a/e turns once to Collection. Physical order remains r/e/c/a. Artifacts outside Git: /tmp/dune-homeworld-native-flight-3218.json, /tmp/dune-homeworld-native-sapho-3219.json.

Action notices occasionally cover controls; local Continue acknowledges them. One transient DOM failure occurred after a successfully ended Richese turn; fresh actual state showed c/a/e remaining, so the accepted action was not repeated. Initial optimizer aborts are retained. Only owned QA services/tabs/root files were removed. No deployed, saved-room, natural full-game or completed-mode certification. New cases cover70 semantic paths and all four minimal legal profiles; no strategy tuning. The frozen six-file card union passes126/126 with types/lint. Parent kept resource, cohort, funded acquisition and actual actor-sequence assertions; fixture-only ship/move trace counts were removed. JSON comparison ignores incidental omitted undefined controls, not physical/queue/private behavior. The application build passes with the existing module.register deprecation, client chunks over500kB and Vinext static route-classification limitations. No warning threshold is changed.

13 October 2026 — native Homeworld CHOAM completed-sale discard

The existing Homeworld Semuta gate now admits choamSaleDiscard. Native sale validation, Karama allowance, physical disposal and payment happen first; only the used card is then offered. No payout, signature or profile is rewritten. The original CHOAM market resumes once after recovery.

The fixture uses original CHOAM/Richese/Emperor/Atreides Homeworld setup. For Worthless cashout, a real native shipment of ten counters pays ten spice and lowers Tupile20→10. The high-population sale prohibition is retained, including duplicate Worthless sales. A real low-Tupile Baliset sale keeps its original two-spice credit. A non-Worthless Shield surplus is independently legal at high Tupile and keeps three-spice credit plus its held witness. All card positions are conserved; no clocks/wallets/population or ledgers are assigned. The initial Stunner choice was wrong because it is a projectile; canonical category inspection corrected the fixture to Baliset without altering a production rule or the native bank-income interpretation.

Four actual before programs (both modes × both sale kinds) paid/discarded without Semuta. Eight parent after claim/pass programs retain the credited amount, native paid counter group and duplicate witness, then consume the same market close. Fourteen new behavioral cases also cover high-Tupile rejection before mutation, full-hand exchange and all four minimal profiles.

Two actual390px controls sell/allow/commit through unmodified GameTable. The low-Tupile sale retains CHOAM0→2, reserves10 and board10; the high-Tupile Shield sale retains CHOAM2→5/reserves20 and physical Shield witness10 while Richese recovers sold Shield9. Both exchange at4/4 and restore original market ownership before native Battle/Spice progression. Evidence outside Git: /tmp/dune-homeworld-native-sale-3217.json. Four initial optimizer requests aborted; subsequent controls completed. Only own QA service/tab and root temporary files were removed. No deployed, saved-room, natural full-game or completed-mode certification follows. The frozen thirteen-file unit union passes236/236, with types/lint and the application build clean apart from the recorded module.register deprecation, large-chunk and Vinext static route-classification warnings. No warning threshold was changed or suppressed.

13 October 2026 — Homeworld Jubba and native Worthless Karama costs

The Homeworld producer gate now admits only the additional existing choamJubbaDiscard and karamaChoamWorthlessDiscard kinds. The unchanged native cancellation predicate still excludes Kull, battle, Ornithopter and ecological/arrival-overlap parents. No action, signature, force/payment rule or optional-module profile changes.

Jubba uses a real paid reserve shipment, original first-turn suffix, then turn2 Weather Control by the original Atreides seat. Storm1 plus actual6 threatens the single CHOAM Red Chasm7 counter; the ordinary Weather discard receipt is passed by original seats. Native readiness opens the real CHOAM Storm decision before casualties. The initial fixture mistakenly used the Kulon fixture's target=c as Weather caster; that C-caster output was real but did not satisfy the specified third-party fixture. It was corrected to the actual Atreides seat and the exact closed-gate before proof rerun.

Ten corrected before programs (Jubba in both modes plus four native printed power cancellations in both modes) had no cost offer. Twenty-four parent post-cutover programs cover claim/pass for those sources plus canceled Jubba. Protection keeps the paid counter alive through the same recorded storm; canceling retains Jubba, reoffers its original decision, then declining sends only that counter to Tanks before the same Spice opening. Native printed counter recovery offers only Karama, never the retained Worthless fuel. Baliset's original move resumes once; Kulon bonus/LL denial/Gamont return remain canceled, with original phase/closing controls preserved.

Four actual390px counter flows cancel with Emperor's held Karama, commit Semuta and recover that physical Karama. Kulon/Baliset exchange at4/4; CHOAM retains its printed fuel. Baliset reaches real Battle selection with Atreides Arrakeen9/Imperial Basin1/moved1, not a second move. Gamont leaves board10/reserves10/Tanks0 before the original close reaches turn2. La La La leaves allowance/counters unchanged and reaches original Atreides foresight. Kulon grants no range and the unused group stays at its original location before normal Collection. Two additional390px Storm flows use actual protect, native Karama allow/cancel, Semuta and original CHOAM controls: protected counter1/Tanks0 versus unprotected counter0/Tanks1, both reserves19 and the same storm7/turn2/phase1 suffix. Artifacts outside Git: /tmp/dune-homeworld-native-counter-3215.json, /tmp/dune-homeworld-native-storm-3216.json.

Parent removed wording/log-count and copied-receipt assertions from the worker tests; real storm position, physical survival/loss and rejected duplicate controls prove the transitions. The final ten-file union passes 192/192, including70 new cases, with types/lint clean. Native first-turn Collection can change a fixture wallet, so same-instance baselines preserve actual original income rather than assigning a constant. Initial Vite dependency request aborts and cosmetic notice dimming are recorded. All owned QA services/tabs/root and /tmp probe scripts were removed; proof JSON/screenshots remain outside Git. No deployed, historical-save, natural full-game or complete-mode certification follows. The application build passes; module.register deprecation, client chunks over500kB and Vinext static route classification remain visible warnings.

13 October 2026 — native Homeworld CHOAM Worthless discard continuation

The Homeworld Semuta producer gate excluded the native printed Kulon, Baliset, La La La and Trip to Gamont costs even though their existing native effects already worked there. The gate now admits those exact four existing continuation kinds; no signature, action shape, payment rule, force rule or optional-module profile changes.

The fixtures use the exposed original post-setup snapshot of the real CHOAM/Richese/Emperor/Atreides Homeworld initializer, before the older Kaitain fixture's hand staging/disposal. Subsequent phase steps are native; selected later physical cards and unplayed Spice order are conserved, not minted. Native reserve shipment supplies the actual CHOAM movement counter. An actual Atreides declaration supplies reactive Baliset's uncommitted move. La La La uses the original free allowance without fabricated Tanks, and Gamont uses an original Atreides starting board counter.

Eight before programs (both modes × four powers) discarded once without a Semuta offer. Sixteen parent post-cutover claim/pass programs all offer and finish the same original suffix: range-two Kulon/alternate Baliset movement reach Collection with one move, La La La continues to original Movement, and Gamont returns one force to Caladan before CHOAM's original close reaches turn2 Storm. Native decline/Karama Baliset paths still move the original declared group once and retain its unused Baliset.

Four actual390px human flows use native power controls and Karama allowance, then the owned Semuta commit. Kulon/Baliset exchange at Richese4/4 and retain CHOAM's two-spice paid shipment/reserves19. Kulon moves that counter from Red Chasm7 to Minor Erg5; Baliset leaves ten Atreides counters uncommitted before its legal Oh Gap9 alternate move. La La La leaves reserves/Tanks and wallets unchanged, then reaches the original phase5 Atreides-spice response. Gamont returns board10→9/reserves10→11/Tanks0 and restores the actual CHOAM closing control, which reaches turn2/phase0. Accepted actions/state are in /tmp/dune-homeworld-native-powers-3214.json outside Git.

The first browser navigation timed out while Vite optimized/reloaded dependencies; the warmed service worked without restarting it. A label/From selector mismatch was reported; the actual observed select handled the same route. Cosmetic notices sometimes dim captures. Final browser errors were empty. Only owned temporary files/service/tab were removed. This is local proof, not deployed, persisted-room or complete-rules certification. Jubba, Kull counter disposal, Nexus and other producer gates remain unchanged. Verification: TypeScript passed after repairing reaction-union narrowing; lint passed after removing an unused fixture import. The first test run hit an incidental undefined-versus-null expectation for proactive Revival; that expectation was deleted, not re-pinned. Actual allowance, force, custody and original-control assertions remain. The final eight-file union passes122/122, including42 new cases and all four minimal legal profiles. The application build also passes. It reports module.register deprecation, client chunks over500kB and Vinext static route-classification limitations. Those warnings are not hidden; this checkpoint does not certify deployment.

13 October 2026 — individual Bureaucrat payer threshold; evidence correction

The printed skill names one other payer's payment of at least five spice. checkBureaucratContributors instead aggregated different payer shares, rejecting three-plus-three before shipment or bid commitment. It now enters the existing integration guard only when an eligible individual payer reaches five. Private/split payments with a qualifying individual still retain that guard; no reaction, recipient split or private-funding convention is invented.

The new fixture uses real original all14 Skills setup, training and a real turn-two worm alliance. Conserved counters and undealt Spice Card ordering isolate payment without assigning wallets, alliances, phase or ledger state. Two valid Basic/Advanced shipment programs rejected before the change. Four post-cutover shipment and auction programs charge personal three and allied three, credit the full six to Guild/Emperor, preserve the physical shipment/acquisition and keep Bureaucrat unused. Eight cases also cover four-plus-three and rejection before mutation for five-plus-three. The older aggregate-three-plus-three rejection expectation is removed. The actual390px Basic table pledges Fremen's three native spice, ships six ordinary counters into Habbanya Sietch17, credits Guild5→11 and finishes Harkonnen's original Movement. Four initial optimizer requests aborted; the controls subsequently worked. No deployed or full-family claim.

Separately, the Box/Distrans/Truthtrance Homeworld UI proof is now real rather than retroactively attributed to earlier checkpoints. Six390px claim/pass flows use actual paid Box search, private Distrans transfer, Truthtrance declaration/priority/question/answer and original Movement completion. The proof bundle /tmp/dune-homeworld-controls-proof-3212.json retains fresh AX, screenshots, accepted actions and observed state outside Git. Parent inspected the three claimed-card screenshots. Local prebuilt native fixture progression is not deployed, persisted-room or natural full-game proof.

The shared parent-signature Homeworld augmentation is removed: it changed unrelated receipt bytes and was unnecessary to enable the new discard producers. Previous claims about unchanged in-flight receipts and already signed occupation-history fields were incorrect. No historical-save or intermediate-checkpoint receipt certification is asserted. Verification: TypeScript passed; the first lint run found an unused mock import and a never-reassigned setup variable, both removed. The final lint and13-file unit union passed135/135. Eight native bot programs (both modes × four profiles) complete shipment with zero rejected candidates. A real bribe reduces the payer's native ten spice to three, its original Bureaucrat choice is declined, then Fremen pledges three. Hard/Brutal use actual three-plus-one or three-plus-two funding; the normal Advanced Guild allowance finishes before checking committed forces/payment. No strategy or difficulty tuning changed.

11 October 2026 — Homeworld Truthtrance Semuta reaction

truthtranceDiscard is now admitted in the same Homeworld envelope, so a definite Truthtrance answer offers the consumed card. Its signature already binds the committed answer record, queue remainder and suspended controls.

A genuine original Homeworld state declares Truthtrance, passes storm priority and answers a real held-card fact; the consumed card is then the fresh batch. Claim recovers the exact Truthtrance, pass leaves it discarded, and the published answer history, wallets, occupation authority and original Movement are unchanged; the answer cannot be replayed. The claim/pass pair and all four legal bot profiles pass. The final checkpoint ran 25 cases in the new file and 140/140 across 11 affected files, with types/lint clean. Battle, Ornithopter, Sapho and other Homeworld producers remain guarded.

11 October 2026 — Homeworld Distrans Semuta reaction

distransDiscard is now admitted in the same Homeworld envelope, so a completed private Distrans transfer offers its used card. The continuation already binds both hands and suspended controls; no new custody or price rule was required.

A genuine original Homeworld state plays Distrans, delivers the chosen private card to a real seat, and offers the used Distrans. The transferred card is never a candidate; the gift has already completed. Claim recovers the exact Distrans, pass leaves it discarded, and the gift, wallets, occupation authority and original Movement are unchanged; replaying the transfer is rejected. The claim/pass pair and all four legal bot profiles pass alongside the existing Homeworld cases. The final checkpoint ran 19 cases in the new file and 113/113 across 10 affected files, with types/lint clean. Truthtrance was still excluded at that checkpoint.

11 October 2026 — Homeworld paid Box Semuta reaction

The Homeworld envelope also admitted no paid Nullentropy Box reaction, so a completed Box search in that roster produced no Semuta offer.

semutaOfferSupported now admits nullentropyDiscard there. The checkpoint also added Homeworld state to the unrelated shared parent signature. That addition changed other Homeworld receipt bytes, so the claim that no existing receipt changed was incorrect; the subsequent correction removes it.

A genuine original Homeworld state runs a real paid Box search: two uncommitted spice are paid, the pile is shuffled, the selected card is recovered and the used Box is placed on top. Semuta is then offered for that used Box. Claim recovers the exact Box; pass leaves it discarded. The payment, the searched card, Homeworld custody, occupation history, the percentage ledger and the remaining Movement are unchanged, and the Box cannot be searched again by its former owner. No pre-cutover Box program was run: the absence was inferred from the gate, not observed. The real post-cutover program showed a singleton search completing automatically before Semuta. The final checkpoint ran 13 cases in the new file and 107/107 across 10 affected files, with types/lint clean. Other producers remain guarded.

11 October 2026 — Homeworld ordinary-card Semuta reaction

The Homeworld Semuta envelope admitted only paid Kaitain disposal, Tupile lost-slot cleanup and printed Karama canceling income, so a used ordinary special card played in that roster produced no reaction. The printed Semuta card carries no module restriction; the exclusion was an implementation boundary of the new envelope.

semutaOfferSupported now also admits ordinaryCardDiscard when the Homeworld roster matches. The existing effect signature includes Homeworlds and revival state, but not the separate occupation-history/percentage fields; the earlier claim that those fields were already signed was incorrect. Ordinary resume restores saved response/decision/pending-Karama/opening.

A genuine original Homeworld occupation state at an active Movement owner plays Hajr: its movement grant commits, the used card becomes the fresh batch, and Semuta is offered. Claim recovers the exact used card; pass leaves it discarded. Wallets, Homeworld custody, occupation history, percentage ledger, the Hajr grant and the remaining Movement are unchanged; a second play and a repeated commit are rejected. The before program printed no offer, then failed an incidental null-versus-undefined assertion; it was not a green before check. Four post-cutover programs and seven consumer cases passed. The final checkpoint passed 77/77 across six files with types/lint clean; the actual 390px Hajr claim and original Movement finish were exercised. Other producers, module mixtures and public starts remain guarded.

11 October 2026 — source-supported first-death KH Ambassador return

The Tleilaxu Ambassador's own-leader alternative excluded Atreides' separate Kwisatz Haderach token even though base p17 revives KH like a leader without adding it to the ordinary roster. Two native before programs with genuine seven-loss combat, an actual KH Lasgun/Shield death, a real worm alliance and a real placed-token arrival offered no KH choice and rejected it.

Shared tleilaxu-ambassador-leaders.ts now supplies the private eligibility list and validates the submitted identity for native and Bene Gesserit copied grants. KH requires Advanced Atreides, seven battle losses, its own dead state and the original cycle1 marker; foreign discs, living KH and a prior return marker remain excluded. No response/decision shape, ordinary roster, wallet, force or quota calculation changed.

Returning KH clears its dead/battle-use state and advances the same cycle marker used by original Ghola and ordinary KH returns. It does not reset battle losses, add a physical disc, spend the ordinary leader allowance, charge spice or alter force pools. Four native/copied human/Easy runtime programs return the same token and resume the original Guild entrant once. Six consumer cases cover both paths, owner/stale/exclusive errors, living and prior-return exclusion and all four minimal legal bots. The fixture's battle preparation and physical Ghola descriptor were corrected during development; no engine rule was changed for those fixture errors. Styled390px humans use the native button, inspect awakened10-loss status and select the legal copied effect before returning KH.

No repeat-return, shared-leader or revival-income interpretation is settled; those remain the recorded policy questions. Types/lint and the frozen six-file Ambassador union pass44/44; no broad-suite or deployed acceptance.

11 October 2026 — Homeworld income cost before original printed share

Seven source-qualified before programs lacked Semuta for Basic/Advanced low Guild income, Advanced occupied Junction, and clean/occupied Emperor auction and Richese special purchase. Original native cancellation already retained the printed occupied portion; this checkpoint changes its discard timing, not its economics or beneficiary.

Existing karamaIncomeDiscard is now admitted in the original separate Homeworld Semuta roster. Only that HW income signature adds original custody, occupation history and percentage ledger. Plain income fields omit the addition; no new response/source identity, callback snapshot, payment calculation, module admission or low/occupied ruling is introduced.

Fourteen actual source replay/claim/pass programs retain the price and physical transaction. Single-payer shipment5 leaves five arrivals, native Guild canceled credit0 and original occupied2; original Movement follows allocation. Auction5 and special purchase3 leave native Emperor0 while their original occupied controller can allocate2/1 to its real ally. The next original Atreides inspection or saved Richese declaration follows once. All tested20-counter pools include visitors and original Emperor subsets; no force or payment is recreated by the reaction.

Child feedback exposed two fixture assumptions, not engine failures: Basic has no separate Salusa, so its included elite subset also counts on Kaitain. Conserved Basic low staging now moves that subset with its typed counter record to Polar Sink, leaving four actual natives; Advanced retains the original Salusa subset. An uncanceled-income baseline still holds its Karama and can answer the original Richese declaration response; the helper now follows that real queue before cache selection. The obsolete null and fixture-wiring assertions were removed, not re-pinned.

Styled390px actual GameTable humans Cancel→Commit at4/4 before any printed allocation. Junction2 is settled to original Richese; Guild then resumes the same paid Atreides five-force Habbanya Sietch Movement. Original occupied Kaitain gives its real Guild/Atreides alliance2 or1, even after native income is canceled. The paid-auction Karama itself is acquired; Richese's distinct Residual Poison acquisition/activation/debit remain and its real declaration opens the next original cache choice after allocation. Screenshots show original amounts/controllers, no cancel option for the printed share and 390px root widths. Four initial optimizer fetches aborted; exercised controls subsequently rendered and completed. No error-free/full-phone/deployed claim.

CLI/table/reference scopes now describe the admitted source types. Temporary scripts, server and tab were removed; no existing game/database was touched. Other Homeworld producers, overlapping/ambassador parents, module mixtures, public starts and comprehensive assurance remain separate. Twenty-six new consumer cases and the frozen six-file union pass65/65; types/lint pass. The bot's raw event-forwarding assertion was deleted; its actual native allocation now proves nonnegative owner/ally credits totaling the original printed amount without pinning a strategy or response shape.

11 October 2026 — native Homeworld Semuta cost composition

Separate semuta --homeworlds private entry reuses original Homeworld occupation setup for native Richese/CHOAM and classic factions, exact CHOAM, Basic/Advanced2–6, with no other optional modules. CLI selection and stored private prototype dispatch use existing undealt-lobby conventions. Runtime profile identity retains original custody/occupation/Tupile history. Only the following two producers offer Semuta in this envelope; other Homeworld producers and combinations remain coverage to finish, not printed bans.

Original kaitainDiscard already paid2 per selected physical card and retained the closing event. Its private simultaneous batch now offers Semuta: singleton completes on commitment; a group exposes candidates only after commitment and requires one selection. Taking Karama or Poison Tooth does not play it, refund its price or finish Emperor/CHOAM. The original paid action clears previous readiness, requiring both owners to acknowledge. Original three-spice CHOAM duplicate sale still coexists in the same window.

New tupileCleanupDiscard physically discards the owner's exact selected normal-limit excess and detaches only its original pending cleanup/opening. Its source lease row stays pending during Semuta. Retirement completes the same original ledger and restores opening/sync/next-holder once. It does not re-discard, restore the lost slot, replay departure or merge distinct holders. Unmarked original native cleanup uses the same extracted suffix unchanged.

Four source-qualified native Kaitain before cases and real Guild/Atreides two-holder cleanup lacked the reaction; original ready HW entry rejected Semuta. Eleven post-cutover programs cover Basic/Advanced singleton/group claim/pass and Advanced Tupile claim-first/claim-second/pass-both. Original all45 Treachery identities and actual paid source mechanics remain. Two real memory-only prototype dispatches reach original setup/playing; the CLI flag parses without store access. No existing database was touched.

Twenty new consumer cases, the related five-file unit union51/51 and original Semuta prototype-entry case1/1 pass; types/lint pass. Child readiness-shape assumptions were removed and replaced by actual required owner acknowledgements; CHOAM sale passes now follow the existing native policy until its real response closes. Redundant exported fixture aliases, duplicate/default/wiring checks and unused typed-force scaffolding were removed rather than made contracts.

Actual styled390px GameTable humans pay4 for Karama/Poison Tooth, privately choose Tooth at4/4, observe Emperor6 and finish both owners into Revival. Original Guild/Atreides lost-holder controls each go5→4; Richese claims Guild's Snooper, the ally discards its distinct Gom Jabbar, all seats continue the second neutral event, and Guild finishes its original unused Movement. Screenshots show the authorized private group and original ally cleanup; observed root widths remain390. Four initial optimizer dependency requests were aborted; the exercised controls subsequently rendered and completed. Temporary scripts/service/tab were removed. No full-phone/error-free or deployed acceptance, new source ruling, public gate or played-save conversion.

11 October 2026 — native income-cancellation costs through Semuta

Five genuine native before scenarios discarded the printed Karama and completed the income denial without a Semuta offer: Basic/Advanced Guild shipment, ordinary Emperor auction, just-purchased auction Karama, and Advanced Richese special purchase.

New karamaIncomeDiscard reuses the original response-cost union, signature, admission and retirement. Admission retains completed native paid sources; only their corresponding auction or Richese purchase parent crosses its existing fence. Original auction and Richese cancellation quotes remain the authority. No fresh source identity, payment calculation or refund is added. Signature facts bind original auction/sale, source controls, current Movement and committed force/shipment state; older cost kinds omit the new fields.

Ten actual source-action replay/claim/pass programs retain the payment and physical transaction. A three-force ordinary Guild shipment costs six spice: Atreides stays at four spice with three arrivals and its shipment used, Guild stays at five. A one-spice auction keeps Atreides at nine and Emperor at ten, advances exactly one lot and restores original Atreides inspection. Spending the exact newly bought Karama is legal; its later claim does not refund the bid. Advanced Richese pays three, stays at two spice, keeps its cache card and spent separate activation, and recovers the original declaration owner.

Sixteen new consumer cases cover those continuations, original full-hand exchange, foreign cost ownership, neutral passes and minimal legal bots. During integration the Guild fixture's counter baseline was moved after native setup: Advanced Emperor's original five elites are created there. No engine stock change was needed. Pure fixture-wiring, default and message pins were removed rather than added as contracts.

Styled390px actual GameTable Cancel→Commit flows acquire the printed Karama at hand4/4 for all three sources. Human Atreides can finish original Movement; human Richese can answer its restored declaration and open native cache selection, retaining Ornithopter. Screenshots inspect the acquired Karama, original next-lot ownership and restored cache controls. Updated live guidance was reinspected. Vite HMR reloaded the QA client and aborted four dependency fetches; reselecting the existing memory scene recovered the original controls. This is bounded local proof, not error-free/full-phone or deployed acceptance.

No module admission, new ruling, public start or played-save conversion. Temporary scripts, isolated server and tab were removed; existing games and unrelated services remain untouched. Types/lint and the frozen seven-file response-cost union pass70/70. The two fixture closure-narrowing errors found by typecheck were repaired with the existing local reaction binding; no runtime source or rule changed.

11 October 2026 — native Emperor and Moritani continuation evidence corrected

The initial Emperor-share fixture directly assigned phase, clock, alliance, wallets and decks. Its cancellation tests and two390px UI flows did not prove original setup, source qualification or stock conservation. The fixture now uses native setup and phase actions through the first turn, a real turn-two worm and reciprocal alliance. Original unplayed Spice Cards are reordered; later hand cards and three Tanks are staged by conserved transfers.

Four actual engine claim/pass scenarios reach Charity or Revival with all45 original Treachery identities and20 counters per faction. The native Emperor wallet remains ten; denial moves neither spice nor forces and claiming acquires the exact printed Karama. Six consumer cases pass on this setup. Guidance now correctly attributes the claimant control to the Semuta holder, not the Karama holder. There is no new UI or module-admission claim.

The observed Moritani cleanup mismatch has two legitimate native branches: an unused held Karama permits Moritani's special-Karama offer after its assassination; absence proceeds directly to winner card cleanup. Two genuine runtime scenarios stage that unused physical card before sealed plans and prove the owned decline, one Master Bewt death, three-spice bounty and native Collection continuation. The existing regression now covers both branches without rewriting engine rules or relying on the random starting hand. The prior isolated reruns did not prove a pre-existing failure's origin.

Deleted the pure Leader Skills panel wording test, the exact incidental worm quote shape and rejection-message pins rather than rewording them. Types/lint and the affected five-file union pass39/39. Temporary proof scripts were removed. No broad suite, save/recovery campaign or deployed proof.

11 October 2026 — Emperor share cancellation cost through Semuta

Actual native emperorRevival/emperorGift cancellation discarded the printed Karama and applied the denial with no neutral opportunity. New karamaEmperorShareDiscard extends the existing response-cost union, factory, bounded admission, validator, state signature and original retirement path. The shared semutaEmperorShareKaramaResponse admits only a genuine Emperor share to a reciprocal ally with a positive amount and no battle or pending shipment/transport, keeping the public cost clean.

The printed Karama is committed first; claim/pass restores the actual saved response and completes the cancellation once. The canceled share moves no spice, forces or revival, and the Emperor extra-revival ledger stays empty. Signature facts bind the response and the extra-revival ledger for this kind; other kinds omit them so their existing shapes are unchanged.

The initial three-seat fixture directly assigned its clock, phase, alliance, wallets and decks; its six tests and two styled390px human controls exercised the cancellation retirement only. They did not prove native setup or source qualification. That evidence is superseded by the corrected native fixture and changed-path proof in the checkpoint above.

No new module admission, source ruling, saved-game conversion or public gate. Temporary QA scripts/server and tab were removed.

11 October 2026 — pre-existing unit-suite failures repaired

Four tests failed at 63e5f22 in a clean worktree (so not regressions from this session). Three pinned superseded wording or an incomplete shape: homeworld-actions-engine matched the word "Basic" in a message now saying "base rules"; leader-skills-controls matched replaced panel prose; and moritani-skills-worm omitted the implemented multi-pile piles result. The wording pins were deleted in favour of behavior/presence checks and the shape expectation was aligned to the intended multi-pile output.

smuggler-battle fabricated a Leader Skills battle with the Ecaz variant module. That profile never admits ecazTreachery, and toggling it mid-battle invalidates the saved Mentat question battle version; the engine correctly rejects the state. The test now asserts the real gate and the rejection. The four files pass33/33; types/lint pass.

11 October 2026 — printed CHOAM-power cancellation cost through Semuta

Actual native Cunning Kulon canceled immediately while its printed Karama entered discard without a neutral opportunity. New karamaChoamWorthlessDiscard extends the existing response-cost union/factory, bounded admission, validator, state signature and original retirement path. Original Worthless cancellation quote remains authoritative; native printed and Cunning Kulon/Gamont/Baliset/La La La/Jubba reuse the same exact declaration and ordinary reactive parent. Kull and unrelated arrival/flight sources stay excluded. Old unrelated signatures omit the new optional source facts.

The public printed cancellation cost is committed first. Native CHOAM's declared fuel remains held, original Cunning history remains pending and its Nexus remains spent. Semuta claim/pass restores the actual saved response, cancels once and resumes one original movement/free-revival/storm/Mentat suffix. Taking Karama cannot claim the retained fuel or restore the denied effect. New signature facts bind declaration, source receipt and affected counters; unrelated leader serialization is not added to this nonbattle source.

Eight consumer cases reuse genuine original five-effect fixtures, checking claim/pass/full hands, retained printed/Nexus fuel, one source spend and the native outcome against original cancellation without Semuta. No whole-save, private-paired-state or recovery campaign. Types/lint and179 affected unit cases across10 files pass. Thirty actual native reaction cases plus one Basic Kulon claim cover all five families and four legal profiles; all cost views project while the original receipt remains pending.

Styled390px actual controls prove Gamont declaration→Cancel→Commit without returning the Emperor elite: it remains at Arrakeen/reserves4, CHOAM retains Hajr, Richese4/4 acquires Karama. Original Finish, not acquisition, assigns Arrakeen to Emperor at claim2/turn3. Jubba cancellation retains Maula Pistol through claim; original Continue loses all6 CHOAM/4 opposing counters and both crossed spice piles, reaching original market once. Actual acquired Karama inspector and updated warning were inspected; settled frames390px.

All temporary scripts/client/server, own service and tab removed. Existing games/stores, user PDF, provider/deployment and public gates untouched. No new module admission or source ruling; comprehensive assurance remains due.

11 October 2026 — five original Cunning fuel discards through Semuta

Fresh native Nexus admission made five previously excluded pending.nexusEvent costs reachable. Actual Kulon consumed a canonical projectile, spent the Nexus and applied bonus1 with no neutral Semuta opportunity. Producer cutover now reuses original Kulon/Gamont/Baliset/La La La/Jubba continuations with an optional completed Cunning event. Arbitrary fuel keeps its actual printed descriptor and private face, unlike the already-public named printed power.

Five existing signatures include the optional event; undefined omission preserves old printed shapes. The validator binds the last original completed Nexus receipt/frame to the exact owner/card/effect/targets and source flags, retaining original force/parent/state checks. Native cancellation retains fuel with Nexus spent. Allowance retires the original receipt and pauses after physical disposal, before the one selected effect and original suffix. No new initializer, payment, named-card transformation or Kull capability.

Two disjoint lanes supplied shared genuine setup/closing-draw and proactive or reactive fixtures. Actual a/b alliance leaves CHOAM unallied to draw its own card; only afterward are existing identities/conserved later stocks staged. Parent removed static-markup/wording, forwarding/re-export and paired-view audit scaffolds. New tests had incidental null/undefined and guaranteed-response assumptions; the latter now holds an actual printed Karama instead of changing normalizer behavior. Jubba's incorrect protected-spice expectation was repaired: printed protection covers forces only. No application storm rule changed.

The reactive fixture assumed Basic dialers in Advanced and ran to final fallback without reaching its boundary. A real trace showed Advanced turn3 card distance6 and zero dialers. The fixture now retains that actual card distance, enumerates all exposed territories in crossed sectors and uses original readiness; no distance/clock/phase is fabricated or rerolled.

Types/lint pass; affected union120/120 across9 unit files. Two proactive and24 reactive actual runtime cases cover Basic/Advanced claim/pass, four profiles, full hands and original all14/Tech/Strongholds closing. Singleton Commit stays automatic. Styled390px actual GameTable completes all five powers through original Allow and full-hand Commit. Acquired Slip Tip retains projectile text/inspector. Gamont's Hajr fuel never activates Hajr: one elite returns, then only original Finish assigns claim2/turn3. La La La preserves3Tanks/0revived/ 10spice before human paid-two revival reaches1Tank/2revived/6spice. Advanced Jubba's Crysknife claim preserves3 selected forces, loses3 other CHOAM and4 opposing forces, destroys both crossed spice piles and reaches original CHOAM market once. All settled frames390px; current warning was reinspected.

Temporary scripts/client/server, own service and tab removed. Existing games, stores, user PDF, provider/deployment and public gates untouched; no broad recovery/privacy/custody campaign. Full game/module acceptance and Kull remain separate from this bounded original five-effect composition.

11 October 2026 — original native Nexus and Semuta discard receipts

initializeSemutaGameForAudit delegates existing unused original Nexus setup when selected; paired CHOAM/Richese uses its original paired initializer, single or both selected E1/E2 native families use the generic initializer. Explicit Skills remains first and keeps original all14 prerequisites. --profile semuta --nexus-cards, optionally --leader-skills, uses the same private fresh-room dispatch, never a player-action gate or played-save retrofit. Three original no-Skills Nexus predicates and the shared skill/Nexus module predicate recognize only explicit native-Richese Semuta context; original roster/module checks remain authoritative. Homeworlds, Discovery/E3 and unrelated overlays remain excluded.

The existing nexusChoamTrade and nexusChoamBetrayal continuations now enter Semuta's bounded allowlist. Betrayal uses the original private-single-entry branch; both bypass unrelated suspended-response fields. Neither original producer nor receipt retirement changed: trade has already paid two bank spice, spent Nexus and discarded its Worthless; Betrayal has already spent Nexus and uniformly sampled/removed the native CHOAM card without compensation. Foreign acquisition cannot repeat either original effect.

Two disjoint lanes supplied genuine four-seat fixture/regression files. Original native setup/first Storm and real first turn precede reordered still-unplayed turn-two worm, reciprocal alliance and qualifying closing draw. Only afterward are original Nexus/Treachery identities moved between conserved slots. No phase, turn, wallet, starting held Nexus, skill training or module ownership is fabricated. The initial trade tests wrongly assumed a second singleton selection: existing Commit completes automatically. The helper and bot cases now exercise that behavior; its obsolete manual-selection test was deleted rather than changing runtime to satisfy it.

Types/lint pass; affected union119/119 across10 unit files. Eight real 2/3/6-seat setup/first-Storm scenarios cover single/paired/mixed original entry envelopes; two actual SQLite :memory: option dispatches save version1 with original Traitors or Skills and no Nexus hand. Sixteen native reaction scenarios cover Basic/Advanced claim/pass/full hands and four legal profiles. Actual CLI help executes. Styled390px human trade→Commit→original four-seat Collection readiness reaches Mentat: original trader12 spice, spent Nexus, Richese4/4 with acquired Trip to Gamont. Native Betrayal→Commit acquires exact server-sampled Snooper, leaves CHOAM Maula Pistol/Kulon, and original Charity readiness works. Actual acquired-card and printed CHOAM Nexus inspectors render. Initial four-seat snapshots measured554px scroll width; post-action frames390, so full mobile presentation acceptance remains open.

The isolated QA harness initially omitted image-shim optimizer environment defines. Installed Vite8 uses Rolldown, and its optimizer needed the same development defines independently of regular transform defines. Corrected probe used actual installed Vinext image shim, actual Tailwind PostCSS and real GameTable/engine; this was not an application-rule failure. Updated Semuta preview guidance was reinspected. All throwaways, own service and tab removed. No existing game/store, user PDF, provider/deployment or public gate changed; no comprehensive save/privacy/custody campaign was run.

11 October 2026 — trained Ixian response retained across Semuta cost

The explicit skill entry makes the formerly unadmitted receipt path reachable. Actual Advanced native all14 setup, original posture/preparation, first loser acknowledgement and declared1/1 exchange precede printed rival Karama. Cost staging succeeded but every player projection failed: the skill-trained substitution validator recognized only live response/Worthless conversion, not the response held by karamaBattleDiscard.

The validator now recognizes that exact saved Ixian cancellation response. No quote/signature/counter check is weakened, and native cancellation still finishes once before the held used Tooth and optional Shield cleanup. Existing fixture entrypoints accept an optional skills argument with default unchanged; their original preparation consumes actual posture/Mentat controls.

Both consumer-visible claim/pass regressions fail before and pass after. Types/lint and70 unit cases across9 files pass. Six actual runtime cases cover claim/pass/four legal profiles, all three pause views, retired/repeated actions, physical inventory and one native canceled exchange. Styled real GameTable at390px completes Cancel with Karama→Commit→Tooth acknowledgements →original Shield choice. Force inspector shows board2Suboids, Tanks1Cyborg, reserves17; Richese retains acquired Karama at phase7 opening, no overflow.

This was a previously static warning made reproducible by the new skill composition, not a Basic/Advanced force-rule difference. Existing native handlers, gates and unrelated saves remain unchanged. Temporary probes, service and tab removed; existing games/storage/user PDF/deployment untouched.

11 October 2026 — explicit Semuta/original Leader Skills composition

initializeSemutaGameForAudit(state,skills=false) and the new scoped --profile semuta --leader-skills option reuse original all14 training before marking Semuta. Default callers retain their old entry. Only explicit native-Richese context passes three original Basic/Advanced native profile gates; original roster/module predicates still govern. Semuta integrity uses ordinary/native-Tech skill eligibility. Original Tech3+ and Advanced Strongholds2+ remain; E3, Homeworld/Nexus/Discovery/Banker, unapproved Mentat steps and public starts are not opened.

The before probe's requested option silently produced faction-only Traitors with no skills; after it produces original private skill offers. Two disjoint fixture/test slices then connect actual Hajr→Movement→Mentat and mandatory loser disposal→Suk/Rihani→original winner cleanup. Native handlers/signatures already preserve timing; no rescue/exchange rewrite was needed. Compulsory winning Artillery stays reserved until Rihani finishes. Traitor/Face Dancer movements never become fresh Treachery targets.

Types/lint and184 unit cases across18 affected files pass. Twenty-four new behavioral cases avoid constructor-only assertions. Fixture repair, not rule change: Basic Emperor has no elite counters; Advanced uses its real two. Internal paid-loss shape and discard-sequence assertions were removed rather than repinned. Original Rihani normal inspection is inherited alongside its skilled exchange; the fixture's proposed suppression was wrong. A fresh typed cleanup binding repairs one stale TypeScript narrowing; unused setup snapshot and incidental posture-shape assertions were removed.

Four actual Basic/Advanced Emperor/CHOAM starts,36 question cases and48 aftermath cases pass. Both Semuta outcomes preserve original ownership, private exact/fallback replies, actual wallets/leaders/forces and physical cards/skills. Suk retains one ordinary in its pool, returns two to reserves and leaves one Tank casualty; Rihani peeks normally, optionally exchanges two new/one old, then actual Artillery/Shield cleanup and reward finish once. A fresh memory-only prototype-room option writes original offers/version1; actual CLI help accepts the new flag, without existing-store access.

Styled390px GameTable completes Hajr→Commit→original Movement→private Crysknife question/show→face-up posture. Original Suk choice/cleanup reaches Collection; force inspection shows14reserves/1normalTank/5board with2Sardaukar. Rihani draws, keeps Flinto and reveals/returns Lady Jessica before later Artillery acknowledgements and Shield cleanup, retaining one new Traitor. Native CHOAM training lists five eligible normal discs, not Auditor; human choices in all three seats reach original Traitors. Observed stale component guidance is corrected to normal Mentat/printed defense/current timing gates and its actual surface reinspected. Action notices were acknowledged, not treated as rule stalls; all tested surfaces have no overflow.

Warning, reference, launcher metadata/help and canonical Semuta/skill contracts updated. Temporary probes/services/tabs removed; no existing game, storage, user PDF or deployment touched. Complete skill/mode and deployed acceptance remain unfinished.

11 October 2026 — original Advanced Strongholds in fresh Semuta games

Fresh Advanced Richese/CHOAM/optional-Ix Semuta now retains unused original Strongholds at2–6, optionally original Tech at3–6. The native Stronghold initializer is reused, and its original E1/E2 roster condition is extracted once for both setup and Semuta validation. Standalone E3 behavior remains unchanged; Basic Moritani/Semuta does not gain modules. No redeal, played-game conversion, Skills/other overlay or public gate changes.

Two consumer-visible closing regressions fail at the old optional-module exclusion and pass after. Genuine native setup/first Storm precedes conserved later card/force staging. Original CHOAM Gamont returns the sole Carthag force; Semuta claim/pass preserves unowned module custody and restores the same final CHOAM window. Only the original owner Finish assigns cards from the changed board: Arrakeen held by Atreides, Carthag unclaimed, claim2, turn3Storm. Tech owners/ledgers and physical Treachery remain unchanged; no early or repeat claim and no keeper award to the card claimant.

Types/lint and161 unit cases across13 affected files pass; actual launcher help prints the updated entry without store access. Nine genuine Advanced starts cover Strongholds2–6 and both modules3–6. Twelve closing runtime cases cover both configurations, claim/pass/four legal profiles and original final assignment. Styled real GameTable at390px completes Return this force→Commit → original Finish in both entries. Public module inspection shows last claim2, Arrakeen held/Carthag unclaimed, with original Tech owners visible in the combo and no horizontal overflow. A role combobox lookup failed despite its fresh AX entry; fresh id-based selection worked. No production control repair needed.

Existing prototype dispatch needs no change because it delegates to the same initializer. Warning, help, reference and canonical Semuta/Stronghold contracts are updated. Temporary probes/services/tabs removed; existing games, storage, user PDF and deployment untouched. No complete-mode/deployed certification.

11 October 2026 — printed native battle-cancellation cost reactions

One shared karamaBattleDiscard receipt extends the existing response-discard pipeline to printed Karama canceling capture, Auditor, quoted battle income, Ixian substitution or Basic native Moritani retention. Accepted public cost is singleton; original response/native opportunity remains pending across neutral Semuta. Retirement restores saved controls and cancels once. Taking that cost cannot undo cancellation. Original quotes remain authoritative; the new kind signs battle/retention/Tech and physical force/leader/wallet/hand facts without changing old charity/Inflation JSON shapes. Auditor validation finds its saved response inside the new receipt. No native effect algorithm, ruling, module, Worthless conversion or public gate changed.

The native Moritani fail-before probe immediately discarded losing cards and cleared retention after the cost, without offering that Karama. Capture/income likewise skipped the cost; corrected Auditor setup reaches the same gap. Twenty meaningful new regressions cover eligible distinct holders, claim/pass, native finality and legal AI. Self-discard claim rows and forwarding/signature- length assertions were removed. Existing income/retention cases now retire the new cost before testing the later canceled-effect/card batch.

Types/lint and 203 unit cases across 18 files pass; final types pass after the existing income timing migration. Forty-eight runtime cases cover all five families, both Ix modes, enemy/ally cancelers, distinct/full-hand holders and four legal profiles. Original Tooth/Shield/allied batches and markets finish, with physical inventory, casualties and costs once. The initial fixture's inferred ordering was wrong: force income precedes Auditor, so its1 is already paid before audit cancellation. Canceled capture then gets ordinary Arrakeen Collection13→15; comparison uses the native baseline, not a frozen phase6 wallet through phase7. Neither correction required a native rule change.

Styled real GameTable at390px completes all five Cancel with Karama→Commit paths. CHOAM wallets11/10 distinguish pre-Auditor paid from canceled income. Ix inspection shows board2Suboids, Tanks1Cyborg, reserves17 after canceled1/1; Tooth acknowledgements and original Shield choice finish. Guild4/4 claims the foreign cost, both played cards discard, and final hand is Worthless/ Karama2/4 without another retention choice. No tested surface overflows; enlarged Semuta guidance is readable. The first temporary Vite harness omitted the app's Tailwind PostCSS plugin; it was corrected and all five styled paths repeated, without production dialog changes. Earlier unstyled captures are not styled-presentation certification.

Two disjoint fixture/test slices were integrated by one owner. Temporary probes/services/tabs removed; existing games, storage, user PDF and deployment untouched. Reference/tooltips and Semuta/retention contracts updated. Complete Semuta/mode and deployed acceptance remain unfinished.

11 October 2026 — native casualty and allied-retention Semuta continuations

Two disjoint native slices supply genuine setup fixtures and consumer-visible regressions; one owner integrates shared engine, table and guidance changes. The actual Ixian blocker was the original compulsory-winner queue, not a discard inside active substitution: loser disposal precedes winner casualties, then native substitution/decline precedes winning used Tooth disposal. Allowing that initial resolved-battle batch preserves the reserved Tooth and optional Shield. The pending Ixian-substitution exclusion stays intact.

Basic native Moritani now admits winner compulsory/optional batches before the original choose-stage retention and its completed unkept-card batch afterward. Existing canonical aftermath validation plus reciprocal alliance binds the preceding native opportunity. The original selected kept card, unrelated hand card and a newly acquired winner card never enter another claim/retention pool. Native Karama finishes before final disposal. All losing played cards are reserved here, so battleResolved with retention remains gated, as do Advanced native Moritani and Nexus retention. No original handler, source ruling, module/profile composition or public mode gate is changed.

Types/lint pass; 162 unit cases across thirteen affected files pass. The initial native cases reproduce missing offers. A test fixture lacked a physical rival Karama but expected its response; conserving one original Karama repairs that fixture. A nullable-shape assertion became a public no-reaction assertion and one captured union narrowing was repaired. The original Hero consumer test now passes the preceding loser offer before claiming the later reserved Hero; the former immediate-Hero assumption was obsolete, not an engine regression. Setup/default-copy tests and the proposed malformed-save campaign were removed.

Forty-eight Ix runtime cases cover both modes, both fresh boundaries, claim/pass/four legal profiles and substitution/decline; four more cancel the original exchange with a real rival Karama. Typed counters, payment, casualties, winner and physical Treachery inventory remain intact once. Thirty-four Moritani cases cover keep either/none, both preceding winner frames, claim/pass/four legal profiles and native enemy/ally allowance/cancel. The first throwaway probe mixed IDs from independently shuffled fixtures; binding each action to its actual fixture corrected that probe only.

Real GameTable at390px claims Snooper, confirms1Suboid/1Cyborg, allows native Karama, completes later Tooth acknowledgements and keeps Shield. Actual force inspection shows board1Suboid+1Cyborg, Tanks1Suboid and reserves17 at the original phase7 Ix opening, with Snooper still Richese-owned. Basic native retention declines, commits and privately selects Maula Pistol from two fresh cards, then reaches phase7 without another retention choice. Both surfaces have no horizontal overflow. Warning, card tooltips, internal reference and contracts match these boundaries. Temporary probes/services/tabs removed; existing games, storage, user PDF and deployment untouched. Complete Semuta/mode acceptance remains unfinished.

11 October 2026 — original native Tech after Semuta battle discards

The fresh CHOAM/optional-Ix Semuta entry now retains original unused Tech at three through six seats, Basic/Advanced, under existing native roster rules. An explicit Semuta context reuses the original profile predicate; existing callers retain its strict default. Skills, Strongholds, other overlays, the separate Basic CHOAM/Ecaz Moritani entry and played-game conversion stay closed. Only the pending Tech battle-reaction exclusion is removed.

Four regressions reproduce the original profile failure and pass after the cutover. Genuine setup/first Storm retains the printed Tleilaxu Axlotl owner and assigns the remaining physical tokens. Mandatory/winner claim or decline leaves custody unchanged until cleanup finishes, then the original winner chooses one of two loser-owned tokens. Both selections preserve the other owners and claimed card, reject repeat use, and precede native Face Dance.

Types/lint and 123 unit cases across eight affected files pass. Eight isolated fresh-start runtime cases cover both modes and three through six seats. Twenty-four battle cases cover both producers, claim/pass/four legal Semuta AI profiles; sixteen also take an original legal Tech AI choice. Actual casualties, physical Treachery custody and one award survive the native Face Dance decline. Real GameTable at390px claims Hunter Seeker, shows both token choices, takes only Heighliners for Atreides, restores Tleilaxu's Decline Face Dancer and reaches phase7 original Ix opening with owners/card intact and no overflow. The isolated Vite probe required route-order correction and a retry after its dependency optimization reload; no production UI defect was observed.

Entry help, persistent warning, card tooltips, internal reference and Semuta contracts are updated. Temporary probes/services/tabs removed. Existing games, storage, user PDF and deployment untouched; no complete-mode claim.

11 October 2026 — native Auditor after Semuta battle discards

Removing only the audit reward exclusion admits mandatory/winner discard reactions while preserving the original native opportunity. Survival and the audited opponent's used-card IDs remain frozen; the same cleanup/income schedule precedes its owner offer, then current hand custody determines pool and price. No quote, payment or sampling algorithm changed.

A source check prevents the wrong wider exclusion: authorized supplied PDF physical p29 CHOAM E names cards that opposing player used. The quote already records those identities. A card acquired from the other combatant can be eligible while the target's own retained weapon stays excluded. The old publisher URL redirects and its temporary mirror is absent; the available authorized local document supplied the wording, not a new publisher fetch.

Both regressions fail before and pass after. Twenty-four isolated runtime cases cover target/third-party holders and mandatory/winner producers, claim/pass, four legal Semuta AI profiles and payment/private inspection. The exact singleton price1 is paid once or that current card is inspected once. Hands stay intact, target/observer insight stays null, retired reaction/payment rejects and the original market completes to phase7 with no repeat payment or sample.

Real production GameTable at 390px performs target-held Semuta, acquires Snooper, retains its own Crysknife, declares the native audit, shows Pay1/Allow, and privately reveals only Snooper to CHOAM. The actual inspector is readable. The owner then completes the original market with its historical snapshot intact at phase7's Ix opening, without horizontal overflow. Types/lint and 152 affected unit cases across twelve files pass.

Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Tech and other parents remain separate. Full CHOAM/Semuta and deployed acceptance remain open. Contracts: Auditor, Semuta.

11 October 2026 — quoted CHOAM income after Semuta battle discards

The existing battle receipt validates the native CHOAM owner and positive income quote. Removing only that reward exclusion admits mandatory and winner discard reactions without changing force payments, quote calculation or aftermath ordering. Claim/pass preserves the unpaid quote through casualties and winner cleanup, then opens its original allow/Karama response. Allow pays once; cancellation redirects income to bank without a payer refund.

The regression fails before and passes after, covering both producers, claim/pass, exact quote preservation, allow/cancel, unchanged already-paid balance and casualties, card conservation and retired reaction rejection. Twenty-four isolated runtime scenarios cover both producers with claim/pass and four legal Semuta AI profiles, followed by allowance and cancellation. The native quote gives one income for the two eligible paid support spice; the already-settled payer balance stays12.

An additional suffix observation confirmed the original phase6 CHOAM market remains after income; it is not a stall or immediate Collection. Every extended scenario finishes that actual market to phase7's Ix opening with no second credit. Real production GameTable at 390px claims Crysknife, restores the quoted one-spice response and native Allow/Cancel controls, allows CHOAM2→3, then finishes the original market with spice still3. Claimed custody persists and there is no horizontal overflow. Types/lint and 119 affected unit cases across eight files pass.

Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Auditor, tech and other rewards remain separate. Full CHOAM/Semuta and deployed acceptance remain open. Contracts: Semuta, battle ordering.

11 October 2026 — native Face Dance after Semuta battle discards

The battle receipt already validates pending native Face Dance against the original winner, territory and Tleilaxu owner. Removing only its battle-reward exclusion admits mandatory and winner-card batches without changing native replacement, force sources or aftermath ordering. Other reward exclusions remain intact; Face Dancer cards are not Treachery targets.

The genuine mixed CHOAM/Ix fixture stages a matching physical Face Dancer by a conserved identity swap with the actual reserve/held traitor zones. The regression fails before and passes after, covering both discard producers, claim/pass, original casualties/cleanup, one replacement and winning leader death, card preservation after replacement and retired reaction/Face Dance replay rejection.

Twenty-four isolated runtime scenarios cover both producers, both modes, claim/pass and all four legal Semuta AI profiles, followed by native replacement. Eight further native Face Dance AI cases cover each profile in Basic/Advanced; all legally reveal their own matching card and replace three survivors. The old winner ends with reserves18/Tanks2 and no board forces; Tleilaxu holds board3/reserves12/Tanks5, with one winning-leader death.

Real production GameTable at 390px claims the winner's Hunter Seeker, restores the original private reserve/sector controls, then reveals the matching Face Dancer and replaces three in Arrakeen10. Hunter Seeker stays held by Richese. Phase7's original Ix opening remains; this is not premature Collection proof. There is no horizontal overflow. Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Types/lint and 117 affected unit cases across eight files pass.

Contracts: Semuta, battle ordering. Full Semuta/Tleilaxu, combinations and deployed acceptance remain open.

11 October 2026 — original final Mentat after Semuta/Gamont

The Gamont receipt now carries an optional final-Mentat marker and signs the native pending opportunity. After the selected physical return, claim/pass restores the same choamMentat decision for CHOAM. No victory check or phase advance runs inside the receipt; the original owner must still finish. Unmarked proactive signatures remain unchanged.

The regression fails before and passes after. Actual native market, readiness and done actions create the closing window. Its unopposed board gives Atreides a three-stronghold victory; recall removes Arrakeen before the same owner can finish. Claim/pass preserves turn2/Mentat, exact force return and cards; wrong-owner completion and retired reactions reject. CHOAM's actual Done then advances to turn3/Storm with no winner. The fixture initially checked phase before native market completion and placed Tabr in sector13; corrected progression and canonical sector14 required no production rule change.

Twelve isolated runtime scenarios cover Basic/Advanced, claim/pass and all four legal AI profiles, including each profile finishing the restored owner window. Real production GameTable at 390px performs Return this force, Semuta commitment, the restored Finish and check victory and actual turn3/Storm continuation, without horizontal overflow. Types/lint and 82 affected unit cases across six files pass.

Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Nexus and other competing parents remain separate. Full Semuta/CHOAM and deployed acceptance remain open. Contracts: source/runtime, discard suffix.

11 October 2026 — typed and concealed Gamont with Semuta

The existing receipt already signs target elite and No-Field custody, but the admission excluded those targets and the suffix used a literal ordinary-force argument. The receipt now stores an optional selected elite or native marker event, validates it and passes it to the unchanged native Gamont helper. Ordinary selections retain the omitted defaults and original signature shape. Reactive stopped-marker signatures also use direct optional fields, with assignments instead of temporary spread objects.

All three permanent regressions fail before and pass after. The elite case uses genuine Advanced Emperor setup and a staged mixed stack: exactly the elite returns, aggregate reserves19 include elite reserves5, and normal/elite revival usage stays unchanged. The No-Field cases use actual original deployment actions before the staged Mentat position. Markers remain concealed during the offer; zero returns no force, while three caps materialization at the two current reserves and recalls one. Both preserve Tanks18, cards and prior shipment payment, and reject retired reactions.

Thirty isolated runtime scenarios cover Advanced elite, Basic/Advanced zero/three markers, claim/pass and all four legal AI profiles. Real production GameTable at 390px claims each target case. Its force inspector verifies twenty physical counters after the capped three reveal: one board, one reserve, eighteen Tanks. Zero leaves board0/reserves2; elite leaves one normal board counter and five elite reserves. There is no horizontal overflow. Types/lint and 163 affected unit cases across nine files pass.

Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Closing Mentat, Nexus and competing parents remain separate. Full Semuta/CHOAM and deployed acceptance remain open. Contracts: Semuta source/runtime, discard suffix.

11 October 2026 — reactive Worthless denials with Semuta

The existing choamBalisetDiscard and choamLaLaLaDiscard receipts now admit clean reactive ordinary movement/free-force requests. The accepted cost stops the uncommitted request before staging. An optional true marker records only that stopped status; retirement installs the original restriction and notice, never re-executing a move or revival. Existing proactive signatures are unchanged when the marker is absent. If a competing parent prevents the offer, the temporary pointer is restored before the original handler runs.

Both native regressions fail before and pass after. Claim/pass preserves resources, force/movement/revival usage and card inventory; the original target restriction remains, and a legal alternate move or paid two-force revival works. Retired events reject. Twenty-four isolated runtime scenarios cover both effects in Basic/Advanced with claim/pass and all four legal AI profiles. Four printed-Karama cancellations retain the Worthless card and Semuta, open no Worthless discard reaction and complete the original request. The first cancel probe's absent-versus-null internal-state pin was removed in favor of observing the public reaction.

Real GameTable at 390px performs reactive Prevent movement, Semuta commitment, visible Carthag restriction, one alternate move to Arrakeen and turn completion. The revival case performs La La La, Semuta commitment and one actual paid two-force revival: quote4, reserves19/Tanks1/spice6 and no free usage. Both surfaces have no horizontal overflow. A Vite optimization reload caused one initial open timeout; the optimized server opened without an existing-service restart. Temporary scripts, isolated server and browser tab are removed/stopped; no saved store or deployed game was targeted. Types/lint and 130 affected unit cases across seven files pass.

Nexus, movement-card/Ambassador and other competing parents remain outside these new paths. Cancellation rules and public gates are unchanged. Contracts: Semuta, native denial/resumption.

11 October 2026 — Semuta after a clean battle Distrans transfer

The completed distransDiscard receipt already binds the donor/recipient hand identities and original battle parent. The reaction guard now admits it during battle without changing transfer legality or competing-parent exclusions. Only the public used Distrans is fresh; the private gift is already held and is not a Semuta target.

The original regression fails before and passes after. The final two cases cover a separate recipient and the Semuta claimant as recipient, preserving one gift, card conservation and the original sealed plan. Original transfer and retired reaction replay reject. A recipient combatant may commit the given weapon in its next legal plan; a claimant recipient retains both its gift and the claimed used Distrans. Types/lint and 69 affected unit cases across seven files pass.

Twenty-four isolated engine scenarios cover Basic/Advanced, both recipient roles, claim/pass and all four legal AI profiles, then legal planning. Each retains the original opposing plan and one exact transfer. Temporary scripts are removed; no saved store or deployed game was targeted. Existing transfer, Semuta and plan controls are reused; no new browser evidence is claimed. Full Semuta and combinations remain open. Contracts: Semuta, printed transfer and commitments.

11 October 2026 — native Basic Semuta/Terror continuation

The local semuta initializer now additionally admits Basic native Richese/Moritani plus classics with exactly CHOAM/Ecaz decks and no optional modules. The existing CLI profile delegates to the same initializer; help documents the entry. Advanced Moritani, native Ecaz and Ix/E3 mixtures remain excluded. Existing CHOAM/optional-Ix entries are unchanged.

Private Sabotage and Robbery-overflow receipts after clean ordinary shipment/movement arrivals now receive the existing neutral all-seat offer and committed-only candidate access. Only admission changed: random victim/draw, removed token, payment, physical entry and original gift/overflow suffix remain native. Worm, Ambassador, other arrival causes, active movement cards and overlap parents retain automatic continuation. The public projection now includes the explicit semutaPreview configuration so GameTable persistently labels this incomplete mode rather than implying certified expansion play.

Two native setup/regression cases fail before and pass after, covering both private producers, original optional gift or drawn-card custody, card conservation, settled arrival resources and rejected retired/second-shipment actions. Thirty-six isolated engine scenarios cover both producers and arrival types, claim/pass, all four legal AI profiles and Sabotage gift accept/decline. Each ends the original turn with exactly two Carthag counters and eighteen reserves; movement entries keep their one completed move. Four fresh-lobby probes reject Advanced, native Ecaz, missing Moritani and extra Ix without mutating their inputs.

Real production GameTable at 390px displays the profile warning, hides the private face before commitment, claims Stunner, restores the original optional Shield gift and finishes the Atreides turn to Richese. Arrival counters stay 2/reserves18; there is no horizontal overflow. The adapter only mounts the real table and switches seats against memory-only state; no saved store was used. Temporary scripts, isolated server and browser tab are removed/stopped.

Types/lint and 80 affected unit cases across eight files pass. The actual start-prototype --help command prints the documented entry without opening a store. SQLite recovery/complete-game/deployed assurance is not claimed here.

Contracts: Semuta source/entry, native Terror suffix. Full Semuta/Moritani, combinations and deployed acceptance remain open.

11 October 2026 — Semuta after a paid battle Box search

The completed nullentropyDiscard receipt already binds the acquired card, ordered shuffled pile and original battle. The Semuta battle-presence guard now admits that receipt without changing search/payment rules or existing competing-parent exclusions. Only the used Box is fresh; claiming it does not claim the searched card or replay the transaction.

The permanent regression fails before and passes after, covering claim/pass, exact two-spice payment, one recovered weapon, unchanged opposing sealed plan, discard order and card conservation. Retired reaction and paid-search replay reject. Twenty-four isolated runtime scenarios cover both rule modes, automatic sole-target or explicit multiple-target selection, claim/pass and all four legal AI profiles. Each uses the recovered weapon in the next legal plan, preserving the original opposing plan and exactly one payment. Types/lint and 72 affected unit cases across seven files pass.

Temporary scripts are removed; no saved store or deployed game was targeted. Existing human Box, Semuta and planning controls are reused; this is engine runtime proof, not new browser/deployed acceptance. Full Semuta remains open. Contracts: Semuta, paid search continuation.

11 October 2026 — Semuta after ordinary battle Ghola revival

The completed ordinary-card receipt already binds Ghola revival and the original battle, but the reaction's battle-presence guard excluded it. The guard now admits only that completed ordinary Ghola effect in addition to its existing battle producers. Revival and plan legality are unchanged; competing parents and market-specific Ghola interruptions remain separate.

The permanent regression fails before and passes after: claim/pass preserves the returned leader, death history, sealed opposing plan and physical cards; retired-event/original-card replays reject, and the returned leader can be used in the next legal plan. Twenty-four isolated engine scenarios cover both rule modes, leader or three-force revival, claim/pass and all four legal AI profiles. Each resumes legal planning with the original opposing plan and exactly the committed revival. Force revival leaves Tanks0/reserves16. The first Advanced probe omitted declining the existing full-plan inspection; the corrected Advanced run uses its actual decline action before readiness.

Types/lint pass; 101 affected unit cases across seven files pass. The first test selection used an unsupported exclusion flag and ran no tests; the corrected selection uses the runner's --suite unit.

Temporary scripts are removed; no saved store or deployed game was targeted. Existing human Ghola, Semuta and plan controls are reused; changed-path evidence here is engine runtime, not a new browser check. Full Semuta and deployed acceptance remain open. Contracts: Semuta, completed ordinary effects.

11 October 2026 — Semuta before native Advanced Harkonnen capture

The resolved battle and winner-cleanup receipts already validate the original pending capture's winner, loser and territory. Removing only pendingCapture from the reaction exclusion admits both discard batches without changing the capture handler, random selection or aftermath ordering. Other pending reward exclusions remain intact.

The real Advanced Richese/Harkonnen fixture now covers mandatory loser disposal, winner disposal, claim/pass, unchanged resources and pending capture, retired events, card conservation and one retained captive. It fails before the guard change and passes after. The fixture also declines the existing Atreides full-plan inspection before shared readiness; no preparation bypass was added. Types/lint and 97 affected cases across eight files pass.

Thirty-six isolated engine scenarios cover both producers with claim, all-seat pass and all four legal AI profiles, followed by capture decline, retention or execution. Each reaches Collection with zero or one captive as appropriate; execution gains exactly two spice against the same decline suffix. An initial probe wrongly attributed automatic Collection income to capture; its corrected comparison uses the complete same-phase baseline.

Real production GameTable controls at 390px claim the winner's Stunner, resume Capture a leader, inspect the captive and retain exactly one before Collection, without horizontal overflow. The QA adapter only switched seats and mounted the real table against an isolated memory-only engine; it touched no saved store. All temporary scripts, server and browser tab are removed/stopped. The first compiler pass stopped on an unused temporary fixture helper; after scaffold removal, the frozen implementation check passed.

Source/runtime boundaries: Semuta, battle ordering. Full Semuta, expansion and deployed acceptance remain open.

11 October 2026 — Semuta with a bound battle-plan promise

The Truthtrance receipt already carried a battle promise and the integrity validator already enforced it. The Semuta admission excluded every promise kind other than none, and a separate guard refused any reaction while a battle existed. Admitting kind === 'battle' and exempting truthtranceDiscard from the battle-presence guard lets an ordinary definite battle answer offer its consumed card without touching the promise or its enforcement. Submitted/revealed-plan questions bind no new promise but still offer Semuta, as do ordinary fact answers during battle; the original checkpoint's automatic-continuation claim was wrong.

The regression fails before (no offer) and passes after, covering claim and decline, the surviving promise, an illegal-dial rejection, the legal dial, public history and inventory conservation. Types/lint pass and the 126-case affected union passes. The fixture needed both combatants marked ready in the shared pre-leader phase before a plan can be committed; that is existing battle preparation, not a change to it.

An isolated runtime smoke subsequently exercises unsubmitted, submitted, revealed and battle-fact answers with claim, all-seat pass and four legal AI profiles (24 scenarios). Battle plans and history remain unchanged; retired events reject. The unsubmitted promise rejects dial0 and accepts dial2; the submitted and fact paths accept the next legal plan without changing the answered plan.

This is local changed-path proof, not complete Semuta or deployed acceptance. Contracts: source boundary, discard continuations.

11 October 2026 — Semuta with a bound Truthtrance shipment promise

The typed truthtranceDiscard receipt already carried a bound promise and the integrity validator already required it; the Semuta admission check excluded every promise. Admitting only kind === 'shipment' lets a classic payer's ordinary shipment answer offer its consumed card while leaving battle-plan promises and every other promise path automatic.

The structured shipment question was still limited to base games, so the Richese Semuta profile could not even ask one. shipmentPromiseModeSupported now admits that profile for a non-Richese active payer, and the result is projected as truthShipmentSupported so the human Truthtrance panel and the engine validation use one boundary instead of the client re-deriving it.

Both regressions fail before the change (no offer; question rejected) and pass after, covering claim and decline, promise preservation and enforcement, public history, and inventory conservation. Types/lint pass and the 125-case affected union passes. Eight isolated CLI scenarios cover both answers across four legal AI profiles. A real 390px check confirms the shipment question is selectable for the Emperor target and refused for a Richese target, with no horizontal overflow.

Native No-Field shipments and other module combinations remain outside this boundary. This is local changed-path proof, not complete Semuta or deployed acceptance. Contracts: source boundary, discard continuations.

11 October 2026 — Semuta before a reserved Truthtrance question resumes

The typed truthtranceDiscard receipt already captured the remaining queue and restored it at ask; the Semuta admission check additionally required no reserved question. Removing only that clause lets an ordinary definite answer offer its consumed card while another question stays pending. The integrity validator already enforced the remaining queue's card custody and priority, so no new custody path was added. Shrine-source answers, promise-bound shipment answers and battle-plan answers keep their automatic continuation because the promise clause is retained.

The permanent regression fails before the change with no offer and passes after, covering the reserved queue's identity, public history, claimant/decline custody, a retired-event rejection and full inventory conservation. Types/lint pass and the 97-case affected union passes. Seven isolated CLI scenarios cover claim and all-seat decline, four legal AI profiles and a rejected replayed claim. This is local changed-path proof, not complete Semuta, recovery or deployed acceptance. Contracts: discard continuations, source boundary.

11 October 2026 — native Fremen Cunning with original Tech/Strongholds

The classic original-component Nexus envelope already permits Tech Tokens3+ and Advanced Stronghold Cards2+, independently or together. beginWorm still suppressed native Cunning whenever either component was present. Removing that software guard preserves all existing occurrence/card/source/arrival processing and leaves other module/faction gates unchanged. No new dynamic destination, Great Maker or Tleilaxu revival ruling is inferred.

The regression fails before and passes after the guard removal. Its genuine setup and first-turn progression establish original Tech and Stronghold owners; only conserved deck/card order and two reserve counters are staged at the actual turn-two Spice Blow. It checks the public opportunity in a paired no-card state, one physical card spend, exact remote movement, original wallet/reserves and component custody, and rejection of a retired ride event.

TypeScript/lint and 41/41 affected cases pass. Nine isolated runtime scenarios cover Basic Tech, Advanced Tech, Advanced Strongholds and both, all four legal AI profiles, and printed Karama cancellation retaining the remote source. At 390px, real GameTable shows Spend Fremen Cunning, then the original typed desert/destination controls. Two Wind Pass14 counters reach Polar Sink0 while reserves8/spice3 and original component custody remain unchanged; no horizontal overflow. A labelled QA button runs the existing post-Nexus continuation policy between the production spend and ride controls. Completed local notices were dismissed explicitly; no production save, room or credential was used.

Temporary scripts/server/tab were removed or closed. This is local changed-path proof, not full games, all optional combinations, recovery or deployed acceptance. Contracts: native Cunning, original component composition.

11 October 2026 — Semuta before original Bene Gesserit Intrusion

Final Ornithopter movement already commits forces, counters and a typed discard-before-arrival frame. Its Semuta admission still excluded every roster with Bene Gesserit. That software limit is removed without changing the arrival suffix: claim or all-seat decline precedes the original native Intrusion once. Basic retains no Advanced Intrusion; Ecaz/Moritani and overlap guards remain. This is the existing ordering composition, not a publisher priority ruling.

The regression fails before the admission change. The repaired test checks fighters remain fighters during the Semuta pause, then become zero fighters after the original optional flip while the two physical counters remain. An initial assertion incorrectly expected the advisor marker to be a boolean; it was deleted rather than re-pinning its object representation. Final 113/113 affected cases pass. TypeScript and lint pass.

Ten isolated CLI scenarios cover Basic/Advanced claim/pass, Intrusion decline, final two-group completion and four legal bots. Real GameTable at 390px, using the installed production Vinext image adapter, proves Commit recovering the physical Ornithopter, the original Become advisors control and Finish shipment & movement advancing Atreides→Richese. Atreides retains Imperial Basin2/Arrakeen1 and BG retains its original two counters as advisors. No horizontal overflow. The observed stale Semuta availability tooltip is corrected to describe the connected private Black Market replacement, native Intrusion and approved full-hand exchange.

The fixture uses real setup/engine/table with conserved staged forces and no saved store. Temporary scripts/services/tabs were removed or closed. This is local changed-path proof, not deployed, full-module, asset or recovery acceptance. Contracts: Semuta, Ornithopter.

11 October 2026 — Semuta before Black Market allied replacement draw

The native Black Market purchase already offers Ixian allied replacement and has a typed discard-before-draw continuation. Its Semuta admission still limited that receipt to normal auctions. The connected path now admits the original Black Market sale without replaying payment or delivery. Every seat gets the neutral offer; the discarded face remains private until a committed holder claims it. Claim or all-seat decline draws one native replacement, credits the original seller once, marks the original sale and restores Declaration. The printed cache-purchase exclusion is unchanged; no cache replacement was implemented or inferred from the broader Semuta effect.

The permanent regression fails before the admission change and passes after, covering draw suspension, private candidates, claim/decline, buyer/seller spice, exact card custody and rejection of a retired event. Types/lint and 63 cases in the affected Semuta/Richese union pass. Twelve isolated CLI scenarios cover three Black Market methods × claim/pass, all four legal AI profiles, claiming before an empty-deck refill and an eligible full-hand Semuta exchange. The full-hand Ixian is correctly excluded from bidding and may still claim its ally's fresh discard afterward.

At 390px, the real SemutaReaction component initially shows the owner Commit button and only neutral Continue for the uncommitted ally. Actual Commit recovers Hajr, completes buyer hand 0→1 and restores richeseDeclaration, with no horizontal overflow. The isolated fixture uses the real engine and no store. Temporary scripts, server and browser tab were removed/closed. This is local changed-path proof, not complete Semuta, combined-mode or deployed acceptance. The current contracts are source/runtime and discard continuations.

11 October 2026 — approved normal Mentat and Emperor gift classification

The user approved normal Mentat's uniform private card-show step in the existing Leader Skills development envelope. mentatQuestionModeSupported now follows the ordinary supported profile; new battles receive the existing question version without a separate global flag. The flag, profile exclusions, CLI option and fixture opt-in are removed. Previously opened unversioned battles remain unversioned. Matching and sole-card hands still require the private target show; the empty-hand skip and Moritani's independent uniform-Continue question are not resolved by this approval. Public faction/mode gates remain closed.

The user also ruled Emperor gifts are not payments for Bureaucrat. The existing gift implementation already excludes them; no production gift behavior changed. The regression verifies a 7-spice gift remains private to Emperor/ally, does not offer or consume Bureaucrat, and a later 5-spice bribe still offers the skill. Other qualifying payment behavior is unchanged.

Evidence:

• npm run check:quick passes. The affected 20-file test union passes 217/217; leader-skills-recovery.test.ts plus moritani-skills-modules-runtime.test.ts pass 11/11.
• Nine throwaway engine scenarios pass: Basic/Advanced matching and fallback, all four legal AI participants, and gift/bribe continuation.
• Real production controls at 390px show the normal question, compulsory exact match show and private owner history; the observer sees no receipt and the target's two-card hand is unchanged.
• Actual CLI help advertises normal activation. --mentat-question rejects as an unknown option with exit 1 before accessing any game store.

Temporary smoke scripts/services were removed. Existing games and stores were not targeted. This is changed-path proof, not deployed or complete-mode acceptance. Source and decisions: Mentat, Bureaucrat, rulings.

9 October 2026 — owned native HMS Sandmaster pile allocation

Both native Storm relocation and Advanced special Karama carry optional explicit sandmasterPiles. The common quote supplies one positive key per entered territory; controls allow a different sector or bonus decline, without declining native collection. Invalid/undeclared ambiguity rejects before cost. The original entered-territory eligibility and skill-before- faction order come from the 7 October ruling; owner allocation is provisional.

Selected keys persist through the ordinary Karama window, special intent and action reconstruction. Older queued moves retain their original single- pile behavior. Native geography, ordinary transport allowances and faction collection caps stay unchanged. The UI preview simulates skill debits before faction collection and depletion on repeated route sectors.

Basic/Advanced native smoke: six passengers, traversed Arsunt11=12 and Arsunt12=5. Selecting11 earns12; selecting12 earns13 and leaves0/4. Cancellation leaves pointer/piles/balance unchanged. JSON continues the selected pending route. All four policies emit legal selected routes. A labelled phase-five special-Karama seam moves/collects once, spends the physical card once and preserves ordinary shipment/movement. At390px, production controls show12→13, exercise bonus decline/reselection and commit the same0/4 piles with spice10→23 after native allowance.

check:quick, 15 movement/control and 92 shared mobile/special/Kull cases pass. No full suite, new recovery campaign or deployment was run. Temporary scripts and the dedicated in-memory QA service were removed.

9 October 2026 — owned worm and physical Ambassador destination piles

The shared destination quote exposes all legal positive piles and an exact selection. Native worm and physical Fremen Ambassador declarations add sandmasterPile when collecting; ambiguity requires a supplied key. Single-pile boolean declarations remain valid. One ride/relocation earns only one spice, regardless of forces or piles, before arrival reactions. Owner allocation is visibly provisional, not publisher adjudication.

The actual UI selectors reset stale destination selection, retain optional opt-out and show before/after quantities. Existing native/profile, same-territory and concealed-marker guards stay. Stored Ambassador movement reconstructs its exact frozen key through the original receipt.

Basic/Advanced native smoke chooses Pasty Mesa6 (3→2), preserves Mesa5 at2, lands four forces in Mesa5 and credits5→6 without changing normal movement. Physical Ambassador smoke chooses South Mesa5 (2→1), preserves Mesa4 at4, lands two forces in Mesa4 and credits20→21 with moved0/shippedfalse. All four existing policies retain legal continuation and send explicit keys when they choose collection; optional destination strategy is unchanged. Isolated 390px production controls reproduce both results, including Ambassador destination reset and opt-out/reselection. No existing game store or deployed acceptance is claimed.

check:quick passes; 91 affected native, quote, control, bot, cancellation and movement cases pass. The selected-pile Intrusion/JSON cases settle once. A duplicate control case that enabled an undealt card variant was removed; existing valid profile guards remain covered. Temporary scripts and the dedicated service were removed. No broad recovery/HTTP campaign or deployment.

9 October 2026 — owned Sandmaster ground-movement pile selection

The shared ground quote now groups all positive pile keys by entered territory. The owner can select either sector or decline collection; authoritative validation rejects two selected piles from one territory before any physical movement or spice transfer. Human and minimal legal AI defaults select at most one per group. The obsolete singleton helper is removed; native HMS retains its separate unambiguous-pile scope. Worm and physical Ambassador destination controls are unchanged.

Basic and Advanced runtime smokes choose South Mesa5 rather than4, leave sector4's four spice untouched, collect one there and one in Cielago East, and move three forces. Personal spice10→12; South Mesa5 ends1 and Cielago East3 ends3. All four profiles emit legal collected-route candidates. Chromium at390px exercises switching, full-territory opt-out and reselection, then observes the same engine result with document width390/no overflow. This is isolated production-component/engine proof, not deployed acceptance. Owner allocation is visibly provisional; no publication gate is opened.

Frozen verification: check:quick and all 21 affected movement, control and worm cases pass. Incidental HTML-attribute-order/default-action pins were removed rather than re-pinned; the retained control regressions exercise actual force movement, spice debit and unavailable-seat/profile boundaries. Temporary UI scripts/service were removed. No broad suite, recovery campaign or deployment was run.

9 October 2026 — built npm runtime uses the proxy-free adapter

npm start still invoked Wrangler despite the container's existing direct Miniflare runtime and the recorded dev-proxy disconnect. It now runs deploy/serve.mjs; the default local path remains .wrangler/state, while the container entrypoint exports its existing /data default explicitly. No application authorization, automatic HTTP retry or migration changes. The upstream proxy report and earlier literal “worker restarted mid-request” witness explain the local tooling distinction; this is not an upstream SDK repair.

Official Node22.23.3 archive SHA-256 matches the published checksum and its extracted executable. The actual build, npm start, throwaway HTTP program and same-executable test subprocesses use that Node22. Eleven HTTP probes return the expected 200/400/403/413/201/200/409 plus four 400 responses at five-second cadence, without retry. Four original normal-room, Advanced-lobby and denied-admin boundary cases pass. The new QA room QZD2XV8L and integration records are only in /tmp/dune-built-runtime-20261009-T1OPGq; existing stores were not targeted. Types/lint and sh -n pass. Build retains its existing chunk-size warning.

The historical paired failure is separate: API metadata confirms CI37208188809/job111453717886 failed isolated step7 and skipped publication; public annotations contain only exit1 and its log endpoint returns403. gh and Docker are unavailable here. API metadata confirms the later CI37211854749/job111464477749 success, but neither that result nor current proxy-free passes identify the former failing request/cause. Diagnosis and dependent repair remain blocked without authorized logs or a reproducer. No complete HTTP/Docker/deployed acceptance is claimed.

9 October 2026 — owned multi-pile Smuggler and Sandmaster choices

The multi-pile guards now have working choices in supported Basic/Advanced skill profiles. Smuggler retains a signed reveal-time aggregate and exact per-pile capacities. Only a surviving partial collection needs an owned allocation; death, all/none and a single pile remain automatic. Sandmaster then offers the winner one existing positive pile for +3, with no new pile or direct faction income. The sector-selection policies are explicitly provisional, not publisher adjudications.

The final-outcome gateway waits for both choices before physical settlement, then retains existing retreat, casualties, card cleanup and later effects. Malformed/foreign choices and stale replays reject; JSON preserves the event and signed allocation. Modified Smuggler strength, unrelated module guards and public starts remain unchanged.

Actual-engine smoke runs in both modes: collect six as 2/4 from original 4/5 piles, select sector 15 for +3, leave piles 2/4 and credit the collector 20→26 once. All four profiles finish the path through legal owned actions. A standalone Sandmaster selects 9→12 in sector 15 without changing sector 14 or personal spice. Seven focused allocation/transition cases pass. Chromium at 390px used both production components, actual styles and the real engine in isolated in-memory QA; it produced the same final values. No existing room or deployed acceptance result is claimed.

Frozen checks: check:quick passes and 52 affected receipt, battle, control, retreat and cancellation cases pass. No full suite, HTTP/recovery campaign, whole-database comparison or deployment was run. Temporary QA scripts and the dedicated in-memory service were removed.

9 October 2026 — two Occupy failures isolated to test contracts and staging

Deterministic seed 8 reproduces the recorded missing-immediate-plan failure. The bot actually offers a legal Ecaz special Karama action; Easy, Medium, Hard and Brutal each then seal the selected lead's plan on their next action. The actual captured engine smoke consumes Karama once and submits the plan. No bot or rule behavior changed.

The regression now pins entropy and follows actual first-policy actions to a sealed plan for both leads and active/canceled Occupy instead of requiring the first action list to contain a plan. That case passes.

Deterministic seed 62 also reproduces the Harass ally/explosion failure: when Lasgun must come from another hand, fixture staging gives that donor the actor's sole held Harass, then tries to seal the now-unavailable defense. The engine correctly rejects it. The staging helper now funds a donor replacement from the original deck when the recipient has room, retaining its earlier selected physical cards. Full hands keep the existing exchange. The real repaired scenario returns two forces before the explosion, discards Harass once and reaches Collection. Its deterministic regression passes. Neither repair changes production engine or bot behavior.

Frozen verification: check:quick passes and all 270 cases in the nine affected Occupy, Stronghold and native-tech files pass. No full offline suite, HTTP campaign, database audit or deployment was run.

9 October 2026 — provisional Kulon/Ornithopter coexistence

Active Kulon no longer blocks either mode of the Richese movement card. The labeled prototype keeps the fixed three-territory cap and applies Kulon to both normal-range groups. The source distinction and remaining Hajr/advisor boundaries are in the movement contract.

check:quick passes; 39 affected engine, bot and discard-continuation cases pass. A throwaway runtime script plays actual Kulon, moves with the card, rejects four territories, finishes both extended normal groups after JSON, and executes fixed-card candidates from all four profiles in both modes. An isolated Chromium surface mounts the production control and commits the three-territory move through the real engine, leaving three forces in Red Chasm and two in Imperial Basin with Kulon/Ornithopter in discard. This is not full-table/deployed acceptance. QA scaffolds were removed.

9 October 2026 — gated captures resumed under the Basic occupation and odd-force Occupy prototypes

The 14 captures that remained gated on 7 October were resumed in place with tools/faction-games.ts --resume against the same preserved positions (same seed, custody and turn; no reset, no re-run from scratch and no guard weakened). Results are in /tmp/dune-resume-wave2-20261009 (logs beside each output directory).

Now completing. Two of the three previously blocking questions no longer block:

• Southern Hemisphere occupied-benefit lifecycle. The visibly provisional Basic current-sole policy replaces the pending competing-occupier / native-repopulation block, so every previously stalled homeworld-occupation-*-basic capture now finishes: homeworld-occupation-atreides-4-basic (a second copy finishes in 6 actions and 5 actions from its two saved copies), atreides-5-basic (413 actions), ixians-6-basic (688 actions) and moritani-6-basic (11 actions), each reaching turn 3–10 phase 8.
• Odd-force Basic Ecaz Occupy casualty rounding. The provisional main-print ceil(E/2) contribution/loss with floor survivors admits the declaration, so the previously stalled Basic Occupy captures now finish: e3-discovery-nexus-ecaz-…-6-basic (135 actions), e3-homeworld-nexus-skills-tech-ecaz-…-6-basic (648 actions), paired-e3-nexus-ecaz-…-6-basic (489 actions), paired-e3-homeworld-nexus-ecaz-…-6-basic (424 actions) and paired-e3-homeworld-nexus-skills-ecaz-…-6-basic (176 actions).

Still gated, unchanged. Four Advanced captures still stop at phase 4 on Revival deployment when this return first reaches the high Homeworld threshold awaits a timing ruling (e3-homeworld-nexus-discovery-… seed 20274745, e3-homeworld-nexus-discovery-skills-stronghold-tech-…, mixed-homeworld-nexus-discovery-skills-… seed 20281145 and mixed-homeworld-nexus-discovery-skills-stronghold-…), and one Basic native-homeworld-skills-ecaz-… capture stops at phase 6 with Combined Occupy requires source-selected native factions; optional overlays remain gated. — an explicitly gated optional-overlay composition rather than a defect. No capture was reset, force-completed or bypassed.

Later the same day — the threshold-deployment question resolved provisionally

The provisional resulting-population policy recorded in Homeworld benefits was then applied, and the four Advanced captures above were resumed again into /tmp/dune-resume-wave3-20261009: all 16 saved copies now complete (e3-homeworld-nexus-discovery-ecaz-moritani-… 78 actions, e3-homeworld-nexus-discovery-skills-stronghold-tech-… 68, mixed-homeworld-nexus-discovery-skills-ix-choam-ixians-richese-… 932 and mixed-homeworld-nexus-discovery-skills-stronghold-ix-choam-ixians-richese-… 133; each reaching turn 6–10 phase 8) with zero rejected actions.

That leaves one previously gated capture, the Basic native-homeworld-skills-ecaz-… sample, which still stops on the explicitly gated combined-Occupy optional-overlay composition rather than on a rules question.

7 October 2026 — preserved captures resumed under the five rulings

Every preserved failed-*.json capture under /tmp/dune-*/ (123 distinct files) was resumed in place with tools/faction-games.ts --resume — the same saved position, seed and physical custody, no reset and no re-run from scratch. 102 of the 116 that produced a report now complete (seven runs collided on duplicate basenames and were re-run with unique output directories); 14 remain.

Ruling-by-ruling:

• Low-Tupile CHOAM opening income. All 23 captures that stopped at response: choamCharity now complete, across mixed-homeworld-nexus-*, single-homeworld-nexus-discovery-skills-tech, paired-homeworld-nexus-*, native-homeworld-skills-* and homeworld-occupation-choam-6-basic.
• Richese exhausted/canceled cache. All three captures that stopped at decision: richeseBlackMarket now complete (discovery-stronghold-tech-choam-choam-6-advanced seed 20265033, paired-discovery-nexus-skills-stronghold-... seed 20273010, and the paired E3 discovery variant).
• Occupation profile. Nine of the thirteen preserved homeworld-occupation captures now complete (atreides-5/6-advanced, choam-2/5/6, ecaz-6-advanced, ixians-5/6-advanced, moritani-6-advanced).
• Suk / Kwisatz, Guild Secret Ally return and Sandmaster relocation changed no capture outcome; their focused regressions cover the changed paths.

The 14 remaining captures are gated on three other unresolved questions, not on the five implemented rulings:

Guard	Captures	Recorded question
Southern Hemisphere occupied benefits await the pending competing-occupier/native-repopulation ruling	7 battleCards/phase-6 and 2 phase-7 stalls	Occupation lifecycle
Revival deployment when this return first reaches the high Homeworld threshold awaits a timing ruling	4 emperorRevival stalls	Homeworld revival timing
Odd-force Basic Occupy awaits the preserved publisher casualty-rounding ruling	3 phase-6 stalls	Basic Occupy boundary

No capture was reset, force-completed or bypassed, and no guard was weakened. The resumed runs are saved-position continuations, not fresh re-runs.

Fresh combined-homeworld-nexus run and the Auditor custody fix

A fresh --profile combined-homeworld-nexus --rules both --players all run exposed a harness gap rather than a product defect: tools/sample-custody.ts built its expected Traitor deck from the printed leaders only, while Advanced CHOAM adds its printed extra Auditor disc during setup, so every fresh Advanced all-expansion sample failed at setup with physical traitor custody. The expectation now includes the Auditor for Advanced CHOAM seats.

With that fixed the fresh run completes 2/4 (both Advanced: 6-seat winner ixians, 5-seat winner ecaz + ixians). The two Basic samples stop at phase 6 on Odd-force Basic Occupy awaits the preserved publisher casualty-rounding ruling — the same third-party question listed above, not the implemented rulings. tests/sample-custody.test.ts (11 cases) still passes.

7 October 2026 — five pending user rulings implemented

The user resolved five recorded rule questions; each is indexed in RULE_DECISIONS.md#user-rulings--7-october-2026 and implemented with a focused regression:

• CHOAM low-population opening income. CHOAM's phase-opening income now counts as a qualifying collection, so a low-population native Homeworld adds its bank increment under the same Inflation multiplier as ordinary charity. The previous requireRule guard is removed; the projection and the CHOAM income notice expose the added bonus. tests/homeworld-charity-engine.test.ts compares low and non-low Tupile with and without Inflation.
• Richese exhausted/canceled cache. requireRicheseDeclarationCache now rejects only a malformed or negative count, and an exhausted cache runs the ordinary pool at its full declared count. A canceled/prevented compulsory cache auction sets cacheCanceled, restores one ordinary lot and runs the pool; the cache offer is skipped whenever no cache lot can run, and the pure continuation quote mirrors that. tests/richese-settlement-preflight.test.ts asserts the one-lot restoration, and tests/nexus-richese-betrayal-engine.test.ts asserts an exhausted-cache Black Market sale now completes.
• Suk Graduate / Kwisatz Haderach. Rescued counters count toward Advanced Atreides' seven battle losses: the battle-loss counter gains the full dialed casualty allocation in both the ordinary and Homeworld rescue paths, and the earlier Suk availability restriction (assignment block, battle preflight and unavailableSkills projection) is removed. tests/suk-graduate.test.ts and tests/advanced-native-skills.test.ts cover assignment and loss counting.
• Guild Secret Ally Homeworld reserve return. The reserve-return grant now overrides the Arrakis-to-native-Homeworld restriction for the holder's own reserves. The return deposits through the shared native-reserve pipeline (addNativeReserves/quoteNativeReserveDeposit, generalized from the revival deposit), so Homeworld custody stays conserved. tests/nexus-guild-secret-ally-engine.test.ts returns a staged Emperor group with Homeworld custody and tests/nexus-guild-secret-ally-controls.test.ts updates the route expectation.
• Sandmaster / native HMS relocation. Interior passengers count as entering the territories the stronghold points into, so the Sandmaster skill collects one spice per entered territory with an unambiguous pile before the faction's own traversed-sector collection. tests/sandmaster-movement.test.ts compares an identical relocation with and without the assigned skill.

The related union passes; types and lint are green. Preserved combined Homeworld/Nexus, occupation-profile and Richese captures are now unblocked but have not been re-run here.

7 October 2026 — distinct Mentat replacement and reproducible suites

replaceMoritaniAssassinationTraitors now draws the first distinct physical Traitor Card from the reserve instead of the reserve's first entry, because the face-up set-aside card can still sit in that list: re-drawing it produced a receipt whose replacement equalled the revealed card, which the assassination integrity check rejects mid-Mentat. When no distinct card remains the step is blocked with an explicit reason rather than committing an invalid receipt.

Four genuine tests were also made reproducible after measuring their real failure rates; a suite that fails for random reasons cannot act as a checkpoint gate:

• discovery-native-typed-runtime (~15–25%): the chosen Discovery Spice Blow card now has every other card for the same territory removed from the deck, so one blow deposits the printed amount instead of stacking a second deposit. Measured 0/20 after the change.
• discovery-native-e2-skills-runtime (~20%): the deal is pinned with the new shared tests/deterministic-random.ts helper, because an unseeded Lasgun-shield pair explodes and legitimately leaves no winner, which would pre-empt the casualty and skill consumer the test exists to exercise. Measured 0/12 after the change.
• ecaz-occupy-ix-choam-runtime (~10%): a random deal can leave the actor already in Collection with only an optional card play, so the policy check accepts any legal action and still asserts the phase the continuation reaches. Measured 0/30 after the change.
• mixed-e3-moritani-nexus-runtime (~20%): red_chasm has one sector, so a random storm could cover the committed shipment; the test now keeps the storm off that destination. Measured 0/25 after the change.

No product behaviour changed for the three test-only repairs. Full offline suite, typecheck and lint are green at this checkpoint.

7 October 2026 — operations report the database size

The owner aggregate sample now also reports the SQLite database size and page count, read through PRAGMA page_count/PRAGMA page_size in the same authority-checked batch as the lifecycle counters, with non-numeric or negative values clamped to zero. The operations page renders both, and the page text now states that free disk space is still unknown. Evidence: tests/admin-operations.test.ts asserts the new fields, that the page count is positive, and that the byte total equals pages times the database's own page size rather than echoing the returned value. No game, seat, saved state or deployment changes.

7 October 2026 — administrator failed-attempt history

Rejected administrator authentication and authorization attempts are now recorded durably in a new additive admin_attempts table with a fixed reason (invalid_key_format, unknown_or_disabled_key, missing_session, unknown_or_expired_session, role_denied), the attempt kind, the attempted role and an already-known account id. No key, key hash, session token, session hash, request body, origin, address or user agent is stored, and the unknown/disabled distinction is deliberately collapsed so the lookup cannot become an account-enumeration oracle.

GET /api/admin/operations?attempts=1 returns seven-day per-reason counters plus the twenty most recent attempts, newest first, to a live owner only, with no-store and the same query guard as the other reads. The operations page adds List failed attempts with the counters and the bounded sample, truncating each account id to eight characters. Recording is best-effort inside the rejection path, so a rejected request keeps its own answer even when the table is unavailable; the history never locks out, disables or revokes anything by itself.

Evidence: tests/admin-attempts.test.ts asserts every recorded reason, the kind/role/account fields, that successful sign-ins and privileged reads record nothing, that no credential text appears anywhere in the page, the reporting window, the twenty-row bound and owner-only recheck after demotion, and that a dropped attempts table leaves the original rejection answer unchanged. The anonymous HTTP boundary also denies ?attempts=1. The shared AdminError moved to db/admin-error.ts so the recorder and the access module no longer form a value-import cycle. No game, seat, saved state or deployment changes.

7 October 2026 — Sneak Attack composes the Bene Gesserit arrival reactions

A positive Moritani Sneak Attack now resolves its committed Terror entry first — placing the reserve forces and accruing the Heighliners token — and then offers the Bene Gesserit reactions the same adopted shipment classification already uses for ordinary off-planet arrivals: an eligible Advanced Intrusion choice when Bene Gesserit fighters stand in the destination, carrying the free spiritual-advisor follow-up, and the advisor shipment itself when the intrusion is declined, with its existing territory, storm and occupancy validation. A zero-force resolution still opens none of them.

This selected order is an implementation interpretation, not a located ruling; it is recorded in the source note and the pending-interpretation registry, and the last Sneak Attack combined with Bene Gesserit arrival reactions guard is removed rather than left as a duplicate check.

Evidence: tests/moritani-force-leader.test.ts asserts the post-entry Intrusion offer and the full decline → advisor decision → placement chain with nothing left pending; the former gated-interaction pin was replaced by the composed behaviour. docs/COMPONENT_INVENTORY.md, the source note, the registry and the status paragraph record the reduced boundary. No game, seat, saved state or deployment changes.

7 October 2026 — Sneak Attack adopts the shipment classification for Heighliners

A positive Moritani Sneak Attack in Shipment and Movement now accrues the Heighliners token once for its owner through the same techIncome helper as an ordinary off-planet arrival. The token still enforces its working phase, its printed Guild exception and one accrual per turn, and a zero-force resolution accrues nothing; the previous phase-5 guard is removed rather than duplicated.

This is an explicitly adopted implementation interpretation, not a retrieved publisher ruling: the printed verb is “Send”, and classifying the expressly off-planet reserve transfer as a shipment is the supported reading already recorded in the source note. The Bene Gesserit spiritual-advisor accompaniment and Intrusion rows remain gated because their ordering inherits the unresolved arrival-timing boundary, and a Spice Blow worm-ride Sneak Attack stays outside the token's working phase.

Evidence: tests/moritani-force-leader.test.ts asserts the accrual, the once-per-turn guard, the unchanged zero-force resolution and the altered-sector rejection; the former "unsupported technology classification" pin was replaced by the adopted behaviour rather than re-pinned. docs/COMPONENT_INVENTORY.md, the source note and the pending-interpretation registry record the reduced boundary. No game, seat, saved state or deployment changes.

7 October 2026 — Tleilaxu Ambassador force return wired

The last unimplemented Ambassador effect is now reachable. A placed Tleilaxu token gives its beneficiary — the Ecaz owner or its ally — a private ecazAmbassador decision at stage revival: one to four physical counters return from the Tanks to reserves at zero cost, quoted by the existing game/tleilaxu-ambassador-forces.ts, which also enforces the shared Fedaykin/Sardaukar one-per-turn counter and keeps Ixian cyborgs uncapped. The player view projects the maximum, Tanks and elite inventory and current elite usage to the beneficiary only; the entry control offers a per-count button and an explicit "Return no forces" decline; all four AI profiles choose a legal return from the decision owner's own view or decline when the Tanks are empty.

Kept gated exactly as recorded: the printed leader alternative (leaderAlternative: false), ordinary force/free/leader allowance accounting around this independent grant, dead-twice eligibility, and Tleilaxu free-income repeat scope. No ordinary revival allowance, price, phase or income path changes; the Tleilaxu special Karama keeps its FAQ-resolved Revival-only timing.

Evidence: tests/tleilaxu-ambassador-engine.test.ts drives a genuine arrival into a placed token and asserts the beneficiary-only projection, the typed return with unchanged spice, the shared elite limit, malformed/over-maximum rejection with immutability, the ordinary-only return and the decline path. The four-profile tests/ecaz-entry-bots.test.ts loop now covers tleilaxu, and its former unsupported-effect pin was replaced by the supported offer/decline expectation rather than re-pinned. No game, seat, saved state, deployment, public start or played-save conversion changes.

7 October 2026 — administrator stalled-decision diagnosis

The owner-only operations page gains List stalled decisions: a bounded, read-only sample of at most ten live rooms whose public pending interaction — decision, response, truthtrance or phaseOpening — has been idle longest, reported as room code, idle duration, interaction kind, turn and phase. The aggregate sample adds stalledRooms and oldestStalledChange for the same predicate. GET /api/admin/operations?stalled=1 repeats live owner authority, answers no-store, rejects any other query combination with 400 and stays read-only: it repairs nothing and pause/close/remove/archive keep their own audited controls.

Paused, closed, removed and archived rooms are excluded, as are unreadable JSON states and non-playing rooms. Only public coordination facts are selected — no hands, orders, private decisions, seat credentials or raw saved state — and the sample is bounded to ten rows, oldest first. A stall is inferred from the room write time, so a slow human turn also counts; the sample does not diagnose why a decision is stuck, disk capacity or backup recoverability.

Owner-only unit coverage asserts the counters, the oldest stalled write, the bounded oldest-first order, every exclusion boundary, idle arithmetic, the absence of private content and the owner recheck after demotion. The anonymous HTTP boundary now also denies ?stalled=1; the full HTTP integration suite passes 55/55 against a local build of this revision. No game, seat, saved state, deployment, public start or played-save conversion changes.

7 October 2026 — mixed E3 programme evidence and the deferred Terror entry

The withdrawn mixed E3 programme pairs are green: Moritani9/9 and Ecaz14/14 (stable across 20 consecutive full-file runs). The recorded resume constraints became real fixture repairs, not re-pinned assertions: Moritani starts in an unoccupied printed stronghold, a pending Leader-Skill posture is concealed before both plans are submitted, a normal Traitor call requires the card that matches the opponent's plan leader, the winner's automatic casualty is not an assassination effect, the public history never carries the private Mentat replacement, and the Moritani Terror/Cunning window uses its own real shipment. Two restored consumer omissions were corrected against the engine: the Discovery entry asserts the token's actual random face and conserved counters, and the Suk rescue asserts the winner's own dialed casualties with the loser never rescued.

New engine behavior. Game.pendingArrivalReaction queues a committed Terror entry whose arrival also opened its own interaction — Guild income, a Bene Gesserit fighter Intrusion or advisor choice, or Fremen storm protection — and settleAutomaticContinuations opens the oldest queued entry once nothing is pending. Payment, force transfer and the original movement never replay; a Terror entry already in flight and every Ambassador combination still reject. The selected order is a provisional implementation interpretation, not a publisher priority ruling.

Former limitation pins now assert the accepted, deferred outcome and drive it to completion instead of the removed rejection: bot-arrival, ambassador-terror-overlap-worm, moritani-entry, both Richese No-Field files, homeworld-grumman-engine, karama-movement-preflight and ornithopter-discard-continuations.

Pre-existing failures inherited at 45e6084 were repaired against current engine behavior rather than re-pinned: the stale Discovery module gates in both native skills integrations, the Ix prototype and Ix skills gates, the advanced Moritani skill boundary, the expansion-faction prototype and recovery gates, and the Richese Nexus betrayal sale-credit expectation (the authorized Advanced source sends Richese's own contribution to the Emperor, or the Bank with no Emperor seated). One incidental gate message ("excludes other optional modules") and one flaky Collection-readiness assertion in the Ecaz Homeworld victory runtime were also corrected; the flake reproduced at HEAD.

Offline suite 7,793/7,793 with typecheck and lint clean at this checkpoint; no game, seat, saved-state, deployment, public-start or played-save conversion is claimed.

7 October 2026 — Mixed E1/E2 and paired E3 Nexus

Original both-family Ix+CHOAM/union47 or both Ecaz+Moritani/ecaz33 with classics preserves all12 Nexus, optional all14/HW/Discovery7/8/Tech3+/ Advanced Strongholds2+ through existing initializers and consumers. 312 original fresh admissions reach setup versus four before. New31 physical programmes plus two Loyalty-stock regressions and the final489/489 affected checks across42 files pass with types/lint/build. Native Ecaz assassination, omitted separate Loyalty stock and exact paired overlap admission repair actual captured consumer gaps. Obsolete old mixed/paired rejection rows are removed, not re-pinned.

All64 original six-seat families finish258/288 with338,931accepted/ 339,426attempted/9,013JSON across three frozen trees and original-prefix continuations. All receipts and30 retained source-guard traces are read. Actual390px original native offers/training, Maker/both piles/card draws, paid typed native/visitor transport, free Suboid plan and separate living Duke preserve20 physical counters in3AVHJN76v765/PSDLV4FJv121. Human Ixian loses: no winner-only rescue or unobserved nested entry claimed. Canonical source and runtime qualifications. Final489/489 union, bundle and actual390px guide pass. Exact pushed 05ab2c92b0 build/owned cutover shows full SHA markers, original765/121 native pools/Duke and exact guide390. Terminal run37565696416/job112612773421 completes success: isolated7 ends03:17:43Z before publication9 starts03:17:44Z,7 October2026; the full final record is read. Complete rules, protected deployment and deferred assurance remain open.

7 October 2026 — Single-native E1/E2 Nexus

Original one-native Ixians OR Tleilaxu/Ix47, or CHOAM OR Richese/CHOAM35 plus native cache, composes Nexus with or without Skills and optional Homeworlds/Discovery/Tech3+/Advanced Strongholds2+. Existing original initializers and source-local consumers remain; paired predicates still require both natives.192 admissions reach setup versus eight before. New15 programmes/affected398 across35 files and types/lint pass. All32 original six-seat families yield190/192 completed208,205accepted/ 208,213attempted/5,539JSON across two frozen trees: one real shared ordinary-skill omission is repaired and its original Smuggler capture finishes40/40/one JSON; two printed ruling guards remain preserved. The obsolete solo-Ix rejection is deleted, not re-pinned. New physical Smuggler5 plus ordinary Collection1 pays one six-spice pile exactly once. Actual original390px Ixian offer/training/typed entry/Cunning/free support/ equal nested Cyborg substitution and no-training Richese one-spice5+3/ concealed reveal preserve20 counters in4CR7JHULv160/LNHZXDEEv102. Canonical source/game/human qualifications. Final types/lint/build and actual compiled390px guide pass; only the owned QA worker reloads, retainingv160/v102 and physical pools. Exact pushed 30a0bdbbb6 build/owned cutover shows both full SHA markers and the compiled guide; its terminal container job 112576050305/run37554058440 succeeds isolated7 before publication9. Canonical evidence records the source-qualified receipt; no full-mode, protected deployment or comprehensive-assurance claim.

6 October 2026 — Standalone E3 Nexus without Skills

Original Ecaz OR Moritani/classic ecaz33/all12 Nexus now composes optional Homeworld/Discovery/Tech3+/Advanced Strongholds2+ without training, through the generic existing initializer and original native aftermath.48 original admissions reject before and reach real Traitors afterward. Ecaz's legal no-Skills Harkonnen roster does not lift its separate Cunning exclusion; Advanced Moritani/Harkonnen, mixed families and pending effects stay gated.

New15 semantic cases and affected372/372 across32 files, types/lint/build pass. Actual continuation, foreign-Homeworld no-Traitor rule, Grumman decline, sole-token automatic transfer and separate ordinary Collection correct fixture assumptions without suppressing game rules. Old no-Nexus native Discovery assassination retains its physical regression with conserved ordinary unplayed land ordering; private view-copy pins are removed.

Sixteen runner families preserve seeds/bands12600–14100. Eight new trace name collisions are repaired by the original faction/roster name branch; partial artifacts are preserved. Original unaffected24 gives23 completions; only interrupted24 is rerun at original seeds and gives23 completions. Combined46/48 across two frozen trees completes44,796/45,084 actions/ 1,189JSON, not one uninterrupted certificate. Two source guards remain.

Original human390px W6SCKGAAv114 plays actual supply-only Cunning then reveals Assassination on Guild's paid native1 Polar arrival: original Staban dies once, one token/card is consumed, bounty5 credits Mori12→17, Guild 14reserves/Polar1/Tanks0. WFEGQTRUv94 randomly inspects/reveals Cistern, freely enters native2 after real parent payment, finishes Maker/both piles/ alliance/closing draw, pays for native Junction visitor1 and spends Ecaz for the living Duke with unchanged purse7 and original20 counters. Exact source/game/control evidence and limits. Final types/lint/build and compiled no-training Nexus guide/evidence pass at viewport/document390. Owned QA cutover retains originalv114/v94; all tabs close and temporary helpers are removed. Private source/human receipts and partial/ruling artifacts remain. Exact checkpoint receipt follows; no complete-mode or protected-deployment claim.

6 October 2026 — Native Homeworld Nexus optional modules

Original paired E1/E2 skill/Nexus and no-Skills Nexus module/Discovery envelopes, plus standalone Ecaz OR Moritani skill/Nexus, now retain Homeworlds with optional Discovery/Tech/Advanced Strongholds. Original setup/private offers/native custody remain. Richese Cunning uses those existing Homeworld paired profiles; no second initializer or revival adapter, public start, played-save conversion or new ruling is added. Twenty-three native runner profiles preserve older names/seeds and prerequisite/resume dispatch.

New15 meaningful cases; affected307/307 across25 files. Fixture corrections use actual pending CHOAM income, physical rescue returns, leader-death rewards, legal funded declarations/Charity and available untrained leaders after posture closes. A fake-auth-name/copied-hand/staged-army test is deleted, not re-pinned. Across all23 families,59 of68 original six-seat games finish71,137 accepted/71,484 attempted actions with1,894 JSON on one unchanged source tree. Nine preserved captures reach existing rulings: seven CHOAM low-opening income, Basic Ecaz odd-force rounding and an Imperial revival crossing a Homeworld high threshold.

Actual390px original AB7UKV8Kv145 draws native Richese after real Maker/ both-pile/alliance settlement; native5+3 Cistern Cunning pays one spice once: reserves12/Cistern8/Tanks0, wallet4, no concealed marker. Original 8Q2WZQMAv88 chooses its random Warmaster/Sanya offer, pays for one native Wallach visitor, then spends Ecaz Nexus for the living Duke with original training intact and unchanged Cunning purse12. Choice/result screenshots, fresh state and document390 prove these bounded human paths. Final types/lint/build and compiled390px guide pass. An observed old lazy chunk after rebuilding under the owned QA worker clears after its restart; originalv145/v88 states retain their changed-path custody. All tabs close and our temporary TypeScript helpers are removed; private receipts remain. Exact programme/source receipts and retained boundaries. No complete-mode, comprehensive assurance, calibration or protected-deployment claim.

6 October 2026 — Classic Homeworld Nexus optional modules

Original classic Homeworld/Nexus now composes all14 Skills, Discovery7/8 or both with optional Tech3+/Advanced Strongholds2+, and no-Skills/no-Discovery Homeworld/Nexus retains the industry/card modules. Three existing envelopes are amended; original setup, typed native returns and physical consumers remain. Native optional-module families and pending rulings are not opened. Fifteen runner profiles keep stable8800–10200 bands and older names/seeds.

New13 meaningful cases and affected242/242 across20 files, types/lint/build pass. Incidental raw/input/view/default-shape and fake identity assertions are removed rather than re-pinned. An observed zero-sample false pass for unsupported Basic Strongholds is repaired using the existing prerequisite guards; two-seat Tech also rejects before producing a report. Twenty-two original six-seat games across all15 families finish14233/14233 actions with375 JSON continuations on one unchanged source tree.

Actual human390px RCGZK4CFv167 keeps its originally offered Suk, draws Fremen after a real closing Nexus, declares a paid typed invasion and zero rescue, then spends the actual card for2 normal/1 Sardaukar revival: Kaitain14/Salusa5, native reserves19/5, Tanks0/0, original visitor1 and uncharged return wallet6. A3LV8Y3Uv74 randomly reveals Shrine, enters with3 original Imperial counters, votes a genuine Maker majority and rides 2 native Fremen including1 Fedaykin inside, then randomly draws Moritani after both actual Advanced piles and settled alliance. Atreides losses2 do not repeat; original source armies/custody remain. All tabs close; temporary scripts are removed. Exact programme/source receipts and limits. No full-mode, comprehensive assurance, calibration or protected deployment claim.

6 October 2026 — Native Homeworld optional modules

Original supported native E1/E2 and standalone Ecaz OR Moritani/classic Homeworld entries now retain Skills, Discovery or both with optional Tech3+/Advanced Strongholds2+. Existing family decks, native setup and pending rulings remain. Exact Ixian pre-training nullable custody and same-quote residual Cyborg Tanks repair reproduced admission/Suk crashes. Native CHOAM invoices/support, Richese caps/nested invoices, Tleilaxu revival, Ecaz Arrakis Occupy and Moritani skill-first assassination retain original consumers. Twelve native runner families preserve old names/seeds.

New35 cases; affected180/180 across19 files, final repair46/46 and types/lint/build pass. Original six-seat14/19 completions and all12-family Advanced three-seat134/144 initial completions retain exact source trees and ruling captures. Two actual Ambassador bot deadlocks finish from their preserved states after base-board target enumeration is repaired; every difficulty legally advances both captures. Not an uninterrupted144 pass or a final-tree certificate. A genuine Guild cancellation and natural-Storm fixture boundary are repaired with explicit legal programme choices, not altered shipment/storm rules.

Human390px original HTTP/private CLI 4AG8J2ZXv74 chooses its original Ixian starting card/training and typed paid native invasion; TYH3JS3Cv56 chooses native Moritani Suk rescue after a genuine defensive Homeworld win. Original armies, Tanks, skill custody and Collection continuation remain. Both tabs closed; temporary scripts removed. Source-qualified evidence and limits. No full-mode, comprehensive assurance, calibration or protected-deployment claim.

6 October 2026 — Classic Homeworld optional modules

Original classic Homeworld Skills/Discovery families now compose either or both with original Tech3+ and Advanced Strongholds2+, under existing fresh private entries. Original all14/DS7+8 setup, native placement, typed nested/ native/visitor Suk, phase-end industries, source-local held benefits and cleanup before mandatory winner Tech remain; no redundant force/payment model. Ten runner profiles retain stable old bands/names/seeds. Nexus/native Homeworld rosters, unrelated previews and pending specific rulings stay separate.

New cases14/14, affected145/145 across17 files, types/lint/build pass. Fourteen completed original six-seat samples total9008/9008 actions/237 JSON across two unchanged source batches. One internal undefined-property view copy assertion falsely stopped an Advanced original sample; that incidental assertion was deleted, not re-pinned. Its preserved capture finishes19 more actions, and the repaired original sample finishes1129/1129/30. Physical custody, rival-privacy checks and real JSON continuation remain.

Actual human390px XJCJ3H3Wv17 submits trained nested Suk and retains Cistern3normal, reserves17/5, Tanks0, Kaitain11+1/Salusa1+4 and separate Cistern2 income. WM8E7CFGv17 selects Spice Production after real Homeworld cleanup, retaining one actual visitor, empty native home and reserves14/4, Tanks2/0. Both tabs closed; temporary human scripts removed. Exact programme, source hashes, capture and limitations: Homeworld runtime. No full-mode, comprehensive assurance, calibration or deployment certification.

6 October 2026 — Classic Homeworld Skills and Discovery

Private fresh Basic/Advanced two–six unique base-faction profiles now compose Homeworlds with either original all14 Skills or Discovery7/8. Original setup and force placement remain; Skills custody stays nullable until placement. Typed Suk native/visitor/Arrakis rescue, explicit human split-home Emperor returns, minimal legal bot choices and Bureaucrat invoice support are connected. External return placement is an implementation interpretation, not the ordinary-revival ruling. Existing Discovery mechanics are reused.

New cases17/17; affected union94/94 across12 files; types/lint/build pass. Four genuine six-seat games complete2330/2330 actions with61 JSON continuations on two unchanged source trees. Original human rooms 3NM6MS4Tv11 and CLQYLURHv11 actually submit Suk allocation and Cistern entry, respectively; physical native/visitor counters and390px surfaces observed afterward. Exact source hashes, programmes and boundaries are in Homeworld runtime. Other overlays/native rosters, specific pending rulings, public starts, protected deployment and comprehensive certification remain separate.

6 October 2026 — Native trained Skills/Nexus/Discovery

Only the existing paired E1/E2 and standalone E3 skill/Nexus family predicates gained the private Discovery envelope; nativeExpansion/nativeDiscovery and the original initializeLeaderSkillsGameForAudit already route them, so no duplicated setup/legality was added. richeseCunningModeSupported admits selected Discovery only through the exact supported paired-skill profile. Original actors/hands/offers/native components and the mandatory Ecaz coalition plus Moritani assassination/own-revival consumers are inherited unchanged.

Affected205/14files, types/lint and build pass. All eight new six-seat profiles were exercised:23 of24 original samples complete25,751accepted/25,751attempts/ 685JSON across source-bound acc980c0 and b1177766 batches. Trained consumers are physical: E1 Suk rescue before one equal Cyborg Tank substitution then cleanup/Tech/ matching Face Dance; E2 signed one-invoice nested pair with private caps; Ecaz quiet living/unclaimed Duke then owner-labelled mandatory Occupy; Moritani skill-first assassination/printed bounty/one private replacement. One Richese sample (seed20273010) is preserved at turn-10 Bidding with an empty cache under the existing richese-settlement exhausted-cache count guard (1,726accepted/1,727attempts/46JSON); no bypass.

Four new isolated human rooms preserve original CLI setups and offered training (BWHS4DU6 Rihani/Prana/Suk/Smuggler; GRM4XMUH Master of Assassins/Suk/Mentat/ Warmaster; 5JS3SUYY Killer Medic/Smuggler/Bureaucrat+Duke Vidal; VFQCEVFB Sandmaster/Killer Medic/Master of Assassins+Duke Vidal+Atomics). New5600–6300 sample bands use full roster/expansion names, leaving earlier profiles/defaults/ seeds unchanged. Fixture repairs preserve real progression: actual auction purchases, forced-loss-to-Suk ordering, valid native setup flags, coalition targets and trained-leader posture. No protected deployment or complete-mode acceptance is claimed.

Verified 2270c07f97 pushed. CI37387218604/container112023319943 job completes successfully: isolated storage/HTTP7 before verified-image9. Exact build/own worker reload and fresh390px screenshots retain the four native rooms and full 2270c07 marker at document width390 without overflow; owned tabs closed. No protected NAS/operator/provider approval or live acceptance.

6 October 2026 — Classic Skills/Nexus and paired native Nexus Discovery

Fresh original classic base33/all14/all12 and separate paired E1/E2 no-Skills 47/35/cache setups compose Discovery7/8, Basic/Advanced2–6, optional unused Tech3+/Advanced Strongholds2+. Exact existing family predicates, original constructors, actors/offers/starting hands and native setup remain. Source-clear revival quotas, training, typed aftermath and held effects stay shared. Richese Cunning keeps its signed one-tariff pair and current revealed destination. At this earlier checkpoint native combined Skills/Nexus/Discovery stayed gated; the newer trained checkpoint above supersedes that boundary. Other overlays, public starts, conversion and unresolved rulings remain gated.

Affected169/14files, types/lint and build pass. Genuine original eighteen six-seat samples finish13,576/13,576/359 JSON on unchanged7c65011d tree. New4800–5500 sample bands/full roster names leave old profiles/seeds/defaults unchanged. Original human BT4SBSLB16/Charity, BZNXHKMU19/Charity and RJF6D6ML24/Movement use connected CLI setups and actual controls: training, free entry, Maker6/2/2 casualties, storm-order votes, two-ordinary/one-Fedaykin free rides, both Advanced piles, reciprocal alliance and end-Spice closing deals. Native unplayed singleton ordering is explicitly controlled, not a natural-history claim. E2 human signed5/3 nested pair settles one fee Richese5→4/Guild3→4, original reserves19→14→11 and Shrine8, no second fee. Canonical scope/proof. Final constructor predicate reuse/live-guide union50, TypeScript, repaired unused-import lint and final build pass. Three original final programme re-runs finish1,659/1,659/44 JSON; these duplicate profile/seeds are not added to18 original samples. CLI help and actual Tech two-seat rejection run. Protected deployment/full acceptance/comprehensive assurance remain due. Verified c8a6d0bb3c pushed. CI37345919728/container111884319700 job completes successfully: isolated storage/HTTP7 before verified-image9. Exact build/own worker reload and fresh390px screenshots retain all three original QA outcomes/full c8a6d0b marker without document overflow; tabs closed. No protected NAS/operator/provider approval or live acceptance is claimed.

6 October 2026 — Original native Leader Skills and Discovery

One exact Discovery envelope feeds existing native family/roster predicates and original all14 setup/starting hands, optional Tech3+/Advanced Strongholds2+. No game/config copies in rule quotes; no public gate or save conversion. Typed entry/range/rescue before Cyborg substitution, original cleanup/Tech before Face Dance, CHOAM stash/invoice/Bureaucrat/green marker, and trained Moritani nested death/assassination/private replacement/own revival compose existing sources. Actual native E2/E3 printed starting hands are preserved.

Affected107 pass. Actual programmes observe rescue3/three Tanks/one real Cyborg loss, six-counter5 fee/receiver3/bank2, and five original battle deaths then turn4 native printed5 revival/optional replacement. Original chronology, support-unit and separate-conflict fixture corrections remove copied math, nonce/default assumptions rather than pinning implementation artifacts.

Three genuine hidden-Smuggler captures had legal human zero-support plans but no bot candidate. Engine projects canonical support; bots stop recomputing full-state module predicates on partial views. The real trainer-plan regression fails before/passes after and keeps modified-strength/multi-pile guards. Original seeds20265473/20265497/20265501 resume unchanged, adding989/387/783 accepted/no rejected actions and26/10/21 JSON on14d66863 tree. All31 six-seat samples finish30,874/30,874/815 JSON including those resumes; initial f2ec1d69 tree evidence is separate, not one frozen-tree/every-effect claim. Earlier filename collisions are retained but un-counted; full original rosters/expansions now distinguish new samples, without changing old names/seeds.

Actual 6NNTCFM2 original CLIv10, natural Bureaucrat/free typed Shrinev12; 5NLWDL68 original CLIv10, natural Killer Medic/Stash inspect12/reveal13/ new-card disposal14 restores5 with no payment; MYPGMSW6 original CLIv8, real nested after-loss target9/human Master Bewt10 returns Guild Bureaucrat, printed10→13, winner cleanup11 and original Mentat12 retires one actual cost/ draws one private replacement. Original hands/offers remain authoritative, conserved positions explicit,390px refresh/tabs closed. Canonical native contract. Full modes, assurance, strategic AI and protected live deployment remain open.

Exact pushed code555afe4070d33e0dd9e6ad7c931920878e51d2e7: CI37320041332/job111796483681 completed/success with mandatory isolated storage/HTTP7 before image9. Final native original-hand/reference36, types/lint/exact build pass. Preserved 6NNTCFM2v12/Storm,5NLWDL68v14/Collection,MYPGMSW6v12/Mentat show local555afe4 at390px after own QA reload. Tabs released; no protected NAS deployment or live acceptance is asserted.

5 October 2026 — Original Discovery Strongholds and mandatory Ecaz repair

Fresh original Discovery classic/E1/E2/standalone E3 and separate classic Skills/Discovery entries retain canonical unused Advanced Strongholds2–6, optional Tech3–6 and actual end-Mentat claims. Source-local benefits compose original entry/tariffs, trained rescue, typed Cyborg/CHOAM invoice and nested No-Field materialization/poison defeat. No nested defense/subsidy inheritance or seventh physical Jacurutu card is created. Other profiles/rulings/public starts and save conversion stay separate.

Affected77 pass. The genuine Ecaz sample's mandatory combined battle exposed the old module guard: two meaningful original cases fail before repair and pass after. Related39, final types/lint/build and actual rule programmes pass. Original Ecaz5/Guild4 loses3 per owner; Ecaz's bank2/own1 is not lent to a Guild-led own3 plan. The existing room-local board primitive already admits nested structural keys; an inferred extra validator repair was withdrawn. Named SukRescueOption fixes a TypeScript recursive-inference boundary without concrete ReturnType coupling. Removed incidental action-trace/default pins.

Four initial genuine six-seat samples complete on b2d64215 tree. Original Ecaz seed20265041 after616 accepted is preserved and resumes557/no rejection/ 15 JSON on9ded0847. Five completed samples total3,096/3,097/81 JSON across two trees; resume does not reconstruct the prior stream. Sixth Richese sample seed20265033 remains captured atturn10/richeseBlackMarket after1,639 accepted/ 1,640 attempts/44 JSON on existing exhausted-cache normal-count ruling. No fake source remedy or rerun to confirm.

Actual UWEH7WNB original CLIv8, natural Smuggler, human held claimv10, free-entryv11 and paid shipment/Guild allowancev13/v14 retain Arrakeen, Cistern4/spice2/reserves15. Native4LBU44PT CLIv8, typed free-entryv10, paid shipment/income allowancev12–14, original HMS copyv16/plansv17–18, Traitor declinesv19–20 and casualty keepv21 leave HMS3/no Cyborg, Shrine4/two Cyborgs/spice3, CHOAM income1 and original Production winner transfer. Both390px refresh; explicit conserved staging/private evidence, tabs closed. Canonical evidence. No production or full-module acceptance is claimed.

Exact pushed codeb0267827b5b16755ff3e091cb78f1543383b7f96: CI37301604738/job111735386439 completed/success with mandatory isolated storage/HTTP7 before image9. Final guide10/types/lint/exact build pass; preserved UWEH7WNBv14/movement and4LBU44PTv21/Battle display local b026782 at390px with original outcomes after own QA reload. Tabs released; publication is not protected NAS deployment.

5 October 2026 — Classic Nexus and original Discovery composition

Fresh explicit nexus --discoveries admits classic/base33/all12/Discovery7/8 Basic/Advanced2–6 and optional original Tech3+/Advanced Strongholds2+. Original setup/first-Storm Tech/end-Mentat custody/next-turn entry, Great Maker worm/vote/typed ride and end-Spice closing Nexus draws remain. Source-clear revival ledgers, native-preserving Guild nested tariffs and actual winner/card/Tech continuation compose existing consumers. Skills, native/HW/variants/previews and unresolved effects remain separate.

Affected64, types/lint/build and actual programmes pass. Two genuine six-seat games finish1,150/1,150/31 JSON on unchanged 761f5ca592af1bd3be766dd0e5654ed18528809855f6139436552428389f5b00. Original CLI room3D7SAG45v8 and explicit undealt order/lottery lead to human one-counter free entryv10, real Great Maker votesv12–14, typed two-counter/ one-Fedaykin reserve ridev15, Advanced blow and actual alliance settlement, then human Guild closing drawv27/Charity: physical Richese/deck12→11, 390px refresh. Source staging is explicit, no natural-every-effect claim. Canonical contract. No production deployment or complete-mode acceptance is claimed.

Exact pushed codea2a92bb40881e6b517e618a5ffd6b3389c960a3d: CI37296234655/job111717999496 completed/success with isolated storage/HTTP7 before image9. Final guide10, types/lint and exact build pass. Preserved3D7SAG45v27/Charity retains real Richese/deck11 and local a2a92bb at390px after own QA reload. Tab released; publication does not satisfy protected live deployment prerequisites.

5 October 2026 — Advanced Orgiz and classic Discovery Skills

Authorized supplied Advanced p24 territory-Collection wording now groups actual positive source keys into one transfer per territory and unique foreign payer. Basic keeps the existing provisional deposit mapping. Mixed/shared/contested sources leave only their transfer unpaid; ordinary facts, bank prefix and already-paid continuation remain unchanged. No new publisher ruling is claimed.

Explicit fresh classic leader-skills --discoveries preserves base33/all14 Skills/Discovery7/8 and optional untouched Tech3–6, Basic/Advanced2–6. Original trained entry, nested tariff, independent Planetologist/fixed-three routes, Harkonnen stash capacity, Suk/Tech ordering and Bureaucrat5→bank2 diversion reuse original consumers. Other overlays/native skill profiles and Banker/Mentat previews remain separate. No public activation or save conversion.

Targeted rule/control/reference75, TypeScript/lint/build and actual programmes pass. Basic3 versus Advanced2 transfers preserve ordinary five-spice collection in controlled conserved positions. Two genuine six-seat games finish 1,578/1,578/42 JSON on unchanged tree 946335ef77745f086cd9bd07bfa405c46c06785a3aae7a684a8e244ce2da4ee5; no natural-every-effect claim. Newly encountered concrete-function return-type coupling uses named owner-defined CollectionQuote/DiscoveryCollectionQuote/ SkillsTechBattleStep contracts.

Actual PCDX5J8M CLIv7, natural human Warmaster/Stabanv8, Cistern inspect/reveal v10/v11 and three-counter free entryv13 preserve training/resources. Original protected turn-two continuationv14 permits a one-force paid shipment; human Guild allowancev16 gives spice3→2/reserves12→11/four Cistern counters. Refresh390px. Actual FCVCEA3R final movement endingv8 automatically collects five and transfers two: owner11→13/payer-own-view10→8, two territorial notices and bank prefix intact. The failed throwaway empty-Battle wait was corrected to the original automatic phase path, not a new confirmation. Tabs released; no unrelated game write.

Canonical source/control evidence. Complete combinations, pending contested/shared/mixed rulings, assurance and deployed acceptance remain open.

Exact source c12b463439 is pushed. CI37273231864 / container111644528093 succeeds isolated storage/HTTP7 before verified-image9. Final reference10/types/lint/exact pushed build pass. Preserved PCDX5J8M v16 showsc12b463 at390px, Warmaster/four Cistern counters/reserves11/spice2; FCVCEA3R v8 retains owner13/payer-own8/two Orgiz notices. Tab released. Publication is not deployment or a protected NAS-prerequisite bypass.

5 October 2026 — native Discovery with original Tech

Fresh classic, selected E1/E2 and standalone Ecaz OR Moritani Discovery entry preserves original decks/native setup and optional untouched Tech at3–6 seats. Typed next-turn entry, paid nested marker shipment/movement/reveal, CHOAM stash 5→6→5 and native Face Dance rewards remain original consumers. Pure No-Field custody recognizes the five known nested IDs at0; live commitment/reveal rejects unknown or unrevealed destinations. No effective-marker reserve allocation.

Actual runtime exposed two Moritani integration defects: the live assassination profile rejected Discovery, and its history accepted only static territories. Both are repaired without disabling the printed different-opposing-Leader restriction or normal-call forfeiture. The nested-source regression pays the actual three-spice Guild Traitor bounty.

Frozen source/consumer union 71/71, TypeScript/lint and build pass. Original programs prove three actual Ixian counters/one Cyborg with no entry fee, one-spice Richese nested marker and one physical reveal, and both original E3 setups with four minimal legal policies.

Four genuine six-seat Advanced Tech games complete on initial tree 6d6c1849d6da9b1e5c2af04e07303f9bec49ec9dac2d8089ae58c77795f48e57; preserved Moritani setup completes at seed20263765 on corrected tree fe22922e7acdea8aea64b75af8ba29247e37b63a63f461efa930f1a8cd2c049c. Completed totals 1,940 accepted / 1,940 attempts / 49 JSON; no single-tree five-game or natural-every-effect claim.

Actual Q3AWYZWC v6 lobby keeps authenticated actors/decks. Original45 controls plus labelled unplayed Spice ordering/placement reach Collection. Human Guild inspection/reveal v8/v9 and original44-action continuation reach Richese v10. Human marker5 + original Guild Allow shipment settle v12 for1spice, reserves20 and effective1; human reveal v13 produces five Cistern counters/reserves15 with no second price. Refresh fits390px. Reload only isolated QA after observed old No-Field validator rejection; actual selector now labels nested sector0 inside the location instead of Polar Sink. Managed tab released; no unrelated room write.

Canonical source/runtime evidence. Contested/shared/mixed rulings, unrelated overlays, normal public starts, complete module strategy, assurance and deployed acceptance remain open. No reset or played-game conversion.

Exact source 67ce690064 is pushed. CI37263699075 / container111615980358 succeeds isolated storage/HTTP7 before verified-image9. Final reference10, TypeScript/lint and exact pushed build pass. Preserved Q3AWYZWC v13 shows67ce690 at390px, five real Cistern forces/reserves15/spice4. Tab released; publication is not deployment or a NAS-prerequisite bypass.

5 October 2026 — printed high Ecaz Homeworld alliance victory

Fresh native Ecaz/Homeworld audit entry marks the actual card conjunction: nativehigh7+, reciprocalalliance oneactualjointstronghold and provedphysically held worlds of twoOTHERnativefactions. Sharedboard andoccupationquotes own legality; duplicateEmperorworlds countone and noTech/advisor/ordinarypoint shortcut. Originalqualifyingwinnerunion precedes BGprediction/finalfallback. Returnedsource disambiguates anEcaz/Fremen printedwin fromFremenfallback. Duke permission unchanged.

Source34/affected119 including guide, types/lint/build and originalprograms pass. Real Movement→Collection→Mentat winneeds onlyonejointsite; all4policies havelegal readiness. High6 and deficientconjunctions do notwin. Original734-action clock reaches turn10 before separatelylabelledconserved Ecaz/Fremen sourceprecedence. Controlledpositions preserve storm, actualTanks/starredfloors andphysicaldecks; there is no syntheticphase/deck/receipt or favorableseed.

Five genuine six-seat Advanced samples finish4,339 accepted/4,358attempts/114JSON on unchanged b0ebb815c973197ca3e3148c4ad447ddc11dba1489f72911de2cd341cafd2f08. 19 rejectedcandidates recorded. Specificnewsource triggering isproved bynative/ humanprograms, not inferredfromwinnerfactions or thesecontinuationcounts. OriginalCLI S8N26ADW v18 setup, realturn-two Ecaz/GuildNexus and labelledsurviving pose preserveactors/deck/clock. Storm7, native7, actualjointHabbanya1, separate Emperor/BGworlds2 appearat390px withoutchangingordinary1/4/Ecaz1/3. ActuallastReady reachesv25/Mentat/finished Ecaz+Guild; refreshfits390px. Drivereligibility andtyped subset issues correctedwithoutweakeninggameguards. Privateproof outsideGit. Canonical source and actual winning evidence. No reset/public/saveconversion/Dukecutover; fullmodes, pendingrulings anddeployment remainopen.

Exact code 17bc4537c3 is pushed. CI37260419689 / container111606286541 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final119 source/consumer/guide cases, types/lint/exact pushed build pass. S8N26ADW v25/Mentat/finished shows 17bc453 at390px with actual Ecaz+Guild and separate ordinaryfalse/sourceTrue. Tab released; no deployed/ reset/privilege or NAS safe-point bypass claim.

5 October 2026 — occupied Tupile capacity, original cleanup and low authority

Fresh native CHOAM/Homeworld audit setup alone marks Tupile slots and the original lease ledger. A server-derived backed flag extends all existing real hand-limit consumers once; old profiles gain nothing. Original Advanced source/reciprocal holder loss retires the lease and queues owner-selected normal-limit excess. Pending old debt cannot borrow a new lease; Basic unknown source preserves its proved state and blocks rather than invents cleanup. Native low intelligence uses known current authority only in this marker, without clearing old answers/use.

Source19/affected143 including guides, types/lint/build, all4 legal policies and original programs pass. Actual ordinary auction admits Harkonnen card9/no card10; one real paid foreign return queues both normal-limit cleanups and retains its remaining movement/counter/price. Fixtures now distinguish a genuinely observed Basic boundary from unobserved expiry, and accept a completed original invoice without manufacturing a pending sale. No wording/error-text pins or fake card.

Ten genuine samples on unchanged 52ccb9305255ecf7234be7a98aea43f7cf44630215639042c50bb0474e93e892: five six-seat Advanced complete4,339 accepted/4,358 attempts/114 JSON; four of five five-seat Basic complete2,430/2,449/64, allfive2,527/2,547/66. Original Atreides5Basic20263432 remains captured at its contested Southern guard. Natural samples containzero owed cleanup choices; native programs/human actual departure supply changed-path proof. No favorable seed or complete-mode claim.

Original backed-up CLI D54MY8JJ v18 preserves deck/actors/clock; a real second-turn Nexus earns Guild/Harkonnen alliance before labelled conserved positions. 390px human Harkonnen8/9 bids5 and holds9/9 atv26, wallet12→7/no tenth bonus. Real last Guild visitor returns to Junction for1 (6→5); Cheap Hero5→4 then allied Jubba9→8 settle atv30 with the original movement still available. v31 finishes only that turn. A separately labelled native1/Fremen1 contact permits private v33 inquiry3 spice/0 weapons; refresh preserves used-faction/history and no rival panel. No overflow/reset/public start/save conversion; private artifacts outside Git. Canonical lease/consumer/evidence. Full combinations, pending Basic/CHOAM and exceptional Duke, final assurance and deployed acceptance remain open.

Exact code 3e79021a6e is pushed. CI37257844991 / container111598626752 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final143 source/consumer/guide cases, types/lint and exact pushed build pass. D54MY8JJ v33 shows 3e79021 at390px, with original private observation/use retained and no reset. Tab released; publication is not deployed evidence and protected NAS prerequisites are unchanged.

5 October 2026 — occupied Homeworld economics, Bidding and Advanced retention

The authorized supplied p22 resolves Advanced qualification/retention: sole foreign presence, continuing until its last force leaves. Original snapshots retain that epoch through contests/native revival/turn changes and replace it only after departure plus a new sole source. Basic historical guards remain.

Fresh Homeworlds alone connects actual Kaitain/Junction/Richese percentage receipts, one completed Southern Collection total, immediate ally allocation, Caladan shared private inspection, sole Ix pool control, Richese card-only choice with native seller terms, and one Giedi bonus using real receiver space/stock. Original paid invoices, hidden custody and source suffixes remain authoritative. Native income/inspection cancellation does not silently cancel printed shares.

Final247 affected cases/24files, types/lint/build and original programs/four legal policies pass. Real wrong-recipient rejection needed the RuleError adapter; actual HTTP409 leaves v42. Human Guild income exposed overwritten BG accompaniment: the signed suffix now restores its original choice through JSON and subsequent actual advisor placement. Conserved random-deal stock/capacity fixtures now stage the exact tested boundary; no favorable seed, invented card or guard weakening.

Pre-advisor-repair50 genuine games on unchanged 09cfdd1957d9ae4c807bce3c7c43edd66fe72b5c239c29cbadf3acca4253de9a: 44 complete18,977 accepted/19,149 attempts/491 JSON; all50 total22,383/22,580/580. Four Basic occupation/two CHOAM captures retain existing rulings. Five exact original Advanced captures finish3,135/3,136/83 at original scenario seeds20263433/453/455/465/475; resume restarts the seed, not its lost stream. After repair, allfive fresh six-seat Advanced games finish4,339/4,358/114 on unchanged 2ada89969c683b3ed263f39b9467f623205d83b765cb3639832ee10adf918aae; 19 rejected candidates remain recorded, not a zero-rejection certificate.

Original backed-up CLI HH7VHT2U v21/4H5CZDMA v18/6K5JFNPH v18 preserve real decks, choices and actors. Actual turn-two alliances precede labelled positions. 390px human controls exercise all four percentages, native Richese terms/card-only selection, full-Harkonnen allied real bonus and sole Ix pool6→5/native-known0. HH7VHT2U actual shipping6 shares Junction3 as1/2 without repeating forces or losing BG; Collection9 retains5/shares4 as1/3 and reachesv72/Mentat with wallets 5/17/11/10/13/9. Richese v29 retains its actual Ornithopter5 invoice/3+2 net split; Ix v25 leaves unrelated Technology native. Allthree refreshed roots fit390px.

Only dedicated QA changes, no reset/public activation/credential disclosure. Private proofs remain outside Git. Tupile capacity/cleanup, exceptional Duke, pending Basic/CHOAM rulings, overlays and complete/deployed acceptance remain. Canonical source, original consumers and evidence.

Exact code 0774ae6f83 is pushed. CI37252859564 / container111583875100 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final247 consumer/10 guide cases, types/lint and exact pushed build pass. Preserved QA rooms v72/v29/v25 show 0774ae6 at390px with Guild spice17/6/6 and their actual original continuations. Tabs released; no deployed claim, reset or NAS privilege/safe-point bypass.

5 October 2026 — stable occupied Homeworld bank income and protections

Fresh original homeworld-occupation enters Basic/Advanced2..6 and selected faction decks with Homeworlds alone. One original continuously present qualifier, no other foreign army/departure/competing qualifier/restored-high history, supports the unambiguous printed bank/defensive effects. Original qualification, physical native population and current garrisons stay separate. No expiry/ replacement policy or old-save conversion is introduced.

Two bounded owners supplied bank queue/component and printed defensive cases; parent integrated original setup/CLI/samples, source history, typed combat/ Voice/FaceDance/Terror, Collection/actual Giedi sources, controls and legal bots. Original captured decision survives the generic dispatcher. Salusa's zero bank icons no longer block unrelated income; its unresolved combat penalty still does. New21/affected262, types/lint/build,24 original setups and real source programs/four legal keep-all policies pass; final clean-Movement regression1/1.

Fifty genuine classic/paired E1/E2/standalone E3 samples ran on unchanged 09f8b0dcdc54bf284f234c6e0f27936689cce1bb1a7b6381548ee13a149d2dae. 37 complete11,762 accepted/300 JSON continuations, with153 rejected candidates. All50 total19,080 accepted/19,283 attempts/491 JSON continuations; not a zero-rejection certificate. Two exact zero-award captures finish7/14 more accepted actions/no rejection at original scenario seeds on correction tree eed8f319ece875181b9412ded145189691db3a8ca56fa6ff00e11f5ca11965ee. Resume restarts the same seed, not the lost original stream.39/50 finish; nine occupation/Salusa-combat and two low-Tupile CHOAM ruling captures remain preserved, not replayed to hide them or forced into invented outcomes.

Original backed-up CLI CPBXKFGD v14 retains actual setup/cards/actors. A real second-turn worm/Nexus earns Guild/Harkonnen alliance before labelled conserved positions. Human390px v21/Mentat settles Caladan2 as1/1, then Wallach1 to ally, with Giedi2 once: Guild3→4/Harkonnen8→12. Source cards, warning, refresh and force inspector show18 Guild reserves/0 Tanks/one visitor on each world with no root overflow. Original readiness reaches Mentat. Native runtime programs exercise protected Voice, two strength-one real starred counters/no Karama restore, an original matching Face Dancer conserved from the unused deck and actual first-Mentat Robbery then paid three-force protected second-Movement entry.

Only dedicated QA changes; no reset/credential disclosure/assurance campaign. Owned throwaway scripts removed; reports/private receipts remain outside Git. Percentage receipts, other occupied powers, unresolved rulings, public/save conversion, complete-mode and deployed acceptance remain open. Canonical source and exact evidence.

Exact code 5e902e384d is pushed. CI37239145022 / container111544136910 succeeds isolated storage/HTTP7 before verified-image9. Final11 clean-Movement/reference cases, types/lint and exact pushed build pass. Rebuilt CPBXKFGD displays5e902e3 at390px and remainsv21/Mentat with actual Guild4/Harkonnen12 and18+1+1 Guild counters. Managed tabs released; no deployed claim. Last observed liveab5c782 and NAS prerequisites remain unchanged.

5 October 2026 — standalone E3 Nexus, Skills and original components

Original leader-skills --nexus-cards now admits Ecaz OR Moritani/classic ecaz33/all14/all12, Basic/Advanced2..6, preserving original Tech3+ and/or Advanced Strongholds2+ (both3+). Two bounded owners supplied connected native rule fixtures; parent integrated admission, engine, original entry/samples, reference/guidance, mandatory Advanced Occupy and human proof.

Fifty-four original setups/four legal policies and26 immutable prerequisite rejects pass. New24/affected224 cases, types/lint/build pass. Fifty-four genuine 2..6 games complete24,845 accepted/no rejection,648 JSON continuations,28 closing choices/five original coalition leads on unchanged tree ceebd866c4de7dfd122c0ddb9754a730b7bbdd93340afddffbd26ec157561816. Three preserved captures finish918/752/21 more actions at their original scenario seeds; continuation restarts that seed, not the pre-capture stream. No skipped fight, reassigned outcome, replaced position or guard suppression. Meaningful coalition cases reproduced wrong-army Suk rescue and missing Diplomat retreat, then verify separate physical commitments and JSON choices. Chosen-plan/own-force skill composition is explicitly inferred, not a new FAQ.

Original backed-up CLI offers/hands/IDs stay authoritative. Human390px YZLNTNEZ v23 uses living-Duke Cunning/normal Warmaster/held poison protection, wins7–5 and releases Duke before original Tech/city income. R2S5UX5U v27 keeps normal Guild Suk, kills unused Master Bewt3 after loss, returns its skill, pays bounty11→14, preserves winner cleanup/Tech and one private replacement, then places supply Robbery Cunning at Red Chasm. L7C8HTQT v23 uses an actual Nexus alliance, trained Sanya4/dial5/support2 with bank2/own0, separate ally2 losses and fixed Ecaz3 rescue:17 reserve/0 Tanks/3 board versus ally16/2/2. Original Emperor Axlotl transfers after cleanup, allied Production stays with Atreides, held Arrakeen stays Ecaz and city2 pays12→14. Actual controls, refreshed force/Terror inspectors and no root390px overflow are observed.

Only dedicated QA rooms changed; conserved positions are labelled. Owned throwaway scripts were removed; source reports/private receipts remain outside Git. Shared-Duke training/exceptional custody, enhanced Terror relocation/ HMS/Grumman, E3 pairs/mixed families/Advanced Harkonnen/HW/previews, public/save conversion and full/deployed acceptance remain guarded. Canonical source and exact evidence.

Exact code 83f825513a is pushed. CI37227846375 / container111511103168 succeeds: isolated storage/HTTP7 precedes verified image publication9. Final13 coalition/reference cases, types/lint and exact pushed build pass; all three preserved human rooms display83f8255 and retain their actual outcomes at390px. Managed tabs are released. This is publication, not deployment; last observed liveab5c782 and NAS prerequisites are unchanged.

4 October 2026 — classic Nexus with Tech and Advanced Strongholds

Two bounded owners supplied original shipment/revival/purchase and coupled battle programs. Parent integrated fresh classic/base33/all12 admission into the existing Nexus seam, original Axlotl hooks, source identity exclusions, sample/resume/entry guidance and human controls. Tech3..6 Basic/Advanced, Strongholds2..6 Advanced, both3..6; Skills, HW, native expansions, other previews, public starts and existing saves remain outside this composition.

New24/affected188, final34 module/guide, types/lint/build and fourteen actual rule programs pass. Four legal free-return policies retain exact3 ledgers, real elite cap and deferred Axlotl. Parent rejected a proposed paid-Fremen Heighliners trigger: authorized physical32 expressly keeps reserves on-planet, and a borrowed tariff is not a new physical origin. Original exclusion remains. Both real free batches activate Axlotl; Emperor extra versus Fremen ordinary allowance stays distinct. Existing bank purchase keeps real wallet/card and does not create industry income. No unresolved ruling was decided.

Eight genuine4/5-seat module games complete4,440 accepted actions, no rejection and116 JSON continuations. Five-seat samples execute five closing Nexus choices; four-seat samples can ally everyone and deal none. Reports capture production unchanged on trees 13367864d40cd778e5b50b5610e97b5819c25f74f37c655d962a884e3314cb28 and ea4f523a732c7c958c4df88fa01f8c335d7c896975348e5403306eda956df012. Later fixture-only undealt-CLI continuation/guide edits do not change engine. No natural free-return or private-inspection claim is made.

Original CLI DPA6UGWKv10/HXEMRA32,FQNN62UGv8 keeps genuine unused setup and exact seats. Human390px HXEMRA32v13/movement returns2normal+1Sardaukar, ordinary/free3/elite1, pending Axlotl1 at wallet12 then13 at real phase end. FQNN62UGv14/Mentat pays Guild3 for5 actual counters, wallet12→9; Heighliners1 pays Harkonnen10→11 only after original movement finishes. DPA6UGWKv18/Collection pays bank2/own4 for support6, retains Shield and1 normal Arrakeen survivor after6 normal/no starred loss. Moritani loser retains played Crysknife before original winner Heighliners; CHOAM reveals only unused Trip to Gamont. Separate city2 yields wallet8. Inspector, controls, refresh and guide are observed, root390px no overflow; controlled positions are labeled. Wider rules/combination/assurance/calibration/public/deployed gates remain open. Code 8ceee7afd0 is pushed. CI37181553391 container job111374984514 completed/success; isolated storage/HTTP step7 preceded verified-image step9: ghcr.io/quintine/dune:sha-8ceee7afd097d36e2ae7471b744d127062e39c29. Final rebuilt worker shows8ceee7a and retains original human v18/Collection, v13/movement andv14/Mentat outcomes. Owned script/tabs removed; store/proof remain. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native Tech and Advanced Strongholds without Skills

Two bounded owners supplied independent E1/E2 and standalone E3 cases. Parent integrated fresh native profile admission into existing faction and Stronghold entries, original Ecaz coalition/Moritani contexts, genuine sample and resume profiles, canonical guidance and original human controls. Tech3..6 Basic/Advanced preserves selected E1/E2 or standalone Ecaz OR Moritani decks/inventories; Advanced may compose six Stronghold Cards. Public starts, old games, unrelated modules and existing rulings are unchanged.

New32 meaningful cases are included in affected187/187. Types/lint/build, thirty actual admission probes/two below-three rejections, twelve actual native programs and four legal original Face Dance policies pass. Final fixture-only generic entropy dispatch passes both original consumers and types/lint. Obsolete Tech rejection, incidental wallet/placement/response pins and error wording were removed, not repinned. Actual printed CHOAM half-income uses two opponent spice→one income, excluding own bank-funded support. Ecaz uses actual affordable support, not a fixture wallet grant.

Ten Tech-only and five Stronghold+Tech genuine3-seat games complete4,902 accepted actions/no rejection/125 JSON. Reports capture unchanged tree 61521366bc68245741ec510546084e7bb7e2395b737474a78eda018f95a92676; final generic repair affects only the fixture, not the game engine. Natural Moritani samples do not claim assassination. Original report roots: /tmp/dune-native-tech-games-20261004, /tmp/dune-native-stronghold-tech-games-20261004.

Original CLI BZVLA22D/YENG8B6Uv8/setup retains unused selected modules and all original seats. Controlled human390px BZVLA22D v21/Mentat selects Ecaz/Sanya4, dial5/support1 against Bashar2/dial2:9–4. Fixed Ecaz3/Guild3 casualties leave2+1 fighters, held Tabr2 income and original Axlotl+Heighliners. No city Collection income is applicable to this Tabr-only position. YENG8B6U v15/Mentat preserves support1/losing Tuek4, printed Master3 death/bounty, wallet18, Guild winner Tech and one private Bashar replacement. Guild independently collects Tuek1 to wallet4. Inspector, decisions, public token labels, refresh and updated guide are observed; root390px has no overflow. The new dedicated QA store preserves these rooms and never touches user saves. Source/rule/faction/module/assurance/calibration/public/deployed gates stay open. Code 2da3c9273b is pushed. CI37175645562 container job111357583598 completed/success; isolated storage/HTTP step7 preceded successful verified-image step9: ghcr.io/quintine/dune:sha-2da3c9273b02efd06c283999c225f56e62214dd1. Final rebuilt/isolated worker shows2da3c92 and retains original human v21/v15 Mentat states. Owned scripts/tabs are removed; room store and proof remain. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — standalone E3 skills with Tech and Advanced Strongholds

Two bounded owners supplied Ecaz ordinary-disc/Duke and Moritani rescue/assassination/replacement programs. Parent integrated existing skill admission, original assassination context, appended sample/resume rows and guidance. Standalone Ecaz OR Moritani ecaz33/all14 admits Tech Basic/Advanced 3..6 and Stronghold Advanced2..6, optionally both. Original setup/first-Storm/ end-Mentat and exclusions remain; no public start, save conversion or ruling.

New15/affected152, types/lint/build and nine actual programs pass. Original probes:22 valid entries/ten retained rule-bound rejections. Eight E3 games:1,531 actions/no rejection/38 JSON; expanded47-game batch: 13,936 actions/no rejection/358 JSON. Captured unchanged tree d9c5e4d1a611f8ab7cf18e4c816161604d18f8aa8c94b25962fc38595fcc71a3. Natural Moritani samples do not claim assassination; controlled/human paths prove it. Legal later Basic dials, prior BG prediction, unoccupied Moritani setup, real Guild allowance/accrual and separate Tuek Collection correct fixture assumptions. Startup wallet/location pins were removed, not repinned.

Original CLI X4YSWBLR/BJH3UVQFv8 and human390px334W75B6v13/Collection, AL6WCG8Bv13/Mentat retain original IDs/pieces. Real normal Warmaster1/Duke6/ Carthag Shield wins7–6 against poison and releases the living Duke. Normal Guild Suk precedes unused Master3 death/skill return/printed bounty, losing Tuek income and one private Caid replacement. Cards/Tech/physical casualties and separately quoted Collection remain; refresh/no overflow pass. Detailed mechanics/evidence: existing runtime. No full rules, assurance, strategic-AI, public or deployed claim. Code 2b72021611 is pushed. Exact CI37165705653, container job111328037714, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-2b7202161170a7e0c108389c273b0cc1591603ac. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — Advanced Skills and Strongholds, with optional Tech

Two bounded owners supplied classic subsidy/defense/income/rescue and native HMS/typed losses/FaceDance/marker programs; parent integrated public-config eligibility, canonical unused-component admission, original Banker/Mentat opt-ins and sample CLI. Advanced classic or supported E1/E2 native2..6 retains all14 skills/six cards; Tech requires3..6. Deck/cache, wallets and actual setup, end-Mentat claims and printed/first-Storm Tech remain. E3/other overlays, Basic Strongholds, public starts, save conversion and unrelated guards remain.

New21/affected277 and final fixture-consumer72 cases, types/lint/build pass. Original setup probes cover26 valid entries/two below-three Tech rejections. Twelve actual programs and twenty-two genuine paired/triple3-seat games pass: 6,672 accepted actions/no rejection,171 JSON continuations, captured unchanged tree 171ecf79ccdef187ca662ddd00c0e5d3c5bce5231d386ee16566ac062ba5dc21. Fixtures use real nonmandatory winner cards before Collection, a funded bribe before cash-boundary rejection, explicit typed casualty choice and original mutual-traitor support payment. The no-spend fixture follows the original response pass queue rather than treating bot recommendations as a legal menu. Two explicit type annotations and exact per-token owner comparison fix fixture inference/lint findings without weakening the custody comparison.

Original CLI J5AAWGEQv8/NY6Y4J4Kv10 and human390px HERCFX3Bv20/Mentat, PG2GR3RCv26/Collection retain original IDs, legal payments, cards/forces and Tech. Actual classic own4 after bank2 qualifies one unavailable Banker grant; trained rescue retains support, and native readiness collects12→13 once. Native copy bank1/own0 preserves wallet10 before original Collection2; typed rescue keeps original subtype custody before winner cleanup/Axlotl. Detailed current scope, source pages and human outcomes remain in the existing skill runtime. No full-module, assurance, strategic-AI, public or deployed acceptance claim. Code f259488a9a is pushed. Exact CI37159813365, container job111310738376, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-f259488a9a6a507d450c5134f6f627ea2151256b. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native E1/E2 Leader Skills with original Tech Tokens

Three bounded owners supplied independent Ixian/CHOAM, Tleilaxu and Richese rule cases; the integration owner extended existing native eligibility, initializer, original Banker/Mentat opt-ins, CLI and canonical guidance. Fresh supported3..6-seat Basic/Advanced retains original deck/roster limits, all14 skills, cache, native wallets and printed Tech assignment. Public starts, E3/other modules, played-game conversion and unrelated ruling guards remain. The supplied Advanced source physical21/38 expressly supports the combination and original winner Tech before Face Dance.

Actual native Richese marker invoices exposed an existing Banker action-key whitelist omission: legal noField/event was rejected. Admit those original fields only for native Richese marker shipping; original validators still enforce source, custody, event and funding. Shared fixture continuation handles actual phase-opening readiness before response passes. Controlled cases use real cyborgs/legal typed commitment and physical winner-card cleanup rather than fabricated dial counts or incidental null/undefined receipt assertions.

Native52/52,261 affected shared cases and the corrected exact obsolete prototype-rejection case, types/lint/build and nine actual programs pass. Seventeen genuine3-seat games (fifteen native) complete5,733 accepted actions, no rejection and149 JSON continuations on unchanged source tree 14be0172b28a45fcabbf0240da12d6718e4fdc871d9a2b639466e6e90d8a1aca. Original CLI VQ3AVFTC/M7HPHNTN/PQ6U2X4S retains native setup atv7. Human390px7RPHJN87v15 typed Suk/card cleanup/sole Axlotl, F244P8DTv8 original Tech-before-FaceDance with mixed real sources, and YWVH5XQFv8 marker5/free companion/price1 retain original outcomes on refresh. The earlier compiled worker rejected native Richese Banker admission; the rebuilt isolated idle QA reload preserves the rooms and exercises the new path. Detailed current mechanics/evidence remain in the existing skill runtime. No full-module, strategic-AI, assurance, public or deployed acceptance claim. Code 219489ae04 is pushed. Exact CI37156345578, container job111300388598, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-219489ae04896ab838735a25091b76a3e4e5bd24. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — classic Leader Skills with original Tech Tokens

Two bounded owners supplied normal payment/free-companion and battle rescue/ reward programs; one owner integrated the existing skill profile, original initializer, separate Banker/Mentat opt-ins, source guidance and sample CLI. Fresh classic3..6 Basic/Advanced keeps base33/all14/three original Tech Tokens. All ownership begins through original setup/first Storm; native factions, Stronghold Cards and other overlays remain separate. No public start or played-game conversion is introduced.

noOtherLeaderSkillModules remains strict. A public-config-only classic Tech predicate admits the exact combination without hidden-card/deal eligibility; ordinary skills, Bureaucrat and existing opted-in Mentat share it. The original audit requires canonical unused tokens before dealing. Separate normal Banker retains earned-faction/separate-payer policy; a phase-end Tech credit is not a new bank-payment producer. Original Smuggler changes priced counters, original Suk/Sandmaster finish before cleanup and mandatory token reward, and no decline is invented for the printed mandatory award.

New25/25 and affected shared/CLI146/146, types/lint/build pass. The CLI case list initially contained a nonexistent Mentat runtime filename; the runner rejected it before executing checks. It was corrected to the exact existing native cases. Two actual fixture defects were repaired: empty Battle automatically advances phase5→7, and that same native transition can collect the ordinary board. The helper now stops at the first clean same-turn native boundary at/after its target; wallet expectations use the independent original Collection quote, not incidental new wallet values or a fabricated battle/phase.

Seven actual native programs cover both-band Smuggler/Banker/Tech through Mentat, both-band skilled Suk then two-token selection, Advanced Sandmaster, private opted-in Mentat fallback and normal single-payer Bureaucrat bribe. The Bureaucrat program reads the original QA v18 without writing it: paid5, recipient unavailable bribe3, Bank2, one phase use and unchanged Tech custody. The Mentat program names Crysknife, observes the target's actual selected Worthless fallback privately, preserves its held card and resumes posture. These are explicitly controlled native programs, not natural-history claims.

Eight genuine Basic/Advanced3..6 games complete2,712 accepted actions, zero rejections and69 JSON continuations on identical before/after source snapshot 0d242f253ae391bccfd8fa3bc0dadbc0421b10b90c9c5475ac1c61582a4922a8. Original CLI WHTKGXEJ v7 retains Banker skill setup; 5YMNGCCT v7 retains original Bene Gesserit prediction before Skills. Both retain three unowned canonical tokens until the real first Storm.

Human390px 63LV57W2 ships Harkonnen physical5 to empty Habbanya17 with the original free-companion checkbox: native wallet10→6, reserves10→5. Heighliners accrues1 for Emperor and Banker fronts1 for Atreides while both owned wallets remain10. Real movement enters v10/Collection: Tech owner11, Banker12 from ordinary city2 with front1 still unavailable. Original human readiness reaches v13/Mentat, Banker13/front0; refresh preserves those facts.

Human390px HC35JG8P follows a real preliminary token capture and chooses the remaining Hagga battle. Hidden skilled Staban5/dial4/support4/Crysknife/ Shield wins9–0 after original optional opposing Diplomat decline. Wallet5−4+2 printed Bashar bounty=3. Actual Suk choice saves3: one kept, two reserve returns, one current Tank casualty; earlier two casualties make total Tanks3/reserves12/ Hagga5. Winner retains both physical cards, then selects only Axlotl from the two real opposing tokens; production stays Emperor. Refresh preserves v18/Collection, wallet9 after separately collecting6 board spice, one token transfer and20 forces. Phone rescue explanation/token controls and the hydrated351px guide within390px are readable without page overflow.

Owned temporary drivers and managed tabs are removed; original game rows, private metadata, captures and QA store remain. No broad assurance/calibration, public activation, completed-modules or deployed claim; live ab5c782 remains last observed. Final guide10/10, types/lint/build and the final rebuilt390px reference pass (351px topic, no page overflow). The final isolated QA reload retains both original human versions and phases. No extra broad assurance suite is rerun.

Code b71f953635 is pushed. Exact CI37146422525, container job111271205483, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-b71f953635e013dab3fd184baf01523681883fdc. Publication is not deployment.

4 October 2026 — standalone Ecaz and Moritani Stronghold composition

Two bounded owners supplied native Ecaz holder-plan and Moritani loss/assassination programs; one owner integrated Advanced profile admission, original setup, canonical ecaz33 deck, CLI samples and guidance. Ecaz OR Moritani with classic opponents and Stronghold Cards alone is admitted; Moritani excludes Harkonnen. E3 pairs, mixed families, Basic and other overlays remain outside this profile. There is no public-start or played-game conversion.

Original end-Mentat ownership and every printed face remain. Ecaz co-control holds the card at Ecaz, but the selected lead receives only its own held effect. Arrakeen pays actual support, never personal cash or fixed free Ecaz strength; Habbanya tie/Tabr income similarly follow the holder-plan. Moritani losing Tuek income precedes original eligible post-loss assassination. Printed bounty, winner cleanup/casualties and one actual private Mentat replacement finish once; normal Traitor revelation forfeits assassination for the game.

Affected native/CLI179/179 pass. Final Richese8/8, types/lint/build pass after repairing a genuine fixture hazard: first Storm dials could let the next random Storm land on the controlled Arrakeen battle, advancing into turn3 and losing card ownership. Legal first-turn dials now keep the target outside that band; no Storm/phase/owner assignment or production rule change is used. Ten actual diagnostic programs retain turn2 and the original Arrakeen effect. Obsolete CLI source-inventory and incidental wallet/placement assertions were deleted rather than re-pinned. Native E3 wallets are never enlarged for the cases.

Four genuine E3 two/three-seat games complete642 actions,15 JSON continuations and3 battles with no rejection. No natural assassination occurs in those samples. Original CLI XK8X548M/HALWWQ6V v6 retain real Traitor setup and six unowned cards. Conserved human boards/cards are staged after original authenticated setup, real alliance and actual card claims, with original identities intact.

Human390px N5SQHZE4 selects Ecaz lead and seals total6/support3/Sanya4/Shield. The wheel shows fixed free Ecaz3 plus Guild-variable3 and bank2/personal1. Native wallet1 reaches0 at winner-card cleanup; real Shield is kept. Original Collection then pays each ally2. Refresh retains v18/Mentat, Ecaz2/Guild1 survivors, Ecaz3/Guild3 Tanks, Emperor8 Tanks, Ecaz wallet2 and Guild wallet7. Human390px ANUJE8L5 starts at original loss with support1/Tuek4 already committed and wallet15. Actual Master Bewt reveal earns printed3, wallet18; original winner cleanup applies Guild's three dial casualties once. Real Collection/Mentat reaches v11 with public Master Bewt retirement and one private Burseg replacement. The traitor and held Arrakeen inspectors are readable.

The isolated QA worker was reloaded only after build, preserving its database and original room states. Full assurance, calibration, public activation and deployed acceptance remain open; live ab5c782 remains last observed. Final guide10/10, types/lint/build and the rebuilt390px guide pass (351px topic without page overflow). The final isolated worker reload retains human v18/v11 at actual Mentat. Owned temporary drivers and managed tabs are removed; the original game records and QA store remain.

Code 39e2954ab4 is pushed. Exact CI37133540369, container job111233294920, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass. Immutable image: ghcr.io/quintine/dune:sha-39e2954ab468aa252d91a33e2e0b52f99a2fe135. Publication is not deployment.

4 October 2026 — Basic even-force Ecaz Occupy composition

Two bounded owners supplied the source-band coalition quote and native Basic runtime cases. One integration owner admitted Basic, migrated production re-quotes, corrected a genuine total-dial validation gap and connected the CLI help, canonical guide and source records.

The coalition quote now requires an explicit advanced boolean with no default or alias. Active Basic requires an even Ecaz count and uses E/2 for the mandatory contribution and ordinary-win Ecaz losses; Advanced keeps its ceiling arithmetic. Canceled Basic permits the preserved odd count through the original own-pool cancellation frame with zero fixed strength. The publisher page-8 paragraph and page-15 example still contradict each other for odd counts, so an uncanceled odd Basic battle is rejected at the original choice before a lead frame exists. It is not rounded, canceled or replaced. Basic has no Emperor/Fremen elite inventory (elites require Advanced or Homeworlds), and the engine normalizes a supplied Basic support amount to zero rather than inventing paid Basic support; the shared editor blocks nonzero support.

A genuine defect surfaced during integration: Basic validatePlan bounded the dial by the ordinary own pool before the coalition quote ran, so a legal total such as six was rejected. The quoted-force branch now includes the actual Occupy profile, and the Basic Prescience numeric dial branch includes the coalition lead; native feasibility still validates the exact total. The board projection gains an optional public Basic-coalition flag so only fresh Basic tables collapse the pair into one battle side; older played Basic games are not retrofitted.

The Basic fixture originally borrowed a wallet so the rival could afford its eight-force sand shipment. Removing that artificial wallet exposed the real unaffordable shipment; the fixture now transfers eight original rival reserves to the battlefield after the genuine Nexus instead, keeping native wallets, phases, alliance, plans and receipts. The genuine Basic fixture does not accept an authenticated lobby yet; the authenticated staging path is separate.

Affected Basic/helper cases47/47 and the affected Advanced/CLI union352/352 on a stable tree pass with types/lint. Five genuine Basic two-through-six-seat games were run: four complete with 2,090 accepted actions, no rejections and 54 JSON continuations; four-seat seed 20261299 is captured at the preserved odd-count conflict after 321 accepted actions. The captured game, report, state and trace remain outside the checkout and are not rerun or bypassed. The four completed natural games contain no coalition lead choice, so the coalition arithmetic evidence comes from the controlled programs and the human path, not from those games.

Authenticated human390px FEJ6SBFB v14 kept the admitted Ecaz/Guild/Emperor seats and native wallets, then staged a conserved even-force board after the genuine Nexus alliance. The table showed the correct Basic labels: a total-dial slider bounded 2..6 (2 fixed Ecaz strength for four Ecaz forces plus Guild's four-force variable pool) with no spice-support control. Real sealed plans — Ecaz Sanya Ecaz 4 with total dial 4 against Emperor Hasimir Fenring 6 — produced an 8–6 Ecaz win. The log and saved state record Ecaz's two mandatory Occupy casualties, Guild's two variable casualties, and the Emperor's eight territory forces to the Tanks; every seat remains at 20 physical forces after refresh. The Basic Karama window, lead choice, plan editor and Collection continuation all use the existing shared controls.

No natural-history claim for controlled positions, reset, public activation, full-mode certification or deployed evidence; live ab5c782 remains last observed.

Code 5f082696a6 is pushed. Exact CI37116854539, container job111185228169, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-5f082696a60ac8b75e3eb4bcaa042826526fbdac. Publication is not deployment.

4 October 2026 — native Ecaz ordinary-disc skills and temporary Duke composition

Two bounded owners supplied native setup/ordinary rescue/revival/Ambassador cases and temporary Duke acquisition/battle/death/revival cases. One integration owner added the exact Ecaz/classic Basic/Advanced native profile, shared family fixture, stable CLI samples, source guidance and real human continuation. Five native discs receive original skills; the separately controlled Duke is not inserted into native rosters or traitor/assignment inventory. Basic Harkonnen remains; Advanced Harkonnen retains its original Duke/capture boundary.

Existing handlers compose without an alternate rule engine: original starting-card/public-skill/Loyalty/traitor/six-force setup, normal versus selected role strength, physically capped native Suk rescue, trained-disc death and optional paid or physical Ghola own-normal-disc skill replacement. Original Ambassador payment/entry/bank grant retains training and the entrant's suffix. Temporary Duke6 with another living face-up native Warmaster gets normal1 only; surviving release or poison death leaves the native trainer/card untouched. Actual bounty remains6; eligible Ecaz paid5 revival keeps the same living set-aside Duke under the earlier user decision. Existing-skilled revival does not establish shared-Duke assignment.

First focused run passes6/9. Two new tests mistakenly pinned dead Duke's incidental usedAt metadata; those assertions are removed, not re-pinned. The Ambassador case omitted the original event; it now submits the actual pending receipt. Final new cases9/9; affected67/67, types/lint/build pass. Twenty actual controlled programs cover Basic/Advanced Duke normal/hidden/ stronger-opponent/death, manual/four-policy native Suk and actual deferred Banker payment. Ten genuine two-through-six-seat Basic/Advanced CLI games finish4,264 accepted actions/no rejection,110 JSON continuations,59 battles, 50 Ambassador decisions and one Suk rescue. New stable ordinals283–292 retain all earlier samples. No strategic calibration or assurance matrix.

Original CLI 24HGMJCD v4 preserves native setup and seats. Human390px LQWE8TZM v18 starts at a conserved pre-Ambassador board after original native setup. Real placement pays1, Emperor's original reserve arrival pays1, and the owner-only Acquire Duke control receives the original living disc. The subsequent conserved Wind Pass/Baliset position retains that actual acquisition, wallets, seat IDs and physical inventory. Real normal face-up Sanya Ecaz/Warmaster, Duke6, Baliset and dial0 face Captain Aramsham5 with two fully paid forces: actual7–7 aggressor tie. An initially over-supported one-force UI attempt is rejected at unchanged v14; correcting the native wheel to2/support2 seals normally. Both actual no-traitor choices, normal winning cleanup and refresh reach Collection/v18/wallet11/eight Wind Pass counters/ Tanks0 and living set-aside Duke. Native trainer/card remain face up; the opponent's owned wallet is7. Enlarged canonical Duke inspection is readable. Its stale unfinished-revival notice is updated to the actual bounded scope.

Shared-Duke assignment, combined Occupy skills, optional modules and other existing rule questions remain explicit. No natural-history assertion for controlled positions, reset, public activation, complete modes or deployment; live ab5c782 remains last observed.

Final native/guide19/19, types/lint/build and visible390px topic (351px width) pass after the affected Duke inspector notice and canonical source updates. The actual reloaded inspector describes paid/Ghola set-aside revival and native ordinary-disc skills without claiming shared assignment or loans. Original human v18/Collection/wallet11/eight counters/living set-aside Duke remains after the final isolated worker reload; CLI v4/setup is retained. Owned temporary entry/rule/staging drivers and managed tabs are removed.

Code f17f4e703e is pushed. Exact CI37110175538, container job111166376104, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-f17f4e703eb09d0870abb3233974da2f31f24bea. Publication is not deployment.

4 October 2026 — native Richese skills and Advanced contribution recipients

Two bounded owners supplied canonical Richese green role substitution and original auction-recipient quotes/tests; one integration owner composed native profiles, engine receipts, force paths, shared fixtures, CLI and current guidance. Basic/Advanced Richese retains original CHOAM-family cards, ten-cache custody, setup and fourteen skills. Native selected decks keep their explicit limits.

Canonical printed green Richese Specials add Planetologist strength without executing their native fee/search/leader-kill effect; weapon-special Stone/Mirror and Snooper defense remain excluded. Marker-only0/3/5 casualties use the actual reserve-capped pool, then original Suk rescue. Normal Smuggler's own companion is one separate physical force, not concealed value. Actual selected-deck games exposed the old single-deck marker admission; the path now shares the native profile. Ordinary allied declaration cancellation retains its original frame, without granting an allied free companion. Original preleader acknowledgments are preserved rather than letting fixture AI consume Residual Poison early.

Authorized Advanced Richese Bidding routes its funded ally contribution to Emperor/bank, even when Emperor buys. The original scalar paid receipt keeps buyer-to-Richese credit separate; cancellation redirects only Emperor's share, never donor escrow twice or physical delivery twice. Basic retains the R2 publisher receipt. Native Banker eligibility uses actual final bank payer legs, not seller/allowed Emperor income or aggregated small payers. Deferred currency remains unavailable until the original Mentat opening.

Final affected rule/CLI union151/151, types/lint/build and eleven actual controlled programs pass: Basic Nullentropy/Advanced Residual Poison substitution, manual/four-policy capped Suk rescue, and original bank/Emperor/cancellation/Emperor-buyer paths. Stable new CLI scenario ordinals254–282 preserve earlier sample assignments. The genuine29-table batch is not green:28 complete11,788 accepted actions, 303 JSON continuations and130 battles; Advanced six-seat seed20261267 is captured after1,523 accepted actions at phase3/richeseBlackMarket. Its exhausted cache reaches the retained ordinary-count ruling guard. Report/state/trace remain outside the checkout; no rerun, artificial card, reset or forced payout. Separate two/three-seat selected-deck follow-ups finish without rejection.

Original CLI FXK6Z8BW v6 retains native setup. Human390px 358WLPYA v16 keeps admitted seats before a conserved controlled zero-marker battle. Actual preleader readiness, skill concealment and sealed plans use Ein Calimar5, Residual Poison as green and dial0; +2 wins the original aggressor tie7–7. Normal cleanup discards the card without its native leader kill. Collection after refresh retains reserves20/Tanks0 and no phantom marker forces.

Human E2K2U5ZW v26 uses actual cache funding controls and the real silent lot: buyer pays4 and Richese supplies4 for one eight-spice Ornithopter. The buyer wallet goes5→1 and acquires exactly that card; seller Richese is5 after its own4 debit plus only buyer4 credit. Absent Emperor, donor4 goes to bank, earning Guild Banker one deferred spice while available wallet stays5. Original normal lots pass, native Revival completes, Guild timing is allowed through actual responses, original shipment turns finish, and the ally declines the separate No-Field opportunity. Collection wallet6 still has front-shield1; actual final readiness opens Mentat, collects once6→7, and refresh retains v26/Mentat/wallet7/empty pile. Fresh accessibility and screenshots show the unavailable-income notice and real controls. The detailed current guide is readable at390px (351px topic), with exact green disposal and recipient limits.

Own mixed No-Field, exhausted-cache count, special-lot Technology, positive Black Market self-bidding, Bureaucrat split funding and other pending rulings remain intact. No full-mode, assurance, calibration or deployed claim; live ab5c782 remains last observed.

Final guide10/10/build and hydrated390px topic (351px width) pass. Necessary isolated QA worker reload retains payment human v26/Mentat/wallet7/empty pile, without replaying the grant or collection. Owned throwaway drivers and browser tabs are removed; original QA records and the guarded captured game remain.

Code 032b41aa87 is pushed. Exact CI37107445770, container job111158645504, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-032b41aa8721fd869a1b25d0fd29213c22b9ba69. Publication is not deployment.

4 October 2026 — Advanced Moritani skills and winner-skill-first assassination

Two bounded test/fixture owners extended genuine native setup/Terror/physical skill cases and original post-loss assassination cases. One integration owner composed the fresh all14/non-Harkonnen classic profile, original assassination state after setup, separate Banker opt-in, CLI and current guidance. Basic including Harkonnen remains unchanged; no inferred Ecaz/Duke assignment or wider native/module admission.

The first integrated normal-role case exposed actual pending Suk casualties being replaced by the original assassination decision. The unspent receipt now waits at winner skills; Suk rescue and Rihani choice finish first, then the original assassination opens with a no-casualty continuation. Reveal/decline cannot replay those costs. Source-specific regressions and actual programs exercise both decisions. Winning-disc exclusion, printed bounty, public retirement, one private Mentat replacement and whole-game normal-traitor forfeiture remain. Fixture corrections preserve real Storm-source completion at later-turn staging, normal opponent Suk rescue, optional winning Worthless retention and winner-only killed-disc bounty. Removed obsolete guard-forwarding and bare-not-throw checks.

Affected64/64, CLI2/2, final native/guide25/25 and types/lint/build pass. Nine actual controlled cases cover two skill-first decisions, manual/four-policy trained-disc assassination/native replacement and explicit Mentat/Banker opt-ins. Five genuine Advanced CLI games finish1,425 accepted actions/no rejection, 37 JSON continuations and24 battles, but contain no assassination opportunity: that evidence comes from controlled programs and the human path. Stable new scenario ordinals249–253 retain all old Basic samples. Fifteen local canonical anchors resolve; no comprehensive assurance campaign or strategic calibration.

Original CLI 7JGUWMAP v6 preserves native setup. Human390px TQH86DL4 v20 keeps the exact admitted seat IDs, followed by a conserved Wind Pass/physical traitor/Worthless/disc position. Real Captain Aramsham5/Trip to Gamont/normal Warmaster1 defeats Vando1 by6–1. Moritani's original owner-only control reveals the different Hasimir Fenring6, pays exactly6 and returns Warmaster once; own Bureaucrat remains. The real winner discards Trip to Gamont, original Collection readiness advances to Mentat, and one private physical replacement appears. Passing free native Terror placement leaves wallet18/Tanks8 and one held Traitor with Hasimir retired. Owned enlargement and refresh confirm usable continuation. The detailed guide is visually readable at390px (351px topic width).

No natural-history claim for controlled positions, reset, public activation, full-mode certification or deployed evidence.

Final targeted GETs preserve human v20/Mentat/wallet18/Tanks8/one held Traitor/ retired Hasimir and original CLI v6/setup. Sixteen final canonical scope anchors resolve. Owned throwaway drivers and browser tabs are removed/released; QA games and the original isolated store remain.

Code d41a7e03a9 is pushed. Exact CI37100245846, job111138195904, completed/success: original isolated storage/HTTP verification and subsequent image publication pass. Immutable image: ghcr.io/quintine/dune:sha-d41a7e03a94bcc785e1417d26a882c5f6dc2ac4e. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native Advanced Tleilaxu skills and foreign-ghola lifecycle

Two bounded owners composed original foreign-disc ownership/skill validation and genuine native fixtures/rule cases. One integration owner extended the shared Advanced profile, stable CLI samples, human guidance and actual runtime. Native Tleilaxu plus optional Ixians/CHOAM/classic seats keep all fourteen cards, original family decks, starting offers and Face Dancers. Foreign revival never draws a new skill; eligible own revival retains its optional offer.

Actual original capture remains legal. The first new validator incorrectly required a concealed snapshot after the native second plan publicly revealed the captive. The failing real-engine case now passes through the existing revelation, execution and surviving-use return handlers without duplicating death, capture or payment. Original disc/ghola/captor controllers stay distinct. Fixture corrections use genuine trained-disc posture, the real own-revival action and the actual native Auditor inventory. Deleted obsolete Advanced denial and bare-not-throw policy assertions rather than re-pinning them.

Affected56/56, CLI3/3 and types/lint/build pass. Nine actual controlled cases cover manual/four-policy funded foreign revival, capture execution/use-return and explicit native Mentat/Banker opt-ins. Fourteen genuine CLI games complete 6,620 accepted actions/no rejection,171 JSON continuations,62 battles, two foreign and five own leader revivals. Stable new ordinals235–248 preserve old Basic samples. Ten canonical local anchors resolve.

Fresh original CLI H485PLF5 v6 preserves native setup. Human390px VNQ5PF54 v33 uses original admitted seats, followed by an explicitly conserved Revival disc/Worthless/storm position. Actual Bashar foreign revival pays1 from wallet5, with no new offer. Actual two-force Wind Pass shipment pays4. Normal face-up Zoal/Warmaster contributes exactly+1 to Bashar2 using actual Trip to Gamont against Caid3/dial0; the native aggressor wins3–3. Original Traitor declines, card retention and phase opening reach Collection after refresh with wallet0, two board counters and the living foreign disc still controlled by Tleilaxu. The detailed guide is visually readable at390px.

No natural-history claim for controlled fixtures, game reset, public activation, strategic tuning, comprehensive assurance campaign or deployment.

Final native15/15, all nine controlled runtime cases and types/lint/build pass after the foreign public-profile quote is cached only within its current validation call. No allocation or retained-state cache is introduced. Eleven final canonical scope anchors resolve. Final isolated-build GETs retain human v33/Collection/wallet0/two counters/living Bashar and original CLI v6/setup. Own throwaway drivers and browser tabs are removed/released; QA games remain.

Code d86d2088e6 is pushed. Exact CI37095454758, job111124330662, completed/success: original isolated storage/HTTP verification and subsequent image publication pass. Immutable image: ghcr.io/quintine/dune:sha-d86d2088e6acc020e44bda0dfbba5093ec98df8f. No deployed claim; live ab5c782 remains last observed.

4 October 2026 — Advanced native Ixian and CHOAM Leader Skills

Two independent owners extended the bounded native profile/helper contracts and genuine full-deck rule fixtures. One integration owner migrated engine admission, native aftermath and Banker eligibility, preserved existing Basic/legacy entries, and exercised original human controls. The new Advanced subset requires unique two-to-six native Ixian/CHOAM plus classic seats, distinct required family decks and no unrelated overlays. Foreign-ghola, captured replacement and Advanced Atreides Suk/Kwisatz Haderach rulings remain guarded.

Affected122/122, types/lint/build and ten actual controlled programs pass: five Ixian mixed-rescue/manual/four-policy continuations, one CHOAM Smuggler collection, two private Mentat disclosures and two real bank-payment-to-Mentat Banker grants. Three genuine new CLI games accept511 actions with no rejection and twelve JSON continuations; none has a battle, so no battle-effect claim is attributed to those histories. Natural scenario ordinals remain stable; new Advanced Ixian/CHOAM/mixed samples use220–234.

Fresh original CLI KFW75TCB v6 preserves genuine skill setup. Human390px ARRHUS7Z v20 begins with real admitted Ixian/Atreides/Emperor seats, then an explicitly staged conserved Wind Pass position. Actual Dominic Vernius dial5/ support1, ordinary opposing leader/dial0, native Traitor declines and4suboid/ 2cyborg loss controls open skilled Suk. Actual rescue saves one ordinary and one cyborg, keeping the ordinary counter; actual native substitution sacrifices one ordinary survivor for the remaining lost cyborg. Original phase opening finishes through real ready actions; refreshed Collection has wallet9, three board forces including one cyborg, four Tanks and zero cyborg Tanks. This is not a played phase history, exhaustive persistence audit or deployed evidence.

Canonical runtime/guide/native follow-ups record current scope. Ordinary Mentat activation, empty hands, normal Banker earned custody and other pending questions are not settled by this composition. No game reset, public activation, AI tuning or comprehensive assurance campaign.

Final CLI2/2 and native/guide18/18 pass; the obsolete Advanced CLI rejection contracts now exercise original full-deck saved artifacts instead. Types/lint and build pass. The rebuilt isolated worker retains human v20/Collection/ wallet9, and fresh visual guide evidence fits390px (351px topic width). Five new canonical scope links resolve. Throwaway drivers and the owned tab are removed/released; QA rooms and the original isolated store remain.

Code 7ee064df14 is pushed. Exact CI37092109758, job111114441767, completed/success: original isolated storage/HTTP verification and subsequent verified image publication pass. Immutable image: ghcr.io/quintine/dune:sha-7ee064df14b79a06d41317f9f8eb193e078d2219. Publication is not deployment; live ab5c782 remains last observed.

3 October 2026 — native Richese, No-Field and Stone Occupy composition

Two bounded owners implemented physical Stone normalization and native Richese fixtures/zero-marker metadata. One integration owner composed admission, selected-plan inspection, original physical revelation, private legal pools, controls, four-policy filtering and internal guidance.

The pre-existing combined sample failure was a mandatory Ecaz+Ixians versus CHOAM Carthag battle rejected because Richese was elsewhere at the table. Native composition replaces that blanket guard, not the battle itself. Original Richese reveal ownership persists even when Ecaz supplies the plan; zero markers remain original presence through response/Traitor validation and public reveal. Stone preflight/resolution subtract the fixed dial offset and count the separate physical Ecaz remainder; public hypothetical pools remain authoritative. Advanced native Mirror uses the same comparison and original physical cleanup. Basic and existing unresolved timing/disclosure/optional-module guards remain.

Affected363/363 and types/lint/build pass. Twenty-six actual native programs cover ten owner/marker cases, eight Stone/Mirror lead/cancellation cases and eight four-policy private-pool cases, reaching original Collection after JSON reload. Fixtures are explicitly controlled conserved board/card/bank positions after genuine setup. The actual combined seed20260932 completes2424 accepted actions, zero rejection and65 JSON continuations at turn9, versus the prior2353-action stall. No new whole-suite/HTTP/storage assurance wave was run.

Original CLI GQ4FEWNW v8 admits a fresh ready four-seat Advanced Ecaz/Richese/Guild/CHOAM setup. Human390px T78EFNZK v22 uses the same original seat identities and fresh admitted setup before a conserved Carthag position. Actual Ecaz lead/ Sanya Ecaz/total5/support2 controls seal against Guild Representative. Both plans reveal the original No-Field5 into only two Richese reserves. Native Traitor decline, CHOAM one-spice support income and closing-market continuation leave Ecaz2/Tanks3, Richese Tanks2 and original Collection/Ecaz wallet30 after refresh. The physical field, variable losses and payer remain distinct.

Corrected the previous mixed Truthtrance log: eight actual programs, not twelve; nested/joint cases are regressions, and its phase/positions were explicitly staged after genuine setup. Deleted obsolete presentation/wording/wiring pins instead of re-pinning changed labels. No reset, public start or deployed claim.

Final native/reference76/76 passes. The new fixture now explicitly declines an unrelated optional Face Dance rather than depending on randomized native identity draws. Final guide paragraphs are readable at390px after the required isolated worker reload; original T78EFNZK v22 remains at Collection with the same relevant owner losses. The old guide chunk was cached in the managed browser, so final guide navigation disabled that prior-build cache; production cache-upgrade acceptance remains open.

Additional mixed controls FCGZTEGV v11 actually authored outer OR with an inner current-spice>=10/Arrakeen4 AND and alternative Carthag6. Yes at20 spice survived a real12-spice bribe, four-force/four-spice Arrakeen shipment and native end-movement with wallet4. The promise is fulfilled and exact grouped Yes history survives refresh. This is a second human journey, not another program case.

Code 113667da55 is pushed. Exact CI37074437398, container job111061051259, completed/success. Its original isolated storage/ HTTP verifier and subsequent verified-image publication pass: ghcr.io/quintine/dune:sha-113667da55647117082c0a502eded30d8d9bdb2e. Publication is not deployment; live ab5c782 remains last observed.

3 October 2026 — mixed current-fact/shipment Truthtrance

Two bounded owners supplied the public mixed tree/compiler/matcher (including internal frozen-constant storage) and complete nested AND/OR authoring controls. One integration owner owns game/truthtrance.ts, engine projection/promise receipt, bots, the shared table guide and this checkpoint.

Current facts are evaluated once at the definite answer and stored privately as three-valued constants; later legal changes cannot rewrite them, and unknown is never collapsed to false. Future leaves still describe one eventual reserve shipment or its absence under the existing FAQ whole-question truth. Multiple ordinary and mixed promises constrain that same event together. Public projection filters mixed promises to their respondent and keeps only the original grouped question and whole answer in history.

The first frozen run exposed three real integration defects, each fixed before verification: the discard-continuation receipt still required a legacy shipment shape; the pre-existing promise.answer shipment shortcut treated a satisfied mixed promise as if it must ship; and two workspace type errors (target-shipment projection and test literal narrowing). Ordinary shipment-only promises retain their original behavior.

Types/lint, the affected truth/ship/discard batch88/88, mixed/reference23/23 and build pass. Eight actual programs cover OR-true-skip, AND-false-ship, AND-true-required, OR-false-ship and all four legal policies. Nested branches after spending and a second joint pure+mixed promise have rule regressions. Fixtures use genuine base setup followed by explicitly staged turn-two Shipment and Movement, conserved positions and wallets; accepted native Truthtrance actions create the promises.

Human390px 4PVKRRWB v10 authored the actual "hold at least10 spice OR ship4 to Arrakeen" question, answered Yes, spent all20 spice as a public bribe, skipped shipment and fulfilled the promise while the public answer stayed Yes; refresh retained it. Earlier phases, Advanced Guild/other modules, expansion shipment modes, other future actions and arbitrary prose enforcement remain unfinished. No new assurance campaign, public start or old-game retrofit.

The prior full offline run exposed a pre-existing failure unrelated to this wave: the combined Advanced CLI sample stalled at phase6 because the engine's roster guard rejected Ecaz+Ixians versus CHOAM at Carthag merely with Richese elsewhere at the table. The same2353-action failure reproduced at0ceb28b. This was missing native Occupy composition, not an illegal bot offer, a Richese opponent or a new ruling question. The later Richese checkpoint repairs it without suppressing the mandatory battle.

Code cd985c7c34 is pushed. Exact CI37065338944 and job111031663449 completed/success: original isolated storage/HTTP verification and subsequent verified-image publication both pass, image ghcr.io/quintine/dune:sha-cd985c7c34a05057ed98b34838effdbcddb7697d. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — native Banker income and Ixian Nexus replacement

Two independent bounded owners supplied native original setup/payment fixtures and exact Ix47 descriptor support; one integration owner owns shared runtime, controls, CLI, reference and this checkpoint. Existing initializer/action/view/ source APIs remain. No public start, old-game retrofit, broader timing ruling, strategic AI or new save/privacy/custody assurance wave.

banker-income adds already-supported Basic Ixian/Tleilaxu/CHOAM/Moritani skill families and their original selected decks/all14 skills. The exact native self-revival and canceled-income cases first failed after profile admission: Tleilaxu's own cost was skipped, and a canceled native payout had no original bank invoice. The repair uses one actual positive-cost payer leg, binding native payer/kind/recipient/cost to the original response. The separate free reward never increases that payer's threshold amount. Paid3 plus free1 does not grant; paid4 does. Native player-recipient/free/self/trainer policies and provisional original-earned-faction retention stay distinct and unchanged.

Three native collection cases initially stopped at phase8 before the existing Ix Amal opening initialized Mentat. The helper now completes that real opening; engine phase order is not moved to force a passing wallet check.

ixian-replacement adds Basic native Tleilaxu/classic with Ix47 and Nexus alone, Ixians absent. The existing generic Nexus initializer retains genuine setup and alliance-qualified acquisition; the fresh native variant omits optional Sandtrout by the existing bounded-profile convention. Exact purchased Thumper/Tooth/Blade/Hunter and actual remaining-deck draws preserve once-only original payment/income and next-lot/final-lot native continuation. Existing base full-hand/depleted source cases remain rather than artificial duplicates. Harkonnen buyers, special origins and pending Nexus questions remain gated.

Types/lint, coherent affected110/110, final native/guide26/26 and build pass. Twenty-eight actual program cases pass:12 native Banker source-to-Mentat/ recipient/cost cases,12 replacement/card/policy cases and4 legal post-income policy continuations. Fixtures use real original native deals and phase/source actions; revival examples explicitly stage only conserved casualty positions. No full-game, calibration or deployed acceptance claim.

Genuine flagged CLI setups 7B55PLA5 v8 and XLFRHKPF v6 retain native original setup. Human390px 86WQMSZV v18 closes the actual Emperor self-bid4, keeps Ix available10 with deferred1, continues original phases and collects automatically at initialized Mentat to11. NMFTVV6N v8 inspects the purchased Thumper, spends its actual Ixian Nexus, draws Amal, retains buyer3, and allows original Emperor income10→12 once before the phase4 Amal opening.

Final reference10/10, build and both390px bounded guides pass; eleven changed-region local links/anchors are valid. All owned tabs and both isolated workers are closed; five smoke/staging/continuation drivers are removed. Private QA/CLI backups remain outside the checkout. No game reset or supplied PDF publication; deployment and full module/faction acceptance remain open.

Code b83d75d9d3 is pushed. Exact CI36999767861 and job110814548718 completed/success. The original isolated storage/HTTP verification and subsequent verified-image publication both pass; image ghcr.io/quintine/dune:sha-b83d75d9d313d2ff1926e11f2155ea0c78ed1757. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — native Mentat question integration

The existing private preview composes with already-supported Basic Ixian/Tleilaxu/CHOAM/Moritani Leader Skill profiles. Fresh exact-version CLI --profile leader-skills --mentat-question preserves actual original native setup and all fourteen skills; no normal/public start or old-game retrofit. Exact/default weapon names use the existing canonical quote. Weirding Way is a weapon, Chemistry is not; an absent name requires the target's actual held fallback card. Inquiry and disclosure precede posture and faction powers; the shown card remains held rather than committed to a Battle Plan.

Before the change, the Ixian regression failed because the engine skipped straight to posture. Five new behavioral regressions now pass, plus the affected inquiry/lifetime batch45/45. Twelve actual program scenarios pass: eight native exact/fallback battles reach Collection, and all four legal policies finish Ixian naming/disclosure. Fixtures use genuine native setup, assignment and Storm, followed by labelled conserved battle positions; these are not complete naturally occurring games or AI calibration.

The existing uniform-response UX and empty-hand questions remain open. Advanced native skills, extra modules and complete module acceptance stay gated. No new save/privacy/custody assurance campaign.

Related corrections: the Moritani lifetime regression now advances actual native Mentat/Storm/phase actions rather than incrementing its turn field; wording pins are removed in favor of exclusion/rejection behavior. The earlier test's manual turn change was not genuine turn-advance evidence; its separate throwaway native transition was. Reinforcements inspection now identifies its working controls and own-reserve provisional cost and links its own rules topic instead of Recruits. These corrections do not change printed card effects.

Final types/lint, build and guide/inspector12/12 pass; eighteen changed-region local links/anchors are valid. The actual new-option CLI starts BGK6YQCK v6 into native Ixian setup. Human390px 8HTTTZMA v9 asks Weirding Way, finishes the target's private show step, reads and inspects its observation, then conceals the native Mentat and resumes the opponent's posture. Fresh 6ZR8HPWD v6 shows readable Reinforcements availability, its own rules topic and the correct instruction to use a battle-card slot, not “still being implemented.” No existing game is reset or retrofitted. Owned smoke/staging drivers are removed; all managed tabs and both isolated workers are closed. Private QA inputs and the original CLI backup remain outside the checkout; the supplied PDF is preserved and untracked.

Code 589e1b9df2 is pushed. Exact CI36990728282 and job110786065439 completed/success. The original isolated storage/HTTP verification and subsequent verified-image publication steps both succeed; image ghcr.io/quintine/dune:sha-589e1b9df245cff4577f9c1d0094eca3f6db4b29. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — authorized Advanced Moritani normal-reveal forfeiture

The user-authorized supplied revision, physical p35 Assassinate Leaders D, resolves the previously open duration: Moritani must not have revealed its Traitor Card normally this game. A normal own-card reveal therefore forfeits the ability for the rest of the game, across later turns and all opposing factions, regardless of that battle's result.

The persisted normalTraitorCall flag already enforced exactly that scope, so no state-machine change was needed. Owner-facing blocked text, the public reveal log and internal guidance now name the sourced forfeiture instead of an unresolved-duration guard. The change is source alignment, not a newly located GF9 erratum or a Basic ruling; exceptional leader custody and the independent private-step UX/public-preview gates are unchanged.

An exact normal-reveal case passes. A new permanent engine regression advances a genuine turn, swaps to a still-living opposing faction and stages a real later loss: the flag persists, no assassination opportunity or decision appears and the owner sees the game-long forfeiture reason. Throwaway native smoke confirmed the same real-reveal and turn-2 persistence. No database reset, new assurance campaign or preview-gate change.

Final check:quick types/lint, coherent assassination/guide38/38, build and 390px Partial / Development: Prototyped guide pass; four changed-region local links/anchors are valid. The throwaway driver is removed and the verifier worker is closed.

Code 934b2ee4d7 is pushed. Mandatory CI36986837326 and job110773684551 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-934b2ee4d7c5d41905bb339a62b64fb8824d2034. No deployment or new local assurance campaign; live ab5c782 remains the last observed marker.

2 October 2026 — independent Treachery cards with Advanced Occupy

Existing ecaz-occupy now accepts explicit fresh CLI --ecaz-treachery, independently including all three original cards:36 Ecaz-only,50 Ix,38 CHOAM, 50 both. Native original setup/owned cards are retained; no public/default start or started-game retrofit. Basic/unprofiled co-side card battles stay guarded.

Three bounded owners shared owner-labelled Harass total-dial normalization, actual native reveal/outcome integration and original-source cases. Own Ecaz Harass returns its floor count while original mandatory ceil remains fixed/free; selected ally uses typed total-minus-fixed commitment. Opponent/canceled ordinary pools stay separate. Returned reserves remain outside later losses/ explosion/FaceDance. Reinforcements preserves its existing provisional own three-reserve normal-first cost and +2 score-only policy on every revealed outcome, not a new publisher interpretation or ally reserve charge.

Exact first own-Ecaz Harass/Reinforcements cases and types/lint passed. Full-case/native natural play then exposed the mandatory-discard callback's logical-winner/physical-owner mismatch. Explicit fullyCommitted Harass facts also preserve exact selected physical losses instead of unconstrained re-enumeration. Both captured original games now complete after the fix. Independent review additionally restored the outside-profile co-side guard; native before/after reproduction proved Basic accepted before and rejects now. Current regression checks exercise both blockers; old wording/log/default pins were removed instead of re-pinned. Native counter precedence in the advisor fixture was corrected without forcing a reaction or suppressing its window.

Pure/native67, coherent affected284/284, types/lint and27 actual native program cases pass, including all four real card policy seals. Current46 ordinary/variant2..6 games complete26,619 accepted/no rejects/696JSON continuations, source unchanged, with nine actual combined lead choices. Earlier “no combined lead choice” statements were projection-reading errors: compact report.json omits counters; immutable full results.json records one in the five-game and three in the23-game checkpoint. Those reports remain unchanged; current guidance corrects the claims.

Original CLI/human390px T8T3ZYWH v12 used Ecaz Harass total5/support2: Ecaz2 returned to reserves, original fixed3 went to Tanks, Guild2 remained. WW54BZGM v12 used equal real leaders and total5/support2 Reinforcements; its +2 won, three own reserves were spent, Ecaz2/Guild2 remained and six total Ecaz counters entered Tanks. Both reached original Collection.

Final check:quick types/lint, canonical guide10/10, build and390px Partial / Development: Verified guide pass. Ten changed-region local links/ anchors and actual variant CLI help are valid. Both fresh36-card CLI starts were exercised. Owned three native/diagnostic drivers are removed; three managed human/guide tabs and both isolated workers are closed.

Final source/native scoped reviews find no defect. No new recovery/privacy/ custody/seat/getter/wholeDB/HTTP/full6,500-suite assurance campaign; direct current playability blockers were fixed. Full rules/factions/combined modes, later comprehensive review/assurance and deployment remain unfinished.

Code cd532222a5 is pushed. Mandatory CI36980970342 and job110755165940 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-cd532222a5dd098dc7a4a1d3ec6383f5bdde62b2. No deployment or new local assurance campaign; live ab5c782 remains the last observed marker.

2 October 2026 — native Ixian, Tleilaxu and CHOAM Ecaz Occupy integration

The existing Advanced ecaz-occupy profile now admits source-selected native Ixians/Tleilaxu/CHOAM with Ecaz/classic/optional Moritani2..6, distinct E3/E1/E2 decks and ordinary33/47/35 cards. Genuine original setup, offers/HMS/Auditor/ Face Dancers remain. No Richese mixed No-Field, independent E3 Treachery or optional overlays, public start or existing-game retrofit is activated.

Three bounded owners integrated actual physical Ix casualties/Suboid exchange with selected lead card cleanup, native CHOAM original support shares, and external Face Dance returning both actual winning co-side armies while retaining selected winner rewards. Same-side Tleilaxu cannot Face Dance itself. Parent human/four-policy maximum now sums actual co-side fighters without a fake merged player. Two scoped rule reviews find no defect.

First Ecaz-led funded Ix case passed. Exact FaceDance return/replacement passed but an incidental same-phase pin rejected valid automatic Collection; deleted, not re-pinned. Narrow feedback also retained real CHOAM movement decisions/ opening passes and generic RNG original-input forwarding. Native34 cases, coherent affected191/191, types/lint and19 actual native-program cases pass. The program includes accept/decline/Karama-denied Ix exchange, own/other/donor/ traitor CHOAM payments, and zero/full whole-co-side replacement.

Twenty-three unstaged classic/paired/mixed2..6 games complete with13,004 accepted actions/no rejection and339JSON continuations, sourceUnchanged:true. Exact family metadata33/47/35 matches selected decks. Full results.json records three actual combined lead choices; native programs/meaningful cases and human rooms additionally establish the exact typed/replacement boundaries.

Original CLI/human390px 5B4FW8D3 v12 let actual Ixians exchange two surviving Suboids for two lost Cyborgs after Ecaz formed the plan. Ecaz retained its Shield; Collection opened with Ecaz2/Ix4 including two Cyborgs. UVGT4DLN v10 displayed/used combined replacement maximum3, returned Ecaz1/Guild2 to their own reserves, placed three Tleilaxu forces and retained Ecaz’s original Slip Tip and bounty. Both continue original Collection.

Final types/lint (check:quick), canonical guide10/10 and build pass. The final390px guide retains Partial / Development: Verified and the exact expanded rule boundaries; six changed-region local links/anchors are valid. Owned native drivers are removed, three managed human/guide tabs and both workers are closed. Private original setups and immutable game reports remain outside Git.

No new recovery/privacy/custody/seat/getter/HTTP-suite/full6,500-suite assurance campaign. Full rules, combined modes, later comprehensive assurance, administration and deployment remain unfinished.

Code 1057eb2719 is pushed. Mandatory CI36966120859 and job110710144783 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-1057eb271938a92a651feebeeef13738659ec8c0. This is existing-pipeline evidence, not deployed acceptance or a new local assurance campaign. Live ab5c782 remains the last observed marker.

2 October 2026 — authorized Advanced Ecaz Occupy combined-army rules

The user-authorized supplied revision, physical32/19, resolves the Advanced ceiling-half free Ecaz contribution, floor-half ordinary survivors and selected lead's own army after Karama. Basic is unchanged; specific Ecaz-only Duke/Ghola revival stays above the sheet's contrary exception. Fresh ecaz-occupy is Ecaz/classic/optional Moritani2..6 Advanced, base33/E3 faction source alone, no independent three-card variant or other overlays, public start or retrofit.

Four bounded owners supplied pure rules, native runtime, usable controls and genuine setup/CLI/study entry. Two rule-only reviewers found a whole-army storm eligibility defect and suppressed voluntary BG conversion. The exact supplied physical6/11 wording rejects component-only plans/casualties: whole armies must be clear/connected. Canonical quote membership now preserves BG's native opportunity. Native before/after storm reproduction changes an isolated ally battle offer to none while clear armies retain one. Final reviews find no defect.

Exact first E1 native case passed. Narrow feedback repaired seat-circle no-op, real arrival-decision suffix, exhaustive lead-decision registries and stable closure narrowing. A typed outcome test now checks printed-strength physical alternatives rather than incidental array order; copied plan echo assertions were removed. Named repaired cases18/18, types/lint, seven actual native-program cases and all four actual policy lead/cancellation branches pass.

Original CLI/human390px Q5Z2WH8X v22 selected Ecaz lead, minimum3/total9 with free Fremen/Fedaykin6; native battle left Ecaz2/Fremen0 and unchanged Ecaz spice5. LZHMY454 v14 used real printed Karama after Ecaz lead, recomputed minimum0/own pool3, sealed dial1/support1 and left Ecaz2/Guild4, with exactly1 Ecaz support debit. Both resumed original Collection.

Final coherent affected rule/guide 173/173 passes. The current-rule five unstaged2..6 games complete with2,123 accepted actions/no rejections and54JSON continuations, sourceUnchanged:true, ordinary33/E3 report metadata. Full results.json records one actual combined lead choice; named native cases and human rooms additionally establish the exact arithmetic and counter paths. The earlier pre-storm-fix report is preserved as different-source evidence.

Final check:quick types/lint, corrected canonical guide10/10 and build pass. The final390px guide shows Partial / Development: Verified, not full faction acceptance. Six changed-region local links/anchors are valid. Actual CLI help and both exact-version fresh starts pass. Owned temporary rule drivers are removed; four managed control/guide tabs and both isolated workers are closed.

No new recovery/privacy/custody/seat/HTTP-suite or full6,500-suite assurance campaign was added. Full rules and later comprehensive review/assurance, administration and deployed acceptance remain unfinished.

Code e112df858a is pushed. Mandatory CI36958647494 and job110687174806 completed/success for that exact SHA. Existing isolated storage/HTTP verification passed before publication of ghcr.io/quintine/dune:sha-e112df858a5a3d27992d22478c5c0d4f3dfac642. No deployment was performed; live ab5c782 remains the last observed marker.

2 October 2026 — expanded Stronghold No-Field, Stone and Face Dancer rules

The existing stronghold-factions profile now composes selected E1/E2 native families with classic2..6-seat Advanced and Stronghold Cards alone. Ordinary decks35/47, Richese cache10, native first setup/END Mentat and existing No-Field/Stone/FaceDance handlers are reused. No public-start change, other overlay or pending mixed No-Field/Stone/Poison Tooth/Ecaz ruling is inferred.

Three rule-only owners supplied native Richese and Tleilaxu paths plus paired/ mixed study/entry. Targeted16/16, types/lint and11 actual rule-program cases pass. Eighteen unstaged games complete:11,066 accepted actions/no rejection/ 290JSON restores. A stale report descriptor was corrected; actual two-seat Ixian/CHOAM, Ixian/Tleilaxu and CHOAM/Richese reports now bind47/47/35 ordinary cards and0/0/10 separate cache respectively. Different-source reports remain immutable; no historical evidence is rewritten.

Original CLI/human390px G7VDY6KB v12 chose real Stone kill mode, completed the Habbanya-winning battle and retained Stone. 736HJUD3 v8 chose two reserve forces for actual Face Dance while the original Ixian kept its winner rewards and retained Stronghold card until the end boundary. Native-program cases cover zero/partial replacement, reserve-limited0/3/5 No-Field reveal and both Stone modes. Narrow feedback repaired Once Around null-pass semantics, actual regenerated auction events and RNG typing; whole-Game nonce equality and keep-action echoes were removed, not re-pinned.

The new rules-first schedule used no new save/privacy/custody/seat/HTTP or full6,500-suite assurance campaign. Final rules/valid-combination/recovery/ privacy/custody/administration/deployed acceptance remains required later. Final coherent rule/guide26/26, types/lint (check:quick), build and expanded 390px guide pass. Changed canonical document links205/205 are valid; owned temporary rule drivers and managed tab/service are removed/closed.

Code 288870c842 was pushed. Mandatory CI36949291343 and job110658387235 completed/success for that exact SHA. Existing isolated storage/HTTP verification passed before publication of ghcr.io/quintine/dune:sha-288870c84289bb1172bd8e21dac046fbab3b5704. No deployment was performed; live ab5c782 remains the last observed marker.

2 October 2026 — rules-first development throughput and compact context

The user prioritizes full rules implementation, with comprehensive review, save/recovery, privacy and custody assurance afterward rather than per-feature gates. Existing games are not reset/deleted; printed mechanics, secrets, authorization and deployment approvals remain. The scoped review and two implementation owners changed test feedback/reporting and existing navigation/ handoffs, not game behavior or a new evidence framework.

npm run check:quick runs types/lint only. Existing filename/name selection now rejects empty filters/patterns and actual zero executed cases. Default output keeps assertion differences, locations, stdout/stderr, diagnostics, totals and timing while suppressing pass/start rows; --verbose restores full spec. Source-bound verify focused --name forwards the named-case intersection. SIGINT/SIGTERM remain failures even if the driver exits zero. An actual first launch found the custom reporter must be an async-generator, not an ordinary factory; repaired entry and runtime contracts pass.

Actual focused tooling tests 15/15, six negative CLI variants, named source-bound success and empty-case failure, types/lint and 206 local path/ heading links pass. Final scoped static review has no finding. Same15-case native rule file: concise 278 bytes/12 lines/2.35s; verbose 2,455 bytes/ 27 lines/2.36s. This reduces output, not rule computation. Named Carthag feedback 0.90s, discovery-only list 0.18s; earlier162-case union 100.22s has different coverage, so no speed factor is inferred.

Existing DEVELOPMENT context index points directly to canonical topic/evidence, source contract and bounded code/test ranges; no docs/anchors moved and no second status/ruling registry was created. Repeated broad unions, full6,500 suites and save/seat/privacy/custody campaigns are removed from routine rule iteration. Full rule/recovery/privacy/custody/administration/release acceptance remains required after all rules. Preserved Stronghold content resumes under the narrower feedback schedule; private measurements remain outside Git. Code e9830b6ced is pushed. Mandatory CI36941218637 and job110632894258 completed/success for the exact SHA; isolated storage/HTTP verification precedes publication of ghcr.io/quintine/dune:sha-e9830b6ced80c95253cfa112bb8ed2eb6e50b74c. This existing pipeline proof does not create a local assurance rerun or deployed/full-rule claim.

2 October 2026 — genuine native Ixian/CHOAM Stronghold rule integration

Fresh stronghold-factions reuses the native Advanced setup for Ixians and CHOAM plus classic2..6 seats, exact combined47-card deck and six Stronghold Cards alone. No public expansion start, existing-game retrofit or other overlay. Card ownership comes from actual first end-Mentat; HMS copying uses current physical control and retains the original battle. Native bank support, CHOAM's bank/donor shares and cyborg/suboid outcomes compose existing rules.

Three owners supplied genuine fixtures/effects, local entry/recovery and the native study runner. Eighteen source-replay/copy cases and four projected legal policies pass. Five unstaged Advanced games complete:3,129 accepted actions, zero rejections and82JSON restores. Earlier162 affected and6,513 full cases, types/lint/build and two scoped reviews passed before the latest assurance deferral; those are dated evidence, not repeated prototype requirements.

Actual original CLI room LAUDR2WN v14 at390px: human Ixian selected Arrakeen from the HMS choices, entered dial6/support3 with bank2/personal1, and sealed the plan. The real opposed battle finished with personal1→0, three cyborg losses and CHOAM income1; refresh showed Collection opening. Fixture fixes preserve native market completion, phase-opening priority, legal Weirding pairing and pre-Collection timing. Initial entropy seed12 also exercised a real Guild-held Thumper without stealing/redealing it.

Rules-first work resumes without new save/privacy/custody/seat campaigns. Ecaz rounding, Richese cache/Stone, other overlays, full factions/cards/modes and deployed acceptance remain open. Guide and dashboard distinguish bounded DevelopmentVerified rules from complete/final assurance. Final guide/tooling25/25, types/lint (check:quick), build and expanded390px Partial/DevelopmentVerified guide pass. Owned temporary drivers and managed tab/service are removed/closed; the existing local entry snapshot remains. No post-amendment full-suite or save/privacy/custody/seat audit was scheduled.

2 October 2026 — normal Spice Banker final-bank income and native Mentat collection

Three exclusive implementation owners connect the fresh banker-income classic2..6-seat Basic/Advanced base33/all14-skills-only profile. Parent integrates the small public notice/source guide, actual proof and shipping. Three is the useful slice count, not a five-agent minimum.

The photographed normal band gains1 additional bank spice when ANOTHER payer makes ONE actual bank payment of at least4, once per physical card, turn and phase. Native paid auctions (including Emperor self-purchase), ordinary/cross/return shipment, actual paid force/leader/KH/Emperor-extra revival and resolved support use their original final bank portions. Real counter-free allowances remain automatic; actual held counters retain native suspension/cancellation. Income paid to a player, free/stopped/waived sources, self-payment and smaller individual payer legs do not qualify. Distinct source/payer legs and lower Banker spending never pool into4. Original money/recipient/card/force/suffix costs finish once; deferred income does not fund its source or any pre-Mentat spending.

New grants follow the actual living available trainer and post-battle survival/posture, not hidden pre-reveal plans. A physical-card stamp cannot reset through death/return/reassignment. Already-earned currency stays with its ORIGINAL gaining faction under an explicit conservative LOCAL policy; the earlier death/capture question and universal split interpretation remain open. Real Mentat atomically marks and credits all uncollected grants once before optional actions/victory. Closed fixed-size consistency history does not depend on today's wallet/trainer/card; no arbitrary read heal or fictitious persisted half-phase8 collect choice is used. Public projection exposes only physical owner/count and current-phase use, not source invoices.

Integrated verification reproduced and repaired nonbattle trainer completion, Emperor own-auction final recipient and secret suspended-invoice projection. Genuine fixture repairs distinguish economic payer from final auction actor, native Harkonnen free2/cost2 from Emperor free1/cost4, KH revival cost2, actual skilled death/revival offers and already-held weapon custody. Native bounty/Collection quotes replace incorrect gross-wallet cost assertions. Two final independent money and recovery/privacy reviews have no finding. Types/lint, 6,487 offline tests, 140 focused Banker/profile cases and build pass. Eighteen native payment/trainer/threshold cases conserve all33 Treachery Cards/14 skills through original source and actual Mentat. All four minimal legal policies preserve available-budget actions with deferred money.

Original private-backed-up six-seat CLI rooms 6VZ8G5BY Basic v38 and 8TN8BTLT Advanced v31 retained native setup/decks/offers/identities/circles. Human390px native Emperor self-auction and Guild own-bank shipment/allow earn1 while wallets stay unchanged. Refresh retains the physical notice; actual final Collection readiness opens Mentat once (Banker10→11 and3→4). Phone evidence caught a26px player-strip notice squeeze; moving it into the main column gives354px width. Necessary isolated-worker reload preserved Basicv14/Advancedv13 continuation before further actions. All card/skill/ normal and elite force inventories are conserved;23 prior isolated QA rooms' states/versions are unchanged. Final guide10/10, types/lint/build and expanded 390px Partial/DevelopmentVerified guidance pass. All82 original saved seats across25 targeted QA rooms restore after final guide-worker reload; the two Banker rooms remain at native Mentat without double collection. Local HTTP is 49/55 with six existing upstream503 rejection failures, not green. Owned temporary drivers are removed; private inputs/backups remain outside the checkout; final frozen check after phone repair again passes all6,487. Code 6785e622a7 is pushed. CI36923901367, container job110576362446, completed/success for that exact head SHA. The mandatory isolated storage/HTTP verifier succeeds before verified-image publication: ghcr.io/quintine/dune:sha-6785e622a7bc8b850aa5e3d338c63be5a33a9403. No skipped verifier or deployment is inferred. Full skill/module, combined-mode and deployed acceptance remain open; local49/55 is still not green.

2 October 2026 — original Harkonnen Nexus traitor retirement and Mentat replacement

Four exclusive implementation owners connect fresh local harkonnen-betrayal: native personal/allied calls and original continuation, pure physical/current/ historical obligations, private controls/four minimal legal policies, and authenticated SQLite/private-backed-up CLI entry. Parent integrates source guidance and raw administrator progress, all verification and shipping. Four is this wave's useful slice count, not a restoration of the removed five-agent minimum.

The photographed printed face cancels one revealed Harkonnen traitor, returns that exact physical identity immediately and draws one replacement during Mentat Pause. The profile admits native Harkonnen plus unique classic 2..6-seat Basic/Advanced, base33 Treachery and Nexus alone. No initial Nexus deal, old-game retrofit, public start or optional/expansion overlay. Genuine alliance-qualified closing Nexus rights remain; effect fixtures need at least three seats, with four for two simultaneous unallied receivers.

Original allied Harkonnen Karama/BG counters resolve first; native denial opens no Nexus gate or cost. A personal call gains no invented counter. After genuine allowance, publicly declare the actual canonical matching traitor and roles before outcome; every publicly possible unallied non-Harkonnen held-Nexus owner acknowledges uniformly. Private face controls only own Use. The local ordering/privacy convention is provisional, not publisher/user priority or an answer to the previously asked universal reaction question. Outside-profile Harkonnen Betrayal and arbitrary combined stacks remain gated.

Use spends one physical Nexus, shuffles only that called Harkonnen traitor into the actual reserve, prevents only the original call and resumes the surviving battle once. All-pass retains both cards and original call. One successful-Use obligation survives to real current Mentat opening, where the actual reserve top is drawn privately once before optional work/victory. Final Collection readiness and Mentat opening are atomic; no fictitious persisted due-phase8 auto-recovery state is used. Nonrecursive history binds each Use even after later passing/recycling, without permanent retired-card custody or a second action/confirmation. Returned-card redraw remains legal.

Initial integrated checks exposed missing typings, an invalid Polar Sink battle fixture, unwanted optional prescience commitments, incorrect two-receiver wrong-face assumptions and a test that mutated empty counter passes to the same empty array. Parent retains native source guards: choose conserved legal sand staging/native declines, explicit distinct singleton receiver faces and genuine live original counter evidence. Native counter-free automatic allowance remains legal rather than forcing a false pause. Independent review repaired an orphanable native allowance: it now requires its exact pending or closed acknowledgement. The public declared-Traitor inspector reuses the existing entitled component; original/current replacement identities remain correctly private. Both final scoped native and privacy/ administrator reviews have no finding.

Parent typecheck/lint and 6,401/6,401 offline tests pass; the affected eight-file union passed 138/138. Final reference 10/10 and build pass. Actual program smoke exercises eight Basic/Advanced personal/allied Use/all-pass paths plus two irrelevant-face partial-pass/refresh paths, from original true call/counters through actual native battle/Collection/Mentat. Separate printed and Advanced BG Worthless preemption spend native fuel once and preserve the original Trait/Nexus stock, with no Nexus offer, cost or replacement.

Four exact-version private-backed-up CLI rooms retain their actual admitted undealt setup, identities/circles/decks and native Nexus rights; no redeal:

• SHMPQ4FK v14: Basic personal human Use; actual Lady Jessica Traitor and own Harkonnen Nexus inspectors, immediate exact retirement and one private actual reserve-top Mentat draw.
• ZAYDHGTU v15: Advanced allied human Use; caller and Guild beneficiary remain distinct, Thufir Hawat declaration prevented and replacement once.
• 3ZLRKAYB v19: Basic allied two-receiver wrong-face human Pass/all-pass; Richese/Guild cards retained. Partial v11 refresh and raw administrator projection agree on sole remaining Guild, without private source disclosure.
• GBFG2C75 v16: Advanced personal wrong-face human Pass; original Soo-Soo Sook traitor outcome and native capture/Collection suffix retained.

Original remaining native votes/cleanup/readiness continue through the real HTTP API to Mentat, not a scripted phase jump. Read-only saved proof retains all33 Treachery/all12 Nexus/Traitor identities, typed forces, original names/ circles, exact returned identity and one private pre-Mentat reserve-top draw. Activation has no spice/force/Treachery cost; legitimate battle/income effects are preserved, not hidden in an incorrect unchanged-wallet assertion. Nineteen earlier QA states/versions remain unchanged. Actual 390px public declaration/own-card inspectors and Use/Pass controls are observed; panel width is 354px. After final isolated worker reload, all 70 original seats in twenty-three QA rooms reauthenticate and all saved outcomes remain unchanged. The actual expanded guide displays Partial / Development: Verified.

Current local HTTP integration is 49/55, not green: six requests returned the known Wrangler proxy 503. No automatic write retry, authorization weakening or reset. Complete Harkonnen/Nexus games, universal reaction policy, combined modules, strategic calibration, public starts and live deployment remain open.

Code checkpoint 1cf8ff72c7 is pushed. The source-bound workflow 36890229643 and container job 110463692950 completed/succeeded for that exact SHA. Mandatory Verify isolated storage and HTTP behavior passed before Publish the verified image succeeded. The configured immutable image is ghcr.io/quintine/dune:sha-1cf8ff72c721691f1924e2f27db5936ce79dd4d2. No unobserved CI case count or deployment is inferred; local 49/55 stays not green. Protected NAS snapshot, human safe point and exact point-of-risk interactive approval remain unavailable. The last observed live marker is ab5c782; no saved-game reset or provider-approval bypass follows.

1 October 2026 — Advanced leaderless declaration before reveal

The supplied authorized Advanced PDF, physical page 11 Leaders, requires announcement before reveal when a player cannot use a leader and is not playing Cheap Hero; that plan may include no Treachery Cards. Current validation already enforced leader availability and empty card slots. Its accepted plan lacked the public announcement. Parent rejected a historical scout claim that live Homeworld combat was disconnected: the later runtime checkpoint already connects that path. No duplicate Homeworld implementation was introduced.

Advanced sealing now appends the public announcement before ordinary reveal or the original special full-plan read continuation. The public view derives only leaderless submitted player IDs from the existing sealed plans; no second saved flag or authority is created. A shared pre-reveal table notice names the declared combatant while keeping dial, support and other choices private. The original plan guard prevents duplicate submissions and announcements. Basic behavior remains unchanged by this Advanced-source cutover. Existing legal bots, Voice, Prescience, full-plan inspections, combat and casualty continuations are retained.

The meaningful privacy regression fails before the implementation with missing public announcement after an actual legal seal; it passes afterward, retaining opponent/observer masking, JSON refresh, read immutability, duplicate rejection and original reveal. Parent types/lint and 6,316/6,316 offline cases pass; the selected ninety-file union is 1,025/1,025. Final reference 10/10 and build pass.

Actual native normal Advanced-preview start/setup plus a conserved staged battle with previously used living leaders exercises legal rejection, one pre-reveal declaration, JSON normalization, duplicate rejection and canonical thirty-three card/typed-force conservation. The stage is not a claimed natural full game. Fresh exact-version private-backed-up room 3Y5U53RW starts through the real HTTP preview action, keeps its actual setup/dealt cards/identities, then exercises 390px human Emperor leaderless sealing and the opponent's refresh. The other plan stays private until human Atreides sealing; original Traitor declines advance to Collection v9 once. Read-only saved proof confirms one chronicle announcement before reveal, all cards/typed forces, unchanged identities and the original single native Arrakeen income, not a fictitious unchanged setup wallet. The ready phone notice is 354px wide within a 390px page. The actual guide explains this timing; all 57 original seats in nineteen QA rooms reauthenticate. No reset, public-mode change or deployment is performed.

Code checkpoint 44d90bb9ae is pushed. Exact workflow 36862512991 and container job 110369907670 completed/succeeded for that exact SHA. Mandatory isolated storage/HTTP verification passed before verified image publication. Immutable tag: ghcr.io/quintine/dune:sha-44d90bb9aea4032fb8ffda51daa64cc53d11d7f8. Publication is not deployment and supplies no unobserved CI case count.

Existing genuine faction-games CLI continuation, seed 20261001 and a 3500-action bound, reports all ten classic Basic/Advanced 2..6-seat games complete with unchanged source and custody/JSON checks. The combined Homeworld/Nexus four-sample run completes six-seat Advanced and five-seat Basic; six-seat Basic and five-seat Advanced stop at turn-six CHOAM Charity. Captured actions reject on the existing unresolved low-Tupile opening-income guard, without mutation; automatic normalization preserves the same pending source. The supplied PDF's physical pages 8/22 do not resolve that recorded modifier question. The guard remains; no fallback, automatic cancellation, fabricated payout or reset is introduced. These native samples establish their actual continuation only, not complete factions/modules or strategic AI.

1 October 2026 — Ixian Nexus Betrayal at original native attempts

Fresh local ixian-betrayal integrates native Ixian Bidding inspection/draw in Basic/Advanced and Advanced Technology exchange before the native effect. It admits unique 2..6 seats with native Ixians and otherwise classic/Tleilaxu, the physical Ix47 Treachery Deck and Nexus alone. Natural alliance-qualified Nexus draw remains required; no initial deal, old-save retrofit or public start is enabled. Richese/special lots and wider modules remain excluded.

Actual native printed/BG Karama counters resolve first. Native denial spends no Nexus and opens no new gate. After all native passes, every publicly possible unallied non-Ixian held-Nexus owner gets a face-neutral acknowledgement. Privately eligible Use spends the actual singleton Ixian Nexus and prevents only this attempt; all-pass allows the original native transition once. Exact source/context/canonical stock/history checks reject stale, foreign, orphaned or changed committed parents without mutation. Nonrecursive history retains bounded serialization and later physical card recycling. Bots consume only canonical private Use/Pass projections; strategy remains uncalibrated.

Independent review repaired original BG Worthless-Karama response ownership, retained native Harkonnen hand-exchange suspension, and restored the existing Technology fizzle when a legal pre-offer exchange removes the declared card. The spent native attempt stays used; no swap, Nexus spend or fabricated gate follows. Already-open Nexus source corruption still rejects. Administrator progress now uses only public unfinished acknowledgements, matching the player table instead of the original ordinary bidder; independent autopilot controls remain available during reactive gates. Both final scoped reviews report no findings.

Parent verification: types/lint and 6,315/6,315 offline tests pass; the affected nine-file union is 167/167. Final reference 10/10 and build pass. Actual scripts exercise eight Basic/Advanced allow/prevent/partial-pass scenarios plus both genuine BG Worthless counter interruptions; public administrator ownership goes from two responders to the actual sole remainder. Four exact-version private-backed-up CLI rooms continue their actual undealt setup without redealing, then declare/respond through the real HTTP API:

• MVLVQHVB v11: Basic Bidding human Use spends Nexus, draws only the normal allocation and resumes the original auction without private Ix inspection.
• T2XSABT4 v11: Advanced Technology human Use retains the selected hand card and unseen lot, keeps the attempt spent and resumes original inspection.
• QBVHGDD5 v13: wrong-face Bidding Pass retains Nexus, then human Ix returns Shield from the genuine extra-card inspection and declines Technology.
• 7NKT45P7 v14: two wrong-face receivers Pass; partial refresh preserves the first acknowledgement and exposes only the sole public remaining owner. All-pass performs the original physical Technology swap once.

Actual 390px controls/own inspector/refresh/native suffix and final expanded Partial / Development: Verified guide are observed. Read-only saved proof retains all forty-seven Treachery/twelve Nexus cards, unchanged spice/force cost, exact native suffix/history and fourteen earlier QA games. After the necessary final isolated worker reload, all 55 original seats in eighteen rooms reauthenticate and all saved outcomes remain unchanged.

Current HTTP integration is 52/55, not green: three admin/discussion requests returned the known Wrangler proxy 503. No unsafe write retry, authorization change, game reset or deployment workaround is introduced. Complete Ixian/Nexus games, wider modules, public starts, strategic calibration and live acceptance remain open. The user removed the five-agent minimum: future waves choose useful agent count for speed and integration cost.

Code checkpoint cdfe0e5370 is pushed. The source-bound workflow and container job 110357305474 both completed/succeeded for that exact SHA. Mandatory Verify isolated storage and HTTP behavior passed before Publish the verified image succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-cdfe0e5370d6fd9f6844f064bafd8198ce897252. No unobserved CI test count or deployed acceptance is inferred. This publication is not a NAS deployment; protected snapshot, human safe point and exact point-of-risk interactive approval remain unavailable.

1 October 2026 — exact Ixian Nexus purchased-card replacement

Five implementation lanes integrated runtime, pure source/custody/history, actual controls/four minimal legal bots, authenticated SQLite/CLI entry and existing source guidance. Fresh ixian-replacement admits unique classic 2..6-seat Basic/Advanced with base Treachery/Nexus alone; no public start, existing-game retrofit or wider-module activation. Normal paid and actual printed Karama purchases, including direct zero-bid free acquisition, are connected. Harkonnen buyers and Richese/special origins remain guarded by their material priority/source questions. Native Ixian allied replacement remains a separate ability, not an alias or a Nexus Karama response.

The typed source binds the exact canonical purchased physical ID, original normal lot/payment and independently progressed cursor before Nexus cost or draw. A publicly possible unallied held-Nexus buyer receives a uniform neutral choice, regardless of private face. Only that buyer receives its owned purchase and canonical eligibility; rivals get no face, private price, deck, receipt or blocked reason. Use spends one physical Ixian Nexus, discards that purchase first, draws the actual deck top and continues the native sale once; Keep retains both cards. No refund, extra fee or re-auction. Full hands and recycled same-card draw remain legal. Own-seat control is independent of the pending gameplay lock.

Initial fixture failures assumed a Nexus draw without an alliance. Native publisher semantics were preserved: no initial deal or automatic empty-hand draw, and a qualifying closing phase requires a settled alliance. Genuine nonrecipient allies now open the draw. Original rosters are selected before creation, not added to an admitted game: effect scenarios need three seats, or four for simultaneous unallied recipients. The initializer still admits two-seat base continuation without inventing an unreachable Secret Ally. CLI-produced undealt native setup continues without reinitializing/redealing.

Independent review found recursive history and an enabled-but-dropped Take back control action. Actual nine-Pass reproduction grew to 7,030,825 bytes; bounded nonrecursive event/outcome/replacement head links now use 134,145, with a permanent linear-history/corruption regression. Actual 390-pixel before-fix Take back control sent no POST and retained Easy; after-fix it sends one 200, restores the same seat controller and retains the same paid event. Both final source/persistence/privacy rereviews are clean. Exhaustive decision dispatch/shape consumers are migrated, and incidental attribute-order/attempted-SQL-write pins are removed rather than re-pinned.

Counterfeit depleted tests inflated the allocated row. Those were replaced with a captured native six-seat seed-11 turn-five payment source reached by real auctions, legal Battle Plans and winner discards: seventeen held cards, twelve discards, four reserved lots, empty draw deck, exactly all 33 cards. Actual payment plus controlled native shuffle proves original-card redraw and existing-discard draw while keeping unsold lots and force stock intact. The permanent JSON fixture is synthetic QA source, not human game data.

Final broad check passes types, lint and 6,227 offline cases. The six-file selected union passes 73/73; final reference check 10/10 and build pass. Fourteen actual standalone native Basic/Advanced paid/free Use/Keep, wrong-face, full-hand and two legal depletion outcomes preserve original ledger, Treachery/forces/elites, Nexus cost, JSON and repeat rejection. Authenticated SQLite covers original payment through restart, Pass/Use CAS, foreign/revoked credentials, private-face parity, source/cursor corruption, zero durable rejection and later physical recycling.

Actual ready rooms GTCHEGKU, JUXLJXHC and HJ5Q64T5 entered once by exact-version CLI with private consistent backups, then continued the same native setup/IDs/circles before real API payment and phone choices. Basic paid Use changes buyer 10->8 and Emperor 10->12 exactly once; Advanced printed free Use keeps buyer 12 and skips purchase income; irrelevant-face Keep retains its original physical purchase and Richese Nexus, with no Use or Ixian inspector. Inspection, native income and refresh work. Read-only saved proof conserves original native Treachery/Nexus/force/elite inventories and eleven prior QA rooms. All 42 original seats in fourteen rooms authenticate after required isolated build reloads. Actual expanded internal guidance retains Partial / Development Verified boundaries.

Local built-worker HTTP is 51/55, four known POST 503s, not green. No unsafe retries, authorization weakening, database reset or deployed acceptance is inferred. Broader Ixian/Nexus effects, special origins, Harkonnen priority, combined games, strategy and public/live gates remain open.

Code a2b04dbfba13eeb913c93de87981a58cb6b7d99d is pushed. Workflow 36829040552 and container job 110261177048 report completed/success for that exact source. Mandatory isolated storage/full HTTP verification and subsequent verified-image publication steps both succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-a2b04dbfba13eeb913c93de87981a58cb6b7d99d. This is source-bound publication, not live deployment or invented CI counts.

1 October 2026 — authorized Advanced Storm and allied separation defaults

Five implementation lanes connected the user-supplied revised Advanced source's physical pages 6, 15 and 40 without a source-fork profile or reset. Every newly opened post-first Advanced Storm draws one of the six canonical faces, even without Fremen. First-turn wheels, Basic's protocol and an already recorded current opening remain unchanged; native Fremen alone keeps cancellable private foresight. Public inspection retains the original card face when Weather Control changes actual movement.

A focused canonical policy now quotes the ending player's own shared territories in Advanced without the later-ally/formation-turn grace period. BG advisors are exempt in both directions; native Ecaz and Polar Sink coexistence remain. Basic retains its earlier deadline and formation policy. Native ordinary/deferred endings keep force, elite and concealed No-Field custody, with preflight before parking a retiring Ornithopter. The own clean-turn warning exposes public names only, not counts or source receipts, and adds no forced-loss confirmation. It is a block-layout semantic output; all existing pending controls retain priority.

Independent frozen rules/storage reviews have no finding. Full verification initially found 40 consumers assuming missing original Storm frames or superseded Advanced timing/dial protocols. Four repair lanes retained counter/SQL/privacy/custody coverage, migrated native phase progression and removed an incidental HTML-role pin. Genuine ordinary overlaps use paid Emperor/Atreides Basin groups in opposite sectors separated by first Storm 10, then a natural Nexus alliance; no allied-entry guard was weakened. A permanent captured real 8a562991 Advanced dial save is genuinely Advanced, not a Basic-flag flip, and preserves its original continuation.

npm run check passes types, lint and 6,169 offline cases; the selected 17-file union passes 339/339, and production build passes. Standalone runtime covers seven Advanced loss/exception scenarios, Basic new-alliance preservation and prior recorded dials followed by a new no-Fremen Deck opening. Authenticated SQLite covers first/next Storm, private foresight, restore, concurrency, owned losses, Hajr, exceptions, corrupt sources and durable rejected-action immutability.

Actual admitted previews CA6FVKVD, PTSMVMDY and U5335T2L were privately backed up before exact-version native preparation, retaining the same room, rules, circles, IDs and credentials. Phone-sized human first/later ending sends only Emperor's two physical forces, including one elite, to Tanks, leaves its ally intact and survives refresh. No-Fremen turn-two inspection shows the drawn five-sector face; human confirmation moves Storm from one to six and refresh retains Spice Blow. The final warning is a 354-pixel block within a 390-pixel viewport. Actual expanded guidance exposes the contract and Partial verification boundary. Read-only saved proof conserves original native setup inventory and cards; eight prior Guild rooms are unchanged. All 33 original authenticated seats in those eleven QA rooms restore after required isolated build reloads.

Local HTTP is 51/55, four known Wrangler-proxy POST 503s, not green. No POST retry/auth weakening or database reset was added. The user-owned 44-page PDF remains local/unpublished, including its retained 2.2 editorial heading versus 2.3 filename/metadata. Broader source differences, full modes, strategic AI, public gates and final-revision live acceptance remain open.

Code e1056a4db0a546400fd9a4461507f93ae6ca57d2 is pushed. Workflow 36814701820 and container job 110217121688 report completed/success for that exact source. The mandatory isolated storage/full HTTP verifier and subsequent verified-image publication steps both succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-e1056a4db0a546400fd9a4461507f93ae6ca57d2. No unpublished CI counts/timings or live deployment are inferred.

1 October 2026 — full funded Guild Nexus Betrayal payment

Five implementation lanes integrated engine, pure funding/custody/history, actual controls and four minimal legal bots, authenticated SQLite recovery and source guidance. Fresh exact-version/private-backup guild-betrayal entry supports classic 2..6-seat Basic/Advanced with native Guild, base decks and Nexus, optionally genuine lobby-enabled Homeworlds; no retrofit/public gate.

Typed reserve, native Guild transport, Homeworld and Junction adapters pause before the original fee/force commit. Actual eligible singleton Guild Nexus spends once; the same payer/authorized escrow funds the full original amount and the holder replaces bank/Guild/occupied-Junction income. Own payment requires existing funds before the later refund; it is not free financing. All-pass leaves native routing unchanged, while free/stopped transport creates no award or Nexus spend. Public possible held-card presence controls neutral acknowledgements, not secret identity; event-only private Use adds no otherwise private price/source or inspector entitlement.

Independent review found an accepted Advanced Richese Secret Ally parent whose resumed shipment failed. Actual reproduction proved spent Nexus and undelivered source; its unsupported offer now blocks before card/parent commitment. A shared native Guild/reciprocal-ally grant is independently revalidated on declaration, restore and commit, separate from purchased rates and protected returns. Both final scoped re-reviews have no finding. Fixture current quotes/native turn progression preserve actual storm rules; real SQLite total_changes excludes durable rejection writes while permitting credential-fenced zero-row CAS. Same-source private-face swaps and existing physical-card allocation repair randomized fixture assumptions.

Final npm run check: types, lint and 6,114 offline tests pass; production build passes. Selected related checks pass 147/147 in nine files. Eighteen standalone Basic/Advanced paid/free cases prove full fee, upfront own refund, donor escrow once, exact native forces and JSON repeat rejection. Authenticated SQL covers all adapters, self-re-signed revoked native grants, corrupt/orphan receipts, privacy, races and later recycling.

Eight actual ready QA rooms were privately backed up and entered once by CLI, retaining the same authenticated seats and admitted code/roster/setup. Real setup/native phases and source declarations preceded 390-pixel controls: Basic own refund, occupied low-Junction whole fee, Guild return and all-pass; Advanced Homeworld bank fee, donor escrow, native Junction and free Fremen. Non-holder Pass has no private Guild inspector/Use. Own inspector, actual contextual guide link and refresh pass. Read-only database proof matches all eight original native force suffixes, exact spice/escrow/card ledger and closed receipt. No existing human games or credentials were reset.

The user supplied the root unofficial Advanced 2.3 PDF as a source of truth. Its 44-page metadata says 2.3 while the rendered editorial heading still says 2.2; exact SHA/physical-page authority and material future Advanced reconciliation targets are recorded in RULE_DECISIONS/DEVELOPMENT and local goal guidance. Relevant Guild/payment/Homeworld/Nexus clauses were compared; this does not certify that all Advanced differences are implemented. The user-owned local PDF is preserved, not republished as an app asset.

Local built-worker HTTP is 48/55, five POST 503s and two timeouts: known Wrangler-dev limitation, not green acceptance. Code 8a56299155d0f12c8c4678bfbe5913be71fea5bb is pushed, and workflow 36798718410 reports completed/success for that exact source. Its mandatory isolated storage/full HTTP verifier precedes publication of ghcr.io/quintine/dune:sha-8a56299155d0f12c8c4678bfbe5913be71fea5bb. Live deployment is separate. Full Guild/Nexus/Homeworld, wider combinations, AI calibration and public/live release remain open.

1 October 2026 — source-aware CHOAM Nexus Cunning Kull

Five implementation lanes connected runtime, canonical fuel/receipt policy, real source/fuel controls and legal bots, authenticated SQLite recovery and internal source guidance. The safe fresh nexus-kull CLI admits native CHOAM plus classic 2..6-seat Basic/Advanced rosters with CHOAM/Ix Treachery and Nexus alone; it supplies no physical Sandtrout or new public/retrofit gate.

Use now requires source/event/card and private plays replaces old cards. Nexus declaration spends actual CHOAM Nexus once; canonical retained fuel is reserved until success. Distinct prevention keeps fuel but not Nexus and resumes the original once. Success discards fuel, retains the original and special once-use, and stamps the actor's activation ban. BG original interception remains before conversion; decline spends neither source cost.

Independent reviews found and repaired canonical self-authorization, native Nexus response discoverability through Kull parents, reserved parent fuel advertised as a nested counter, and loss of CHOAM winning-payment coverage. A retained Karama's canceled Cunning effect is not ordinary payment ineligibility. Verified old printed counter saves receive a bounded immutable source-binding migration; malformed signatures and new Nexus missing-selection frames still reject. There is no source-omitting action shim. Fresh setup's Ix Treachery requirement no longer accidentally admits Sandtrout.

Final npm run check: types, lint and 6,022 offline tests pass. npm run build passes. Engine/production authenticated SQLite cases include native Atreides, Sardaukar, advisor and Guild parents, BG overlays, actual auction payment, races, no-write corrupt/orphan rejection and later recycled custody. The existing Fremen remote-Cunning pre-offer scope guard remains; native special summon and its unsupported remote offer boundary are exercised. Both final scoped independent re-reviews report no remaining finding.

Four actual CLI entries continued owned ready QA rooms from version 5 to setup 6. Genuine setup/Storm/Spice completed before conserved pre-action resources were arranged. Standalone runtime and 390-pixel controls prove Basic/Advanced weapon fuel success and distinct prevention. Actual selectors and separate fuel/Nexus inspectors pass; rivals see no private fuel inspector. Success retains Karama/BG Baliset and bans activation; prevention retains fuel, spends Nexus and resumes original shipment/conversion. Refresh/direct saved-state proof retains full physical inventory, exact source history and unchanged spice. No existing human games, seats or credentials were reset/modified.

Current local built-worker HTTP is 49/55: four POST 503s and two timeouts retain the Wrangler-dev limitation, not green local acceptance. Code 0d9d0a72d63b29d93161857cee2d1a2cd6acd7e3 is pushed, and workflow 36770260638 reports completed/success for that exact revision. The mandatory isolated container verifier runs full HTTP/storage checks before publishing ghcr.io/quintine/dune:sha-0d9d0a72d63b29d93161857cee2d1a2cd6acd7e3. Live NAS, wider modules, full CHOAM/Nexus games and calibrated AI remain open; publication is not deployment and no public gate changes.

30 September 2026 — bounded Richese Nexus Betrayal auction integration

Five implementation lanes delivered pure source/invoice/custody policy, typed prepayment engine continuation, human controls and minimal legal bots, authenticated SQLite recovery, and source-bound internal guidance. Fresh richese-betrayal entry supports Basic/Advanced paired CHOAM/Richese plus classic seats, the physical CHOAM deck and Nexus alone.

A public cache auction won by native Richese may be vetoed before payment: the exact intended card enters ordinary discard, nobody pays or acquires, and the original lot retires once. Another buyer's positive cache or concealed Black Market sale keeps the original price, authorized escrow split, physical delivery and earned Harkonnen bonus; only its recipient changes from Richese to bank. All-pass keeps the Nexus and settles the unchanged original purchase. Public held-Nexus presence determines neutral acknowledgement membership; actual identity affects only own private Use. Independent pending/completed cursor history binds saved source ownership and rejects orphaned frames before disclosure or SQL writes.

Independent review found and repaired donor escrow double-counting and a Harkonnen bonus path that skipped exhausted-cache preflight. Regressions cover a seller funding its buyer with zero unpledged spice and rejection of an unfinishable closing bid before any receipt, payment or delivery. Existing wording/incidental assertions were removed rather than re-pinned.

Verification: npm run check passes types, lint and 5,953 offline tests; npm run build passes. Eight focused files pass 80 cases, including both alternatives/all-pass, private timing parity, actual table controls, four legal bot profiles, JSON/production SQLite restart, competing Use/Pass, no-write rejections and later recyclable physical custody. Final independent economy and persistence re-reviews found no remaining scoped defect.

Actual prototype CLI started four owned disposable rooms from version 5 to setup 6. Genuine setup/bids created typed opportunities; a separate runtime smoke proves Basic/Advanced veto and cache/Black Market diversion. At 390 pixels, real controls prove Basic veto, Advanced all-pass, Basic cache diversion and refreshed Advanced Black Market diversion without an unknown-face inspector. Saved outcomes retain the original completed event, exact card custody and buyer/seller balances. No human games or seats were reset or modified.

Current built-worker local HTTP is 51/55, with three POST 503s and one Advanced-preview timeout; it is not green acceptance. Code checkpoint 9c0000e469935d9f0fae1605358d5e6a2617be56 is pushed, and workflow 36720704874 reports completed/success for that exact source. The checked-in workflow requires tools/verify-container.mjs, including the full proxy-free HTTP suite, before publishing ghcr.io/quintine/dune:sha-9c0000e469935d9f0fae1605358d5e6a2617be56. GitHub's job step array retained stale pending/in-progress entries despite its final success metadata; no individual step timings or test totals are asserted from that array. Full Richese games, hidden normal-deck self-buys, private special-Karama veto, broader modules and live NAS acceptance remain open; image publication is not deployment and no public gate changes.

30 September 2026 — opt-in printed Kull Wahad integration

Five implementation lanes supplied validated activation frames, phase/physical-counter policy, mounted human controls and legal bot participation, authenticated SQLite regressions and source-bound internal guidance. The kull local profile starts only a fresh ready Basic/Advanced CHOAM-plus-classic roster with CHOAM/Ix physical cards, without public expansion starts or optional modules.

A legal ordinary or prepared special attempt pauses before its cost. Every seat sees neutral CHOAM timing regardless of held Kull. The interrupted card stays held and reserved; Kull may be prevented only by another eligible physical card. BG interception precedes conversion. Decline or prevention resumes the original typed effect once. Successful Kull discards its native cost, retains the original, leaves a prevented special unspent and applies a turn/phase activation ban, not an ownership/transfer ban. Native denied Kull remains held but its physical effect is blocked for that phase.

The user deferred unpayable winning-overbid recovery. The preview privately refuses non-CHOAM unfunded bids before commitment, as well as affected activations before cost. The former late guard accepted a bid that the preview could not settle; a targeted smoke reproduced that boundary before the early-fence repair. Numeric UI bounds and non-preview bidding are unchanged; no free award, funding or auction restart is invented. Unproven live-promise cancellation/counter suffixes likewise reject before cost. Pending-frame reconciliation cannot release a suspended promise; Auditor traversal now includes the saved parent; orphaned Kull declarations fail before private views or partial SQL writes.

Focused rules/control/bot/SQLite regressions include real Voice and Auditor parents, distinct/BG counters, orphan rejection, promise-compatible costs, legal progress and profile safeguards. npm run check passed types, lint and 5,907 offline tests; the production build passed. Independent re-reviews of the repaired rules/privacy/persistence paths found no scoped defect. Direct Kull and local-profile CLI smoke passed.

In isolated phone-width Basic/Advanced browser rooms, the actual reactor used Kull, Basic's other seat allowed it, and the original card and phase ban persisted across refresh with no rate-control shortcut. Advanced BG's held original could not counter Kull; its distinct printed card prevented Kull and resumed the original BG conversion. Another cancellation was then declined through the refreshed CHOAM offer and retired the same saved parent once. Kull stayed held, BG's already converted card remained discarded, and no shipment rate or ban was fabricated.

Isolated Wrangler-dev HTTP passed 49/55: five proxy-layer 503s and one 15-second timeout. This is not a green local HTTP suite; proxy-free workflow 36706704939 passed the full isolated HTTP suite for aeae152 and published its image. Nexus Cunning Kull, combined modules and full CHOAM completion remain unfinished. No NAS deployment is claimed.

30 September 2026 — user-approved full-hand Semuta exchange

The user selected atomic acquisition/disposal at the faction hand limit. Engine commitment and private controls now allow a full hand; the claimed card replaces Semuta without increasing the completed hand. Already overfull hands still reject, and the pure exchange quote preserves incoming reservations. The obsolete caller-selectable free-slot policy was removed. Normal and Harkonnen capacity boundaries, physical conservation, private projection, JSON continuation and authenticated full-hand Trip recovery have focused regressions.

The same conversation approved Kull's distinct-card counter and pre-conversion BG interception, while deferring an unpayable winning-overbid remedy. These rulings are recorded in the decision index and source update; Kull runtime is not yet implemented by this capacity checkpoint.

npm run check passed types, lint and 5,854 offline tests; the production build passed. Independent review found no scoped defect. Direct engine smoke kept four cards before and after claiming Hajr. In an isolated authenticated phone-width QA room, the real full-hand seat showed enabled Commit, exchanged Semuta for Hajr and retained 4/4 after refresh. The throwaway staging script was removed. Isolated Wrangler-dev HTTP passed 49/55: five proxy 503s and one timeout. This local HTTP run is not green; proxy-free workflow 36684960601 passed the full isolated HTTP suite for 3285172 and published its image. No live NAS deployment is claimed.

30 September 2026 — Semuta after accepted CHOAM Jubba Cloak cost

In the explicit Richese preview, CHOAM's printed moving-storm Jubba Cloak now discards its named public Worthless card before a neutral Semuta reaction. No territory is protected and no storm casualties or spice clearing occurs before claim or all-seat decline. The saved receipt binds the selected territory, storm traversal, phase, CHOAM force custody and physical card. Claim or decline applies one protection then resumes the existing storm suffix once, including ordinary casualties and the next CHOAM market. A canceled card, Nexus conversion or competing parent retains its previous direct path.

Focused engine checks cover hidden-holder parity, JSON normalization, forged territory/storm/force/card rejection, physical custody, legal AI, one claim or decline and exact casualties/spice movement. Authenticated in-memory SQLite verifies seat views, restart, stale retry and storm completion. Direct engine smoke observed pre-protection card custody, one claim, CHOAM survival and the opponent's three losses in one traversed storm. Full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,853 offline tests; the production build passed. Independent rule review found no scoped defect. The built phone-width guide visibly described Jubba's before-protection offer. Isolated Wrangler-dev HTTP passed 50/55: four requests returned its proxy-layer 503 and one discussion request timed out. This is not a green local HTTP suite. Proxy-free workflow 36676105785 passed the full isolated HTTP suite for 98d556a and published its image. No live NAS deployment is claimed.

30 September 2026 — Semuta after proactive ordinary Trip cost

In the explicit Richese preview, an accepted ordinary Trip to Gamont Worthless response now discards its named public card before the selected opponent force leaves its board sector. Every seat sees the same neutral Semuta offer regardless of the private holder. A claim can take that physical card, and either claim or all-seat decline then returns exactly one ordinary force to reserves. The saved receipt binds target and location, original target force/elite/reserve custody, owner hand and suspended parent state. No second Karama response or duplicate force return occurs. Elite and No-Field returns, closing Mentat decisions, Nexus conversion and competing parents retain the existing direct path.

Focused engine checks cover hidden-holder parity, pre-return timing, JSON normalization, corrupted target/location and force custody rejection, single claim or decline, legal AI, physical cards and subsequent Mentat continuation. Authenticated in-memory SQLite verifies seat views, restart, stale retry, card custody and one actual force return. The full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,851 offline tests. After the in-app guide update, typecheck, lint and 18 focused reference/Semuta cases passed; the production build passed. Independent rule review found no scoped defect. A direct engine smoke observed the accepted public discard, pre-return custody, exact physical claim and single ordinary force return. The built phone-width rules guide visibly named Baliset and ordinary Trip before their effects. Isolated Wrangler-dev HTTP passed 50/55: four requests returned its proxy-layer 503 and one Advanced-preview request timed out. This is not a green local HTTP suite. Proxy-free workflow 36674543364 passed the full isolated HTTP suite for 953be21 and published its image. No NAS deployment or complete expansion claim follows.

30 September 2026 — Semuta after proactive CHOAM Baliset cost

In the explicit Richese preview, an accepted proactive Baliset response now discards the named public Worthless card before a neutral Semuta offer. The chosen player's movement restriction into the occupied CHOAM territory is installed only after claim or all-seat decline; shipment remains possible. The saved receipt binds target, territory, owner forces and hand, existing restrictions, phase and public card cost. It cannot replay the Karama response, restrict twice or remove the original mover's forces. Declared-move responses, Nexus conversion and competing arrival parents retain the prior automatic path.

Engine tests cover hidden-holder parity, pre-restriction timing, card/target/territory and occupancy custody, JSON normalization, one saved block after claim or decline, rejection without mutation, physical card conservation and legal AI claim. Authenticated in-memory SQLite checks cover seat projections, restart, exact stale retry, preserved seat rows and rejected restricted movement. A direct engine smoke observed a public offer, one physical claim and a turn-scoped restriction. Full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,849 offline tests, including 23 Baliset and 13 Semuta recovery cases. The production build passed; independent review had no scoped finding. Isolated built-worker HTTP passed 49/55: four Wrangler-dev proxy 503s and two 15-second timeouts. This does not certify local HTTP. Proxy-free workflow 36673190056 passed the full HTTP suite for 756af19 and published its image. No NAS deployment is claimed.

30 September 2026 — Semuta after proactive CHOAM La La La cost

In the explicit Richese preview, a clean proactive La La La Worthless response now discards its public physical card before a neutral Semuta offer. The selected target's remaining free force revival is blocked only after a claim or all-seat decline. A claimant may take the spent card; the block still applies once without a second response or card cost. Paid revival remains legal. The saved receipt binds the target, original Revival rules, owner/card custody and current phase. Reactive pending-revival requests, Nexus conversion and other Worthless effects remain outside this bounded reaction.

Focused engine checks cover hidden Semuta-holder parity, pre-block timing, target and Revival-rule corruption rejection, physical custody, legal AI claim, decline and paid revival. Authenticated SQLite checks cover restart, exact stale retry, seat/private-view continuity and a later paid revival. A direct engine smoke observed the accepted public cost, one claim and target block. Expansion and full Semuta gates remain open.

npm run check passed types, lint and 5,847 offline tests; the production build and phone-width guide inspection passed. Independent review found no scoped defect. An isolated authenticated browser seat displayed neutral Continue and held-only Commit, took the physical La La La, showed zero free revivals and a two-spice paid quote, and preserved that state after refresh. Direct Wrangler-dev HTTP passed 50/55 with four 503s and one timeout; proxy-free workflow 36671450678 passed isolated storage and the full HTTP suite for b130cff, then published its image. No live NAS deployment or production gameplay check is claimed.

30 September 2026 — Semuta after clean CHOAM Kulon cost

In the explicit Richese preview, a clean accepted Kulon Worthless response now discards its public physical card and opens the same neutral Semuta opportunity before adding CHOAM's turn-scoped movement range. A claimant takes that exact card; all-seat decline leaves it in the pile. Both paths add one range once and return the still-active mover to the same movement turn. The saved receipt binds the spent card, owner, prior bonus, hand and movement state. Reactive movement, fixed Ornithopter range, Nexus and other Worthless effects remain outside this bounded reaction.

Focused engine checks cover hidden-holder parity, pre-bonus blocking, legal AI claim, physical custody, forged receipt rejection, claim/decline and the resulting legal longer move. Authenticated SQLite checks retain the offer and exact bonus through restart, preserve seats/private views and reject stale replay. A direct engine smoke exercised the accepted card cost, one claim and resumed mover. Public expansion and complete Semuta acceptance remain gated.

npm run check passed types, lint and 5,845 offline tests; the production build and phone-width guide inspection passed. A targeted phase-five smoke after genuine Richese/CHOAM/BG setup also restored the active mover and one range bonus after a claim. Independent review found no scoped defect. Direct Wrangler-dev HTTP passed 48/55: six tests saw HTTP 503 and one 15-second Advanced-lobby timeout. The proxy-free container/full HTTP gate for this revision and live NAS acceptance are still open.

30 September 2026 — Semuta after completed CHOAM card sale

In the explicit Richese preview, a clean CHOAM market sale now pays its printed two- or three-spice income and discards the one publicly named physical card before a neutral Semuta offer. A canceled or invalid sale leaves its card in hand and creates no fresh batch. Claim or all-seat decline resumes the same CHOAM market choice without repeating income or disposal. The saved receipt binds owner, exact card, duplicate witness if used, earned balance and the open market. Concurrent market obligations and other sale families retain their earlier automatic paths.

Focused engine checks cover hidden Semuta-holder parity in outsider views, a quoted Worthless sale, income once, exact card custody, rejected altered receipts, legal AI claim and resumed market choice. Authenticated SQLite checks cover restart, stale retry, preserved seats and the next market decision. A direct engine smoke exercised the committed income, one claim and same market return. The public expansion and complete Semuta gates remain closed.

npm run check passed types, lint and 5,843 offline tests; the production build passed. The phone-width built-worker guide showed the sold-card timing. Independent review found no scoped defect. The direct Wrangler-dev HTTP suite passed 50/55: four origin/ validation requests returned 503 instead of expected 403/400, and one Advanced-lobby request timed out after 15 seconds. The proxy-free container workflow 36668822954 passed its isolated storage checks and full HTTP integration suite, then published the 4c07e1b image. This is not a live NAS deployment or production acceptance; no production game was touched.

30 September 2026 — Semuta before private Ixian ally replacement

The explicit Richese preview with the Ix expansion now interrupts a clean normal-auction Ixian ally card replacement at its original private discard, before the replacement draw. The buyer paid for the lot and accepted the alliance; every seat sees the same neutral Semuta offer without its card face or a named claimant. A committed holder can take the exact fresh card; claim or all-seat decline then draws one replacement for the buyer and finishes the saved sale/Richese cache continuation. The original buyer is the discarder, not the Ixians. Cache and Black Market sales, nested interactions and other private discard producers remain guarded.

An engine scenario through genuine three-seat setup checked hidden Semuta-holder parity in both outsider views, unspent deck order, physical custody, one replacement and legal AI claim. An authenticated SQLite scenario checked restart, owner-only controls, stale retry and the owed Richese cache choice. A separate direct engine smoke exercised a paid lot, one private reaction and the replacement. Normal expansion starts and full Semuta acceptance remain gated.

npm run check passed types, lint and 5,839 offline tests, and the production build passed. A phone-width browser view of the built worker showed the private-discard timing in the rules guide. Independent review found no scoped defect. The isolated built-worker HTTP suite passed 49/55; five origin/validation or ordinary-success requests returned 503 and one Advanced-lobby request timed out at 15 seconds. Full HTTP acceptance remains open. This code was not deployed to the NAS and no production game was modified.

30 September 2026 — Semuta after printed Karama winning-bid payment

The explicit Richese preview now stages a second normal-auction Karama discard when the winning bidder chooses its printed card instead of a spice payment. The bid and bidder are already fixed; the card enters the public pile before the same neutral Semuta offer. Claim or all-seat decline settles the reserved lot once, without charging bid spice, and preserves the following Richese cache offer. The saved receipt binds the bid winner, round, cache, deck and hand custody. Richese lots, Worthless conversion and nested responses stay outside this bounded reaction.

Engine and authenticated SQLite tests cover the winning decision, full bid above available spice, legal AI claim, JSON/restart continuation, forged bidder/round rejection, exact stale retry, physical card custody and the following cache choice. A direct engine smoke settled the printed card, lot and cache sequence. Public expansion starts and complete Semuta coverage remain gated.

npm run check passed types, lint and 5,837 offline tests; the production build passed. A phone-width browser view of the rules guide visibly included the winning-bid timing. Independent review found no scoped defect. The prior purchase checkpoint passed its container workflow's isolated storage/HTTP check and published an image; it is not deployed to the NAS. On this paid-payment build, a focused built-worker HTTP Advanced-lobby test timed out at its 15-second request limit; a separate direct QA-room create/join and two authenticated seat reads returned 201/200/200/200 with distinct seat identities. The prior full local HTTP suite passed 51/55; four origin/malformed-request cases returned 503 instead of 403/400. Full HTTP acceptance remains open. No production game was touched.

30 September 2026 — Semuta after printed Karama normal-auction purchase

The explicit Richese development preview now offers a neutral Semuta response after a clean printed Karama pays its public normal-auction purchase cost but before the reserved lot settles. A committed holder may exchange one physical Semuta for that newly spent card; all-seat decline leaves it in the discard. Both paths settle the original free purchase once, with the lot, round, cache, deck and hand custody bound to the saved receipt. A pending Richese cache offer after the normal auction remains owed. Richese lots, paid Karama bids, Worthless conversion, shipping and nested responses retain their automatic paths. Normal expansion starts remain gated.

Engine and authenticated SQLite tests cover the neutral offer, legal AI claim, reserved lot, spent-card custody, JSON/restart continuation, Richese cache suffix, stale exact retry and rejected altered receipts. An isolated engine smoke completed the purchase after the Semuta claim, placing the lot once, exchanging the printed card and closing Bidding. The wider Semuta discard inventory and deployed acceptance remain open.

npm run check passed types, lint and 5,835 offline tests; the production build passed. The isolated built Wrangler worker rendered the revised Semuta guide on a phone-width browser. Its HTTP integration suite passed 51/55 cases, including normal lobby and saved-seat flows; four existing origin and malformed-request cases received HTTP 503 instead of their expected 403/400. Those failures are not attributed to this purchase path, and the HTTP gate is not green. A separate standard Vite server startup timed out before it could host a rerun. No production image or game database was changed.

30 September 2026 — Owner-only manual integrity check

Administration → Operations now has a separate Run integrity check control. An owner-only request batches live owner authority with SQLite quick_check(1) and a bounded foreign-key existence query; the response contains only pass/fail and sample time. It exposes no database diagnostic, table, row, game state or credential and makes no repair. Refresh/owner changes clear stale browser results. A failed check advises a protected snapshot and private investigation, not automatic restore.

Focused in-memory SQLite tests verified healthy structure, an actual orphaned foreign key, unchanged seats and live-role demotion. Both query forms succeeded separately in a disposable Wrangler D1 store; an isolated programmatic Miniflare batch timed out, so it did not prove the combined workerd path. Local HTTP tests covered anonymous denial; the owner UI was visually exercised on phone width with explicitly mocked owner responses, not a real authenticated network integrity request. Independent rules/security reviews found no scoped defect. npm run check passed typecheck, lint and 5,833 offline tests; npm run build and 55 local HTTP tests passed. No production database scan or deployed revision was exercised. Disk capacity, backup restore safety, stalled-decision diagnosis and complete administration remain unfinished.

Follow-up isolated built-worker verification used a disposable migrated D1 database and provisioned owner: authenticated GET /api/admin/operations?integrity=1 returned only time and two pass flags (both passed). After inserting one orphaned test seat while the worker was stopped, the same endpoint returned sqlite: passed, foreignKeys: failed and no row details. The actual owner Operations page displayed both outcomes at phone width, including the protected-snapshot/no-auto-repair warning. The earlier programmatic Miniflare batch timeout remains an initial test limitation; this later workerd run proves the HTTP path locally, not the live NAS database or deployed revision.

30 September 2026 — Semuta after BG Charity Karama

In the explicit Richese preview, a clean printed Karama cancellation of Bene Gesserit Charity now pauses after its public card cost but before that extra charity response settles. A neutral all-seat Semuta offer can transfer only the used Karama to a different holder. Claim or decline restores the original response and finishes its cancellation once: BG's declared charity remains spent without granting spice or undoing CHOAM's earlier income. The new karamaBgCharityDiscard receipt binds the BG charity turn, saved response and physical card/spice custody. Previously saved CHOAM Charity and Inflation receipts retain their distinct kinds and signatures; Worthless conversion and other Karama uses remain automatic.

Focused claim/decline and authenticated SQLite restart/CAS checked owner-only projection, exact card transfer, unchanged balances and saved-seat parity. A direct production-engine smoke run observed the same outcome. Two independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,831 offline tests; npm run build and 55 local HTTP tests passed. The phone-width local guide rendered the new scope. No deployed revision was exercised. e9f9994 passed isolated container verification and image publication in workflow 36659099415; the live footer was separately observed at ab5c782, not this new source.

30 September 2026 — Semuta after printed CHOAM Inflation Karama

The explicit Richese preview now also pauses after printed Karama publicly discards to cancel a clean CHOAM Inflation response. CHOAM's placement attempt has already been spent; the token is not placed until the response settles. A neutral Semuta offer permits a different holder to claim only the used card, or all seats to decline. The saved Inflation receipt binds the attempt turn, absent token, original response and physical card/spice custody. Completion restores and cancels the response once; no Inflation token appears or same-turn attempt reopens. CHOAM Charity retains its existing distinct serialized receipt and signature so a saved pending Charity offer remains readable; a new Inflation receipt has its own kind.

Focused Charity/Inflation paths, authenticated SQLite restart/CAS and owner-only projections passed. A direct production-engine smoke run observed the neutral offer and recovered card without an Inflation token. Independent rules/privacy review found and resolved a saved Charity receipt compatibility regression; follow-up source review found no remaining mismatch. npm run check passed typecheck, lint and 5,829 offline tests; npm run build and 55 local HTTP tests passed. The phone-width local reference rendered Inflation scope. No deployed revision was exercised. Other Karama uses, pending rewards, normal Richese starts and publication acceptance remain gated. Container workflow 36657454120 for the previous d9c67ca checkpoint verified isolated storage/HTTP and published that image; the failed 32d9ef4 image was not published.

30 September 2026 — Semuta after printed CHOAM Charity Karama

In the explicit Richese preview, a clean printed Karama cancellation of CHOAM Charity now pauses after the public activating card reaches the discard but before canceled income settles. Every seat receives the same neutral offer; a different Semuta holder can claim the spent Karama, or all seats may decline. The receipt binds the exact suspended response, spent card and spice/hand custody. Completion retires it, restores that response and cancels CHOAM income once. Prior-turn charity receipts remain valid; no current-turn cancellation is accepted twice. Worthless conversion, other Karama uses and nested responses retain their automatic paths.

Authenticated SQLite restart/CAS, owner-only projection, corrupted receipt rejection, first- and later-turn cancellation and one-card custody were exercised. A direct production-engine smoke run observed the parent response, neutral offer and one cancellation with zero CHOAM income. Two independent read-only reviews found the prior-turn receipt and test type-narrowing defects; both were corrected. npm run check passed typecheck, lint and 5,827 offline tests; npm run build and 55 local HTTP tests passed. The phone-width reference rendered the new scope. No deployed revision was exercised. The previous 32d9ef4 container workflow built but failed its isolated storage/HTTP step; public logs expose only exit code 1, not the underlying assertion. Docker, Podman and authenticated GitHub logs were unavailable locally. Do not treat that image as published.

30 September 2026 — Semuta after clean Residual Poison

In the explicit Richese preview, Residual Poison now pauses after one random opposing leader is sent to the Tanks and its used public card is discarded, before battle inspection reconciliation and shared readiness resume. A neutral offer appears only for an uninspected, unready pre-leader battle without competing rewards or responses. Claim moves that physical card to another holder; all-seat decline leaves it in the pile. The saved receipt binds battle event, victim, leaders, hand/force custody and unsealed preparation. Neither choice rerolls the victim or repeats death. Accepted plays in inspected or partly ready battles retain the existing automatic path.

An authenticated SQLite room restored the offer and a private holder claim without replaying death; focused JSON/custody and automatic fallback tests passed. A direct production-engine smoke run observed offer, one dead leader, a recovered card and unready preparation after claim. Independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,824 offline tests; npm run build and 55 development HTTP tests passed. The phone-width local reference rendered the clean Residual Poison note. No deployed revision was exercised. Inspected/partly ready pauses, other discard producers, full-hand timing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after between-battles Sapho

The explicit Richese preview now pauses after Juice of Sapho commits a clean between-battles chooser reorder and publicly discards its physical card. The next battle has not been selected. All seats see the same neutral offer; claim transfers only that used card, and all-seat decline leaves it discarded. The saved receipt binds the chooser use/event, last battle, unselected board, hands and force geometry. Its completion restores the current chooser without replaying the reorder or opening another battle.

Genuine CHOAM/Richese setup, first/last chooser order, claim/decline, owner-only projection, JSON normalization and authenticated SQLite restart/room CAS were exercised. A direct production-engine smoke run observed the offer, single card transfer and next battle chosen by the preserved actor. Two independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,821 offline tests; npm run build and all 55 local HTTP tests passed. The local phone-width reference rendered the updated Semuta guidance. No deployed revision was exercised. Competing responses, other discard producers, full-hand sequencing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after Once Around Sapho

The explicit Richese preview now pauses after a clean Once Around Juice of Sapho public discard and finite bidder reorder, before the lot's settlement suffix. Previously acted bids and funding remain committed; discarding Sapho can admit its formerly full-hand holder to the still-open lot. Every seat sees the neutral offer, and only an eligible held Semuta owner can claim the used card. Claim or all-seat decline resumes the same saved lot and active bidder once. The receipt binds the auction event, bidding round, order, funding, hands and spice. A Black Market Semuta reserved as the offered lot remains in its seller's hand: the neutral offer persists, but the owner's Commit is disabled and an attempted commit rejects before any card moves.

Genuine auction setup, both first/last and full-hand paths, private projection, JSON corruption checks and authenticated SQLite restart were exercised. A direct production-engine smoke run observed offer, active reordered bidder and one recovered physical Sapho. The independent read-only rules/privacy reviews found two defects: Black Market reservation and unbound bidding-round state; both were corrected with focused regressions. npm run check passed typecheck, lint and 5,819 offline tests; npm run build and all 55 local HTTP tests passed. The phone-width local reference rendered the Once Around guide. No deployed revision was exercised. Remaining battle-choice Sapho, competing parents, full-hand take-before-discard and public Richese starts remain gated.

30 September 2026 — Semuta after pre-plan Sapho aggressor

The explicit Richese preview now stages a clean pre-plan Juice of Sapho discard after its public card and single aggressor/tie-priority choice commit, before either combatant closes shared preparation. Every seat sees the same neutral offer; a different held Semuta owner may recover exactly that card or all seats may decline. The saved receipt binds the battle event, Sapho event, committed priority, unsealed readiness, hands and force custody. A resolved response retires the frame without replaying the aggressor choice or battle; both combatants can still declare ready and choose plans.

Genuine faction setup, owner-only projection, saved JSON, authenticated SQLite room CAS/restart and legal AI claim/pass were exercised. A direct production-engine smoke run observed offer, an unsealed battle and one recovered card with unchanged priority. Focused tests passed; npm run check passed typecheck, lint and 5,816 offline tests; npm run build passed; all 55 development HTTP tests passed. The phone-width local rules page rendered the pre-plan guidance. Two independent read-only rules/privacy reviews found no scoped defect. No deployed revision was exercised. Once Around and remaining battle-choice Sapho, competing parents, full-hand sequencing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after Ix-deck Amal

In the explicit Richese preview with the physical Ix deck, playing Amal at a clean phase opening now publicly discards its one held card, halves every faction's available personal spice and resets earlier opening passes before a neutral all-seat Semuta offer. A different holder with hand space may claim only that used Amal and discard Semuta; all-seat decline leaves Amal in the ordinary pile. The exact phase-opening window then resumes once. No auction card draw, Bidding prelude or other opening effect runs ahead, and the same spice is not halved again.

Genuine Ix-deck setup covers prior-pass reset, odd/even spice, owner-only legal AI claim, all-seat decline, physical card census, JSON continuation and later Richese Bidding prelude. An isolated migrated SQLite room restores the paused reaction, commits an authenticated Amal claim and completes the opening without changing saved seats or double-paying. Independent rules/continuation and privacy/recovery reviews found no scoped defect. Nested opening interactions, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

A direct production-engine run completed genuine Ix-deck setup, halved 11/9/7 personal spice to 5/4/3, showed a neutral offer, let the legal bot recover used Amal and restored cleared opening passes. Three real ready actions then opened Richese's Bidding prelude without another halving. The phone-width rules deep link rendered the boundary as Partial. npm run check passed typecheck, lint and 5,814/5,814 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after Ix-deck Thumper

The explicit Richese Semuta development profile now permits a fresh CHOAM & Richese game with the physical Ix deck. Only that deck supplies canonical Thumper. Playing it at a clean Spice Blow opening places its public card on the discard pile, then pauses before the injected worm or next actual spice-card draw. Every seat sees the same neutral offer; another holder may take the used Thumper and discard Semuta, or all seats may decline. Both choices run one saved blowSpice suffix: the prior territory is devoured once, the next land card is drawn once, and phase/Nexus consequences retain the existing rules. CHOAM-only Semuta games have no Thumper to offer; public expansion starts remain closed.

Genuine Ix-deck setup exercises owner-only legal AI claim, all-seat decline, pre-draw deck invariance, one force/spice casualty outcome and physical census across JSON. An isolated migrated SQLite room preserves the undrawn state through automatic recovery and commits one authenticated claim while retaining seat rows. Nested opening responses, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent privacy/recovery review found no scoped defect. Rules review found the initial saved Thumper receipt omitted Advanced mode, elite/No-Field custody, Ix expansion selection and the additional-worm cancellation turn. Failing-before/passing-after regressions now bind those inputs; follow-up rules review found no remaining scoped defect. A direct production-engine run completed genuine Ix-deck setup, undrawn neutral offer and bot claim, then one worm casualty and one spice draw. No original play was modified.

The actual phone-width rules page rendered the Ix-deck Thumper boundary and Partial checklist. npm run check passed typecheck, lint and 5,813/5,813 offline cases after the receipt corrections; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta at first mandatory battle discard

The explicit Richese Semuta preview now pauses a clean public battleResolved discard batch after its combat result and physical used-card disposal but before casualty choices or winner cleanup. A normal battle's used loser defense is one fresh card; a mutual Traitor battle can produce one simultaneous pair owned by both combatants. Every seat sees the same neutral offer. The holder may commit and recover only a card discarded by another player; two eligible cards require owner-only inspection and exact one-card selection. Other cards remain on the pile. The result, losses and later mandatory/optional winner batches continue once, separately.

Genuine setup exercises a normal battle's loser defense, all-seat decline into winner choice, and a two-owner mutual-Traitor batch with committed selection and physical census. An isolated migrated SQLite room recovers both the initial and owner-committed mixed batch without auto-advancing; authenticated selection changes one card without rewriting seats or doubling casualties. Pending battle rewards, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules review found no scoped issue. Privacy/recovery review found that the initial battleResolved metadata did not bind the exact original card/owner pair, permitting a malformed saved batch to reassign a former owner or substitute an old discarded card. Failing-before/passing-after cases now bind the original mandatory entries in the resolved battle receipt and reject both corruptions before projection or claim; frames predating that receipt continue automatically rather than inventing an offer.

Follow-up privacy/recovery review found no remaining scoped defect. A direct production-engine run resolved a mutual-Traitor battle, opened one two-owner public batch, committed Semuta, selected one opponent card and left the other physically discarded without a winner. Phone-width rules showed the three separate battle stages. npm run check passed typecheck, lint and 5,811/5,811 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta between mandatory and optional winner cleanup

The explicit Richese Semuta preview now pauses a clean public winnerMandatoryDiscard frame after the loser/battle discard but before optional winning-card cleanup. A physically used Hero is already in the ordinary pile; every seat receives the same neutral offer. Another holder with free hand capacity may recover that one Hero and discard Semuta. All-seat decline leaves it on the pile. The committed casualty counts and winner remain fixed; finishWinner continues once to the still-held optional weapon decision. Its later discard is a distinct fresh batch, not another chance at the Hero.

Genuine setup covers two combatants, preparation, Hero plus retained projectile, the mandatory Hero offer, neutral passes, legal AI claim, JSON continuation and exact physical census. An isolated migrated SQLite room restores that offer, authenticates the Hero claim, then opens and declines the later optional weapon batch without repeating Semuta disposal or battle rewards. Loser/mixed-owner mandatory cleanup, pending battle rewards, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules/continuation and privacy/recovery reviews found no scoped defect. A direct production-engine run completed genuine AI setup, a mandatory Hero discard, neutral offer and bot claim, then showed the retained projectile in the original winner's optional card decision. Phone-width local rules rendered the two-batch boundary as Partial. npm run check passed typecheck, lint and 5,810/5,810 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta choice among simultaneous winner cards

The explicit Richese Semuta preview now recognizes a clean batch of two or more publicly revealed played cards selected by a battle winner for discard. The battle result and earlier mandatory cleanup are committed; all seats receive the same neutral offer. Only the actual Semuta holder with free hand space can commit, and only after that commit does their private view reveal the fresh candidate list. They must select exactly one. The other cards remain in the discard, Semuta is disposed once, and the resolved battle continues once. All-seat decline leaves the full batch in place.

Genuine setup covers both a single winner card and simultaneous projectile/Shield selections, owner-only candidates after commitment, legal AI choice, explicit alternative human choice, stale foreign selection rejection, exact physical census and resource equivalence. An isolated migrated SQLite room restores the offer and later the committed selection without automatic progress, checks rival candidate privacy and authenticates the exact one-card choice. Other multi-card producers, mandatory/reward-pending battle frames, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules and privacy/recovery reviews found no scoped defect. A direct production-engine run committed the two-card batch, showed only the owner both candidates and selected Shield while the other played weapon remained discarded. Phone-width local table fixtures showed two owned Inspect/Claim cards and a rival's candidate-free waiting state; the stale hand-help text was updated. npm run check passed typecheck, lint and 5,809/5,809 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after one winner-selected battle card

The explicit Richese Semuta preview now pauses a clean single public winner-selected battle-card discard after the battle result and mandatory cleanup are committed. The played card is physically on the ordinary discard pile; every seat sees the same neutral event. An eligible holder may recover exactly that card and discard Semuta; all-seat decline leaves it in place. Neither path re-resolves battle, re-awards casualties or bounty, nor lets an old card be claimed. The existing battleCleanup frame retires before finishBattle continues the phase once.

Genuine setup exercises a real two-combatant plan and traitor call, mandatory loser-card retirement, optional winner discard, legal AI claim, all-seat decline, physical card census and JSON views. An isolated migrated SQLite room restores the pending reaction without auto-advancing, authenticates the claim and preserves seat rows. Multi-card winner selection, Moritani loser retention and pending battle rewards remain automatic without Semuta; full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A direct production-engine run completed genuine AI setup, battle preparation and plans, a public winner discard, neutral offer and bot claim without replaying the recorded winner. Phone-width rules rendered the battle boundary as Partial. A recovery assertion that searched the entire observer view for an earlier public card ID was too strict; it now checks that the current recipient hand is not projected. npm run check passed typecheck, lint and 5,809/5,809 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after a clean completed Ornithopter flight

The explicit Richese Semuta preview now pauses a completed range-three or second-group Ornithopter as its one public used card leaves escrow. The pilot's exact forces have already arrived and its move counter has advanced; the neutral all-seat event precedes the saved arrival log and territory-entry suffix. A legal holder can claim only that retired card and discard Semuta. All-seat decline leaves the card on the pile. Either choice resumes the one arrival without placing another force or consuming another move.

The bounded roster excludes Bene Gesserit intrusion and Ecaz/Moritani entry reactions, alongside other competing parent transactions. Genuine setup covers a final flight, exact card/force census, JSON restoration, owner-only legal AI claim, all-seat decline and stale action rejection. An isolated migrated SQLite room restores the paused arrival without automatic advancement, commits an authenticated claim and preserves seat rows. The excluded arrival compositions, multi-card batches, full-hand sequencing, normal Richese starts and deployed acceptance remain open.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A throwaway production-engine run completed genuine AI setup, a final flight, neutral offer and bot claim; one moved force remained at its destination, one move was consumed and the active pilot retained control after arrival. Phone-width rules rendered the clean arrival boundary as Partial. npm run check passed typecheck, lint and 5,808/5,808 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after clean movement-order Sapho

The explicit Richese Semuta preview now pauses after Juice of Sapho physically discards its public card and commits a clean first/last reorder of remaining combined shipment and movement turns. Every seat sees the same neutral event before the active turn changes. A legal holder can claim only the used Sapho and discard Semuta; all-seat decline leaves Sapho in the ordinary pile. Both paths resume the already committed order once, retaining protected last and prior Guild timing without restarting any completed turn.

Genuine setup covers first reordering, last protection, all-seat decline, one physical claim, exact card census and JSON views. A corrupted saved queue, newly spent movement, changed Basic/Advanced profile or altered faction roster rejects before claim; an isolated migrated SQLite room restores the paused reorder and commits an authenticated claim with unchanged seat rows. Independent rules review found the initially missing timing-profile binding; the failing-before/passing-after regression now covers both Advanced mode and Guild identity. Auction and battle Sapho, competing parents, full-hand ordering, normal Richese starts and deployed acceptance remain outside scope.

Follow-up rules and independent privacy reviews found no remaining scoped defect. A throwaway production-engine run completed genuine AI setup, Sapho first reorder, neutral Semuta offer and bot claim; the saved turn advanced to the reordered actor exactly once. The phone-width rules guide rendered the bounded Sapho path as Partial. An initial npm run check failed one expansion-roster CLI resume while source edits were concurrent; the focused case passed after source stabilized. The stable rerun passed typecheck, lint and 5,807/5,807 offline cases; npm run build and all 55 Vite development HTTP cases passed after the timing-profile fix. No deployed revision was exercised.

30 September 2026 — Semuta after a final definite Truthtrance answer

The explicit Richese Semuta preview now pauses the public card discard after a clean final definite Truthtrance answer. The asker has spent the actual held card, the respondent's answer is already recorded, and the public history is bound before the neutral all-seat offer. Another holder with hand space may take only that freshly consumed card and discard Semuta; all-seat decline retains the original pile. Neither path re-answers, duplicates a promise, restarts a question, or changes the recorded fact.

Genuine setup and an isolated migrated SQLite room exercise a real declaration, priority passes, privately answerable spice/hand fact, definite answer, persisted reaction and authenticated claim after restart. JSON projections, custody, public answer history, legal AI, owner-only commitment, all-seat decline and saved seat rows remain stable. Setup-era facts, queued follow-ups, promise-bound questions, competing parent transactions, other discard producers and full-hand ordering remain outside this bounded preview.

Independent rules/continuation and privacy/recovery reviews found no scoped defect. A throwaway production-engine run completed genuine AI setup, declaration, definite hand answer, neutral reaction and bot claim with one fixed public history entry. The phone-width guide rendered this boundary as Partial. npm run check passed typecheck, lint and 5,805/5,805 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after a completed private Distrans transfer

An explicitly opted-in Richese preview now pauses after a clean Distrans action physically gives one privately selected card to its recipient and publicly discards the used Distrans. Every seat sees the same neutral fresh-discard event, not the transferred card. A legal holder may recover only the public used Distrans, discarding Semuta; all-seat decline leaves Distrans in the ordinary pile. The recipient keeps its transferred card on either path. Existing pending gifts, bid or response contexts remain outside this bounded reaction; ordinary transfers retain their previous completion.

Genuine setup and isolated migrated SQLite room cases cover physical custody, owner-only commit and legal AI participation, all-seat decline, private recipient card projection, saved restart without auto-advance, exact authenticated claim and unchanged seat rows. Incomplete producer families, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent privacy review found no scoped leak. Rules review found that a duplicated transferred card in removed Richese custody escaped the initial saved receipt check; a failing-before/passing-after regression now requires the recipient's card to be unique across all physical non-discard zones. Follow-up review found no remaining scoped defect. A throwaway direct engine run completed genuine AI setup, private transfer, neutral offer and bot claim; the nonrecipient view omitted the given card and the recipient retained it. The phone-width rules guide visibly marks this path Partial. npm run check passed typecheck, lint and 5,804/5,804 offline cases after the custody fix; npm run build and all 55 Vite development HTTP cases passed. No production deployment was verified.

30 September 2026 — Semuta after an early-ended Ornithopter flight

The explicit Richese Semuta preview now interrupts the one public Ornithopter discarded when its pilot ends movement before using every available flight group. The first group has already moved its exact forces and consumed one move; the card then leaves escrow exactly once. Every seat sees the same neutral event before the saved movement queue advances. Another holder with hand space can claim that retired physical card and discard Semuta; all-seat decline leaves it on the pile. Both paths advance the original turn once without moving forces again.

Genuine setup exercises a completed first group, early retirement, JSON restoration, owner-only commitment by the legal AI, all-seat decline, exact force/card census and stale-action rejection. An isolated migrated SQLite room recovers the paused flight without auto-advancing, projects only the owner's Commit control and commits the claim through authenticated room CAS, preserving seat rows. Completed flights with arrival/intrusion follow-up, competing suspended transactions, multiple fresh cards and unresolved full-hand ordering remain gated. This is not a complete Semuta or deployed Richese path.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A throwaway direct production-engine run completed genuine AI setup, moved one group, showed a neutral offer with owner-only Commit, recovered the played card and advanced to the next seat with one move and one arrived force. A phone-width local rules page rendered the new boundary and Partial checklist. npm run check passed typecheck, lint and 5,803/5,803 offline cases; npm run build and 55/55 Vite development HTTP cases passed. No production deployment was verified.

30 September 2026 — Semuta after a completed paid Box search

The explicit Richese Semuta preview now opens the same neutral all-seat response when a clean paid Nullentropy Box search finishes and places its used physical Box on the discard pile. The search owner has already paid two spice, privately recovered its chosen card and shuffled the remaining pile once. Another holder may commit Semuta and take only the freshly discarded Box; declining preserves the Box on top. Neither path re-pays, reselects, reshuffles or reopens the search. Older discard cards and the privately recovered card are not fresh targets.

Genuine-setup engine cases verify both claim and all-pass paths, exact card census and discard order, every-seat JSON restoration and stable two-spice payment. An isolated migrated SQLite room restores the Box reaction after the paid selection, leaves automatic recovery idle until a real choice and commits the claim through authenticated seat control without changing saved seat rows. Independent privacy and continuation reviews found no scoped issue. This extends the previous phone-width neutral control surface; no new browser POST was sent. Auction/CHOAM-market overlaps, multiple fresh cards, other producer families and full-hand ordering remain gated. This is not a complete Semuta, Richese or deployed claim.

npm run check passes typecheck, lint and 5,802/5,802 offline cases; npm run build and the 55/55 local development HTTP cases pass. The phone-width rules deep link shows the updated Box target boundary and partial checklist. No authenticated production Box/Semuta play or deployed revision was exercised.

30 September 2026 — neutral Semuta clean-discard prototype

The bounded runtime uses an explicit fresh Richese development profile. A real Hajr discard after genuine setup opens an identical public event for all seats; only the actual holder sees Commit, no one inspects a fresh face before commitment, and the sole eligible other-player card transfers automatically with Semuta's physical disposal. All-seat passes preserve the card and effect. Free hand space is a conservative, provisional guard. Other discard producers and full-hand sequencing remain unfinished; normal Richese/public starts remain closed.

Focused engine cases preserve exact custody through JSON, hide possession under an equal-card-count private swap, reject stale/forged actions and corrupt saved reactions, and complete each original effect once. An isolated production room module with migrated SQLite restored the same owner-private offer and committed one of two competing Semuta requests under room CAS; the fixture's seat rows remained intact. The actual start-prototype.ts --profile semuta CLI started a fresh disposable ready lobby with its seat preserved. Mobile browser GET fixtures showed the owned Commit button and rival Continue-only panel at the same event; no browser POST or real local room was mutated.

Independent privacy review found no scoped leak. Rules review identified and prompted fixes for a deleted-reaction auto-retire, duplicate Semuta custody, a suspended CHOAM sale crossing the clean gate, and a forged all-passed deadlock. Deleted-reaction, duplicate-card and all-passed corruption each have failing-before/passing-after regressions; the CHOAM sale exclusion was source-reviewed without a direct fixture. A final read-only review found no remaining scoped issue. Focused Semuta/ordinary-continuation and room-start tests pass; full-game and deployed acceptance do not follow from this bounded preview.

An unstaged six-seat Basic Richese preview at RNG seed 20260930 completed 916 accepted actions, zero rejected candidates, 24 JSON view restores and six neutral passes at one ordinary-card discard. No natural Semuta acquisition/commitment occurred in that game; the focused genuine-setup and production-D1 fixtures cover the committed claim. npm run check passes typecheck, lint and 5,801/5,801 offline cases; npm run build and all 55/55 local development HTTP tests pass. These results and one complete sampled game do not certify the remaining card sources, full Richese mode or deployment.

30 September 2026 — owner key rotation and safe re-enable

The account panel now rotates another enabled or disabled administrator’s personal access key with one exact tab-scoped request. A disabled target becomes enabled only with the new key; all old sessions are revoked and historical hashes prevent A→B→A key reuse. The owner reviews name, ID, role, enabled state, reason and revocation impact; one-time key disclosure remains confined to the confirmed tab. Additive migration 0020 preserves previous account receipts and games. Live SQL owner/version/key checks, one durable rotation receipt and actor-attributed safe audit prevent stale or duplicate changes.

Independent persistence review found no scoped issue. Security review identified an exact historical replay that could show a superseded key as currently usable. The client now compares its receipt with the last-read account metadata, warns when changed/unlisted, and advises sign-in verification even when matching. The focused security follow-up found no remaining issue in those changed lines. A phone-width authenticated local page showed exact pre-send confirmation; a completed-record fixture showed the superseded warning without sending a mutation. The isolated built-worker network smoke provisioned, rotated, replayed, disabled and re-enabled a disposable target, rejected old keys and sessions, refused key reuse and preserved safe audit and origin denial. No live account or saved game was modified.

npm run check passes typecheck, lint and 5,787/5,787 offline cases; npm run build, drizzle-kit check and all 55/55 development-server HTTP cases pass. A second full HTTP run against the local production bundle did not pass: workerd intermittently returned 503 mid-request under the suite. Draining oversized admin bodies removed an early unread-stream return; isolated built requests returned 413 and later requests remained healthy, but the full bundle load issue remains unresolved. None of this proves a deployed revision, complete administration or production recovery.

29 September 2026 — natural Advanced Moritani reveal and replacement

A source-unchanged genuine six-seat sample at base seed 20261307 completed 1,666 accepted actions, no rejected candidates and 45 JSON continuations. The Easy Moritani bot declined one turn-six opportunity, then revealed its held emperor-1 Traitor Card against a different Emperor leader on a later normal battle loss. The target was already dead, so bounty was zero. At accepted action 987 the card remained physically held; automatic Mentat replacement at action 995 moved it face up out of hand and privately drew fremen-4. A separate replay JSON-restored all six projected views at both custody transitions. The runner verified physical inventory after every accepted action through final turn ten.

The bounded feature record links the source-bound private report. This demonstrates a natural dead-target reveal, not a living-target kill, all optional modules, publication readiness or deployed acceptance.

29 September 2026 — worm-ride arrival candidate correction

A natural six-seat Moritani Advanced sample at base seed 20261007 completed 1,541 actions with two rejected Fremen worm rides into a placed Terror while a BG intrusion would open. Both were rejected without mutating the game. The owner-view preflight now quotes that public worm destination and excludes the unsupported combined reaction before the bot selects an action. A focused engine regression reproduced the rejection first and covers four legal AI fallbacks. The same genuine game finishes 1,541 accepted attempts, zero rejects and 41 JSON continuations. Two assassination opportunities were declined; no natural reveal/replacement was proved. The authoritative reaction-order gap and public expansion gate remain.

npm run check passes typecheck, lint and 5,782/5,782 offline cases. No app route or persistence schema changed; build and HTTP checks were not repeated for this bot candidate filter.

29 September 2026 — Guild transport arrival preflight

The arrival preflight now filters single-source Guild cross-planet transport candidates before they enter a publicly unsupported Terror/Guild-income reaction combination. A six-seat Advanced Moritani game at base seed 20260930 first completed 1,262 accepted actions, six rejected Guild candidates and 34 JSON continuations. Same-seed replay after the fix completed 1,262 accepted actions, no rejected candidates and 34 JSON continuations. Two real assassination offers were declined; neither sample shows a natural reveal.

A focused engine test reproduced the illegal action before the fix, then covered all four bot filters and accepted Guild-funded transport with no income response. No card face, hidden rival data or unsupported arrival ordering enters the quote. Existing expansion start and publication gates stay closed.

npm run check passes typecheck, lint and 5,781/5,781 offline cases. No app route or persisted database changed; the production build and HTTP suite were not repeated for this bot-only correction.

29 September 2026 — owner account management prototype

The account page lists only safe metadata to a live owner. Provisioning uses a tab-scoped, browser-generated 256-bit key and an exact durable operation receipt; only its SHA-256 hash enters the database. Owners can change another account’s role or disable it after reviewing the name, ID, current/desired role and reason. Database writes repeat live owner authority and target-version checks, retain the final-owner trigger, and attribute the single successful provision/role/disable audit event. Disabled sessions fail immediately; room and seat rows remain untouched. Rotation, re-enable, failed-attempt audit and complete administration remain pending.

An isolated direct D1 smoke provisioned a disposable account, changed its role, disabled it, confirmed its old key/session fail and verified safe owner-attributed history without a raw key. An isolated Request/Response route-handler smoke confirmed owner provision, exact replay, directory read and foreign-origin denial without contacting a persistent database. Focused account/access/audit regressions include an additive migration preserving existing room, seat, credential and audit bytes. The local browser showed signed-out denial at phone width; intercepted owner fixtures displayed exact owner-role disable confirmation, retained a one-time key after refresh and hid directory/key controls after a focus-triggered demotion. Browser fixture POSTs never reached an account database. Authenticated positive network HTTP and live NAS acceptance remain untested.

Independent security review found and corrected unchanged-role audit no-ops and incomplete final disable confirmation. A separate persistence review reproduced a logout-all timestamp rollback; the account version is now monotonic and a stale disable rejects. Both follow-up read-only reviews reported no remaining scoped finding. The first focused HTTP run found a test assuming JSON for Vite’s foreign-origin 403; the corrected boundary test passes 3/3, and the full local HTTP suite passes 55/55.

npm run check passes typecheck, lint and 5,780/5,780 offline cases; npm run build and drizzle-kit check pass. These results do not certify complete administration, authenticated production mutations or deployment.

29 September 2026 — Advanced Moritani assassination sample matrix

The reusable offline runner now supports the explicitly gated moritani-assassinate profile with native Moritani and supported classic opponents excluding Harkonnen, across two through six Advanced seats. Initialization uses the actual preview path; resume requires both its saved marker and ability state, and the external physical Traitor census includes publicly retired assassination cards only after Mentat replacement. The existing six default samples and their ordinals are unchanged.

At base seed 20260929, all five games completed in 2,511 accepted actions, zero rejected candidates and 65 JSON continuations, with an unchanged source fingerprint. The six-seat game reached two actual private assassination offers; both were declined. Genuine battle/Mentat focused tests independently exercise reveal, retirement, replacement and duplicate custody rejection; the natural game samples do not establish that use. Source-bound private report: /tmp/dune-moritani-assassinate-matrix-20260929/report.json, based on c961a93 plus this checkpoint's uncommitted source (fingerprint 8889d9bf25b964948913588aa3320a3f47fd2b3f1fd79edf9df12397ce687c57). Independent read-only review found no concrete profile or custody defect. The pending rule-duration and uniform-private-step UX questions remain. No complete Moritani faction, public Moritani start or deployed acceptance follows from these samples.

The focused assassination/CLI/custody union passes 56/56 cases. npm run check passes typecheck, lint and 5,767/5,767 offline cases. No app route, database schema or deployed game changed in this checkpoint.

29 September 2026 — Ecaz card variant full-game integration samples

The reusable offline runner now has --profile ecaz-treachery: two through six genuine paired Ecaz/Moritani seats, each Basic and Advanced, with the independent three-card deck, physical custody checks, all four saved AI profiles and explicit JSON continuation. Its default six historical games and seed offsets remain unchanged; incomplete snapshots can resume only under the exact saved variant/roster. Public starts remain gated.

The first same-seed matrix completed eight of ten games and caught an actual saved-view mismatch: an unlocked Bene Gesserit advisor stance was stored as {lockedTurn:undefined} by movement, Guild transport, Junction transport or Fremen Ambassador relocation, but JSON restored it as {}. The four writers now store a canonical empty stance or a numeric lock. Focused Guild, Junction, ordinary move and Fremen relocation cases preserve view parity after JSON; locked arrivals still retain their original turn. No saved room or credential was altered.

The final source-bound run at base seed 20260929 completed all ten games: 3,768 accepted actions, no rejected candidates, 95 JSON continuations and unchanged source fingerprint. The six-seat Advanced game used all three physical Ecaz card effects. Report: /tmp/dune-ecaz-treachery-matrix-final-20260929/report.json, based on 6ac5dab plus the uncommitted source changes of this checkpoint (source fingerprint 466f801d36e8dc9aa1b14d2c9215813c8b4561926cc2ba43664d38e03ebbb081). This samples playable continuation, not complete card interactions, combined-module acceptance, calibrated AI or deployed behavior.

The focused runner/advisor suites pass 101/101 cases. An independent read-only review of the four writer changes, source custody and resume gates found no concrete defect; it did not run tests or certify release readiness.

npm run check passes typecheck, lint and 5,765/5,765 offline cases; npm run build passes. No database schema or HTTP route changed. The last verified live image predates these changes.

29 September 2026 — Reinforcements in paired Ecaz/Moritani battles

The independently selected three-card Ecaz variant now allows its physical Reinforcements card in clean Basic/Advanced Ecaz/Moritani battles, as well as the prior classic-only profile. The existing battle quote pays three own reserve counters into typed Tanks, adds two to normal score without changing the physical dial, and mandates one discard after reveal. Owner-only card slots and all four minimal AI policies follow the server offer. Co-present Ecaz allied armies, Richese, Ixians/Tleilaxu and other optional modules stay guarded; prior provisional cost rulings are unchanged.

A failing-before/passing-after genuine-setup regression covers each paired faction as holder in both rules modes, private plans, physical custody and JSON recovery. A paired Advanced room also survives restart and a competing final D1 write with one cost and discard. Forty-five focused Reinforcements/Harass cases pass. A separate engine smoke settled one paired battle with 15→12 own reserves and one discard, while the co-present-ally attempt was rejected without mutation. A React-rendered owner fixture in a mobile Chromium tab showed Reinforcements selectable; it was not a live-room UI check. Independent static review found no patch-introduced defect and noted co-present Ecaz armies as a separate boundary, now guarded in the server and owner offer. No public start or complete module acceptance is claimed.

npm run check passes typecheck, lint and 5,761/5,761 offline cases; npm run build passes. No route, database schema or public start gate changed. The last verified NAS image predates this source; local results are not deployed acceptance.

29 September 2026 — Moritani and Tleilaxu Leader Skills samples

At source revision 29aedf1, all five Basic Moritani plus Leader Skills two-through-six-seat games at base seed 20260929 finished through genuine setup and saved AI actions: 2,013 accepted actions, zero rejected candidates and 53 JSON continuations. The four-seat game exercised a Bureaucrat payment decision and nine battles; the six-seat game reached twelve Terror decisions and ten turns. The source fingerprint was unchanged and no live room was used. The private report is /tmp/dune-goal-20260929-moritani-skills/report.json.

At source revision df71faf, all five Basic Tleilaxu plus Leader Skills two-through-six-seat samples at the same base seed finished with 2,723 accepted actions, zero rejected candidates and 70 JSON continuations. The six-seat game reached native early-revival requests, actual Face Dancer replacements, seventeen battle selections and eight turns. No live room was used; the source fingerprint stayed unchanged. The private report is /tmp/dune-goal-20260929-tleilaxu-skills/report.json. Neither matrix certifies every skill effect, Advanced play, combined modules or AI strength.

29 September 2026 — paired expansion game samples

At source revision b9c8b74, the reusable genuine-setup runner completed all six fixed Basic/Advanced CHOAM/Richese, Ecaz/Moritani and combined expansion samples at base seed 20260929: 4,641 accepted actions, no rejected candidates and 122 JSON continuations. The source fingerprint remained unchanged throughout. The private source-bound report is /tmp/dune-goal-20260929-expansion-pairs/report.json; no live room was used. This is sampled integration evidence, not effect-by-effect acceptance, full module coverage, AI calibration or permission to open public expansion starts.

29 September 2026 — Homeworld-sourced AI arrival preflight

A genuine five-seat Advanced combined Homeworld/Nexus/expansion game on 41fd6fe exposed two rejected Tleilaxu shipments from its own Homeworld into unsupported Ambassador/Terror entry combinations. The public AI preflight had skipped Homeworld sources. It now quotes their off-planet arrival through the same authoritative public reaction helper, without sampling private Terror faces or recreating source pricing. A failing-before/passing-after real-engine regression exercises all four AI profiles and executable fallbacks. The identical genuine game completes after the fix with 786 accepted attempts, no rejected candidates, 21 JSON continuations and a fourth-turn shared victory. Other Homeworld payment-dependent reactions and unsupported combined arrivals remain gated; no public start was opened.

The initial full check exposed an existing Guild shipment test that asserted payment before a legitimately opened Karama rate response. That test now resolves the response before checking the rounded cost. The final npm run check passes typecheck, lint and 5,757/5,757 offline cases. No HTTP contract, database schema or player-facing control changed.

29 September 2026 — Sapho finite-bid boundary and pending source questions

The existing Once Around Juice of Sapho adapter permits an unacted holder to move first after another bidder's completed bid. New engine and persisted-room regressions cover the committed bid, remaining single opportunities, exact discard, stale/duplicate rejection and private projections. The hand-panel unavailability explanation and Sapho contract now describe this bounded behavior rather than a pre-first-bid restriction. Thirty focused Sapho cases pass. A separate direct engine run after an earlier bid reported canFirst:true, one completed bidder, the holder next, unchanged standing bid 1 and one physical discard after JSON reload. A React-rendered owner-panel fixture inspected in Chromium displayed the corrected guidance; this is not a live-room UI check. npm run check passes typecheck, lint and 5,756/5,756 offline cases; the app build also passes. No engine rule or public start gate changed.

The source follow-up records that the requested publisher/designer search did not settle Tleilaxu Secret Ally revival accounting, leader eligibility or partial use; the decision index also retains the Moritani Atomics alliance-change ambiguity. Neither receives an inferred rule or an implementation unlock.

29 September 2026 — administrator action history prototype

The existing Action history draft now has a bounded source-bound checkpoint. Its read-only endpoint joins nine durable receipt families, projects only public operational settings and identifier/name fields, and returns reasons only to a live owner/operator role. Search excludes raw JSON, messages, saved games, secrets and reasons; pagination/count and role rechecks share the same database batch. Viewer and anonymous access stay restricted. No game row is read or changed by the history query.

Ten focused offline audit/D1 cases pass, including a workerd compound-query regression, malformed metadata, deleted accounts, filtered pagination and commit-time demotion/revocation. The administrator HTTP boundary passes two focused cases (54/54 in the last full local HTTP suite). An isolated non-test in-memory query returned only the two account-event envelopes, without credential contents. Browser inspection showed signed-out denial and read-only operator/viewer fixtures at desktop/mobile widths; viewer reasons stayed hidden and mobile had no horizontal overflow. Independent read-only security review found no concrete authorization or privacy defect. Typecheck, lint, 5,756/5,756 offline tests and the app build passed with this draft present. The dedicated signed-in QA operator HTTP verifier was not run: it revokes all sessions for its account and requires a separate authorized QA key. This is not deployed acceptance or complete administration; failed-attempt history, broader operations and backup/restore remain pending.

29 September 2026 — Fremen Nexus Betrayal pre-blow worm suppression

The second printed Betrayal alternative now spends the physical Fremen Nexus card at a clean phase-one boundary before the first spice blow or worm. For that turn ordinary Fremen worm rides and native Cunning remote rides do not open; worm destruction, survival/protection, spice placement and Nexus still resolve. This advance-declaration timing is a conservative product boundary, not a publisher priority ruling or a reactive post-appearance use. The existing phase-five movement-range alternative remains independent; a card recycled at the current turn's Nexus cannot activate both alternatives.

Sixteen focused Basic/Advanced, actual-worm, empty-Cunning, late-rejection, owner/rival control, all-profile bot-priority and authenticated concurrent SQLite continuation cases passed. A direct non-test third-turn worm smoke showed one spent card, a real Nexus, four surviving Fremen forces and no ride. A read-only browser preview rendered the owner-only pre-blow button with no rival or spent-card control; no room was written. Independent review found that the first movement-only checkpoint's six-field receipt would have locked saved seats on direct GET. Its original event/signature are now validated alongside new mode-bound receipts; JSON and authenticated SQL reads/actions accept genuine old records and reject tampering. The source-bound Fremen contract marks the timing and combined-mode limits. Typecheck, lint, the app build, 5,756/5,756 offline tests and 54/54 local HTTP integration cases passed. This does not open public Nexus starts or prove deployment.

29 September 2026 — bounded Moritani Atomics Aftermath

In classic-plus-Moritani tables without Guild, Ecaz or optional modules, a placed Atomics Terror token may be revealed against an eligible original entry. The existing arrival is never replayed. All physical forces in that territory enter the Tanks, the revealed token leaves play, and one public Aftermath marker permanently bars shipments there, including Fremen free reinforcements. Ordinary movement and the printed Sneak Attack exception remain available. From detonation Moritani and its ally at activation lose one Treachery hand slot; excess cards are discarded randomly through the saved fresh-discard continuation, not by identity chosen by another seat. The unresolved later-alliance penalty is conservatively gated before any Moritani alliance offer or break, while unrelated alliances remain possible.

Seventeen focused pure, Basic/Advanced gameplay, owner/rival component and authenticated SQLite CAS/restart cases pass. They cover elite counters, unallied and Harkonnen hand limits, physical card custody, privacy, Fremen shipment rejection, movement and Sneak Attack, and corrupted saved state. A direct non-test Basic reveal preserved two random discards, two lost armies, reduced projected hand limits and public Aftermath through JSON. Read-only browser inspection showed the owner-only reveal, no rival offer, public Aftermath notice and map marker; no room was written. Independent review found an impossible post-Aftermath Nexus bot alliance; the shared pre-offer guard and corresponding player controls now leave bots a legal Ready path. Typecheck, lint, the app build, 5,747/5,747 offline tests and 54/54 local HTTP integration cases passed. This is not a complete Moritani faction or release gate. See source-bound Atomics scope.

29 September 2026 — bounded Fremen Nexus Betrayal movement alternative

An unallied holder may spend the one physical Fremen Nexus card before Fremen move during Shipment and Movement in classic-only Nexus games. The native two-territory advantage stays suppressed through that turn; ordinary movement, city ornithopters and other independent movement remain available. The server-bound event and saved receipt reject duplicate or malformed plays. The holder-only control and all four AI profiles share the same private offer, with bot priority before Fremen's first move. Basic/Advanced real second-turn Nexus draws, JSON continuation, expiry, corrupted receipt rejection and a concurrent authenticated SQLite CAS/reconnect check pass seven focused cases. The actual React control rendered an owner button and no rival control in a read-only static preview; no room was written. Typecheck, lint, the app build, 5,735/5,735 offline tests and 54/54 local HTTP integration cases passed. Independent read-only review found no actionable issue in bounded timing, privacy, custody, receipt or movement. The card's separate worm-riding suppression remains unimplemented, and combined modules/public Nexus starts remain gated. See Fremen Nexus rules.

29 September 2026 — bounded Ambassador/Terror storm-order continuation

An original entry into a shared Ecaz Ambassador and Moritani Terror stronghold is now committed once, then two distinct optional owner reactions are saved in current storm order. Ecaz and Moritani can each decline or use a supported face/effect; the second owner still receives the original entrant, territory, token entitlement and turn after JSON restoration. The signed receipt remains server-only, the public notice shows current/next faction without hidden Terror identity, and physical shipment spice, counters and movement allowance never replay on continuation. This is a provisional conservative table priority chosen after a targeted source review found no publisher ruling, not a certified simultaneous-effects rule.

The first focused engine/quote/in-memory SQLite group passed 41 cases across three files. A direct non-test Basic game smoke put Moritani before Ecaz: the entrant shipped two forces for two spice once, Moritani revealed Robbery and collected nine of the remaining eighteen, then Ecaz's Emperor Ambassador collected five bank spice. JSON reloads between responses preserved owner order and the original two forces; rival views kept Robbery's face hidden before revelation. BG fighter Intrusion, Fremen/Guild Ambassador child arrivals, Atomics, optional modules and public expansion starts remain separate unfinished work. The table order and its limits are in the source-bound policy.

Follow-up regression coverage now exercises Basic/Advanced Fremen worm rides through both saved arrival stages in SQLite, Robbery hand overflow, Sabotage discard/gift, and a special-Karama summon whose Nexus precedes the queued ride. The bot owner-view quote accepts a supported ordinary overlap. The focused overlap/guide suite passed 30 cases. The obsolete prose-matching reference test was removed rather than re-pinned; full typecheck, lint, the app build and 5,735/5,735 offline tests now pass with the separate Fremen Nexus movement alternative integrated. This local coverage does not certify an expansion start or deployment.

29 September 2026 — native Guild cross/return rate response

The classic Basic/Advanced Guild rate interruption now owns a typed, persisted cross-planet/return declaration as well as ordinary reserve shipment. Guild, its reciprocal ally and paid allied Fremen southern reserves can cross-ship one exact physical group; only Guild returns an on-planet group to abstract reserves. The prepayment Karama response binds original sector/elite groups, turn, destination, quoted half-price cost and approved ally contribution. Canceled rate uses full normal destination price for that same group; a Guild return costs one spice per force under the explicit doubled-tariff interpretation. If original resources or source custody cannot support it, the declaration withdraws without payment, force transfer or consumed shipment. The spent Karama keeps a replacement at full price for this turn. Independent purchased shipping rates, Guild income and canceling transport permission remain distinct; Homeworld and optional-module combinations are not certified.

Focused engine/quote/in-memory SQLite cases cover group conservation, paid Fremen transport, exact funding and unaffordable replacement, Basic/Advanced responses, BG Worthless conversion, source corruption or depletion, private views, legal AI candidates and a concurrent CAS race. A direct non-test multi-sector smoke preserved 20 Guild spice and the source forces through JSON reloading, then canceled the rate and settled three Carthag forces for three spice with one Karama discarded. A local read-only Chromium seat-view preview displayed the public prepayment rate and owner-only Cancel with Karama button without persisting a room. These bounded cases do not certify complete Guild, public Advanced or deployed behavior; see the selected transport policy.

A second read-only Chromium seat preview selected two physical forces after an unaffordable Guild return; the replacement quoted two spice instead of the old one-spice half rate and enabled Return to reserves. It wrote no room.

Independent review found and verified a previously excluded affordable four-force/two-spice Guild Nexus Secret Ally bot cross-shipment; its independent card rate remains separate from the native rate. Existing Moritani/Terror alliance continuations also required the classic-faction roster gate rather than relying only on expansion flags. Eleven focused Guild/Nexus/Moritani files passed 123 cases; all 5,706 offline tests, the local client/server build and all 54 HTTP integration cases passed. npm run check/lint remain blocked solely by the concurrent untracked Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn field, not a transport diagnostic.

29 September 2026 — bounded Guild rate Karama before payment

In classic-faction Basic/Advanced tables without optional modules, an ordinary Guild or reciprocal ally reserve shipment priced at the Guild half-rate waits for a Karama response before any spice or forces move. Advanced Guild's separate special stop resolves first. A canceled discount reprices the exact declared force cohort at full destination tariff without enlarging the original approved ally contribution. If that split cannot fund full price, the spent Karama withdraws the uncommitted shipment; a later ordinary declaration in the same turn uses full price. This conservative withdrawal is an explicit table policy, not an identified GF9 refund ruling. Independent Karama rates and later Guild-income cancellation remain distinct; Guild cross-shipment, return and optional-module combinations remain gated.

New focused engine tests cover physical custody, exact funding, unaffordable withdrawal/replacement and turn expiry, Advanced stop priority, BG Worthless conversion, legal AI, corrupt saves and validated unstamped Advanced saves. An in-memory SQLite room test exercises authenticated private views, restart, CAS race and duplicate cancellation. A direct non-test engine smoke showed 20 Guild spice and 20 reserves held during response, then 17 spice, 17 reserves, three Arrakeen forces and exactly one discarded Karama after JSON restore/cancellation. In a local read-only Chromium QA view, the cancel button was visible before payment; after unaffordable cancellation the replacement form quoted two spice for two Arrakeen forces, selected the existing two-spice ally pledge and enabled shipment. No live room was modified. Independent review identified and verified fixes for the quote projection and older unstamped Guild-stop declarations. This is a bounded prototype, not complete Guild or deployed evidence; see the publisher distinction and selected policy.

The focused Guild rate, existing Guild income, pending shipment and BG Karama group passed 43 cases in seven files. All 5,689 offline tests, the local client/server build and all 54 HTTP integration cases passed. npm run check stops in TypeScript on a separate concurrent untracked Fremen Nexus draft referencing missing Player.fremenNexusMovementBlockedTurn; the separate lint command reports only that same draft error. No source or saved room was reset.

28 September 2026 — Moritani Extortion saved Mentat continuation

The real Terror-entry reveal now reserves five bank spice without crediting Moritani. Normal Mentat placement/relocation and any Karama response resolve first by the user's explicitly selected interpretation; bank collection then opens one saved storm-order offer for each other faction. The first three-spice payment removes the physical revealed token and ends the queue; if all decline, the return helper rotates all hidden supply identities. Insolvent and allied players retain a decline, and neither the bank award nor a payment replays after JSON reload or an SQLite compare-and-swap race. Public notice and owner-only payment controls are connected; the minimal AI declines legally.

Independent review identified three concrete follow-ups, now corrected: the current payer's affordability is private, Nullentropy Box and Richese gift continuation frames retain the exact pending payment, and an Extortion revealed by a real Guild Ambassador shipment after Mentat placement settles before the turn changes. The focused entry/engine/SQLite/alliance/placement suite passed 119 cases in eight files. A direct game-engine smoke revealed Extortion at Moritani spice 12, reached placement before collection to 17, then two AI payers declined and the revealed token returned under a different hidden ID. Separately, an offline three-seat Basic Ecaz/Moritani game completed in 110 accepted actions with two restores and no rejected bot proposals; that sample did not draw the Extortion effect.

The local rules reference displayed the selected order and late-Mentat continuation in Chromium; the production UI/room flow remains unverified. After review corrections, npm run build, all 5,677 offline tests and all 54 HTTP integration tests against the local server passed. The required TypeScript/lint umbrella check still cannot finish because a separate concurrent untracked Fremen Nexus draft references a nonexistent Player.fremenNexusMovementBlockedTurn; no Extortion diagnostic remains. Atomics/Aftermath, mixed arrival reaction priority, complete faction games and public expansion starts remain gated. See the publisher sequence and user selection.

28 September 2026 — all-expansion Homeworld/Nexus samples

The offline combined audit setup can also enable genuine Homeworld custody with Nexus Cards and all three expansion decks; public starts remain unchanged. Five- and six-seat Basic/Advanced games all completed: 2,800 accepted actions, 74 JSON/private-view restores and unchanged source fingerprints. Five-seat tables reached three Nexus Card draw/keep choices and six actual Homeworld revival-deployment decisions. Eight proposed shipments/moves into public Ecaz Ambassador and Moritani Terror overlaps were rejected without mutation; bot continuations found other legal actions. The published arrival-priority question remains unresolved. An intentionally capped ten-action Advanced save resumed to turn-five victory with 877 accepted actions and 23 more restores. The source-bound matrix and replay reports are in /tmp/dune-combined-homeworld-nexus-matrix/report.json and /tmp/dune-homeworld-nexus-resume-finish/report.json. These sample wins do not certify individual card effects, every Homeworld entitlement or combined expansion publication.

28 September 2026 — five/six-seat all-expansion Nexus integration samples

The offline-only combined-nexus audit setup selects all three physical expansions and Nexus Cards for five seats (Ixians, Tleilaxu, CHOAM, Ecaz, Moritani) or six (plus Richese). Basic and Advanced samples for each roster completed with 4,098 accepted actions, zero rejected bot actions and 109 JSON/private-view restores. The five-seat tables reached five real Nexus Card draw/keep decisions; the six-seat tables formed alliances but did not draw cards. The report at /tmp/dune-all-expansion-nexus-matrix-final/report.json records status: passed and unchanged source. A separate intentionally capped ten-action five-seat save resumed to a turn-nine win with 1,380 accepted actions, 37 more restores and zero rejected actions. The resumed random stream restarts, so its outcome need not match an uninterrupted game. No card effect happened in these samples, so they do not establish individual card correctness, complete cross-expansion behavior or permission to open public starts.

28 September 2026 — owner-only operational counts

/admin/operations now samples the build revision and live database aggregates: saved/removed/archived/paused/closed rooms, active seat credentials, syntactically invalid JSON saves, last room write, backup snapshot bytes/count and committed private exports. Its read query repeats owner authority in SQL and returns no saved state, seat token, message, backup payload or audit reason. The page is read-only and refreshes only on request; it makes no integrity, disk-capacity, repair or stalled-decision claim. Two isolated D1 tests pass for counts, live demotion/revocation and unchanged saved games. The production HTTP suite passed 54/54 with anonymous/forged-session denial, and the build includes the new route/page. A real local signed-out browser denied access; desktop and 390-pixel samples rendered correctly using mocked owner API responses only, not an authenticated production owner. Full administrator operations and deployed acceptance remain gated; no production data was changed.

28 September 2026 — owner-only room backup capture

The new /admin/backups page lets an authenticated owner capture, list and download an immutable private room snapshot. It includes the saved game and related seat/recovery, lifecycle and discussion records without changing room version or granting access. Exact operation replays, live database authorization, content/version fencing and byte quotas protect competing writes and storage. An append-only owner/room/time receipt records each successful private export before its payload is returned. These are capture-only files: there is no import, validated restore, server health display or unified action-history entry yet.

Twelve isolated in-memory D1 backup cases pass, including exact replay, revoked access, unversioned concurrent changes, highly escaped state rejection, the 32,768-record download-audit capacity boundary and duplicate snapshots. A throwaway genuine game created in an isolated store was captured, listed and downloaded once; its room version remained zero and its export receipt count was one. The signed-out local browser showed the owner gate. A separate intercepted local UI view showed an older snapshot available to download after its live room had disappeared; that view used mocked API responses, not a real room restoration. The HTTP suite passed 53/53, including a new anonymous, forged-admin and real room-host backup denial case; the build included both new backup routes and the page. The stable full offline run passed 5,662/5,662 cases with zero failures. npm run check remains blocked by the unrelated concurrent Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn type field. The 1,800,000-byte per-snapshot cap, 16 MiB per-room and 64 MiB global quotas, bounded export ledger without archival, absent chunked backups, and unavailable live NAS Apps session keep saved-game and deployed acceptance open. No production game or credential was modified.

28 September 2026 — rules-reference duplicate links

The Ecaz faction topic no longer repeats its Duke Vidal related link, and the Homeworld implementation checklist lists each Tupile intelligence and Terror entry receipt source once. The local /rules?topic=faction-ecaz#faction-ecaz page rendered its opened Ecaz guide and one Duke link after the change; its fresh browser console had no React duplicate-key errors. Before the change, the same page reported duplicate keys for all three entries. This is a reference-display correction, not new game-rule acceptance.

28 September 2026 — source-stable complete-game integration samples

tools/faction-games.ts completed five genuine Basic Tleilaxu/Leader Skills games across two through six seats: 2,435 accepted actions, 64 JSON/private-view restorations and no rejected bot candidates. Ten genuine classic-faction Homeworld + Nexus games spanned two through six seats in Basic and Advanced: 4,284 accepted actions, 110 restorations and no rejected candidates. Both source-fingerprint reports passed unchanged, with custody checks after each action. The real setup and four rotating AI profiles used no staged cards, forces, phases or statistics. Private reports: /tmp/dune-tleilaxu-skills-20260928/report.json and /tmp/dune-homeworld-nexus-matrix-20260928/report.json.

Thirty paired CHOAM/Richese, Ecaz/Moritani and Ix/Tleilaxu + Nexus games also finished, covering two through six seats in both modes. Two six-seat games with all three faction expansions finished in Basic and Advanced. Together these 32 further games accepted 14,785 actions with 385 JSON/private-view restorations, zero rejected candidates and unchanged source fingerprints. The paired-module reports are /tmp/dune-choam-nexus-matrix-20260929/report.json, /tmp/dune-ecaz-nexus-matrix-20260929/report.json and /tmp/dune-ix-nexus-matrix-20260929/report.json; the combined-expansion report is /tmp/dune-all-expansion-complete-20260929/report.json. The runner checks physical cards, force counts and typed elites after each action; its generic expansion samples do not independently census exceptional Traitor zones.

Fifteen additional Basic Leader Skills games with native Moritani, Ixians or CHOAM finished across two through six seats: 7,829 accepted actions, 206 JSON/private-view restorations, no rejected bot candidates and unchanged source fingerprints. The reports are /tmp/dune-moritani-skills-matrix-20260929/report.json, /tmp/dune-ix-skills-matrix-20260929/report.json and /tmp/dune-choam-skills-matrix-20260929/report.json. Across all nine reports, 62 games finished with 29,333 accepted actions and 765 restores.

These samples establish legal sampled continuation to a winner, not natural exercise of every rare card or payment effect. They do not certify complete Leader Skills, Tleilaxu, Homeworld, Nexus, Advanced or expansion play, browser usability, production deployment or AI strength calibration.

28 September 2026 — Basic Tleilaxu revival/Bureaucrat composition

A genuine Basic Tleilaxu/Leader Skills game now offers a living native Bureaucrat's once-per-phase redirection on another player's actual paid revival price of at least five spice. The payer's cost and revived physical leader or forces are committed once; native Tleilaxu income retains its existing Karama window, and a cancellation does not offer a player-directed payment. A separate one-spice free-revival award cannot lift a small price over the threshold and is not diverted. The decision binds the payer, trainer, payee, amount, turn and phase to the saved response; the declined opportunity remains available. Negotiated price is available to its participants and trainer but omitted from unrelated observers' pending view and the public redirection log.

The owner panel shows the original price, both possible recipient amounts and the separate free-award explanation. Four legal bot policies use the projected choice. Genuine setup, Karama allow/cancel, negotiated leader and small force revival, JSON reload, authenticated SQLite restart and competing-version CAS have focused regressions. A read-only intercepted local browser room displayed the actual seven-spice payment and both controls; no room write occurred. This is one bounded payment family, not complete Tleilaxu, Leader Skills or combined-module acceptance; the verified live image remains c9a3625.

Independent rules and privacy/recovery reviews passed after correcting a public log that initially disclosed the negotiated price. Scoped lint, the production build, all 52 local HTTP integration tests and the standalone 716-file, 5,652-case offline suite pass. The required npm run check cannot complete: concurrent independent work in game/nexus-fremen-betrayal.ts:38 reads an undeclared Player.fremenNexusMovementBlockedTurn field. This checkpoint does not alter that draft or claim a green typecheck.

28 September 2026 — Ecaz Duke revival and bounded Mirror Weapon

The user chose two explicit product interpretations after bounded publisher source review: a successfully revived Duke returns alive to the shared area, unclaimed until later acquisition; a victorious physical Mirror may be kept even when its copied attack activates Poison Tooth or Artillery. Neither is presented as an official GF9 clarification. Ecaz's separate five-spice ordinary Duke revival and Ghola now use the same physical disc, with first five-in-Tanks cohort eligibility, frozen discount/payment and Tleilaxu stop/cancellation continuation, owner controls, minimal legal AI and JSON/ isolated SQLite recovery. Repeated six-disc native cycles, exceptional shared-disc custody and Advanced Harkonnen remain guarded.

Canonical Mirror now occupies the actual weapon slot in bounded Basic/Advanced CHOAM/Richese-deck classic/CHOAM/Richese battles. Revealed opposing attacks, copy-first independently saved Tooth/Stone choices, Stone's public casualty feasibility, physical-card retention/custody, Carthag's effective-poison defense, named Voice, human controls and four-profile legal AI are connected. Combined modules, changing card roles, complete Richese starts and release acceptance remain gated. Read-only local desktop browser fixtures showed the selectable Duke at five spice with strength six/set-aside guidance and the Mirror weapon selector, copied-attack explanation and updated hand guide; no real room was written. The verified live image remains c9a3625.

Independent read-only reviews found and prompted fixes for concealed foreign- ghola death-count privacy, Mirror Voice compulsion deadlock, reordered saved copy decisions and incorrect Stone scoring of ordinary Mirror copies. The reviewed focused run passed 66/66; the frozen full offline suite passed 5,643/5,643 across 714 files, live development-server HTTP integration passed 52/52, scoped oxlint and the app build passed. Project TypeScript still reports only the unrelated in-progress Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn; the required full npm run check cannot be claimed green until that draft is resolved. Browser proof also showed the actual copy-first revealed Tooth decision and physical Mirror/ opponent Tooth card faces. Production deployment remains blocked by the OS-locked host Apps session, not by a local reset or game migration.

27 September 2026 — Bounded Emperor Nexus bank-auction purchase

The separate Secret Ally purchase alternative lets an unallied holder with Emperor absent retain the full personally affordable winning bid on an ordinary bank-paid Treachery auction. The actual lot enters the winner's hand, the unique Emperor Nexus enters the discard, and ordinary auction follow-ups continue. A uniform winner confirmation in eligible classic-faction Nexus-only games avoids revealing hidden ownership; its timing remains a provisional product choice pending the recorded user question. Owner-only controls, all four legal AI profiles, signed event/receipt, JSON integrity and concurrent in-memory SQLite CAS/restart/replay are connected. Seller-paid/allied/expansion and non-Bidding transactions remain gated, as do the forced Emperor-payment Betrayal alternative and complete Nexus acceptance.

Independent review found and prompted repair of a stale cross-lot offer event and a bypass of normal-auction physical custody/hand-capacity preflight. The offer now binds the public auction index and final price without exposing the hidden lot face. Twenty-four focused purchase/automatic-payment cases passed; the frozen offline suite passed 5,610/5,610 across 708 files. Isolated project TypeScript excluding only the unrelated Fremen Nexus draft, scoped oxlint and the app build passed. npm run check and full lint stop at that draft's missing Player.fremenNexusMovementBlockedTurn. A read-only local browser fixture displayed the owner's purchase control, bid proof and ordinary payment choice; a rival seat saw only the uniform waiting decision and no private offer or card. No room write occurred. Production remains on the last verified c9a3625 image.

27 September 2026 — Bounded Reinforcements Battle Plan

The independent three-card runtime now permits the physical Reinforcements card in either Battle Plan slot for Basic/Advanced classic-faction games without other optional modules. A normal battle score gains two without changing the dial, support or on-board casualties; exactly three own ordinary-first reserve counters transfer to typed Tanks and count as battle losses at settlement, even for traitor/explosion outcomes. Mandatory discard, private category-None inspections, owner-only controls, four minimal legal AI profiles and JSON/SQLite saved continuation are connected. The normal-first choice, all-outcome payment and accounting are provisional product interpretations pending the recorded user/source ruling, not complete variant certification. Same-plan Harass/Stone Burner and optional modules remain gated; an opposing Harass plan is supported. Independent rules and privacy reviews found and prompted repair of a revealed-plan deadlock against opposing Harass.

Fourteen focused Reinforcements cases and 27 focused Harass cases passed, including Basic/Advanced physical custody, rival privacy, rejected-action immutability and concurrent in-memory SQLite CAS/restart. Read-only intercepted local browser views displayed the owner card in both physical selectors, cost guidance and no duplicate card after selection; the rival had no private card or cost offer. No room write occurred. Project-wide npm run check stops at the unrelated in-progress Fremen Nexus draft Player.fremenNexusMovementBlockedTurn diagnostic; isolated project TypeScript excluding only that draft and scoped lint passed. The final frozen offline suite passed 5,595/5,595 cases across 704 files; the app production build passed. Production still runs the earlier verified c9a3625 image.

27 September 2026 — Bounded native Richese Nexus Cunning pair

The Richese source contract now has one usable two-No-Field shipment in genuine Richese/CHOAM paired Nexus games without other optional modules. Two distinct nonrepeating physical tokens ship at the one-marker price; one immediately reveals into reserve-capped public normal forces and the other remains the sole concealed marker. The native Karama cancellation leaves resources, tokens and shipment allowance untouched while spending the card; Advanced Guild special prevention spends the attempted allowance without placing tokens or charging spice. Owner-only controls, four minimal legal bot paths, public value/force log and private concealed custody are connected. A read-only local browser fixture displayed the owner pair selector; the rival view had no private panel. Same-shipment lastShipped handling is a product interpretation, not a published FAQ answer.

Pure custody, Basic/Advanced engine, canceled/allowed responses, malformed intent, all AI profiles and concurrent in-memory SQLite CAS/reload/replay cases passed 60 focused tests after independent review fixed orphaned pending continuation and nullable bot-offer filtering. The final frozen full offline suite passed 5,581/5,581 cases across 700 files after the allocation-only validation refactor. Isolated project TypeScript excluding only the unrelated Fremen draft, scoped lint and app build also passed. npm run check still stops at the unrelated Player.fremenNexusMovementBlockedTurn draft error. Persistent faceup-component artwork, allied and optional-module combinations, Richese Betrayal and complete Nexus/public starts remain gated. This checkpoint is not yet in the live image.

27 September 2026 — Bounded Ecaz Nexus Secret Ally traitor inquiry

The Secret Ally prototype lets an unallied holder spend the physical Ecaz Nexus card at a quiet boundary when Ecaz is absent and ask any seated player, including themself, whether that player holds one of the holder's native leaders as an ordinary Traitor Card. The public action names the target but discloses no answer or matching identity; the holder alone can revisit the signed historical yes/no after the target's hand changes and the Nexus discard recycles. Native printed leader scope and holder-only audience are privacy-preserving product interpretations, not publisher rulings. Basic/Advanced real actions, four AI profiles, owner/rival projections, malformed and interrupted requests, JSON recovery and concurrent in-memory SQLite CAS passed six focused cases. A local read-only browser fixture showed the holder's target control and subsequent private answer, while a rival saw neither; no room write occurred. An independent rules/privacy/persistence review found no actionable defect.

The complete offline suite passed 5,571 tests across 699 files after the source tree stopped changing. Two source-bound CLI cases had reported a changed-source fingerprint during the earlier concurrent edit; all 19 CLI cases and the full suite passed on the frozen tree.

The shared clean-play predicate preserves CHOAM's existing boundary (12 focused cases). App build, scoped lint and a project TypeScript check excluding only the unrelated in-progress Nexus/Fremen draft passed. npm run check stops on that draft's missing Player.fremenNexusMovementBlockedTurn; it was not included here. Full Nexus and combined-module acceptance remain gated. This checkpoint has not been deployed.

27 September 2026 — Bounded Moritani Nexus losing-card retention

The Secret Ally prototype now opens the same after-loss choice for every Nexus loser when Moritani is absent and at least one publicly played card can be retained. Only an unallied holder may spend the physical Moritani Nexus card to keep one eligible played card; nonholders continue without disclosing custody. Mandatory discards and the other played cards follow ordinary saved battle cleanup. Native allied retention and its Karama response remain separate. Real Basic/Advanced battles, all four legal AI profiles, CHOAM winner inspection ordering, JSON restoration, rejected-action immutability and concurrent in-memory SQLite commits passed seven focused cases. An independent review found a Homeworld location-label crash; the corrected panel renders the server's public combat location name. Local browser views displayed the Arrakis decision, retained private hand and corrected Homeworld decision through read-only intercepted room responses; no room was mutated.

The complete offline suite passed 5,565 tests across 698 files, the app build and scoped lint passed, and a full project TypeScript check excluding only the unrelated in-progress Nexus/Fremen draft passed. npm run check still stops at that draft's missing Player.fremenNexusMovementBlockedTurn; this checkpoint is not yet deployed. The uniform loser prompt is a privacy-preserving product inference, not publisher timing text, and complete Nexus/module acceptance remains gated.

27 September 2026 — Bounded CHOAM Nexus after-victory inspection

The Secret Ally prototype now preserves the losing combatant's physically used-card IDs and offers every Nexus winner the same post-cleanup decision when CHOAM is absent, without revealing who holds its card. An eligible unallied holder may spend the physical CHOAM Nexus card to sample exactly one unused opposing hand card; only that seat receives the card snapshot, while the public log omits its face. Basic/Advanced real battles, all four AI profiles, signed receipt recovery, paid Nullentropy interruption, subsequent battle/turn expiry, rejected-action immutability and concurrent in-memory SQLite commits passed focused cases. A local browser with a read-only intercepted room view displayed the live table decision and private inspector; no saved room was changed. This is a product privacy interpretation, not a publisher ruling or complete Nexus certification.

The complete offline suite passed 5,558 tests across 697 files, and the app build and scoped lint passed. npm run check still stops at the unrelated in-progress Nexus/Fremen Player.fremenNexusMovementBlockedTurn type error; the CHOAM type error found on the first pass was corrected, and a second full TypeScript run reported only that unrelated diagnostic. The live image has not yet received this checkpoint.

27 September 2026 — Bounded Orgiz Processing Station Collection

The Discovery prototype now composes a sole Orgiz occupant's one-spice transfer over ordinary Collection: one uniquely collected board deposit is one observable blow, even when older blows stacked there. Separate deposits pay separately; contested Orgiz occupancy and unresolved Ecaz shared lots withhold their uncertain transfers without blocking ordinary collection. Advisor releases follow the ordinary Collection quote. This is a documented inference from the Ecaz & Moritani rulebook, not a publisher ruling. Basic/Advanced engine, JSON restoration, simultaneous in-memory SQLite CAS, conserved spice, rejected-action custody and player-visible log are covered by 20 focused Discovery cases. An actual staged engine continuation reached Collection and credited the Orgiz owner; an isolated local browser table rendered its token guidance and chronicle log without writing a room. The broader Discovery, combined-expansion and publication gates remain closed; this source is not yet the live c9a3625 image.

The complete offline suite passed 5,549 tests across 696 files, the app build passed, and scoped TypeScript/ESLint checks passed. npm run check still stops at an unrelated in-progress Nexus/Fremen draft with fremenNexusMovementBlockedTurn missing from Player; that draft was not changed or included in this checkpoint.

27 September 2026 — Bounded skilled Diplomat retreat

The standalone Leader Skills retreat interpretation now offers a surviving losing trained leader an event-bound, saved decision before ordinary loser casualties. The server quotes destination-specific undialed normal/elite counts using dial commitments, occupied strongholds, sector adjacency and the storm; accepted choices transfer those exact physical counters, while a decline or dead leader follows ordinary losses. Human controls and all four AI profiles use the same projected choices. Nine focused engine, controls and concurrent in-memory SQLite cases passed, including JSON restoration, split-sector custody, legacy-battle continuation and rejected-action immutability. An isolated browser view from a genuine revealed battle rendered the destination/count selectors and decline; POST was blocked, so no room was changed. The scoped type check and production build passed. This is a provisional strength/outcome-order interpretation, not a complete skill or combined-module ruling, and it is not yet deployed.

The complete offline regression suite passed 5,545 tests across 696 files after the retreat changes. The unrelated in-progress Nexus/Fremen draft still blocks the repository-wide type/lint check; the scoped type check covers this retreat slice. The live 4801ce0 image predates this slice.

Deployment follow-up: successful workflow 36358270534 published c9a3625ff2a9ddafdbc08e64de809eca6029db85, and a dedicated deployment agent updated only the NAS Apps dune image. The public footer title/accessibility name matched the full revision, the owner signed in, and all nine prior rooms remained (one playing room at version 54). The 0600 online SQLite backup passed PRAGMA quick_check. Live Diplomat battle gameplay and private saved-seat recovery were not exercised; the local browser fixture remains the feature-specific UI evidence.

27 September 2026 — Ixian/Tleilaxu with Nexus Cards

The paired-faction Nexus sample path now includes genuine Ixian/Tleilaxu games without opening the public expansion/module starts. At seed 20260927 all ten two-through-six-seat Basic/Advanced samples completed with 3,853 accepted actions, 100 JSON restores, five unallied card choices and no rejected actions. The three-seat Basic and Advanced traces reach Ixian auction decisions and Nexus draws; Basic reaches a Face Dancer decision, Advanced an Ixian Technology decision. A five-seat Basic trace also plays one Atreides Nexus effect, while an interrupted four-seat Advanced game resumes its own roster. The source-bound report is /tmp/dune-ix-nexus-checkpoint-20260927/report.json. This does not certify all card effects, combined module configurations or complete expansion rules.

27 September 2026 — Ecaz/Moritani with Nexus Cards

The paired-faction Nexus audit setup now includes genuine Ecaz/Moritani games, retaining the CHOAM/Richese profile and both public start gates. At seed 20260927 all ten two-through-six-seat Basic/Advanced samples completed: 3,827 accepted actions, 98 JSON restores, five unallied card choices and no rejected actions. A three-seat Basic trace reaches Ecaz Ambassador decisions, battles and Nexus drawing; an interrupted four-seat Advanced game resumes as its own Ecaz/Nexus roster. The source-bound report is /tmp/dune-ecaz-nexus-checkpoint-20260927/report.json. None of those draws activated a Nexus card effect; card-family and combined-mode completion remain gated.

27 September 2026 — CHOAM/Richese with Nexus Cards

The offline sample runner now admits genuine CHOAM/Richese setup with the physical Nexus module at two through six seats in Basic and Advanced. At seed 20260928 all ten games completed with 3,481 accepted actions, 90 periodic JSON restores, no rejected actions and one unallied Nexus Card choice. A separate seed 20260927 completed nine games with three choices, then stopped in six-seat Advanced Bidding after 1,863 accepted actions at the existing unresolved exhausted-Richese-cache normal-auction-count guard; the failed report is /tmp/dune-choam-nexus-trial-20260927/report.json. The passing source-bound checkpoint report is /tmp/dune-choam-nexus-checkpoint-20260928/report.json. No drawn card effect happened in these samples, so they do not certify the CHOAM Betrayal panel, all Nexus effects or public module starts.

27 September 2026 — Combined expansion game continuation

The original six faction samples now complete at seed 20260927, including the six-expansion-faction Basic and Advanced games. Those two combined games reached turn ten and turn nine respectively, with 4,396 accepted actions, 118 periodic JSON restores and no rejected actions. The Advanced trace includes nine explicit Ixian declines on Richese lots, ten Ecaz Ambassador decisions and fifteen Face Dancer decisions; it no longer stops at the historical movement-arrival guard for this seed. The source-bound report is /tmp/dune-combined-checkpoint-20260927-2183376/report.json. One seeded roster is not every valid combination, and the Richese Technology exchange remains unresolved; expansion/publication gates stay closed.

27 September 2026 — Ixian/Tleilaxu standalone roster samples

The expansion sample runner now exercises the Ixian/Tleilaxu pair with two through six seats under Basic and Advanced rules. At seed 20260927 all ten genuine setup/play games completed: 6,365 accepted actions, 169 JSON restores and no rejected actions. The six-seat Advanced trace reaches both Ixian Technology and Tleilaxu Face Dancer decisions, along with battle, revival and shipment paths. An interrupted four-seat Advanced run also resumes to completion. The source-bound report is /tmp/dune-ix-roster-checkpoint-20260927-final/report.json. This is bounded playable coverage, not full E1 rules certification or public expansion-start authorization.

27 September 2026 — CHOAM/Richese and Ecaz/Moritani roster samples

The sample runner now covers each expansion pair in Basic and Advanced at two through six seats, using genuine faction setup, legal AI decisions and periodic JSON restoration. The ten CHOAM/Richese games at seed 20260928 and ten Ecaz/Moritani games at seed 20260927 completed: 6,523 accepted actions, 167 restores, no rejected actions. Source-bound checkpoint reports are /tmp/dune-choam-roster-checkpoint-20260928/report.json and /tmp/dune-ecaz-roster-checkpoint-20260927/report.json. A separate CHOAM/Richese seed 20260927 completed nine games but stopped in six-seat Advanced Bidding after 1,728 accepted actions: an exhausted Richese cache reached the existing explicit unresolved normal-auction-count guard. That source question remains open, not papered over by the passing matrix. These samples do not certify full expansion rules, all rosters or public starts.

27 September 2026 — Bounded CHOAM Nexus Betrayal

The CHOAM Betrayal panel now has a playable Basic/Advanced path when CHOAM is seated. An unallied rival spends the physical CHOAM Nexus card at a clean boundary; the server samples and discards one actual held CHOAM Treachery Card without spice compensation. The holder-only control never offers a rival card choice or identities; its hand count appears only during Bidding. Bots act only when that count is public. A saved discard receipt completes once after JSON restore, including later same-turn Nexus recycling. Focused quote, controls, bot, physical inventory, rejection and interruption cases pass; the isolated browser table rendered the enabled holder control without room writes. Complete Nexus, combined-module and deployed revision acceptance remain open.

26 September 2026 — Bounded Ecaz Nexus Betrayal and build revision

The Ecaz source contract now has a narrow Betrayal path at the opening of Shipment and Movement. The unallied card holder chooses a public territory shared by Ecaz and its reciprocal ally. One physical Ecaz card is spent before a provisional Karama response; allowance returns the ally's entire typed group from all sectors to reserves, while cancellation preserves its board forces. The native shipment and movement queue is unchanged. Pure quote, real turn-two Nexus, bot ordering, privacy, rejection, JSON continuation and in-memory SQL duplicate-CAS/restart regressions exercise this bounded path. A local browser fixture rendered the owner-only shared-territory selector and rival public Karama notice; no room was written. The homepage revision was visually verified on local desktop and mobile. Broader combined-module acceptance and other Ecaz Nexus panels remain separate.

The landing lobby and active-table masthead now show the build's Git commit. Vite bakes a checkout HEAD or validated BUILD_REVISION; the container workflow passes its GitHub commit to Docker before building. A source tree with uncommitted edits still displays its committed HEAD, not those edits.

26 September 2026 — Bounded Fremen Nexus Cunning prototype

The Fremen Nexus source contract now has a native Basic/Advanced path for initially empty natural and accepted additional worm appearances, plus an Advanced Fremen special-Karama summoned appearance in classic-faction Nexus-only games. A uniform public offer does not disclose the privately held Fremen card. Accepted use spends it once, preserves the original worm and permits one source-labelled desert ride after its Nexus, moves exact normal/Fedaykin counters, and resumes native arrival children. Summons keep a separate server-issued parent event through the saved original Spice Blow. A Karama response provisionally cancels only the remote ride. JSON and in-memory SQLite continuations, duplicate-offer CAS races for natural and summoned appearances, owner-only controls, minimal legal bot participation and focused checks cover this bounded path. Independent review exposed an inherited-key force creation bug that was reproduced and fixed. Browser QA exercised natural and summoned offer/response/ride controls from genuine projected views with isolated GET interception and blocked POST; no room was mutated. Full module games, second Cunning offers during interrupted controls and Great Maker, combined modules and the absent-faction protection remain gated. A disconnected Moritani Atomics quote is not a runtime effect.

26 September 2026 — Unified administrator action history

Action history reads the nine existing durable audit sources with date/group/search filters, pagination, actor/target attribution and public recorded settings. Live owners/operators receive reasons; viewers receive none, and reasons are never searched. No saved-game or message table is read. Records remain available after target removal, with malformed metadata handled without leaking raw contents or breaking the page.

Independent review found and corrected unsafe role coercion, a rejected-field search oracle, affected-account name lookup and missing player-circle changes. Focused source/SQL regressions and genuine configuration receipts cover these boundaries. Real-runtime HTTP checking exposed workerd’s five-term compound-query limit; materialized source groups and an isolated D1 regression cover the fix. Required checks, HTTP/browser acceptance and preservation accompany the checkpoint separately. This is successful-operation history; failed attempts, full operational diagnostics and the remaining admin/game goal are unfinished.

26 September 2026 — Administrative discussion moderation prototype

Discussion controls connect human-seat mute/unmute to the admin directory and player message panel. New public/private sends are blocked at commit; history, incoming messages and exact committed retries remain usable. Settings survive seat recovery/handover without reviving old credentials. Game JSON, versions, timestamps, private custody and AI pacing remain unchanged.

Atomic live authority/membership/version fences, per-seat revisions and audit receipts protect concurrent and uncertain requests. Independent SQL/privacy and UI source review found no blocking defects. Focused regressions cover mute/send ordering, rollback, stale unmute races and exact retry privacy. Browser, HTTP, source-bound checkpoint checks and preservation evidence accompany this slice. New-revision deployed acceptance remains open; full administration and game rules/expansion completion remain unfinished.

26 September 2026 — Administrative participant AI prototype

Participant AI connects paused human-seat support to the existing authoritative controller action. It retains player access, private custody and AI deadlines; explicit resume starts normal paced continuation. Atomic authority/room/pause/seat fences, durable receipts and target-owned unused permission revocation preserve concurrent and uncertain requests. Local retry controls survive refresh and confirm old operations without reversing takeback.

Independent review corrected sector-18 and worm-ride compatibility, core continuation shape guards and changed-access handling after reconciliation. Focused regressions and twenty-two administrator HTTP groups passed; source-bound checks, browser acceptance and preservation accompany the checkpoint separately. Positive production admin testing remains pending authorized access. The complete administration panel, rules/expansion coverage and AI refinement remain unfinished.

26 September 2026 — Readable admin and saved-seat notices

First administrator and seat-control submissions show progress while the request is in flight; saved/uncertain requests retain their recovery controls. This extends the room-entry fix to admin creation, controls, lobby changes, removal, closure, archive, AI permissions and handovers. Successful recovery and handover confirmations remain above the table until Continue, including after polling or game actions. No game action waits for that acknowledgement.

Independent read-only review found no material issues. Focused notice/entry regressions and delayed/lost-response browser checks accompany the checkpoint; broad checks and deployed evidence are recorded separately. The complete admin panel and rules goal remain unfinished. See readable notices.

22 September 2026 — Administrative archive/unarchive prototype

Archive or unarchive organizes closed rooms without changing their saved state, timestamps, credentials, discussion or AI pacing. Separate directory filters compose with removal; unarchive leaves play closed, reopen rejects archives, and removal/restoration retains both flags. Live operator authority and room/archive version fences commit with durable audit receipts. Tab-scoped exact retries remain confirmable across refresh and later availability changes.

Independent read-only review found no material issues. Focused database/client checks and twenty dedicated administrator HTTP groups passed. Browser acceptance, source-bound broad checks and preservation evidence accompany the checkpoint. Authenticated production acceptance awaits authorized QA access. Full admin and rules gates remain unfinished.

22 September 2026 — Administrative close/reopen prototype

Close or reopen now separates administrative availability from the saved game's rules status and winner. It retains readable private tables and discussion, blocks new player/AI/seat/message mutations, and preserves exact prior receipts. Atomic audit/version/revision fences and independent closure metadata compose with pause, lobby configuration and recoverable removal. Reopening preserves credentials and pending choices, with existing AI pacing.

Independent review corrected recovery-claim scope, unnecessary closed-room worker scheduling and typed closure errors after write races. Focused runtime checks, dedicated HTTP acceptance and lost-response/mobile browser QA accompany the checkpoint. Source-bound broad checks and preservation evidence remain private; production acceptance must match the deployed checkpoint. Archive, permanent removal, bulk operations and the rest of the full administration panel remain unfinished; this does not certify complete rules or open publication gates.

22 September 2026 — Recoverable room removal and restoration

Added administrator removal/restoration with a typed-room confirmation, persistent operator/player notices, removed-room directory filters, live authorization and atomic version/revision audit receipts. Removed rooms deny private reads, joins, actions, AI, seat changes and discussion; restoration keeps saved state, previous pause/join flags and credential revocations. Exact retries retain proof across refresh, lost responses and temporary removal. Independent review repaired stale client removal markers without discarding recovery drafts. The dedicated HTTP flow also exposed and fixed AI lobby readiness after a human joins or changes faction. Focused, browser and required source-bound evidence accompany this checkpoint. Full administration and authenticated deployed acceptance remain unfinished.

22 September 2026 — Neutral administrator lobby configuration

Added rules/modules, AI configuration and existing-human host assignment through public administrator controls. Genuine unused-lobby admission, existing engine calculations, atomic live authorization/version fences and durable audit preserve normal start gates, physical pieces and private seats. Exact tab-scoped requests confirm without reapplying after a lost response, refresh or later game start. Independent malformed-save review, focused regressions, actual HTTP/browser checks and required source-bound checks accompany the checkpoint. Full admin scope and authenticated production acceptance remain unfinished.

22 September 2026 — Administrator room creation

Added configured lobby creation with explicit new-host ownership, initial AI factions/difficulties, supported optional rules, invitations and the ordinary voluntary host-seat transfer path. Atomic live-authorized writes and saved account-bound requests keep retries from duplicating rooms or reviving revoked private-seat access. Normal readiness and preview gates remain. Full neutral lobby administration, participant support and authenticated production acceptance remain unfinished; verification evidence accompanies the checkpoint.

22 September 2026 — Administrator room pause and joining locks

Added reversible pause/resume and joining-lock controls, availability filters and public player notices. SQL fences cover joins, player actions, automatic normalization and AI workers, including in-flight races. Saved-seat recovery, handover, discussion and AI takeback remain available. Control changes and exact receipts are audited atomically, with expected account binding protecting stale administrator tabs. Local HTTP/browser evidence includes a lost successful response, refresh, one-record replay and resume. See scope and verification. Full lifecycle, admin tools and authenticated deployed acceptance remain open.

22 September 2026 — Readable room entry and completed-action text

Normal create/join now shows concise pending text while the first request runs; the existing full recovery panel is reserved for saved or uncertain requests and remains until explicitly resolved. Automatic-action notices retain text behind a local Continue control without gating rules, server actions or AI pacing. See readable notices and action feedback. Focused regressions, delayed/lost-response browser QA and required checkpoint checks accompany the change. Deployed evidence remains separate and required.

22 September 2026 — Administrator access and room directory prototype

The first admin panel slice adds personal operator-provisioned keys, live owner/operator/viewer permissions, separate persistent eight-hour sessions, current/all-session sign-out and a privacy-preserving room directory. Additive schema/trigger changes protect the last enabled owner, invalidate disabled-account sessions and retain safe audit events. Filters, paging, public roster inspection, refresh and mobile controls are connected; no existing game state is rewritten.

Independent review found and resolved malformed-roster search failure and a revocation race at directory reads. Focused auth/SQL/privacy tests, authenticated HTTP and local browser checks precede source-bound check/build/integration and deployed acceptance. Evidence and actual final results belong to the checkpoint report. Room lifecycle, creation, participant support, backups, audit browsing and complete administration acceptance remain open; AI refinement remains gated.

22 September 2026 — Administration and deployed verification added to the goal

The user requested a complete admin panel, including adding and removing rooms and other useful operational actions. The goal now includes room lifecycle management, participant support, backups/restoration, health views and audited, authorized administration. This is a requirements checkpoint only; no admin capability or live room change is claimed. Administration is explicitly part of the non-AI completion gate; the existing Git, selective-subagent, rules coverage and saved-game preservation requirements remain unchanged. The user also requires relevant browser acceptance against the actual deployment at https://dune.procrastination.games, matching its revision and preserving human games. The verification workflow records the distinction from local checks. No new production test is claimed by this documentation checkpoint.

21 September 2026 — Selectable Advanced preview

The user-authorized Advanced preview now has room-creation and host lobby selectors, renewed readiness after mode changes, an explicit preview start and a persistent unfinished-rules notice. It uses genuine setup for two through six classic factions, with the existing Tech Token and Stronghold Card options. Saved mode integrity, fresh-piece checks, authenticated recovery and concurrent-start tests retain authority, custody and privacy. All 57 base rosters complete setup with each of four existing legal AI profiles. Full rules compliance, expansion starts and publication remain gated; final verification evidence stays in the private checkpoint report and Git message.

21 September 2026 — Harkonnen forced exchange return

Special-Karama exchanges now return automatically when the entire combined hand is owed. A private saved inspection retains the actual drawn card faces; legacy forced saves describe their held-card observation without inventing draw origin. Real choices remain interactive. Shared settlement preserves suspended responses, auction recovery and physical custody. See scope and evidence. The existing unfunded-bid ruling and Advanced/publication gates remain open.

21 September 2026 — Completed-action feedback

Core committed movement, shipping, revival, collection and battle results now feed the existing house-colored notices and optional sound. Burst summaries retain every represented action count while limiting the visible/pending queue to three notices. Hidden pages consume updates silently and clear old feedback. See coverage and verification. Rules and AI strategy are unchanged; full visual acceptance and remaining power tags stay open.

21 September 2026 — Truthtrance physical-force questions

Current force facts compare normal, elite or total physical counters in reserves, the Tanks or an exact live board location. Shared controls and validation retain typed-counter availability, exclude concealed No-Field values and reuse private compound answers, legal AI replies, history and card disposal. Restored fact questions are reparsed; current answers do not constrain later force actions. See the scope and evidence.

21 September 2026 — Basic CHOAM ordinary Leader Skill integration

The existing genuine CHOAM setup now shares ordinary skill action guards for its Basic/base roster. Full-deck, card-sale, mandatory battle cleanup and saved market/Ghola replacement choices are covered by the integration contract. Auditor, Richese and other mode/module boundaries retain their separate gates. The Sandmaster/native-HMS source audit records an unresolved eligibility question rather than assuming an extra collection power.

21 September 2026 — Basic Ixians with Leader Skills

Genuine full-deck setup connects cyborg movement per origin, Sandmaster HMS entry and exit, Suk rescue before actual Tank substitution, Rihani precedence and exact green-Special mandatory disposal. Signed aftermath choices, private controls, legal AI paths, authenticated concurrent recovery and two-through-six-player samples accompany the integration contract. Existing missing effects and mode/publication gates remain; source-bound final evidence is stored outside the checkout.

21 September 2026 — Basic Tleilaxu with Leader Skills

Genuine Basic Tleilaxu setup now uses the full skill deck, native Rihani Face Dancer exchanges and response-driven own-leader revival choices. Completed Rihani history releases live custody only when later Face Dance begins; Zoal Smuggler collection uses opposing printed disc strength. Shared guards, private controls, legal AI continuation, authenticated recovery and two-through-six player samples accompany the integration contract. Existing unfinished effects and public completion/publication gates remain.

21 September 2026 — Basic Moritani with Leader Skills

The existing private initializer now connects Basic Moritani with base opponents and the full fourteen-card skill deck. Shared public-profile guards cover the movement, shipment, payment and battle paths; Terror death/revival and ally retention compose with physical skill/card custody. Focused genuine-setup tests, authenticated concurrent recovery and a reusable two-through-six-player sample profile accompany the integration contract. Existing unfinished effects, Advanced/other roster combinations and publication gates remain explicit; private checkpoint reports record actual final evidence.

21 September 2026 — public battle component display

Revealed plans now share one table area with exact dials, played leader portraits and readable card faces. Direct inspection and navigation preserve pending decisions; both players retain access when a post-reveal choice belongs to one seat. Sealed plans and unused hands stay out of this display. Battle components records scope and evidence; focused tests and independent review accompany private check/build, browser, preservation and Git results. No game rule, saved field or AI strategy changed.

21 September 2026 — Advanced Ecaz Loyalty

Genuine Advanced Ecaz setup now randomly sets one native Traitor Card aside face up before dealing. A persisted public identity, enlarged inspector and automatic notice connect to initial setup, Tleilaxu Face Dancers and Nexus replacements. Physical census and invalid-state checks preserve its separate custody; older already-dealt games stay unchanged. Ecaz Loyalty records official sources, sequencing interpretation, focused tests and combined-module limits. Independent review accompanies private check/build/HTTP, genuine faction samples, browser and saved-preservation evidence. AI strategy and release gates remain unchanged.

21 September 2026 — public faction-sheet inspection

Every table player now has a public faction inspector and the internal guide contains a twelve-faction gallery. Basic/Advanced preview uses shared reference text without changing the game or reading private state. Richese, Ecaz and Moritani receive shared guidance from settled contracts; stale CHOAM and Ecaz availability summaries are corrected. Faction sheets records scope, source boundaries and remaining text/interaction acceptance. Focused checks and independent review accompany private browser, check/build, preservation and Git evidence. No AI strategy or release gate changed.

21 September 2026 — private-hand browsing

The private hand now supports literal name search, printed-category filtering and stable display sorting. Physical card IDs, existing inspectors/actions and saved order remain intact; required choices stay outside the filtered row. Hand browsing documents empty results, reset, live changes and local-only filter lifetime. A stale Harass allocation availability sentence is corrected. Focused tests and independent review accompany the private final browser, check/build, preservation and Git evidence. No AI strategy or gate changed.

21 September 2026 — live Treachery and Spice draw counts

The table now shows both physical draw-pile counts above the board. The public projection excludes auction pools, hands, caches and discards, while keeping private card identities and order concealed. Draw-pile counts connect existing saved responses, empty/refill guidance and internal inspection help. Setup, actual draws/refills, skipped worms, Thumper exclusion, privacy and JSON/rendering checks accompany independent review and private final evidence. No schema, game action, AI strategy or mode/publication gate changed.

21 September 2026 — public force counter inspection

Every player now has Inspect forces, with enlarged diagrams, special subsets, advisor faces, board locations and native/foreign Homeworld accounting. The reference includes all twelve factions. Force inspection excludes concealed No-Field values and temporary strength bonuses from physical counts. Focused projections, rendering, genuine setup and JSON recovery accompany independent review and private browser/preservation/Git evidence. No game action, AI strategy, schema, mode or publication gate changed; the full goal is unfinished.

21 September 2026 — live Nexus offer withdrawal

An unallied sender can now see the recipient of its outgoing Nexus offer and withdraw it through the existing action. Public history distinguishes proposals, withdrawals and alliance breaks. Nexus offer controls retain the current quote, timing, readiness, card forfeiture and version fences. Focused full-table rendering, JSON continuation, legal AI participation and production SQLite race checks accompany the private source-bound browser, preservation, independent review and Git record. No strategy, mode or publication gate changes; the broader game remains unfinished.

21 September 2026 — ordinary bribe controls

Players can now initiate the existing out-of-turn bribe action, with server-derived recipient limits, private incoming escrow and public payment history. Limits preserve reserved funds and binding Truthtrance completions; existing Bureaucrat redirection and saved version handling remain authoritative. See bribe controls. Focused rules/projection/rendering and HTTP concurrency checks accompany independent review and private source-bound browser, preservation and Git evidence. Strategic AI negotiation remains deferred. The separately reviewed Emperor gift/Bureaucrat interaction remains pending; this work does not open mode or publication gates.

21 September 2026 — durable table discussion prototype

Public table conversation and direct human-seat messages now have usable controls, plain-text rendering, durable history and exact retries. Message SQL independently fences current credentials and membership, filters private channels before paging, and leaves game JSON/version, sealed choices and bot continuation unchanged. Recovery/handover transfers access to the seat's history; old credentials stop working. Independent review found and fixed committed-write/rotation and late unmounted-response retry races, with regressions. See table discussion for the complete boundary. Final source-bound checks, browser observations, preservation and delivery records belong to the private checkpoint. AI messaging, prose-contract enforcement and full acceptance remain open; no mode gate changes.

21 September 2026 — Storm and Spice Blow practice

The interactive introduction now has thirteen lessons and eleven independent Basic examples. Storm separates sealed dials, reveal and movement, using both first-turn and later-turn ranges. Spice Blow compares accumulation, storm loss, later Shai-Hulud and first-turn worm return, with Nexus beginning after the replacement blow. Shared live calculations keep exposure and placement consistent; no rules or save-schema change. Version 6 preserves all prior lesson identities and results. Focused engine comparisons, independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Full faction, worm-ride and expansion teaching and complete game acceptance remain open.

21 September 2026 — Kwisatz Haderach component inspection

The companion inspector connects original artwork, private battle-loss tracking and availability guidance, permitted full-plan and public revealed-plan components, and static reference inspection. Existing server projection remains the privacy boundary; no rules calculation, save migration or AI tuning changes. Focused rendering/projection/JSON tests supplement the existing battle/death/revival checks. Independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Manufactured-layout verification and full Advanced acceptance remain open.

21 September 2026 — Storm Card inspection

The Storm Card inspector connects six numeric reference faces, the existing private Fremen forecast and actual public reveal receipts in the chronicle. Inspection is read-only. Saved public records retain their original face after movement or Weather Control, separately from effective storm distance. Earlier text-only history remains valid; unknown component metadata fails closed. No AI strategy or rules mode changes. Focused projection/provenance checks, independent review, browser controls and final check/build/HTTP/preservation/Git evidence belong to the private checkpoint. Complete physical face/artwork and broader component acceptance remain unfinished.

21 September 2026 — Charity and Revival practice

The introduction expands to eleven lessons and nine Basic examples. Charity teaches the top-up to two spice; Revival teaches shared free allowances, paid force returns, the ordinary cap, leader eligibility and separate leader/force limits. Existing production calculations supply the costs and choices; a legal saved action history preserves cumulative spending and custody. All previous lesson identities and outcomes migrate to version 5. No live AI strategy or rules mode changes. Focused engine comparisons, independent review, browser controls and source-bound checks/preservation/Git evidence belong to the private checkpoint. Duke revival/loans retain their existing unresolved custody boundaries; the full curriculum and game remain unfinished.

21 September 2026 — Interactive Nexus alliance practice

The introduction now connects nine lessons and seven Basic examples. A four-player Nexus teaches mutual consent, unanswered offers, withdrawal and unilateral alliance breaks. An explicit later Mentat check contrasts three shared strongholds with the ordinary four-stronghold joint victory. Shared production pairing, progress and victory quotes preserve physical force ownership. The live engine retains phase/expansion checks and card forfeiture. Version 4 practice saves preserve all prior lesson identities and committed choices. Focused engine comparisons, migration and rejection checks accompany independent review and final source-bound browser/check/build/preservation/Git evidence in the private checkpoint. Broader teaching and all mode/publication gates remain open work.

20 September 2026 — Interactive ordinary bidding practice

The introduction now connects eight lessons and six Basic examples. The new Fremen bidding position teaches raising, passing and re-entry, full hands, all-pass termination, winner-only payment and private card inspection. Shared ordinary-auction quotes also serve the live engine without changing its funding, payment or reaction layers. Version 3 practice saves migrate every prior lesson by identity and validate exact bid history through replay. Focused engine comparisons and independent review are paired with final browser, source-bound checks, preservation and Git evidence in the private checkpoint. Broader teaching, rules and mode/publication gates remain unfinished.

20 September 2026 — Configure existing lobby AI seats

Lobby AI configuration connects host-only difficulty, faction and player-circle controls to a shared strict quote and authoritative lobby action. Seat identity persists, faction rosters follow existing setup, actual changes clear human readiness, and public history explains each change. Focused engine, SQLite/restart/concurrent-start and HTTP tests cover the bounded contract. Final independent review, browser, source-bound check/build/HTTP and saved-game preservation evidence belong to the private checkpoint and Git message. Existing AI strategies and mode/publication gates remain unchanged.

20 September 2026 — One-use named-player AI permission

The AI permission prototype connects optional owner consent to a named human and fixed difficulty for one activation within 24 hours. It retains ownership and private information, uses both exact session fences, atomic versioned activation/consumption, owner takeback invalidation and saved exact retries. Additive migration 0006 preserves existing rooms and seats. Independent review, focused SQLite/client/HTTP checks, browser acceptance and final source-bound check/build/HTTP/preservation evidence belong to the private checkpoint and Git message. No AI strategy or mode/publication gate changes.

The Sites platform audit found no supported durable trigger or alarm binding. Unattended resumption remains a platform blocker; no inert scheduler was added or claimed complete.

20 September 2026 — Movement and Traitor introduction exercises

The introduction now connects seven lessons and five Basic practice positions. Movement uses shared geometry/occupancy; Traitor call, decline and mutual betrayal use the production battle quote. Version 2 browser saves explicitly migrate every old lesson and preserve its previous choices. A hot-update state mismatch found in the browser is corrected by remounting the lesson component on schema change. Focused comparisons exercise 96 actual engine moves and all offered Traitor outcomes. Independent review and final browser/check/build, preservation and Git evidence belong to the private source-bound checkpoint. Full curriculum remains unfinished; mode/publication gates stay closed.

20 September 2026 — Sandmaster worm-ride prototype

Native Fremen worm rides collect one optional destination spice after legal placement and before faction arrival reactions. Shared server, control and minimal AI paths preserve source exclusion, typed force custody and normal movement. Existing atomic room writes and saved arrival decisions prevent repeated payment after concurrent requests or restoration. Empty/ambiguous piles, unsupported combinations and legacy actions preserve ordinary riding. Ten focused engine/control/SQLite checks and independent review cover the bounded contract; final check/build/HTTP, browser/sample and preservation results belong to the source-bound private checkpoint and Git message. No release gate is opened.

20 September 2026 — Smuggler battle collection prototype

Unmodified Smuggler collection binds the reveal-time pile and pays once after leader survival, including losing or captured leaders. Shared server/control/bot admission preserves the pending modifier and combined-module boundaries; deferred settlement before Sandmaster remains an explicit timing inference. Native face-up skilled discs are excluded from AI selection. New receipts preserve private saved continuation and old unversioned battles retain their prior behavior. Independent review and focused engine/SQLite evidence are paired with source-bound final checks, browser/samples, preservation and verified Git delivery in the private checkpoint and commit message. No gate is opened.

After the reported outage the server responded and all 1,106 baseline games matched their saved rows. The prior private QA seat restored after refresh. No restart, reset or maintenance automation was needed.

20 September 2026 — Interactive introduction prototype

Five guided lessons connect shipping budgets, sealed battle plans and spice collection to shared production rule quotes, with keyboard controls, card inspection and browser-local saved progress. The fixed opponent is a teaching example, not an AI match. The wider faction, movement, bidding, Advanced and expansion curriculum remains unfinished. Focused checks cover combat outcomes and saved-choice validation; final browser/check/build, preservation and Git evidence belong to the private source-bound report and commit message. No mode or publication gate is opened.

Independent Smuggler review supports the deferred survival receipt but found no official modifier-strength ruling. That single new question remains explicit in the decision register; no pending answer was inferred to enable collection.

20 September 2026 — Sapho early battle aggressor

Early aggressor connects the held physical card, existing pre-plan opportunity, shared tie priority, controls, four AI profiles and private saved continuation. It preserves participant slots and chooser, respects Habbanya in either slot, and checks Stone finishability before commitments. Later battle intervention and its unresolved allocation/response protocol remain unfinished. Independent review found no material rules/privacy blocker after final integration. Focused engine/control/SQLite evidence is paired with final source-bound checks, browser/sample reports, preservation and verified Git delivery in the private checkpoint report and commit message. Public mode and publication gates stay closed.

The Mirror admission audit supersedes its earlier ordinary-slice recommendation: every genuine CHOAM/Richese setup includes the unresolved copy candidates. A synthetic restricted deck, hidden eligibility gate or reveal-time rejection cannot establish playable full-game support. Existing user/source rulings remain pending.

20 September 2026 — Optional table sound prototype

Table sound controls add local mute, keyboard volume and a test sample, with short synthesized cues for public phase changes and tagged automatic actions. Silent baseline consumption, coalescing and background suppression avoid replaying old updates. Preferences survive refresh and synchronize between tabs; game actions, AI timing and saved state are unchanged. Focused audio/cursor checks and browser controls cover the connected prototype. Physical output, screenshot acceptance and final event coverage remain unfinished. Required check/build, preservation and verified Git delivery belong to the source-bound private report and commit message. No mode or publication gate is opened.

The reported outage left all 1,072 baseline games unchanged. The responding server was reused and the existing isolated seat reconnected without a database reset.

14 September 2026 — Harass revealed physical allocation

Connected ordinary/elite and multi-sector choices after public plan reveal, before Traitor declarations. Unique returns remain automatic; selected counters are public but stay on board until atomic Traitor settlement. The shared quote, player controls, four AI profiles and versioned saved decision preserve exact custody and existing mode gates. Winner casualties cannot choose a smaller physical commitment after its undialed complement has returned. See the allocation contract for source timing and limits; source-bound final evidence and delivery remain in the private report/Git message.

14 September — AI ordinary arrival preflight

AI arrival checks filter known unsupported ordinary shipment/movement candidates with the existing authoritative reaction quote. All four profiles retain executable alternatives, single reactions, faction exemptions and correctly routed Guild contributions. The public-input adapter never reads concealed Terror faces or rival private resources. Special routes remain on their existing adapters; no simultaneous reaction rule is invented. Source-bound same-seed samples, focused regressions, required checks, saved-game preservation and delivery are recorded in the private report and Git message.

14 September — reusable base player-count samples

The faction sample runner now also selects genuine base Basic/Advanced games at every player count from two through six. Original expansion defaults and seed offsets remain stable. A shared inventory check includes unsold auctions, nonnegative force/spice values, exact elite totals and subsets, and post-setup base Traitor custody. Rejected-action immutability and restored private rival boundaries are checked. Failed traces and snapshots remain replayable through explicit resume. This consolidates the repeated private harness corrections; it does not certify complete player-count rules or open any mode gate.

The Moritani Secret Ally source audit also records why a holder-only retention pause would leak its hidden Nexus. The existing shared UX question remains pending; no duplicate question or new timing policy was introduced. Focused and full-run results, source identity and delivery are recorded in the private checkpoint report and Git message.

14 September 2026 — Compound shipment promises

Shipment-only AND/OR extends the existing Truthtrance shipment question with whole-expression truth, complete destination search, controls and private AI answers. Earlier separate promises remain jointly binding, and legacy flat records retain their meaning. The existing timing/module gates and unresolved material questions stay in place. Source-bound final checks, browser continuation, private preservation and verified Git delivery are recorded in the checkpoint report and commit message. The opening baseline is 1,004 rooms.

14 September 2026 — Sapho remaining battle-choice order

The Sapho battle-order prototype adds first/last remaining Battle-phase choice through the existing physical card, hand controls, legal AI and saved state. The public chooser is separate from physical attacker/defender; old battle outcomes, storm order and tie rules remain intact. Accepted priority persists through complete aftermath and later changed board eligibility. This separation and phase duration are explicit implementation interpretations.

A fresh Reinforcements cost review found no authoritative resolution of its reserve payment versus a traitor win. The question has been sent to the user; the card remains disabled while independent Sapho work proceeds. Advanced Atreides accounting and same-plan Harass ordering remain separate unresolved combinations.

The checkpoint uses a 970-room preservation baseline, a separate browser lobby, focused rules/controls/AI/SQLite checks and independent review. Final complete-game, browser, broad-check and verified Git results belong to the source-bound private report and commit message. Public mode and publication gates remain unchanged.

14 September 2026 — Harass & Withdraw battle prototype

Harass & Withdraw now connects either physical card slot, category-aware private inspections, unique typed undialed returns before battle losses, successful opponent-Traitor cancellation and mandatory disposal. Both selectors, all four AI profiles and saved continuation use the shared physical quote. Existing Planetologist inspection and literal Truthtrance slot promises remain unchanged. Richese/Stone Burner timing, ambiguous allocations and optional-module combinations remain gated; public starts stay closed.

Focused rules, controls, bot and authenticated recovery evidence is paired with independent review. Final complete-game samples, browser checks, preservation, required broad checks and Git delivery are recorded in the source-bound checkpoint report and commit message. This is a connected prototype, not full rules certification. All 936 opening games and 1,959 seats survived the reported outage unchanged; the healthy server was reused without resetting saved state or recreating automation.

14 September 2026 — Recruits independent-card preview

Recruits is connected in an explicit development preview. Genuine Basic/Advanced faction setup includes all three independent Ecaz Treachery Cards before shuffle and deal. Physical play/discard, public effective rates, shared revival quotes, exact free-use tracking, existing CHOAM/Tleilaxu response continuation, owner controls and all four AI profiles share the authoritative contract. Inactive games retain their earlier free-use arithmetic. The other two battle effects and public variant starts remain unfinished.

Source review supports the bounded clean-case contract. The independent seven-force cap after faction cancellation remains an explicit inference. Earlier-paid returns, late grants, pending repricing and same-turn recovered-card replay remain gated; the user's late-paid question is pending. Focused rules, controls, genuine local setup and authenticated recovery tests accompany the implementation. Complete-game and browser evidence, required broad checks and Git delivery are recorded with the checkpoint; this does not certify complete variant or combined-mode compliance.

All 902 opening rooms and original seat/recovery records survived the latest power failure unchanged. The healthy server was reused; integrity and foreign keys pass. No database reset, server restart or recurring automation was needed.

Final independent review's 37-case union and four SQLite recovery cases pass. Review closed normal-auction sale aliasing, malformed canonical cards, known-zero legacy ledger initialization, seat-control validation and ordinary-start bypasses. Eight genuine six-seat Basic/Advanced samples finish in 7,995 accepted actions, with zero rejected candidates and three Recruits plays. Every action preserves physical card/Traitor/force/elite custody; 212 periodic all-seat JSON restores and terminal views pass. The conserved browser exercise verifies play/discard, global rates, four free returns, explanatory chronicle, private seat and refresh. Earlier harness attempts remain preserved; JSON comparison normalizes undefined properties on both sides without dropping defined values.

14 September 2026 — Fremen/Ecaz final-turn victory and deferred shipment repair

The explicit Sietch Tabr FAQ now reaches automatic victory resolution: reciprocal Ecaz/Fremen allies with fighters there may satisfy the Fremen final-turn condition. The same public quote drives territory/blocker guidance; the chronicle explains a successful special win. Solitary/nonallied Ecaz, unrelated fighters and the unsupported Habbanya extension retain their existing exclusions. Effective advisor and concealed-marker presence, ordinary stronghold/prediction precedence, Guild fallback and existing no-Guild behavior are preserved. This adds no mandatory confirmation or schema.

Independent source/privacy review found no blocker. Seventeen focused cases pass, including Basic/Advanced outcomes, all four AI profiles, JSON/private views and authenticated SQLite restoration before and after final readiness. Concurrent last-ready requests commit once; stale/finished requests do not write. Exact cards, Traitors, forces, elites and seat records are preserved. Final-turn positions are explicitly staged after genuine setup, including the reciprocal alliance and a turn-ten Fremen prediction, rather than claimed as natural full-game outcomes. The broader existing victory regression union passes 83 cases. A fresh browser room verifies the public guide, actual Ready-to-win transition, explanatory log and pending/finished refresh. Private read-only comparison confirms unchanged spice, cards, Traitors, leaders, forces, elites and seat records.

A genuine Advanced sample also exposed the pre-existing Guild shipment deadlock: an accepted declaration could not pass an Ambassador/BG arrival overlap. Prior HEAD replay reproduced all 90 actions. Fresh ordinary/No-Field preflight and narrow, typed saved-declaration recovery now avoid the trap while preserving unresolved reaction-order gates. Independent review resolved an early No-Field window bypass and malformed special-marker handling; its 149-case union passes, including three authenticated SQLite cases.

The exact failed snapshot finishes after 842 further accepted actions, with 109 guarded candidates, on turn ten for Guild. The original Basic/Advanced seeds finish in 563/806 accepted actions with 14/81 guards, on turns seven/nine for Guild/BG. All 58 periodic JSON rounds, twelve terminal private views and physical custody checks pass against unchanged gameplay source. The Advanced runs form Ecaz/Fremen alliances, but neither uses shared Tabr or its special victory. The saved continuation uses a documented new random stream; no failed seed or snapshot was silently replaced. Simultaneous arrival integration remains open.

The latest reported outage preserved all 835 opening games and original seat records. All 869 current rooms are backed up before final verification, and the finished browser seat restores correctly. The healthy server is reused.

Browser and complete-sample evidence, types/lint/offline/build/HTTP results, source fingerprint, saved-game preservation and verified Git push are recorded with this checkpoint. The running server is reused; complete rules coverage, all combinations and publication remain gated.

14 September 2026 — Moritani Assassinate Leaders prototype and outage preservation

Assassinate Leaders connects native Advanced Moritani's qualifying battle loss to private reveal/continue controls, a different opposing-faction Traitor Card, live-target death and bank bounty, and automatic Mentat replacement with a public set-aside marker. Dead targets remain legal with zero bounty. All four AI profiles use the owner's legal choices; one use per faction and physical held/reserve/retired custody persist across saves.

The explicit local preview excludes exceptional captured/foreign leaders and combined modules. A uniform private step prevents hidden eligibility leaks but awaits the user's UX decision. Normal traitor-call duration also remains unresolved; a recorded call guards later use without declaring a publisher ruling. No ordinary start or publication gate opens. The checklist records the bounded prototype.

Independent source/privacy/persistence review and 32 focused cases pass. Separate battle obligations bind cleanup, normal-call logs wait for public revelation, and replacement custody rejects missing cards and forged same-turn consumption chains. Five SQLite cases cover authenticated pending/resolved restoration, Truthtrance interruption, competing writes, stale/duplicate actions and corrupt saved receipts.

Two genuine Advanced four-profile games finish in 296/101 accepted actions, with zero rejected candidates, ten periodic JSON rounds and all eight final seat views restored. Exact physical custody holds. Two opportunities are declined; these samples do not exercise an assassination reveal. A separate conserved, staged browser battle verifies Master Bewt's death, three-spice bounty, retained card, automatic Mentat replacement, public marker, context-correct readable inspection, and pending/resolved refresh. The QA game remains at human Terror placement.

After the reported power failure, all 801 opening games remain unchanged and the healthy server is reused. Final types/lint/offline/build/HTTP results, source fingerprint, preservation of room and seat/recovery records, and Git delivery are recorded in the verified commit and private report. The full goal remains unfinished.

14 September 2026 — Truthtrance recorded knowledge and outage preservation

Truthtrance knowledge connects stored Bene Gesserit prediction faction/turn, a respondent's active submitted storm dial and the card actually known to native Advanced Fremen. Server validation, target-only answer projection, compound controls, all four AI profiles and saved continuation share the same eligible facts. Missing knowledge stays unknown; only the aggregate answer becomes public and a definite answer consumes the physical card once. This does not implement general future commitments or AI question strategy.

Independent source/privacy review and 13 new cases pass; the focused union passes 44, including five authenticated SQLite recovery cases. Review fixed missing comparison controls, parent selector mapping and the invalid-input submission guard. Recovery covers pending questions and interrupted storm peeks, private seat views, dishonest/stale/duplicate requests, competing writes and malformed saved predicates without state or physical-custody corruption.

Two genuine-setup games using all four profiles finish with zero rejections: Basic 192 actions/five periodic JSON rounds; Advanced 518/fourteen. Exact card and force custody holds, including all eight restored final seat views. Three scripted questions use naturally held cards and cover prediction faction, prediction turn and submitted dial. Forecast coverage comes from the separate browser exercise, whose only staged acquisition relocates two physical Truthtrances. That exercise verifies invalid input, unknown/rephrasing, both compound clauses, a forecast comparison and refresh following submission and final resolution.

After the reported power failure, all 767 opening rooms and original seat/recovery records match the backup. Integrity and foreign keys pass; the healthy server is reused. A fresh snapshot protects all 768 rooms before broad checks. Final broad results, source fingerprint, post-HTTP preservation and Git delivery are recorded in the verified commit and private report. Completion/publication gates remain.

14 September 2026 — Emperor Nexus revival prototype and outage recovery

Emperor Secret Ally now connects exactly three additional free force returns in Basic/Advanced base-faction Nexus games. It preserves ordinary force/free allowances, shared Advanced Fedaykin caps and physical card custody, without a public pause or forced pass. Private legal controls, four AI profiles, JSON continuation and production SQLite recovery are connected. Independent review validates phase-wide timing and private receipts; 17 focused effect tests cover illegal/stale/competing requests and later Ghola. The separate purchase alternative remains pending its uniform payment UX question.

Two genuine-start samples finish (Basic 715 actions/19 periodic JSON rounds; Advanced 263/7), with no Emperor use. Two explicitly staged continuations finish in 18 and 17 actions with one normal-force return each. All candidates are legal; exact Treachery, force, elite and Nexus custody holds, and all 14 final seat views restore unchanged. These samples retain their setup and coverage limitations. The separate staged browser game exercises a Fedaykin return, then three ordinary revivals, unchanged spice, readable inspection and refresh recovery. The reusable local prototype writer adds genuine Nexus setup without opening public starts.

All 733 opening games and original seat/recovery records survived the reported power failure unchanged. Integrity/foreign keys pass and the healthy server is reused. A new snapshot protects all 734 rooms before final checks. The verified commit and private report record required broad checks, source fingerprint, post-HTTP preservation and Git delivery. Full module and publication gates remain.

14 September 2026 — Bureaucrat payment prototype and outage preservation

Bureaucrat now connects optional two-spice redirection for ordinary auction, Guild shipment, Richese auction and actual bribe payments in the bounded base/CHOAM Leader Skills profile. Native income cancellation resolves before the offer; the payer is charged once and the original callback resumes once. Decline leaves later opportunities available, and bribe proceeds remain unspendable until Mentat Pause. The physical-card use ledger survives ownership changes. Payment-unit guards, composition inferences and missing families remain explicit; no public mode or publication gate is opened.

Owner controls and all four AI profiles use public payment information. Independent review covers saved receipts, private projection, costs, custody and callback ordering. Review found and fixed duplicate use-event corruption and an overly broad guard on Bank-bound independent Karama shipments. Focused regressions cover those defects, auction/card delivery, real Bene Gesserit advisor continuation, bribe escrow, private SQLite restoration and competing version writes.

Four controlled-shuffle genuine-setup games complete with zero rejected actions: base Basic 718 actions/20 JSON restores, base Advanced 551/15, CHOAM Basic 681/19, and CHOAM Advanced 174/5. Full physical card, force and skill custody is checked. None reaches a Bureaucrat payment decision, so those samples establish bounded regression continuation only. A separate conserved staged browser game allows one five-spice bribe and redirects two from a second: ten is paid, eight stays in bribe escrow, and only one skill use is recorded. Both pending and resolved states restore after refresh with unchanged physical custody and private projections.

After the reported power failure, all 699 opening games and original seat/recovery records matched the private backup. The database passed integrity and foreign-key checks and the server remained healthy. No restart or reset was needed. Final broad results, source fingerprint, Git delivery and post-HTTP preservation totals are recorded in the checkpoint commit and private verification report.

13 September 2026 — Private Mentat question preview and outage recovery

Mentat has a connected private pre-plan question preview: canonical named weapons, a uniform target-owned card-show step, owner/target-only historical observations and subsequent leader concealment before faction powers. The shown card stays in hand and does not bind a plan. The private opt-in is absent from player views and cannot be enabled through actions. Ordinary Leader Skills games remain unchanged pending the user's forced-response UX exception decision; empty hands skip with an explicit unavailable receipt and no fabricated answer.

Independent review and 22 focused tests cover legality, custody, sequencing, private controls, all four AI profiles, JSON/SQLite restoration and stale/competing writes. Two complete genuine-setup samples deliberately deal Mentat through a controlled initial skill shuffle: Basic 100 actions/3 JSON restores, Advanced 507/14, each with one private observation and no rejected candidate. These are bounded preview paths, not complete skill or expansion acceptance. The separate browser QA uses a staged conserved battle and verifies private disclosure, a readable inspector, refresh recovery and the right to conceal after asking.

After another reported power failure, all 665 opening rooms and original seat, recovery and receipt rows matched the backup. A fresh backup captured 666 rooms, including the isolated preview; database integrity and foreign keys passed. The existing server responded at localhost:3000, and its lock prevented a duplicate start. The saved Mentat browser seat restored its hand, resources, observation and pending posture. No reset, recurring automation or publication was introduced. The verified Git checkpoint records final broad results and preservation counts.

13 September 2026 — Deferred movement arrival safety and reusable samples

Deferred movement fixes the combined Advanced sample's accepted CHOAM decline deadlock. The actual conflict was a qualifying Ambassador and Terror at the same destination. Fresh movement checks existing arrival guards before native prevention windows or new Ornithopter commitment. A saved explicit CHOAM decline can return an uncommitted unsupported move for another choice; its existing reserved card remains available and retires once when the replacement use finishes. Unrelated exceptions still reject atomically, and Karama cancellation still validates arrival before spending its cost. No simultaneous-arrival order is invented; that material question remains pending.

Independent review covers rules, custody and private continuation. Focused regressions exercise native Ixian/Fremen declarations, ordinary single-token arrivals, saved legacy choices and Ornithopter escrow. In-memory production-room checks cover authenticated decline, restoration, stale/duplicate ownership and concurrent version races. The final checkpoint records actual broad results.

tools/faction-games.ts replaces repeated private simulation copies with six fixed genuine-setup scenarios, all four profiles, physical custody checks and JSON restoration. It records private traces, failed snapshots, source fingerprints and explicit nonzero failure. Snapshot resume records provenance and starts a new seeded continuation stream. Full-game samples remain evidence of their particular paths; rejection counts and any later guards are retained in the checkpoint. All six fresh samples completed. Combined Advanced finished at turn six with 1,303 actions, 35 JSON restores and 46 guarded arrival candidates. The exact prior failed save separately finished after 691 additional actions, 18 restores and 39 guarded candidates. The detailed feature document records the limitation.

After the reported outage the server was healthy, all 632 opening games and their original seat/recovery records matched the private backup, and existing Ecaz and Ixian QA seats restored their private hands and pending choices in the browser. No restart or reset was needed. Public starts and publication remain gated.

13 September 2026 — Expansion faction setup and saved Ixian auction decline

The faction development profile connects all seven nonempty expansion selections to genuine Basic/Advanced setup and existing faction controls, AI and saved continuation. Ecaz now allocates six starting forces within Imperial Basin, keeping fourteen in reserve; Fremen, Advanced Bene Gesserit and Moritani placement ordering is preserved with its printed and inferred boundaries documented. The optional Ecaz Treachery variant stays separate, ordinary decks contain 33/35/47 cards, and Richese keeps its separate ten-card cache. Public starts remain gated.

Combined play exposed an existing Ixian Technology/Richese special-lot deadlock. A saved explicit per-lot decline now opens the original cache or Black Market lot without using Technology, changing its card custody or revealing a concealed card. Exact event, round, declaration and custody validation protects view, normalization and actions, including Gift/Truthtrance interruptions. Competing uses of the reserved offered card are rejected before creating responses. The actual exchange still needs its recorded replacement-custody interpretation.

Focused setup, controls, legal AI, private JSON/SQLite continuation and concurrent write checks pass, with independent review of rules, custody and persistence. Five of six genuine mixed-profile samples finish. Combined Advanced progresses past three special-lot declines to turn three, then stops on an existing CHOAM movement/Ambassador arrival guard. Guarded arrival candidates also occur in the Ecaz samples. These are explicit remaining integration limits, not full expansion acceptance. The detailed feature document retains exact sample metrics.

The browser verified genuine Ecaz traitor/force setup and refresh, then a separate Advanced development game's saved Ixian decline, unchanged offered card, legal bidding and private hand restoration. After the reported outage, all 597 opening games and original seat/recovery records matched the backup. A stale server module cache required a restart after a fresh 598-room backup; every room matched before QA resumed. Required broad checks, final preservation totals and source fingerprint are recorded in the checkpoint commit and private report. No database reset, recurring automation or publication was performed.

13 September 2026 — Diplomat base-defense copying prototype

Diplomat now optionally counts one committed Worthless as an opposing base Shield or Snooper, including to save its native trained leader. The owner chooses after public plan reveal and before traitor decisions. Exact physical plans and cards stay in place; the selected Worthless is discarded after battle even on a win. This timing and explicit-discard precedence over ordinary traitor retention are recorded implementation inferences, not additional printed rulings. Lower retreat and modified/combined defenses remain unfinished.

Player controls, all four legal AI paths, public projection and saved decisions are connected. Independent review and focused SQLite restart, concurrent copy or decline, corruption rejection, self-protection and traitor-preempted discard checks cover this boundary. Two genuine four-profile samples completed without rejected candidates: Basic used 210 actions and six JSON restores; Advanced used 223 actions and seven restores. Neither encountered an eligible Diplomat offer; targeted battle checks establish the effect. A fresh browser scenario restored the pending copy, saved native Hasimir from poison, discarded Baliset exactly once, kept Crysknife and restored the private hand/traitor plus four board forces, fifteen reserves, one Tank and eight spice. Required broad results are recorded in the checkpoint commit and private report.

After the new outage report the server responded normally, database integrity and foreign keys passed, and all 563 opening rooms plus their original seat/recovery records matched the backup. No restart, reset or automation was required. Public mode and publication gates stay closed.

13 September 2026 — Smuggler with owned Richese No-Field

The officially permitted combination now ships one separate free physical force alongside a concealed marker at its unchanged price. The private panel, shared AI quote, both cancellation/interception stages and saved continuation are connected. Revealing zero/three/five tokens preserves all physical forces; bots can reveal a zero marker accompanied by a real force before movement. Genuine CHOAM & Richese Leader Skills setup uses the sourced two-card deck addition or replacement without duplicate Ix cards. Public starts remain gated.

After the outage report, the healthy existing server was reused. All 529 opening games and their seat/recovery records matched the private backup. Focused tests, independent recovery review, browser evidence, required broad checks and final preservation/Git results are recorded in the checkpoint commit and private report. Allied No-Field and remaining combined modes are unfinished.

The first broad check exposed two deck/gate expectations and a randomized recovery test incorrectly asking an unautomated human seat for an AI action. The deck assertions now match the sourced inventory while other audit starts retain their gate. The recovery test now submits an explicit legal human choice. The failed report is retained separately from final verification.

13 September 2026 — Sandmaster movement collection prototype

Sandmaster now collects optional spice from distinct territories entered along explicit legal ground routes. Shared human/AI choices retain each source sector, path and selected pile. A Fremen movement response preserves the original declaration; cancellation collects nothing and successful completion transfers each board spice once before arrival reactions. Internal saved proofs remain outside player projections.

Independent rules and persistence review, focused legality/custody/privacy tests and SQLite continuation cover this boundary. Broad checks, browser and sample-game evidence and saved-game preservation are recorded in the checkpoint commit. Special relocation, combined modules and multiple-pile collection remain missing; no public mode or publication gate is opened.

13 September 2026 — Spice Banker battle commitment prototype

Spice Banker connects one through three sealed own spice to a selected skilled leader's surviving battle strength. Funds remain separate from force support and unavailable for other spending. A sole successful traitor caller keeps the commitment; other outcomes pay the Bank even on leader death, while death removes the bonus. Printed disc values and bounties stay fixed.

Owner/full-plan inspection and public reveal display the amount at their proper times; all four AI profiles submit funded choices. Independent source and persistence review, private SQLite restart, rejected diversion, concurrent final resolution and legacy omitted-field continuation cover this boundary. Two seeded Basic/Advanced samples finished without rejected candidates but did not use Banker spending; targeted tests establish the effect. The browser checked a three-spice commitment, pending refresh, actual +3 strength and payment, then restored one board force, fifteen reserves, four Tanks, two spice and the same private cards. Broad results and final preservation are in the checkpoint commit.

Normal income remains pending a user ruling about already-earned public spice when the trainer dies or is captured before Mentat Pause. Combined modules and complete skill acceptance remain unfinished; no mode/publication gate is opened.

13 September 2026 — Smuggler reserve shipment prototype

Smuggler shipping connects one optional free accompanying force for an empty-territory off-planet shipment. The shared quote preserves actual reserve/elite custody, Guild rounding and real recipient payments. UI controls and all four AI profiles explicitly choose the bonus; declining and legacy unstamped declarations preserve ordinary pricing.

Independent review found saved quotes could lose their required Guild decision. Read/action integrity now binds the declaration to its unique current or saved interception, rejecting missing/mismatched decisions or removed discounts. The first broad run also exposed a random Discovery fixture that searched only the undealt deck for Karama. It now relocates an existing card from its actual zone and asserts the complete physical card inventory is unchanged. SQLite restart, concurrent allowance, stale replay and old quote recovery pass. The browser exercised the price toggle, three physical arrivals for two spice and refresh with the same private hand. Two Basic/Advanced samples finished without rejected candidates but did not use Smuggler; targeted checks cover it.

The latest outage left the existing server healthy. All 427 opening rooms were unchanged and a new backup captured 428 rooms. No restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. The lower battle effect and combined routes remain missing; no rules-mode or publication gate is opened.

13 September 2026 — Leader battle effects prototype

Battle effects connects lower Mentat +2 strength, Bureaucrat occupation penalties and automatic Sandmaster board spice, plus both Rihani private inspection and committed optional exchange. Shared quotes, owner controls, all four AI profiles and saved continuation form usable prototypes. Three normal bands and Spice Banker, Diplomat and Smuggler remain missing.

Independent review found a completed Rihani receipt was not bound to current custody during battle cleanup. Decline/exchange now preserve and validate exact deck order; regressions cover corruption, replay and SQLite concurrent writes. A fresh genuine browser setup followed by a conserved staged battle exercised private inspection, separate draw, pending refresh, public return and completion. Two Basic/Advanced samples finished with no rejected candidates but did not trigger Rihani; they do not certify its integrated full-game behavior.

The server remained healthy after the outage report. An online backup preserved 393 opening rooms; no restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. No rules-mode or publication gate is opened.

13 September 2026 — Suk Graduate casualty rescue prototype

Suk Graduate connects both printed bands through shared physical casualty quotes, owner controls, all four bot profiles and durable battle continuation. A face-up trainer returns exactly one casualty to reserves; a surviving selected leader may save up to three, keeping one in its original sector and returning the others. Raw casualty choice and paid support remain unchanged. Elites retain their identity. Sole legal normal rescues are automatic.

Independent rules and implementation review found two custody defects: a stale dead face-up trainer could retain a skill, and a pending rescue was not bound to its actual skill assignment. Both now reject before mutation, with regressions. Saved receipt, missing continuation, replay, killed/returned captives, ordinary and elite rescue, JSON restore and SQLite concurrent submission are covered. The final Suk/Leader Skills focused union passed 46 tests, including the private assignment restriction, usable alternate selection and all four bots. New Advanced Atreides selection is unavailable while the existing Kwisatz Haderach loss-count question is pending; old assigned saves retain preflight protection. Seven other skill effects and combined modules remain unfinished.

Genuine module setup in fresh browser room BD33WTTV assigned Suk Graduate to Hasimir Fenring. A separately staged conserved battle then exercised the actual rescue control: three casualties saved, one kept in sector 10, two returned to reserves. Refresh preserved two board forces, seventeen reserves, one Tank, the private Crysknife/Baliset/Burseg and winner card cleanup. Two four-profile samples completed Basic/Advanced games with 92/188 actions and 3/6 JSON restorations, respectively. Neither encountered an eligible rescue; targeted tests and browser play establish that effect. These are bounded prototype samples, not calibration or full rules acceptance.

The latest reported outage left the existing server healthy. A fresh online backup captured all 360 rooms. All 359 opening rooms and their seat/recovery records remained unchanged; the new QA seat restored after refresh. No restart or reset was needed. Required broad checks and final preservation are recorded in the checkpoint commit and source-bound private report. Public Advanced, expansion, module and publication gates remain closed.

13 September 2026 — Planetologist movement and green-Special battle prototype

Planetologist now connects capped extra range, a single movement from two territories to one destination, and the surviving skilled leader's +2 green-Special battle substitution. Fremen cancellation preserves the independent skill bonus and both saved origins. Human controls, all four bot profiles and authoritative saved continuations use shared eligibility/range rules. The exact nine base Specials retain physical custody and never activate their normal effects through the battle slot. Mandatory discard includes traitor wins; that later-card-specific reading remains explicitly identified as an inference.

Independent review fixed stale saved battle plans accepting an already-dead skill leader; the original reproducer now rejects without mutation. Another integration check found appended skill moves were bypassed by ordinary candidates: they now share the existing public destination ordering. All four profiles actually choose and legally execute range and gather moves in targeted first-choice fixtures. The final focused union passed 84 tests. The first broad run stopped at lint because six new test declarations lacked the required explicit promise marker; those declarations were corrected before repeating the checkpoint check. Two four-profile sample games finished: Basic seed 20260916, 194 accepted actions and six JSON restorations (range and gather both executed); Advanced seed 20260917, 186 accepted actions and six restorations (range executed). Neither rejected a proposed action. These are bounded samples, not AI calibration or complete module/combination acceptance.

Fresh browser room TQWK5AEY used genuine Fremen/Emperor setup and selected Planetologist/Stilgar. The range-three control became available, then a real gather moved two Sietch Tabr forces and one False Wall West force to Wind Pass using one movement. Refresh restored 5/2/3 forces, the private Crysknife/Burseg and the skill. A separate targeted battle fixture in this new QA room relocated one physical Family Atomics from the deck and placed Emperor reserve forces. The actual weapon selector, plan reveal, traitor loss and mandatory discard were exercised. The Shield Wall remained intact; dead Stilgar returned the skill, and refresh preserved the remaining hand and losses. This fixture is not a naturally reached full game.

The server remained healthy after the user's outage report; no restart was needed. All 325 opening rooms were privately backed up and unchanged after browser QA; one new test room was added. Required broad checks and final preservation counts are recorded in the checkpoint commit and source-bound private report. Eight other skill effects, enemy-only mixed BG gather arrival, expansion rosters/cards and optional-module combinations remain unfinished. No public gate is opened.

13 September 2026 — Leader Skills setup, five disciplines and skilled capture

The first connected prototype adds all fourteen physical cards and readable faces, source-ordered private setup, public battle posture, five card-role strength modifiers, death return and own-leader revival through controls, all four AI profiles and saved actions. The other nine effects remain missing; combined modules and public starts remain gated.

The user's requested capture research resolved publicity through the known card's required movement with the leader. Harkonnen gets only its lower battle effect; surviving return and death retain physical custody. This is a component-based source inference. Captured replacement entitlement stays separately unresolved and explicitly guarded.

Independent review found and fixed a Voice/mandatory-leader deadlock and invalid simultaneous assignment/offer custody. Focused capture review found no remaining blocker. The focused union passed 66 tests, including genuine setup, scoring, capture and SQLite restart/concurrent setup and revival selections. Three sample games finished; their exact scope and source fingerprints are recorded separately. Browser setup, card inspection, AI assignment and refresh were exercised in new room REF6YHN7; narrow sidebar cards were made readable. All 291 opening rooms were backed up before QA. Final preservation and broad check results are recorded in the checkpoint commit and private report.

The first broad run passed types/lint and 4,410 of 4,411 offline tests. Its one failure was an existing Discovery privacy test treating treachery-32 as a substring match for hidden treachery-3. The exact physical pair now forms a deterministic scenario and assertions compare complete JSON string identities; the opponent's own card remains visible. Independent review and all six Discovery runtime tests pass. The broad run was repeated after this correction. During the follow-up, another user-reported outage stopped the server. All 292 games survived; a fresh backup and necessary server start restored the same private prototype seat and pending Storm choice.

The first broad run also exposed a pre-existing random Discovery test failure: the hidden identifier treachery-3 matched the viewer's distinct treachery-32 through a substring assertion. The regression now stages both physical cards and checks their complete identifiers; no production privacy behavior changed.

13 September 2026 — Sapho first after completed movement turns

Extends the existing clean-boundary movement contract to let Sapho's holder act first among remaining unstarted turns after earlier players fully finish. Completed shipment resources, forces, cards and counters stay intact. Advanced Guild priority remains guarded until Guild finishes. Current private controls, all four AI profiles and persisted room actions reuse the same legality check; the card is discarded once. Other Sapho modes and release gates remain pending. See runtime scope.

Four new engine tests include genuine Advanced setup and owner-only rendered controls. One independent SQLite test exercises real completed shipment, restart, concurrent claims, physical custody and replay rejection. Independent review found no blocker. Checkpoint-wide results and the final source fingerprint are recorded in the commit and private report.

The user reported a power outage during this work. The existing server was healthy, all 291 rooms were present, SQLite integrity/foreign-key checks passed, and all 218 rooms in the prior opening baseline matched. QA room 2EMYG4CY restored its same private hand, resources and pending Storm choice after refresh. All 291 rooms were backed up before further work; no reset or restart occurred.

The independent Leader Skills source contract supplies the complete fourteen-card inventory and shared lifecycle for the next batch. It records unresolved edges and establishes no runtime prototype or mode gate.

13 September 2026 — Discovery location effects prototype

Adds automatic unambiguous Jacurutu battle income, an owned Testing Station storm adjustment and physical Shrine card substitution through existing Karama and Truthtrance paths. Decisions and committed effects preserve JSON/SQLite continuation, physical custody and private information. Testing Station cannot change Weather Control; Jacurutu counts opposing physical losses, not the wheel alone. See the prototype scope and rulings.

Orgiz, contested Cistern/Testing Station and mixed-force Jacurutu remain pending. Normal module/Advanced starts and publication stay gated. Targeted browser room A5EJQ2W4 exercises station choice and refresh after real setup/reveal/entry with QA positioning. Independent review and focused regressions cover all three functions; required broad results, source fingerprint and preservation of all 187 opening rooms are recorded in the checkpoint commit and private report.

The preceding ab0ab52 entry/flight checkpoint passed 4,313 offline tests, build and 40 HTTP tests. Its outage recovery and 156-room opening baseline are historical results; the current batch keeps every game created afterward.

13 September 2026 — First connected Discovery prototype

Connects genuine base-faction Basic/Advanced audit setup to all seven sourced Spice Cards and eight opaque physical tokens. Great Maker resolves worm effects, an ordered majority vote and a free Fremen reserve ride. The six Discovery blows destroy prior forces/spice before their new blow and separate token placement. Private faction peeks and Collection inspection/reveal lead to exact stash rewards, a saved full-hand draw/discard choice, carried Ornithopter custody and five public nested locations; only Jacurutu contributes stronghold victory. Shared human/AI controls and JSON continuations accompany the actions.

This is Prototyped progress with Partial coverage. Next-turn free entry, the five special location benefits and Ornithopter spending remain missing. The normal public module start gate stays closed. Great Maker first-turn skipping, Sandtrout suppression and empty-token-supply behavior remain identified source inferences for refinement, not new confirmed rulings. See the prototype boundary and dependency queue.

Focused component, runtime, Great Maker, board/admission, private-control and SQLite recovery checks pass. Two seeded Basic/Advanced games finish while preserving components; browser 3RJBH26Y verifies genuine Fremen setup, a real Discovery blow, native private peek and enlarged card guidance. Review repaired lost encounter/arrival controls and an unfinished overflow discard. Broad verification and preservation results are recorded in the checkpoint commit and private source-bound report. No complete-module certification is claimed.

13 September 2026 — CHOAM Nexus Collection prototype and Discovery inventory

Adds the missing absent-CHOAM Secret Ally Collection trade through the engine, private physical-card selector/inspector, all four AI profiles and JSON discard continuation. Both cards are spent for exactly two bank spice; stale actions, competing SQL writes and saved replay cannot duplicate the payment. The separate battle inspection remains missing. See contract and scope. Independent review found a queued Grumman Collection lock mismatch; the server and private offer now share that automatic-continuation block.

A bounded acquisition helper resolved all Discovery component identities and card placements. No Discovery runtime is claimed. Focused trade tests pass; checkpoint-wide check/build/HTTP results are recorded in the verified commit and private source-bound report. Existing mode and publication gates remain closed. No server restart or saved-game reset is needed.

13 September 2026 — Genuine Ix expansion prototype

Connected Basic/Advanced Ix setup with both expansion factions, the complete 47-card Treachery Deck and Sandtrout through the existing game pipeline. A local prototype command backs up the named fresh lobby, starts it once with a version comparison, and preserves every seat and other room. The normal start gates remain closed. The checklist now separates Prototyped progress from Partial rules coverage. See Ix prototype.

Six new focused tests cover private setup at all four profiles, exact starting forces, Face Dancers, cards, JSON restoration, immutable rejection and the local SQLite writer. Two reproducible full games use seeds 2026091301 (Basic) and 2026091302 (Advanced), including both expansion factions and physical inventory checks. Review caught a saved JSON version mismatch, now corrected and covered. Browser room W5LE6VFB verifies genuine human Ixian setup, private refresh, Weather Control and mobile stronghold placement; owned autopilot then continues the same game. Final broad checks, later browser outcome and preservation results belong to the verified checkpoint. No complete expansion certification is claimed.

13 September 2026 — Atreides full-plan interaction verification

Replaced the full-plan suite's Basic-then-flip fixture with genuine Advanced initialization and added five tests for Truthtrance, Voice, ordinary Prescience, Ghola preparation and private full-plan inspection. Seventeen focused tests pass, including seven interruption windows and all four profiles. The tested native runtime paths needed no change. Independent source and test review found no publisher-backed defect, while preserving the unresolved special offer/deadline and target-first interpretation. See the timing audit for exact evidence and limits. Browser room AZC4HGLB verifies human special inspection, Medium AI Ghola preparation and a restricted sealed plan; desktop and phone inspection are readable. Refresh after the already-completed restart restores that private view and the earlier inventory seat. All 64 saved room versions/hashes remain unchanged. The user removed hourly restarts: restart only when warranted, preserving games and verifying restoration. Final required checks and aggregate usage belong to the verified checkpoint; no mode gate is opened and no recurring automation is installed.

13 September 2026 — Truthtrance hand size and primary-role facts

Added total physical hand counts and explicit primary-role comparisons, sharing classification with component presentation. Canonical Richese roles, Ix alternate uses, Worthless faction powers and Ecaz slot-only specials retain their distinct semantics. Current facts disclose one aggregate result and create no retention promise. The existing count controls, all four bot answer paths and production-room continuations are reused; no public mode or publication gate opens.

Eight new focused tests cover the 60-card catalog, actual engine questions, privacy, AI and JSON/custody changes. Expanded SQLite cases restore total/category and compound answers around an interrupted auction and commit competing answers once. Independent review findings were limited to two corrected wording issues. Room LC3E55GY verifies combined role counts, total size, invalid input and phone refresh. Required broad results and aggregate token endpoint belong to the verified checkpoint commit and private source-bound report. See hand inventory contract and efficiency measurements. Wider Truthtrance and Guild gaps remain explicit; preserve all post-reset games.

Typed Advanced shipment-promise checkpoint, 13 September 2026: Shipment promises now support base Advanced games without Guild or optional modules through the existing authoritative commitment, controls, private guidance, bots and recovery. Ghola preparation reuses canonical eligible normal/elite limits; pending BG conversion preserves feasible promises while retaining real responses and hiding conditional shipment pricing. Cancellation releases only when owned alternatives fail. Genuine Advanced scenarios and production SQLite races cover physical custody and saved continuations. Full validation and browser outcomes are recorded in the checkpoint commit and source-bound verification report. Ordinary Guild settlement, broader commitments, combined modules and complete mode acceptance remain unfinished; no release gate is opened.

Efficiency setup and fresh local save checkpoint, 13 September 2026: Current status and the rule decision index consolidate existing evidence without changing mode gates. Reusable verification adds private source-bound check logs, read-only saved-game snapshots/online backups and bounded HTTP seat-restoration checks. Focused regressions cover child failure/cancellation, stale source, output protection, WAL backup and seat privacy; the required full-check result is recorded in this checkpoint’s Git commit and external verification report. The user explicitly authorized clearing old local saves: a verified private backup preceded removal of 3,644 rooms and related records, preserving schema/migrations and creating a fresh empty baseline. Future games remain protected. Pilot measurements retain selective subagents, mandatory verified Git pushes and the full game scope; no gameplay or release gate is enabled. Browser setup remains feature-specific, and no live browser acceptance is claimed for this tooling change.

Guild Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_GUILD_SECRET_ALLY_RUNTIME.md records one explicitly selected Guild-priced shipment for an unallied holder with Guild absent. Reserve, physical cross/abstract-return and independently legal world-to-world routes preserve actual faction identity, typed custody, ordinary movement and bank payment. Fremen retain their free reinforcement choice; the separate paid southern route reaches beyond its range without storm privileges or off-planet triggers. Private controls and all four bot profiles share source-aware price/permission; binding shipment promises can rely on the card. Exact committed records and an independent outcome marker preserve arrival alliances and later movement without inventing native Guild responses. Final types, lint, all 4,162 offline tests, production build and 40 HTTP/session tests pass. Twenty-six new cases include real Moritani arrival alliances and production SQLite races, corruption rejection and private recovery. Review also repaired an older Cunning fixture's post-auction card-availability assumption; ten repeated runs passed 190 cases. Two three-seat browser rooms passed paid Fremen shipment/movement, mixed Emperor Homeworld shipment, desktop/phone controls and six private refreshes. The 03:46 UTC backed-up restart preserved all 3,612 opening games and restored twelve earlier private seats; final comparison preserves every opening version/hash, with two browser and thirty HTTP rooms added. Homeworld-return interpretation was asked of the user; that route, concealed transport, Betrayal and complete module/mode acceptance remain gated. Automation remains removed.

Guild Nexus Cunning checkpoint, 10 September 2026: NEXUS_GUILD_CUNNING_RUNTIME.md records a second paid native Guild shipment within the original combined turn, followed only by unused Hajr movement. Original shipment/movement history, typed Homeworld sources, cross/return routes, interception and later entry effects retain their rules. Private controls and all four bot profiles share availability; new binding shipment promises recognize the extra opportunity. Native Karama and paid BG conversion preserve the original source, and countering conversion restores it. Independent review fixed a later Moritani alliance freezing the remaining Hajr continuation; transport validation also rejects a same-territory cross-shipment. Final types, lint, all 4,136 offline tests, production build and 40 HTTP/session tests pass. Thirty-seven new cases include genuine nested interruptions, pending-frame corruption and competing production SQLite requests. Two three-seat browser rooms passed second shipment/Hajr and cancellation, desktop/phone controls and six private refreshes. A raw internal event notice found visually was corrected and verified by final rendering tests; earlier pending screenshots precede that text correction. All 3,580 opening room versions/hashes remain unchanged, with two browser and thirty HTTP rooms added. Guild Secret Ally/Betrayal, the physical Ornithopter combination, remaining native cancellation/arrival gaps and complete module/mode acceptance remain gated. Existing server reused, no restart due; automation remains removed.

Richese Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_RICHESE_RUNTIME.md records one-to-five actual reserve forces at the one-force price in the ordinary shipment pipeline. Native Guild/Fremen pricing, typed Homeworld reserves, native Ixian HMS entry, Guild prevention, BG accompaniment and real Terror entry retain their own rules. Private controls and all four bot levels share the quote; binding shipment promises recognize the affordable discounted source. Exact saved declarations and independent outcome markers protect pending and terminal history through corruption checks, competing SQL requests, Truthtrance and later turns. Review fixed the consumer's omitted native HMS destination. Types, lint, all 4,099 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases and two three-seat browser rooms cover allowance/prevention, typed Emperor sources, desktop/phone controls and six private refreshes. The 02:48 UTC backed-up restart preserved all 3,548 opening games and restored twelve earlier private sessions. Final comparison leaves all opening versions/hashes unchanged, with two browser and thirty HTTP rooms added. Native Richese Cunning, Betrayal, foreign-Homeworld tariff integration and complete module/mode acceptance remain gated. The Guild source audit prepares its distinct extra-shipment, borrowed-route and payment effects without claiming runtime completion. Automation remains removed.

Moritani Nexus Cunning checkpoint, 10 September 2026: NEXUS_MORITANI_RUNTIME.md records Basic/Advanced supply placement throughout the printed Arrakis map, including existing Terror stacks. Shared controls and all four bot profiles use the private offer; ordinary relocation stays unchanged. Native Karama cancellation preserves the token and spends the opportunity/Nexus. Independent review fixed arrival-signature downgrade, stale former-location reuse and physical-face rebinding; current placement permission and historical entry evidence remain separate. Types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests pass. Twenty-seven new cases include real later shipments, Robbery/Sabotage/Sneak Attack, Truthtrance, prior Grumman outcomes and concurrent SQLite recovery. Two three-seat browser rooms passed phone placement, allowance/cancellation, map markers and all six private refreshes. All 3,516 opening room versions/hashes remain unchanged; two browser and thirty HTTP rooms were added. Relocation/HMS/Grumman interpretations, other unfinished Terror/Nexus effects and full module acceptance remain gated. The new Ecaz source audit records its leader-scope and disclosure boundaries. Existing server reused, no restart due; automation remains removed.

CHOAM Nexus Cunning checkpoint, 10 September 2026: NEXUS_CHOAM_RUNTIME.md records five native effects using one actual Treachery Card in Basic and Advanced. Shared controls inspect the real cost independently of the selected effect; all four bots use projected legality. Karama retains the cost and spent Nexus; actual intervening cash-in fizzles and resumes the original operation. Independent review fixed saved movement, revival and storm orders accepting valid-looking replacements. Types, lint, all 4,042 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases include real paid Nullentropy, private views, physical disposal and concurrent SQLite outcomes. Two three-seat browser rooms passed phone declarations, allowance/cancellation and all six private refreshes. All 3,484 opening room versions/hashes remain unchanged; only two browser and thirty HTTP rooms were added. The printed family has six effects: Kull Wahad remains unavailable, as do unfinished Secret Ally/Betrayal and full module starts. Existing server reused, no restart due, automation remains removed.

Grumman stack cancellation checkpoint, 10 September 2026: GRUMMAN_PLACEMENT_CANCELLATION.md records the reproduced failure of printed Karama against a native Mentat placement after a legal Collection stack. Cancellation now preserves the existing stack without requiring distinct occupied locations. Independent SQL review also fixed allowance accepting unrelated duplicate physical token IDs; both outcomes validate the same inventory. Existing denial semantics remain unchanged. Types, lint, all 4,012 offline cases, production build and 40 HTTP/session cases pass. Six new cases cover Basic/Advanced, low population, unchanged income, competing cancellation/allowance, private restoration and malformed records. Browser phone declaration, desktop/phone cancellation and three-seat refresh pass. The hourly restart preserved all 3,453 opening games and restored twelve earlier private seats; final comparison leaves those same versions/hashes unchanged, with one new browser room and thirty HTTP rooms added. New Ixian replacement and Fremen Nexus audits record remaining source and privacy boundaries. No new Nexus effect or release gate was enabled; automation stays removed.

Emperor Nexus Cunning checkpoint, 10 September 2026: NEXUS_SARDAUKAR_RUNTIME.md records five ordinary counters temporarily using Sardaukar strength and support in one Advanced battle. Physical counters, starred reserves and ordinary losses remain distinct. Shared editor and bot calculations handle the Fremen exception and Salusa support. Review fixed a canceled-enhancement Prescience deadlock and retained durable winner casualty choices across competing SQLite requests. Types, lint, all 4,006 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases cover independent counter arithmetic, real Homeworld thresholds, future commitments, hidden information and recovery. Two three-seat browser rooms passed desktop/phone allowance, cancellation, reanswer, sealed planning and private refresh. All 3,421 opening room versions/hashes remain unchanged; only thirty HTTP rooms and two browser rooms were added. Fewer-than-five interpretation, Emperor Secret Ally, Betrayal and complete module acceptance remain gated. No release gate opened; no restart was due, and automation remains removed.

Bene Gesserit Nexus advisor checkpoint, 10 September 2026: NEXUS_ADVISOR_RUNTIME.md records whole-territory, multi-sector Cunning conversion during the native owner’s Advanced Shipment and Movement action. One Karama cancels the entire declared batch; source positions, counts and action allowances are preserved. Saved responses survive Truthtrance, Harkonnen exchanges and paid Nullentropy. Shared controls and all four bot profiles consume the public legality quote. Types, lint, all 3,971 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases include pending-parent corruption, physical custody and concurrent production SQLite recovery. Two three-seat browser rooms passed desktop/phone selection, allowance/cancellation and private refresh; review also fixed checkbox spacing, accessible SVG titles and stale Nexus guidance. All 3,389 opening saved rooms retain their versions/hashes; only two isolated browser rooms and thirty HTTP-test rooms were added. Fresh advisor/storm rulings, borrowed Voice, Betrayal and complete module acceptance remain gated. The Emperor source audit prepares the next family. No release gate opened; no restart was due, and automation remains removed.

Tleilaxu and Ixian Nexus Cunning checkpoint, 10 September 2026: NEXUS_CUNNING_RUNTIME.md records atomic revealed Face Dancer replacement and full-strength Suboids in every battle for the rest of the turn. Basic and Advanced retain Cyborg support costs and exact physical losses. Review fixed fresh Ixian Nexus setup, future-plan search through an unspent Cunning card and its private preparation hint; prior commitments remain binding. Types, lint, all 3,936 offline tests, production build and 40 HTTP/session tests pass. Fifty-one new cases include real Face Dance, all four bots, mixed-force support, concurrent SQLite recovery and future Truthtrance/Prescience commitments. Desktop/phone card play, private refresh and a seven-strength/two-support sealed plan passed. The hourly restart preserved all 3,359 then-existing games; final comparison preserves all 3,327 opening room versions/hashes. Tleilaxu Secret Ally, Betrayal and remaining Nexus effects stay gated pending their recorded requirements. No expansion release gate opened; automation remains removed.

Harkonnen Nexus exchange checkpoint, 10 September 2026: NEXUS_HARKONNEN_RUNTIME.md records draw-first Cunning and absent-faction Secret Ally, exact private returns, protected revealed Face Dancers, saved suspended actions and durable prior traitor declarations. Shared controls and all four bot profiles use projected identities. Independent review fixed lost preceding decisions and the paid Nullentropy action gate. Types, lint, all 3,885 offline cases, production build and 40 HTTP/session cases pass. Forty-six new cases cover rules, consumers, continuations and concurrent SQLite recovery. Two three-seat browser rooms passed draw/return, private restoration and desktop/phone inspection. All 3,295 preexisting room versions/hashes remain unchanged. Betrayal remains blocked pending the existing private response timing decision; complete Nexus and expansion games remain unfinished, and no release gate opens. The server was reused, no restart was due, and automation remains removed.

Atreides Nexus inspection checkpoint, 10 September 2026: NEXUS_ATREIDES_RUNTIME.md records Cunning's distinct second commitment and absent-faction Secret Ally, physical card disposal, No-Field distinctions, private history, all four editor locks and bot handling. Independent review fixed lost-response bypass, first-answer drift and a sealed plan contradicting its signed observation; legitimate Residual reanswers preserve the first historical disclosure. Types, lint, all 3,839 offline tests, production build and 40 HTTP/session tests pass. Forty-four new cases include concurrent SQLite recovery and four independent corruption regressions. Three-seat keyboard play, answer, protected plan submission and desktop/phone refresh passed. All 3,234 preexisting room versions/hashes survived the scheduled backup/restart and final comparison. Betrayal response timing, Residual after two answered Cunning fields, other card families and complete module games remain explicitly unfinished; no release gate opened. Automation stays removed; verified checkpoints are authorized for push without another confirmation.

Nexus ownership and complete component reference checkpoint, 10 September 2026: NEXUS_CARD_RUNTIME.md records the twelve-card physical deck, whole-phase Basic/Advanced draw opportunity, private replacement policy, all three alliance-forfeiture paths and complete inspectable 36-panel reference. Review fixed real Storm-entry initialization, edited progress/replay acceptance, one-way alliances and the private redraw prompt's public timing leak. Pre-draw preferences resolve without extra confirmations. Types, lint, all 3,795 offline tests, production build and 40 HTTP/session tests pass. Three-seat keyboard draw/redraw/refresh and all twelve normal/enlarged desktop/phone cards passed; independent review inspected 48 renders. All 3,173 preexisting room versions/hashes remain unchanged. All individual Nexus effects, Discoveries and complete expansion games remain unfinished; no release gate opened. Existing server reused, no restart due, no automation recreated.

Tupile private intelligence and occupation evidence checkpoint, 10 September 2026: HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md records current low-population contact checks, one historical spice/category answer per opposing faction, private controls and shared legal bot requests. Genuine setup binds qualification history and lifetime usage; legacy history stays unknown. Ordered battle observations retain brief sole occupation while simultaneous destruction does not invent it. Deterministic source identities make direct actions and restored continuations agree. 3,755 offline tests, types, lint, production build and 40 HTTP/session tests pass. Three-seat desktop/mobile keyboard shipment, private disclosure, later balance change and refresh passed. The hourly restart and final comparison preserved all 3,112 preexisting room versions/hashes. Occupation entitlement/expiry/income, complete module games and the full expansion goal remain unfinished; no release gate opened. The removed automation stays removed.

Grumman Collection and stacked Terror checkpoint, 10 September 2026: GRUMMAN_STACKED_TERROR_RUNTIME.md records one hidden-token addition with four bank spice, separate Mentat placement, private stacked-token selection, shared controls/AI and durable discard/alliance continuations. Review fixed selected-choice rewinds and restoration of a consumed Sabotage token during its genuine discard child. 3,712 offline cases, types, lint, production build and 40 HTTP/session cases pass. Desktop/phone keyboard Collection, shipment, token selection, Robbery payment, public stack count and three-seat private refresh passed. All 3,081 preexisting room versions/hashes remained unchanged. Removal custody, occupation, unfinished effects and complete expansion games remain unresolved; no release gate opened. The existing server was reused and the removed automation stays removed.

Caladan victory reinforcement checkpoint, 10 September 2026: HOMEWORLD_VICTORY_REINFORCEMENT_RUNTIME.md records the actual high-Caladan post-victory one-force transfer, current population and survivors, original battle location, exact native/visitor custody, owned controls and all-profile AI. Shared Ambassador arrivals preserve the original reinforcement and its nested children. Independent review reproduced and fixed arrival-to-choice rewinds and a deleted preceding cleanup choice; new revival returns also carry version-bound independent progress, while legacy completed QA saves remain readable. Final types, lint, 3,682 offline cases (89.9 seconds), production build and 40 HTTP cases pass. Eight Caladan production SQLite cases cover competing writes, reloads, private projections, nested arrivals and corruption. Two older Face Dance fixtures now explicitly decline the preceding guarded Caladan option, without choosing the unresolved placement order. Desktop and phone keyboard placement and three-seat refresh passed; final restart restoration passed for both Caladan and revival QA games. All 3,051 pre-existing room versions/hashes remain unchanged after restart and additive HTTP work. Low-Tupile public contact/once-per-faction quoting has seven cases but no playable disclosure action. Face Dancer ordering, guarded entry combinations, occupation, other missing effects and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld revival deployment checkpoint, 10 September 2026: HOMEWORLD_REVIVAL_DEPLOYMENT_RUNTIME.md records newly revived Fedaykin placement and Tleilax ordinary Free Revival deployment, exact typed groups, normal/Emperor-extra/Ghola source distinctions, owned controls and all-profile AI. Signed return, income and Ambassador completion records preserve nested arrivals and CHOAM sale restoration. Independent review found and fixed altered-offer acceptance and deleted-child premature completion. Final types, lint, 3,634 offline cases, production build and 40 HTTP cases pass; seven new production SQLite cases cover competing writes, lost responses, nested Ambassador restoration and corruption. The final suite also made an older auction test deterministic when the purchased Karama creates a second income responder. Desktop and phone keyboard placement, Ghola decline, refresh and three private seats passed without overflow or page errors. The hourly restart preserved all 3,050 saved room versions/hashes and restored the QA seats. First-reaching-high timing, partial/split groups, storm/arrival classification, occupation and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and the automation stays removed.

Homeworld collection and Terror checkpoint, 9 September 2026: HOMEWORLD_COLLECTION_RUNTIME.md records automatic high-Giedi income on actual positive desert receipts, once-per-phase recovery across Ecaz allocations, and low-Grumman original entering-force restrictions. Concealed No-Fields count as one; Ambassador choices and all four bot levels honor count-dependent arrival limits. Independent review found and verified a repair for altered saved arrival counts: original facts are now bound through live Terror, alliance cancellation and forced-discard continuations. Final types, lint, 3,575 offline cases, production build and 40 HTTP cases pass. Thirty-four new cases include seven production SQLite recovery scenarios; the older stale-entry regression now covers both signed and legacy saves. Desktop/390-pixel phone keyboard collection and three-seat refresh preserve seven collected spice plus the automatic two-spice bonus, with readable history and no overflow or browser errors. All 2,958 pre-existing room versions/hashes remain unchanged after the controlled restart and additive QA/HTTP work. Missing whole new receipts/signatures retain explicit legacy compatibility. High Grumman removal custody, occupation and low-Junction rounding questions remain pending; high Grumman operations, other faction effects and complete expansion games remain unfinished. No release gate opened, workflow optimizations remain in use, and automation stays removed.

Homeworld payment income checkpoint, 9 September 2026: HOMEWORLD_PAYMENT_INCOME_RUNTIME.md records low Kaitain and Junction reductions, original payer costs, separate ordinary-income cancellation, public split previews and private Guild contributor receipts. Final types, lint, 3,541 offline cases and production build pass; 40 HTTP cases passed before the final UI/AI funding guard. Twenty-six new cases cover actual auctions, shipment funding, native departure thresholds, Richese special/Ambassador purchases, all four profiles and five production SQLite recovery scenarios. Independent review found and verified repairs for mismatched Ambassador previews and invalid AI funding candidates. Desktop/390×844 phone keyboard allowance and three-seat refresh preserve the 5-spice purchase, 3-spice Emperor receipt and 2-spice bank remainder; screenshots were inspected without page overflow. All 2,894 baseline room versions/hashes remain unchanged. Occupation and contributor rounding questions are pending; divergent low-Junction odd/odd splits reject before declaration/payment rather than adopting an unverified rule. Legacy receipts without all new metadata retain the documented evidence limitation. Occupation, remaining card effects and full expansion games remain unfinished; no release gate opened and automation stays removed.

Kaitain and Ecaz card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records shared end-of-Bidding paid Kaitain discards and CHOAM sales/trades, current-population Ecaz poison income, private receipts and all-profile controls. Winning mandatory cards now discard after winner casualties and Ixian substitution, with reserved physical custody and independent saved battle obligations. Final types, lint, 3,515 offline cases, production build and 40 HTTP cases pass. Forty-seven new cases and updated battle/SQL regressions cover timing, privacy, corruption and races. Independent review found and verified fixes for conditional battle-role corruption, played-card diversion and deleted winner-discard queues. Desktop keyboard and 390×844 phone play completed disposal, private income, trade, sale, closing readiness and all-seat refresh; screenshots were inspected without page overflow. All 2,894 pre-existing room versions/hashes remain unchanged. Occupation, remaining Homeworld effects, complete expansion setup and full module games remain unfinished; no release gate opened. Workflow optimizations remain in use and automation stays removed.

Tupile card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records high-Tupile restrictions on both Worthless sale prices and CHOAM Ambassador payouts, private legal choices, and Ghola interruption with durable sale restoration and nested Tleilaxu income. Types, lint, 3,468 offline cases, production build and 40 HTTP cases pass. Thirty-one new regressions include all four AI profiles, five production SQLite scenarios and the repaired receipt-binding issue found by independent review. All 2,864 pre-existing room versions/hashes remain unchanged. Kaitain has source and pure-quote coverage only; its shared phase-end window, Ecaz poison-discard income, occupation and complete expansion games remain unfinished. No release gate opened. The optimized workflow remains in use; automation stays removed.

Homeworld mobility and advisor checkpoint, 9 September 2026: HOMEWORLD_MOBILITY_RUNTIME.md records low-Caladan phase-opening foresight restrictions, low-Wallach free-advisor suppression and high-Wallach two-force Polar Sink batches, low-Ix mobile-stronghold restrictions, and low-Richese token movement restrictions. Paid arrivals, physical troop movement and legitimate previously learned knowledge remain available under their separate rules. Final types, lint, 3,437 offline cases and production build pass; 40 HTTP cases passed before the final declared-advisor-count display text. Fifty-three new cases cover pure thresholds, actual actions, all-profile choices, Guild Ambassador continuations, and ten production SQLite recovery scenarios including paid Box interruption. Desktop choices, phone keyboard declaration, another human seat's allowance, saved reaction and settled refresh passed; phone screenshots were visually inspected without overflow. All 2,833 pre-existing room versions/hashes remain unchanged. Occupation-retained penalties, remaining high/occupied effects, full expansion setup and complete Homeworld games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Junction sponsored transport checkpoint, 9 September 2026: JUNCTION_TRANSPORT_RUNTIME.md records optional Guild half/full offers, replacement and expiry, exact Arrakis/Homeworld source groups, native returns, foreign departures, payment provenance, Karama immunity, arrival continuations and all-profile controls/AI. Final types, lint, 3,384 offline cases and production build pass; 40 HTTP cases passed before the final sponsor-panel identity and AI-priority guard adjustments. Forty-four new regressions include production SQLite concurrency/recovery and independent review. Actual desktop keyboard offers/replacements and phone typed shipment/refresh passed; visual inspection found readable layouts without phone overflow. Browser testing prompted preserving the sponsor panel across offer replacement. A controlled restart restored the private QA seat and preserved all 2,802 saved rooms; all 2,802 pre-existing room versions/hashes also remain unchanged after isolated QA/API tests. Occupation, remaining faces, concealed transport, unresolved generic/ordinary Karama interactions and complete module games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Guild Arrakis-to-Homeworld transport checkpoint, 9 September 2026: GUILD_HOMEWORLD_TRANSPORT_RUNTIME.md records actual Guild invasions and Junction returns from exact Arrakis sector pools, protected mobile-stronghold departures, shared interception, legacy API parity, accessible controls and all-profile AI. Final types, lint, 3,340 offline cases, production build and 40 HTTP cases pass. Thirty-six new regressions cover legality, physical custody, competing requests, interrupted recovery and private projection; independent review found no further defects. Desktop validation and keyboard declaration, phone interception, refresh and visual inspection passed in an isolated QA room. All 2,771 pre-existing room versions/hashes remain unchanged, with none missing. Junction-sponsored routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start or publication gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld invasion shipment checkpoint, 9 September 2026: HOMEWORLD_SHIPMENT_RUNTIME.md records actual world-to-world invasions, explicit native/foreign pools, mixed Emperor origins, Guild native returns, separate shipper/donor payments, Guild interception and present-force alliance restrictions. Final types, lint, 3,304 offline cases and production build pass; 40 HTTP cases passed before final UI/reference edits. Forty new regressions include actual invasion-to-battle discovery, all-profile policies, competing declarations, allowance-versus-stop races and Box-suspended recovery. Independent review fixed a public automatic-work flag that disabled genuine human Guild choices. Desktop mixed-source shipment, phone keyboard allowance and both-seat refresh preserve exact forces/payment; all 2,740 pre-existing room versions/hashes remain unchanged. Arrakis/Junction routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld battle runtime checkpoint, 9 September 2026: HOMEWORLD_BATTLE_RUNTIME.md records live Homeworld battle discovery, native strength, sealed plans, native-only Traitor calls, typed explosion losses, late Portable Snooper decisions, Ixian replacement and native Tleilaxu Face Dance. Final typecheck, lint, 3,264 offline cases and production build pass; 40 HTTP cases passed before the final saved-decision and board-selection fixes. Independent review and browser testing fixed paused-decision validation gaps and an off-planet territory-selector crash. Desktop/390×844 keyboard battle settlement and refresh preserved exact typed forces and card disposal in a conserved staged invasion. All 2,709 baseline room versions/hashes remain unchanged. Actual invasion transport, occupation, remaining face effects, unresolved return/support interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld combat foundation and Salusa checkpoint, 9 September 2026: HOMEWORLD_COMBAT_IMPLEMENTATION.md records public typed off-planet armies, pure native battle/explosion rules and connected high-Salusa free Sardaukar support. Final typecheck, lint, 3,221 offline cases and production build pass; 40 HTTP cases passed before the final Ghola guard. Independent review reproduced a population-changing Ghola deadlock after a sealed plan or prescience answer; execution, UI and AI now gate that specific unresolved interaction, with eight Salusa engine regressions covering rejection, privacy, JSON restoration and subsequent completion. All 2,648 baseline room versions/hashes are unchanged. Live Homeworld invasion/battle/occupation, remaining face effects, full module games and new browser acceptance remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld charity and revival checkpoint, 9 September 2026: HOMEWORLD_BENEFITS_IMPLEMENTATION.md records source-separated charity payments, dynamic low free-revival rates, four-free Fremen capacity, and Tleilax’s durable phase-start income condition. 3,190 offline tests, typecheck, lint, final production build, 40 HTTP tests and 144 focused Homeworld/reference cases pass. Independent review reproduced and integration fixed Box-suspended charity overpayment, invented saved free revivals and an AI/server special-Karama mismatch. Seven production SQLite recovery cases cover races, interrupted choices, privacy and rejected writes. Desktop/390×844 keyboard claims, invalid revival prevention, threshold crossing and refresh pass in an isolated QA room. All 2,648 pre-existing room versions/hashes are preserved. CHOAM opening-income and special-Karama interpretations remain pending; Homeworld battles, invasion, occupation and full module games are unfinished. No start gate opened; automation remains removed.

Homeworld native-reserve runtime checkpoint, 9 September 2026: HOMEWORLD_RUNTIME_IMPLEMENTATION.md records genuine supported-deck setup, saved typed custody, Basic strength-one special counters, exact native shipment sources, Emperor transfers and revival destinations, public controls and all-profile AI. 3,152 offline tests, typecheck, lint, production build and 40 live HTTP tests pass; the final focused Homeworld/reference run passes 106 cases. Actual transfer → shipment → Storm death → revival, Hajr, Ghola receipt integrity and competing SQLite requests are covered. Desktop/390×844 controls, card inspection, invalid-source prevention and refresh pass in a new isolated QA room. Twenty two-player Basic games complete 3,079 accepted actions without rejects/stalls or changed source fingerprints; this is a bounded regression sample. All 2,617 older saved rooms are unchanged. Invasions, Homeworld battles, occupation, card effects, remaining arrival routes and full module games are unfinished; public starts remain disabled. Workflow optimizations are preserved and the automation stays removed.

Homeworld component and custody checkpoint, 9 September 2026: HOMEWORLD_IMPLEMENTATION.md records all 13 cards and 26 verified faces, original bundled planetary art, searchable high/reverse inspectors, typed native/foreign custody and a separate population projection. 3,085 offline tests, typecheck, lint and the final production build pass. Both enlarged faces of every card were exercised on desktop and 390×844 phone; normal reverse controls, artwork loading, full-text search, keyboard activation, scrolling and refresh pass. Screenshot sampling and remaining complete visual acceptance are explicitly bounded in the feature document. The 07:53 UTC controlled restart preserved all 2,617 saved room versions/hashes and restored the authenticated QA seat. Actual Homeworld shipment, battles, occupation, card effects, AI and complete games remain unfinished; no mode gate opened. User workflow optimizations are in use and the automation remains removed.

Ecaz Ambassador alliance checkpoint, 9 September 2026: ECAZ_ALLIANCE_IMPLEMENTATION.md records the reusable token’s owner offer, entrant consent/refusal, immediate reciprocal alliance and original movement/worm continuation. Duke availability is independent; optional loans await a custody ruling. 3,058 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass. Thirty new alliance tests include public-identity quotes, all four AI levels, actual Box suspension, corrupt-save rejection and competing SQLite replies. Browser mobile keyboard proposal, AI acceptance, chronicle and refresh passed; all 2,586 older non-QA room versions/hashes are unchanged. Twenty Basic games completed 12,186 accepted actions and 545 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Full faction/mode/module completion remains gated, user workflow changes are preserved, and the automation stays removed.

Ecaz shared collection checkpoint, 9 September 2026: ECAZ_COLLECTION_IMPLEMENTATION.md records bilateral desert allocation, private proposals/counteroffers, the odd-to-ally default, automatic bank income and scoped Karama cancellation. All 3,028 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass under the new automatic test-discovery workflow. Sixty collection tests include actual engine transitions, all four AI levels, suspended Box/Karama recovery and SQLite races; review fixed orphaned collection controls. Twenty Basic games completed 10,206 accepted actions and 465 JSON round trips without rejects/stalls or changed source fingerprints. Real browser proposal/AI acceptance, phone keyboard completion and refresh passed; all 2,556 older non-QA room versions/hashes remain unchanged. Full Ecaz combat, its Fremen endgame exception, Tleilaxu Ambassador, remaining Duke interactions and complete Advanced/expansion/module acceptance stay unfinished and gated. User workflow optimizations are preserved; the automation stays removed.

Ecaz joint stronghold victory checkpoint, 7 September 2026: ECAZ_VICTORY_IMPLEMENTATION.md records the three co-occupied stronghold win, shared public server/UI/AI progress, prediction privacy and final Stronghold Card recovery. 2,758 rules/client/component +245 multiplayer tests (3,003 total) pass with TypeScript, lint and production build clean. Twenty Basic games completed 12,818 accepted actions and 568 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Actual browser Mentat victory, verbose chronicle, phone/keyboard and refresh passed; all 2,526 pre-existing non-QA room versions/hashes remain unchanged. Fremen’s Ecaz endgame exception, combined Occupy combat, shared collection, Tleilaxu Ambassador runtime and full Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Ecaz territorial occupancy checkpoint, 7 September 2026: ECAZ_OCCUPANCY_IMPLEMENTATION.md records shared server/AI entry and path checks, permanent Ecaz allied co-occupation, advisor exceptions, physical/hidden-marker conservation and the automatic turn-end notice. 2,730 rules/client/component +242 multiplayer tests (2,972 total) pass, with TypeScript, lint and production build clean. Twenty Basic games completed 11,446 accepted actions and 515 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Desktop/phone, keyboard completion, notices and refresh passed; all 2,496 older non-QA room versions/hashes are unchanged. Combined Occupy combat, shared desert collection, special victory, Tleilaxu Ambassador runtime and complete Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Tleilaxu Ambassador foundation, 7 September 2026: TLEILAXU_AMBASSADOR_RULES.md records the resolved physical return helper and outstanding interpretation boundaries. Eleven new registered tests pass for typed force custody, the fixed four-counter grant and shared Fedaykin/Sardaukar turn limit, including the Ixian exception; full TypeScript, focused lint and formatting pass. This helper has no engine integration or controls. Ordinary allowance, leader repeat-death and income interpretations remain pending; no full mode gate was opened. The automation stays removed.

Guild Ambassador checkpoint, 7 September 2026: GUILD_AMBASSADOR_IMPLEMENTATION.md records independent free typed reserve shipment, source-bound Guild prevention, BG accompaniment/Intrusion/Terror and chained Ambassador continuation, including phase-one worm riders and the Ixian HMS exception. 2,691 rules/client/component +239 multiplayer tests (2,930 total), typecheck, lint and production build pass. Twenty balanced Basic games completed 10,640 accepted actions and 482 JSON continuations with no rejects/stalls and unchanged source fingerprints. Desktop/mobile forms, keyboard submission, private refresh recovery, notices and chronicle pass; all 2,466 older non-QA room versions/hashes are unchanged. The review fixed orphaned saved shipment decisions; the 11:51 UTC controlled restart preserved all 2,497 games and restored the authenticated browser. No-Field substitution and simultaneous arrival interpretations remain unresolved; Tleilaxu Ambassador, complete Ecaz/Advanced/expansion/module acceptance and broader presentation remain unfinished. The automation stays removed.

Fremen Ambassador checkpoint, 7 September 2026: FREMEN_AMBASSADOR_IMPLEMENTATION.md records independent typed board relocation, concealed markers/HMS, advisor and separate Terror children, Baliset cancellation/re-selection, all-four-profile controls and saved-game recovery. 2,613 rules/client/component +233 multiplayer tests (2,846 total), typecheck, lint and production build pass. Twenty Basic games completed 12,252 accepted actions and 547 JSON continuations with zero rejects/stalls and unchanged source fingerprints. Desktop/phone form, keyboard submission, refresh, chronicle and automatic notice passed. The hourly restart preserved all 2,437 rooms; the subsequent QA changed only its named room, preserving all 2,436 older non-QA versions/hashes. Simultaneous Intrusion/Terror ordering awaits the user's interpretation; Guild/Tleilaxu effects, Occupy combat, full Advanced/expansion acceptance and broader mobile acceptance remain unfinished. The automation stays removed.

Richese Ambassador checkpoint, 7 September 2026: RICHESE_AMBASSADOR_IMPLEMENTATION.md records automatic three-spice purchases for all twelve possible beneficiaries, source-bound Emperor income and Harkonnen bonus, private failure handling, real BG-copy/worm continuation and all-four-profile support. 2,548 rules/client/component +228 multiplayer tests (2,776 total), typecheck, lint and production build pass. Twenty Basic games completed 12,218 accepted actions and 544 JSON continuations with zero rejected actions/stalls; only a reference evidence path changed during that run. Browser purchase, refresh and income cancellation passed, and all 2,406 older non-QA room versions/hashes remained unchanged. Fremen/Guild/Tleilaxu effects, full Ecaz/Advanced/expansion acceptance and mobile acceptance remain unfinished. The Duke revival interpretation question is pending. The automation stays removed.

Ghola lifecycle and AI checkpoint, 7 September 2026: GHOLA_LIFECYCLE_AND_AI.md records all-four-profile ordinary Ghola choices, authoritative target controls, the actual Kwisatz explosion/revival/next-territory fix, Ecaz-only shared-Duke checks and full primary card text. 2,517 rules/client/component +226 multiplayer tests (2,743 total), final typecheck, lint and build pass. Twenty Basic games completed 12,304 actions with zero rejects/stalls and 550 JSON round trips, including 18 actual Ghola plays across all four levels. Browser Ghola revival, refresh and a later sealed Carthag plan with revived Kwisatz pass. The hourly restart preserved all 2,377 saved rooms. Paid/set-aside Duke revival, full Advanced/expansion acceptance and mobile acceptance remain unfinished; the custody interpretation question is pending. The automation stays removed.

Ecaz Duke acquisition checkpoint, 7 September 2026: ECAZ_DUKE_ACQUISITION.md records direct acquisition through the reusable Ecaz Ambassador, same-disc transfer, token return, original entrant resumption, all-four-profile choices and readable controls. 2,474 rules/client/component +224 multiplayer tests (2,698 total), typecheck, lint and production build pass. Twenty Basic games completed 10,450 accepted actions with zero rejected candidates/stalls and 476 JSON round trips. Browser acquisition, refresh, inspection and subsequent battle use passed; Duke was set aside alive after use. Ambassador inventory now collapses without hiding the actual decision. Alliance/loan alternatives, Duke revival/capture, full Advanced/expansion acceptance and mobile acceptance remain unfinished. The automation stays removed.

Placement cancellation checkpoint, 7 September 2026: PLACEMENT_CANCELLATION_RECOVERY.md records source-bound Ecaz/Moritani/Duke denials and shared movement setup, phase income/refunds and victory. Duplicate movement order, absent victory allies and negative saved refunds now reject before supported cancellation costs. 2,450 rules/client/component +220 multiplayer tests (2,670 total), typecheck, lint and production build pass. Twenty Basic games complete 13,655 accepted actions without rejected candidates/stalls, with 603 JSON round trips. Browser cancellation, refresh, shipment and next-player handoff pass. All 2,286 older non-QA room versions/hashes remain unchanged. Full Advanced/expansion acceptance and exhaustive continuations remain unfinished. The automation stays removed.

CHOAM cancellation and revival checkpoint, 7 September 2026: CHOAM_WORTHLESS_CANCELLATION_RECOVERY.md records exact Worthless context restoration, shared unchanged revival checks and public storm offers. Malformed saves can no longer use these cancellation paths to produce negative Tanks, accept invalid revival prices/queues or restore a cross-phase Mentat decision. 2,386 rules/client/component +216 multiplayer tests (2,602 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,008 accepted actions without rejected candidates/stalls and with 536 JSON round trips. Browser cancellation, readiness and restart recovery passed. Controlled maintenance preserved all 2,287 saved room versions and hashes exactly. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Auction cancellation checkpoint, 7 September 2026: AUCTION_CANCELLATION_RECOVERY.md records shared Ixian draw/Technology and paid-sale, income, bonus and next-lot continuations. Independent review reproduced and fixed duplicated unsold-card custody in malformed saves. 2,312 rules/client/component +212 multiplayer tests (2,524 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 10,529 accepted actions without rejected candidates/stalls and with 475 JSON round trips. Browser cancellation, refresh and a subsequent legal bid passed. All 2,196 older non-QA saved rooms retain their exact versions/state. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Restored cancellation checkpoint, 7 September 2026: RESTORED_CANCELLATION_CONTROLS.md records exact Richese gift/purchase restoration, Moritani alliance cancellation and Ixian substitution cleanup. 2,250 rules/client/component +208 multiplayer tests (2,458 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,657 accepted actions without rejected candidates/stalls and with 522 JSON round trips. Browser gift cancellation recovered and exercised the original advisor choice. All 2,196 older non-QA saved rooms retain their exact versions/hashes. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Combat and terminal cancellation checkpoint, 7 September 2026: COMBAT_TERMINAL_CANCELLATIONS.md records shared combat queues, income/knowledge cancellation, No-Field declaration checks and canceled CHOAM sales. 2,162 rules/client/component +204 multiplayer tests (2,366 total) pass (full suites plus eight focused ownership regressions); typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,552 accepted actions without rejected candidates/stalls and with 521 JSON round trips. Browser Baliset cancellation restored the Voice controls and private hand; the banner and seat highlight now name the actual decision owner. The manual restart preserved all 2,197 saved room versions and hashes. Exhaustive continuations, durable Karama cost frames and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle aftermath checkpoint, 7 September 2026: BATTLE_AFTERMATH_PREFLIGHT.md records shared ordered cleanup, board and collection calculations, movement cancellation and owner-promise prerequisites before supported Karama costs. It fixes zero-force storm geometry and preflights the newly empty Auditor path after a cost card is spent. 2,044 rules/client/component +201 multiplayer tests (2,245 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,550 accepted actions without rejected moves/stalls and with 521 JSON round trips. Browser capture cancellation and refresh recovery passed; all 2,105 older non-QA saved rooms retain exact versions/hashes. Exhaustive suffix proof, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle, revival and disaster checkpoint, 7 September 2026: BATTLE_REVIVAL_DISASTER_PREFLIGHT.md records shared battle calculations, canceled-revival quotes and typed storm/worm prerequisites checked before Karama costs. 1,961 rules/client/component +197 multiplayer tests (2,158 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,430 actions without rejections/stalls and with 554 JSON round trips. A browser storm cancellation reconnected after the controlled restart; all 2,106 backed-up rooms retained exact versions and state hashes. Later battle aftermath, exhaustive cancellation/promise checks, Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama cancellation checkpoint, 7 September 2026: KARAMA_CANCELLATION_CONTEXTS.md records original canceled-power bindings, pure Moritani cleanup prerequisites and pure canceled-Baliset arrival checks, preserving nested conversions and summoned-worm rides. 1,850 rules/client/component +194 multiplayer tests (2,044 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,735 actions without rejections/stalls and with 567 JSON round trips. Browser cancellation and refresh recovery passed; 2,075 older non-QA rooms retain exact saved versions/state hashes. Exhaustive cancellation/promise preflight, Karama cost frames, Semuta and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama preflight and conversion checkpoint, 7 September 2026: KARAMA_PREFLIGHT_AND_CONVERSIONS.md records pending BG purchase capacity, mandatory hand-return reservations, preserved conversion opportunities across nested interruptions, and pure Richese settlement prerequisites. 1,812 rules/client/component +188 multiplayer tests (2,000 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 14,230 actions without rejections or stalls and with 627 JSON round trips. The browser restored its pending BG response after refresh and the manual restart; all 2,076 saved rooms retained exact versions and state hashes. Complete Karama cost continuations, Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ordinary card discard checkpoint, 7 September 2026: ORDINARY_CARD_DISCARD_CONTINUATIONS.md records exactly-once recovery for completed Hajr, Ghola, Harvester, Weather Control and Family Atomics effects, including preserved income and preparation promises. 1,766 rules/client/component +184 multiplayer tests (1,950 total), typecheck, lint and production build pass. Twenty Basic games completed 10,931 actions without rejections or stalls and with 495 JSON round trips; dedicated new tests provide direct ordinary-card coverage. A browser Hajr playtest verified the extra move and refresh recovery. Semuta, remaining discard producers and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Truthtrance discard checkpoint, 7 September 2026: TRUTHTRANCE_DISCARD_CONTINUATIONS.md records consumed-answer receipts, exact queued-question/parent restoration and preserved public history and promises. 1,742 rules/client/component +179 multiplayer tests (1,921 total), typecheck, lint and production build pass. Twenty current-source Basic games completed 12,616 actions with zero rejections/stalls and 559 JSON round trips; they contained no Truthtrance actions, so the 26 dedicated new tests provide direct coverage. All 1,956 saved rooms survived the manual restart unchanged; the QA table reconnected and updated internal guidance was visually checked. Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ornithopter discard checkpoint, 7 September 2026: ORNITHOPTER_DISCARD_CONTINUATIONS.md records separate completed-arrival and early-ending continuations, exact force/marker/counter recovery and preserved Guild/Sapho queues. 1,721 rules/client/component +174 multiplayer tests (1,895 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 11,522 accepted actions, zero rejections/stalls and 517 JSON round trips; dedicated tests cover the expansion card. An actual two-group browser playtest verified refresh, prevention of reusing moved forces, automatic disposal and unchanged completed state after reconnect. Semuta and complete Advanced/expansion acceptance remain unfinished; the removed automation stays removed.

Box discard checkpoint, 7 September 2026: BOX_DISCARD_CONTINUATIONS.md records a completed paid search, frozen private recovery/shuffle and exact interrupted-control restoration. An independent Auditor corruption probe prompted binding modern saved opportunities to their completed battle receipt; legacy saves remain supported. 1,703 rules/client/component +169 multiplayer tests (1,872 total), typecheck, lint and production build pass. Twenty Basic regression games completed with 12,326 accepted actions, zero rejections/stalls and 551 JSON round trips; this sample preceded the final Advanced-only Auditor guard and does not exercise Box. Browser guide/readable layout and saved QA seat restoration were checked. Semuta, remaining discard producers and full expansion acceptance remain unfinished. The removed automation stays removed.

Forced Terror discard checkpoint, 7 September 2026: TERROR_DISCARD_CONTINUATIONS.md records Sabotage and Robbery overflow saved steps, private exact card custody, preserved victim/draw and optional gift or deferred Nexus continuation. 1,685 rules/client/component +165 multiplayer tests (1,850 total), final typecheck, lint and production build pass. Twenty Basic games completed with 11,332 accepted actions, zero rejections/stalls and 509 JSON round trips; dedicated tests cover the new Terror behavior. The browser rules checklist and saved-seat restoration were verified. Semuta and full expansion acceptance remain unfinished; the removed automation stays removed.

Battle discard checkpoint, 7 September 2026: BATTLE_DISCARD_CONTINUATIONS.md records mandatory mixed-owner disposal, separate winner/Moritani cleanup, frozen effective casualty choices and exact-once post-battle recovery. Independent tests exposed and prompted a fix for corrupted Auditor ownership being accepted by private projection. 1,673 rules/client/component +161 multiplayer tests (1,834 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 12,114 legal accepted actions, zero rejections/stalls and 540 JSON round trips. All 1,806 saved rooms survived manual restart unchanged, and the QA seat reconnected. Semuta remains inactive; the full goal remains unfinished and the removed automation stays removed.

Discard continuation checkpoint, 7 September 2026: TREACHERY_DISCARD_CONTINUATIONS.md records isolated Semuta transfer rules and saved steps for Ixian/CHOAM Ambassador exchanges and Ixian purchased-card replacement. Concurrent recovery preserves exactly one replacement and each original payout. A public automatic-work signal schedules private saved frames after reconnect. Semuta activation, other discard producers, reaction timing and the full-hand question remain unfinished; no mode gate was opened and the maintenance automation remains removed. 1,653 rules/client/component +156 multiplayer tests (1,809 total), final typecheck, lint and production build pass. The existing QA table restored after browser refresh. This does not certify a playable Semuta reaction or full expansion games.

Juice of Sapho checkpoint, 7 September 2026: JUICE_OF_SAPHO_RUNTIME.md records first/last Once Around and clean combined-turn ordering, full-hand eligibility, protected last beyond Guild deferral, private controls and all-profile AI. 1,631 rules/client/component +152 multiplayer tests (1,783 total), final typecheck, lint and production build pass. Desktop/mobile staged auctions and movement, exact-once disposal, refresh and restart recovery passed. Twenty ordinary-AI Basic games completed without rejected actions or stalls; they cannot exercise Sapho because expansion starts remain gated. Battle aggressor, normal auction scope and other timing modes remain unfinished, with three material questions pending. The maintenance automation remains removed.

Shipment promise checkpoint, 7 September 2026: TRUTHTRANCE_SHIPMENT_PROMISES.md records the new structured Basic reserve-shipment commitment, complete owned preparation search, actual event enforcement, all four AI responders and private human guidance. Full regression: 1,598 rules/client/component +148 multiplayer tests (1,746 total); final focused checks, typecheck, lint and production build pass. Twenty Basic games through public production start completed with zero rejected actions or stalls and fulfilled 30 naturally sourced shipment promises. Desktop/mobile controls and refresh recovery passed in an isolated QA room. Earlier-phase, Advanced/expansion and arbitrary future promises remain unfinished; no mode gate was opened. The maintenance automation remains removed.

Truthtrance and recovery checkpoint, 7 September 2026: named-card count questions now support exact/minimum/maximum comparisons, compound facts, private verified answers and all four AI profiles. TRUTHTRANCE_CARD_COUNT.md records the implementation and desktop/mobile playtest. CHOAM_MARKET_AUTO_AUDIT.md records automatic empty-market completion only during Bidding, where counts are public; independent review caught and removed an initial non-Bidding information leak. Background recovery now schedules empty Auditor offers and unaffordable audit payments. 1,577 rules tests +143 multiplayer tests pass (1,720 total), with typecheck, lint and production build. Twenty CHOAM/base complete games had zero rejected actions or stalls, but no empty-market auto-close event; direct branch evidence comes from focused and browser tests. All 1,686 saved rooms survived the hourly restart unchanged. CHOAM_KULL_SOURCE_UPDATE.md found no new official ruling; Kull and the overall goal remain unfinished.

Auditor checkpoint, 7 September 2026: CHOAM_AUDITOR.md records the new extra leader, private inspection/payment, native lifecycle restrictions, original portrait and actual desktop/phone/recovery checks. All 1,560 rules tests +137 multiplayer tests pass, with typecheck, lint and build. A 20-game CHOAM/base-faction sample completed after fixing a reproduced Emperor AI pending-revival timing bug: 14,316 accepted actions, zero rejections, 627 JSON continuations. The two Auditor revival-cycle interpretations remain pending; Kull Wahad and broad expansion/module work remain unfinished. Prior statements that Auditor is wholly missing are historical. No full-compliance claim or start-gate change is made.

Target: classic GF9 2019 Dune + advanced game + Ixians & Tleilaxu + CHOAM & Richese + Ecaz & Moritani, including optional expansion modules. User additionally requests generated images, animations, AAA polish, a complete navigable rule reference with tooltips/guidance, and addable AI players at Easy/Medium/Hard/Brutal difficulty. The player-facing app must not link to external sites. This is an ACTIVE goal, not a completed implementation.

Current working slice

• Vinext/React/TypeScript, Cloudflare Workers + D1 via Sites.
• Lobby with faction choice, rooms and shareable eight-character invitations.
• D1 authoritative JSON state with optimistic version checks; private HttpOnly seat cookies hashed in storage; personalized projections strip hidden game information.
• Six base factions, traitor setup, Fremen allocation, prediction.
• Basic nine-phase loop: storm dials, spice blow/Nexus, charity, auctions, revival, shipping/movement, sealed battle/traitor choices, collection, victory.
• Base faction choices now include BG optional free shipments; Fremen ally worm protection, post-Nexus multi-sector worm rides and free ally revival; winner card discards; Harkonnen ally traitor support. Server enforces the designated decision owner.
• Battle preparation has guaranteed Voice → prescience → element answer → sealed-plan steps. The faction owner chooses whether to assist an ally, only the requested element is committed, and prescience values stay private to the two combatants.
• Multi-sector movement and Guild shipments, with single total rounded shipment cost. Ally funding supports private phase-specific pledges, refunds and explicit payment splits; committed bids stay funded. Ordinary spice draws preserve deck order.
• Truthtrance now overlays interrupted decisions with storm-order declaration priority, verified named-card/selected-traitor AND/OR questions, public freeform answers, unknown/retry/save flow, turn-stamped records and AI responses. Current-battle conditions now constrain plans, compose with Voice/prescience and release when impossible after an opposing effect. Arbitrary promises, feasibility through future card plays and the full timing audit remain unfinished.
• CHOAM charity, force revival, Inflation, end-phase card sales/allied exchanges, special Karama cash-in and combat funding/income now have engine, private UI and AI support. Kulon, La La La, Baliset, Jubba Cloak and Trip to Gamont Worthless effects also have engine/UI/AI support. Auditor now has its extra disc, survival-based private inspection, full cancellation payment, Karama continuation, capture/foreign-ghola exclusions, first native revival, original portrait and four-level AI controls. CHOAM tables defer victory until their final Mentat opportunity after the market. Kull Wahad, Auditor repeated/sixth-disc revival cycles and interaction audits remain unfinished; the twelve ordinary leader rosters are verified; faction starts remain disabled.
• Partial faction powers and card effects. Explicitly blocks advanced/expansion starts pending implementation, instead of claiming complete compliance.
• Interactive terrain map, hand, table log, phase rail, action forms, responsive layouts, reduced-motion support.
• Original generated artwork: two Arrakis scenes, sixty identity-mapped ordinary leader portraits across all twelve factions, and a separate Duke Prad Vidal portrait, with live text/strength and vector fallback for unsupported identities or image failures.
• Optional tech tokens for tables of three or more: initial ownership, deferred phase income, post-battle transfers, one-owner set victory bonus, public UI, internal rule topic and all four AI policies. Expansion faction starts remain gated.
• Tleilaxu now has private Face Dancer setup, post-battle replacement, three-card recycling and once-per-Mentat replacement with Karama response. Zoal copies leader strength and bounty. Revival commerce now includes private early-leader quotes, force-limit permissions, discounts, income and Karama responses. Foreign ghola acquisition, private buybacks, shared leader control and AI are also implemented. Special Karama revival prevention now has engine/UI/AI support; its timing and exception audit remains unfinished, and starts stay gated.
• Cheap Hero traitor matches either hero card, supports repeated/ally calls and KH protection, and retains public revealed identities for UI/AI use.
• Amal has an explicit public opening window for all nine phases, before automatic phase effects. The engine, UI and bots support halving available spice with upward losses and deferred phase continuation.
• Thumper has phase-opening engine/UI/AI support using a virtual worm encounter that does not alter spice-deck inventory.
• Sandtrout has persistent spice-deck/anti-alliance support with private Atreides preview and public pending status; live expansion starts remain gated.
• Ixian cyborg/suboid combat, half-strength basic dials, fixed suboid support rules and post-casualty substitution have engine/UI/AI support. Ixian movement, collection capacity and typed revival pricing also have engine/UI/AI support. Hidden Mobile Stronghold placement, relocation, sector routes, entry, protection, battles, victory and special Karama now have engine/UI/AI support; setup/bidding technology now has private decisions, Karama responses and AI support. The complete fourteen-card Ix inventory is now assembled; complete-game expansion integration and interaction audits remain unfinished.
• The complete fourteen-card Ix treachery inventory is assembled with distinct identities, including the extra ordinary weapons, defenses, Worthless card and Harvester. The combined base/Ix deck has 47 cards. Full starts remain gated pending card-face and faction/phase interaction audits.
• Current verification: 2,517 registered rules/client/component tests and 226 persisted/API tests pass, with TypeScript, lint and production build. Coverage includes the Basic game, implemented advanced/expansion slices, four AI profiles, staged setup and private authoritative recovery. Public Advanced/expansion starts remain gated; passing slice tests does not certify them.
• Earlier checkpoint: verified Truthtrance current-spice comparisons now have authoritative answers, all-profile AI responses, controls, private restoration and duplicate-answer tests. Source-ordered base setup remains integrated with private prediction, traitor selection, force placement and an automatic final Treachery deal. The new 192-game Basic calibration completed 59,380 accepted actions without rejected candidates or checked failures. The shared offline initializer passes 456 Advanced setup combinations; 456 genuine Advanced games also completed with zero rejected candidates. Difficulty calibration and full expansion/module acceptance remain unfinished.

Stronghold Cards checkpoint (2026-09-07)

All six Advanced Stronghold Cards now have authoritative local battle effects, end-Mentat public custody, event-bound mobile copying, support/payment previews, AI policies, original bundled illustrations and full readable inspectors. A sole copy choice is announced automatically. Card ownership remains fixed until turn end even after defeat. Carthag augments actual defense roles; Habbanya also resolves Stone ties; Arrakeen preserves CHOAM donor/bank accounting. Independent review found and root corrected an inaccurate Stone outcome explanation. All-level testing exposed and root fixed omitted affordable Arrakeen plans for larger armies. STRONGHOLD_CARDS.md records sources, all six identities, interpretations and integration boundaries.

1,528/1,528 rules/client/component tests and 133/133 persistence/API tests pass (1,661 total). New coverage is 12 pure module cases, nine engine cases, four all-profile AI cases, three additional combat-matrix cases and four production-room SQLite cases. Recovery covers actual seat rotation, sealed plans, duplicate/crossed copy choices, exactly-once income/support and eight malformed persisted bindings. Full logs: /tmp/dune-stronghold-full.log (64.65 seconds), /tmp/dune-stronghold-multiplayer.log (18.27 seconds). TypeScript and lint: /tmp/dune-stronghold-final2-type.log, /tmp/dune-stronghold-final2-lint.log. Production build and final ledger rebuild both pass: /tmp/dune-stronghold-build.log, /tmp/dune-stronghold-final-build.log. The initial lint complaint about an ordinary image element was resolved using the installed image component.

A separate 40/40 complete-game sample exercised the module with base factions across all counts two through six and all four homogeneous AI profiles, twice per combination. It accepted 19,665 actions with zero rejected candidates, stalls or checked failures and continued through 912 actual JSON round trips. The unchanged strict base audit initializer is followed by empty optional-module configuration before any setup action; resources/cards/forces are untouched. This does not exercise Ixian or CHOAM complete games. Runner and complete traces: /tmp/dune-stronghold-fullgames.ts and /tmp/dune-stronghold-fullgames.json; summary hash/source evidence is in the module document. Root reviewed the complete runner and every contributed test file, all six generated illustrations, both source audits and runtime review. Comparative difficulty calibration remains unfinished.

Browser inspection verified all six normal desktop faces and all six enlarged faces on desktop and 390×844 phone width. Text remains selectable and readable, images are bundled, Close controls work and the viewport override was reset. The isolated room P2PLZKVL was created through the UI with a Guild host and two Hard AI opponents and completed normal setup. Only that named QA room was then staged for a mobile battle. A reload restored its two eligible public copy choices. Choosing Arrakeen preceded plans; two support spice correctly displayed bank 2/personal 0 and was accepted at zero personal spice. Battle settlement emitted the automatic bank-support notice. The subsequent collection phase awarded the separate four-spice city income; the lost mobile battle did not prematurely transfer its retained card. The sample is a staged control test, not an entire expansion game.

Manual maintenance at 00:46 UTC backed up all 1,593 rooms to /tmp/dune-maintenance-20260907T0046/database.sqlite, then verified all saved JSON hashes and versions exactly. The private Guild transport seat reconnected with its same hand and resources. The known human room remained v14 and idle. Development server session 81510 is the current controlled launch; next maintenance is due about 01:46 UTC if active development and human play permit. The user-removed automation remains removed.

Complete Advanced faction/card timing, all expansion games, Ecaz combined-force battles and every optional-module combination remain unfinished. Public mode gates remain closed. The goal remains active.

Effective battle weapon foundation checkpoint (2026-09-07 local date)

Shared combat now distinguishes physical card identity from effective attack behavior. A pure resolver describes canonical Mirror copies, original attack roles and independent copy-first Tooth/Stone choices. Ordinary leader attacks, Artillery effects and the Lasgun explosion predicate consume these descriptors; the engine and AI use the common explosion check for their entitled inputs. Physical plans, custody, prescience, promises and retention remain unchanged. Mirror plan admission is still disabled: copied-choice persistence, effective Stone outcome, controls and settled cleanup remain necessary before activation. EFFECTIVE_BATTLE_WEAPONS.md records the complete contract and boundaries.

1,500/1,500 rules/client/component tests and 129/129 persistence/API tests pass (1,629 total). Sixteen new tests cover both copy orientations, printed defense matrices, independent Tooth answers, Artillery suppression, explosions, strict identities and blocked partial activation. Full logs: /tmp/dune-effective-weapons-full.log (67.15 seconds), /tmp/dune-effective-weapons-multiplayer.log (18.64 seconds). TypeScript, lint and production build pass: /tmp/dune-effective-weapons-type.log, /tmp/dune-effective-weapons-lint.log, /tmp/dune-effective-weapons-build.log. Independent regression comparison found zero differences across865,580 attack,216,395 explosion and3,364 single-weapon evaluations of existing canonical cards. Root reviewed the helper, both new test files, integration, comparison script and independent audits. Historical648-game calibration was not rerun.

Fresh bounded publisher retrieval did not settle the previously asked Mirror copied-Tooth/Artillery disposal question. No user answer or house rule was inferred. Current Stone and Portable foundations supersede the older Mirror audit's descriptions of missing implementations. Recovery-only follow-ups include plain evaluator errors for malformed Mirror-marked saves and missing event/source validation for existing Poison Tooth answers; no valid-action exploit was demonstrated. No live game was staged or played in this slice. The user-removed automation stays removed; server session24370 remains the last controlled launch, with maintenance next due about00:46UTC if active development and human play permit. The full goal remains active.

Pending physical shipment integrity checkpoint (2026-09-07 local date)

Ordinary physical shipments now revalidate current turn/opportunity, typed reserves, arrival stance, destination, price, funds and reciprocal allied contribution before continuation. Guild allowance and special-stop responses must match the saved public declaration. Invalid state rejects before any room write or response-card disposal. New declarations include their turn; valid older unstamped saves still resume. Concealed No-Fields retain separate contracts. No automatic save repair or cancellation settlement was introduced. See PENDING_SHIPMENT_INTEGRITY.md.

1,484/1,484 rules/client/component tests and 129/129 persistence/API tests pass (1,613 total). Ten new engine cases and three production-room SQLite cases include 24 corrupted declarations checked independently for allowance and stop, stamped/legacy restoration and duplicate CAS. Root integrated and reviewed both agents' complete files; the final runtime includes the reciprocal-donor correction caught by independent testing. Full logs: /tmp/dune-pending-shipment-full.log (61.96 seconds), /tmp/dune-pending-shipment-multiplayer.log (16.80 seconds). TypeScript, lint and production build pass: /tmp/dune-pending-shipment-final-type.log, /tmp/dune-pending-shipment-final-lint.log, /tmp/dune-pending-shipment-final-build.log. The historical 648-game calibration was not rerun for this slice.

Browser inspection confirmed that the existing Guild QA seat remains at its legitimate movement decision, with the same private hand, 20 reserves and two spice. The updated internal phase guidance is readable, searchable and reachable by its direct link after page loading. No new live state was staged. A read-only database comparison found 1,563 rooms and exact unchanged JSON/version pairs for all 1,502 rooms in the 23:45 UTC backup. The known human room remains v14; Guild QA remains v13. The removed automation stays removed. Server session24370 remains the last controlled launch; next manual maintenance is due about00:46 UTC if active work and human play permit.

The allied transit audit confirms that ordinary shipment into allied territory followed by departure is allowed by the November FAQ but remains unsupported by the table. The exceptional outcome after an opposing effect makes departure impossible remains a pending user clarification; no answer was inferred. ALLIED_TRANSIT_RULES.md records source precedence, advisor separation and the distinction from existing co-occupation. Ordinary Guild rate/permission cancellation, nonbattle Truthtrance promises and the wider Advanced/expansion scope remain incomplete. The goal remains active.

Guild contributor routing and transport controls checkpoint (2026-09-07 local date)

The Guild now receives a non-Guild ally’s shipment contribution even when Guild itself ships. Guild’s own payment still goes to the bank. The coordinating review applied November2020 FAQ’s direct-contributor rule over April’s older transfer-to-shipper wording; the source provides a general rule, not an explicit reverse-direction worked example. Both ordinary shipment and direct Guild transport use the same income calculation. Independent Karama, Guild-funded allied shipment and income cancellation retain their distinct payment destinations. Automatic chronicle entries explain collection or prevention.

Guild cross-planet, southern-reserve and return controls now display the actual selected physical-force total, rounded price, personal share and authorized ally pledge. They reject invalid counts, elite allocations, entry and funding before submission; the server remains authoritative. Combined-sector totals override the unrelated scalar control. The private preview does not expose opposing spice or implement future-action feasibility. The source/payment contract and remaining limitations are recorded in GUILD_SHIPMENT_PAYMENTS.md.

1,474/1,474 rules/client/component tests and 126/126 persisted/API tests pass (1,600 total). Nineteen new rules/quote tests and three production-room SQLite cases cover contributor direction, both settlement paths, exact counts, cancellation, duplicate CAS, privacy and restored pending income. Independent UI review compared10,320 synthetic settled-state selections without a quote/server mismatch. Root integrated and reviewed every contribution. Full logs: /tmp/dune-guild-full.log (67.75seconds), /tmp/dune-guild-multiplayer.log (17.60seconds). TypeScript, lint and production build pass: /tmp/dune-guild-final-type.log, /tmp/dune-guild-final-lint.log, /tmp/dune-guild-final-build.log. Historical648-game calibration was not rerun for this change; current full suites include the existing complete-game cases.

Root browser QA created room6XMTUD6U with Guild and two Hard AI seats, completed setup, then explicitly staged only that room atv11 for transport/payment inspection. A1+2 combined group cost2 despite scalar amount19; five-force Red Chasm transport correctly exceeded available1+2spice, while return cost3 remained enabled. Actual return consumed personal1 and pledged2, returned five forces and credited Guild the donor’s2. Finalv13 has20reserves, no Guild forces on Dune, spice2, zero incoming pledge and spent shipment; movement remains unspent. A fresh invitation restored the same private seat, spent shipment and enabled Finish control. Full-page desktop visual inspection found readable labels/counts/costs and no clipped quote controls. This is a focused staged scenario, not full-game or mobile acceptance.

The manual23:45UTC restart backed up all1,502rooms, then verified exact JSON hashes/versions, HTTP200 and private-seat restoration in PRAVNYBG. The known human room remained v14 and idle. The initial sandboxed launch failed on denied network-interface access; the authorized runtime launch succeeded, without database repair. The removed automation remains removed. Current development server session24370 started around23:46UTC; next manual maintenance is due around00:46UTC7September if development continues and human play permits. Production test runs add QA rooms; do not infer that later room-count growth changed earlier saved states.

Shared normalized pending intents, ordinary Guild rate/permission responses and current-turn Truthtrance promises remain incomplete. An additional audit found malformed/stale persisted ordinary intents can bypass revalidation; this was not a valid-action remote exploit and needs a separate exact-custody/context check without inventing cancellation recovery. Advanced and expansion starts remain gated. The overall goal is active.

Truthtrance current-spice checkpoint (2026-09-07 local date)

Truthtrance now asks whether another player currently holds exactly, at least or at most a nonnegative whole amount of personal spice. The server compares p.spice at the answer action, excluding separate pledged aid and incoming payments. It rejects dishonest/unknown answers to this knowable fact and publishes only the requested answer. AND/OR keep their three-valued semantics and reveal no additional per-clause results. The fact does not constrain later legal spending. Freeform interpretation, other facts and nonbattle promises remain incomplete.

The existing private-answer projection lets all four AI levels respond legally without new privileged information or balance fields. The UI adds a styled comparison/amount form, linked input validation and public preview, and the in-game reference adds a five-part checklist. Root reviewed all new tests and the UI; independent privacy/recovery review found no runtime defect. No engine dispatcher, public mode gate or bot strategy was changed. See TRUTHTRANCE_SPICE_FACTS.md.

1,455/1,455 rules/client/component tests and 123/123 persisted/API tests pass. Nine new rules/AI cases include105 comparator lifecycle examples, all profiles, secret-state perturbations and a later paid revival. Four new SQLite cases preserve a genuine auction/payment choice, private composite answers and one history/discard under duplicate CAS. The first broad run included eight of the nine new rules tests; the final broad run includes all nine. Logs: /tmp/dune-truth-spice-final-full.log, /tmp/dune-truth-spice-multiplayer.log. Released-source TypeScript, lint and production build pass: /tmp/dune-truth-spice-final2-type.log, /tmp/dune-truth-spice-final2-lint.log, /tmp/dune-truth-spice-final2-build.log. No additional broad game-calibration claim is inferred from the earlier648-game source checkpoint.

Browser QA in the explicitly staged private roomPRAVNYBG verified a human spice question to Hard AI, disabled invalid amounts, an AI Yes with one card discarded, the resumed first Storm, and invitation recovery. A second canonical card fixture verified the human-target private answer and pending-question restoration. Publishing it produced finalv18: two Yes records, exactly two physical Truthtrances in discard, unchanged personal balances10/7 and the same saved Emperor storm dial3. Root visually inspected both forms. No real human room or earlier completed browser game was modified. The database now contains1,502 rooms; all1,388 rooms from the22:45UTC backup retain exact versions/state hashes except the previously recorded intentional ZJUGV6XW Karama completion. The real human room remainsv14.

The broader source-defined shipment commitment requires shared legal shipment feasibility, declaration/settlement checks, prevention of voluntary evasion through spending or skipping, and honest release after opposing effects. Those requirements and the unresolved Guild cases remain in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md. Full Advanced/expansion acceptance and the overall goal remain unfinished. The removed automation stays removed; the next manual development-server maintenance remains due around23:45UTC if active work continues and human play permits.

Source-ordered setup checkpoint (2026-09-07 local date)

New base tables follow the published sequence: fixed player positions, private Bene Gesserit prediction, private traitor selection, starting spice and forces, then Treachery. The persisted setup stage exposes only the IDs of players whose choices remain. Fremen place before the Advanced starting advisor; absent factions and completed automatic steps need no acknowledgement. Harkonnen keeps four traitors automatically. No starting Treachery identity is available during placement.

Public Basic start and the strict offline initializeBaseGameForAudit share one initializer. The audit entry accepts only a fresh ready base-faction lobby without expansions or optional modules and cannot be selected through a room action. Public Advanced and expansion gates remain intact. Legacy setups without a stage finish using their existing pieces; recovery never repeats the new initializer.

The complete suites pass 1,446 rules/client/component tests and 119 persisted/API tests, including 456 Advanced setup combinations across all 57 base-faction rosters, all four profiles and both actor/physical orders. Stage-ending duplicate requests commit only once through the production SQLite compare-and-swap path. The earlier failures were fixtures assuming the old deal order; the corrected fixtures preserve their gameplay, privacy, pacing and concurrency assertions. Logs: /tmp/dune-staged-setup-full.log, /tmp/dune-staged-setup-multiplayer-final.log, /tmp/dune-staged-setup-type-final.log, /tmp/dune-staged-setup-lint-final.log, /tmp/dune-staged-setup-build-final.log.

Two frozen-source Basic studies complete 192/192 games, 59,380 accepted actions, zero rejected candidates, stalls, exceptions or checked invariant failures. AI_STAGED_SETUP_BASIC_CALIBRATION_20260907.md records exact source boundaries and the historical incorrect-order comparison. Four registered Advanced full-game bot cases now begin genuinely Advanced through the shared initializer. The separate Advanced roster study completed 456/456 games with 116,270 accepted actions, zero rejected candidates or checked failures, and 5,943 actual JSON continuation points. It covers all 57 rosters at four difficulty shifts and two seed blocks. The 20-game pilot exactly reproduces the first 20 full-study rows and is not counted as additional independent games. Medium, Hard and Brutal do not show a consistent increasing strength ladder. These complete games do not resolve the remaining rule gaps or certify full Advanced compliance.

After calibration completed, engine formatting preserved its canonical syntax tree; formatting and setup-reference/checklist changes occurred outside the measured source intervals. The final engine hash is db169e5fc959a7b26469f22f26e6957cbb39fe49aab8ed25a8714dec3c31a3c1. All 22 targeted setup/reference checks and released-source TypeScript, lint and build pass: /tmp/dune-staged-setup-final-reference.log, /tmp/dune-staged-setup-final2-type.log, /tmp/dune-staged-setup-final2-lint.log, /tmp/dune-staged-setup-final2-build.log. The five-part setup checklist now records implementation, controls, AI, documentation and verification separately.

Two fresh browser tables verified prediction before private cards, private traitor selection with empty hands/board, human and AI Fremen placement, and the automatic card deal into Storm. One then completed online atv347 with a turn5 Bene Gesserit victory under voluntary Brutal autopilot; a fresh invitation restored its finished board and private hand. No game-state staging was used. Independent source/privacy review found no substantive defect in valid base setup or legacy continuation. Complete expansion setup and optional-module ordering, broader Advanced interactions and the remaining base Guild/Truthtrance rules remain required. The next bounded Truthtrance slice is documented in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md: verified current-spice questions first, followed by source-defined shipment commitments with their full enforcement and feasibility requirements.

Fremen movement cancellation and Advanced setup checkpoint (2026-09-07 local date)

Ordinary Fremen movement now offers a Karama response only when the selected route uses its two-territory advantage. A stored turn/movement/group intent waits before any force moves. Allowance revalidates and continues the exact group through normal arrival handling. Cancellation spends one cancellation card, preserves the forces and unspent movement, and limits that particular movement use to one territory. Hajr or the second distinct Ornithopter group has a fresh range use; city and fixed-card ornithopter range remain independent. The November 2020 FAQ supersedes the April whole-phase answer; see FREMEN_MOVEMENT_KARAMA_RULES.md.

The public response explains the destination and consequence. The mover sees the current restriction, and ordinary movement and normal-range Ornithopter controls reject an unavailable replacement route before submission. All four bot profiles use the projected current restriction; Hard and Brutal can cancel an enemy movement toward their own public fighters. Advanced Bene Gesserit setup bots now wait for the public Fremen placement prerequisite while completing their own traitor/prediction choices, then consider all legal printed starting sectors.

The complete existing run passed 1,431 tests, and all five subsequently registered independent movement edge tests passed on the same engine. The 116-test persisted/API suite passed. New verification consists of four BG setup tests, nine Fremen tests, five independent continuation/typed-custody tests and three production-room SQLite recovery/concurrency tests. Full suite logs: /tmp/dune-fremen-full.log, /tmp/dune-fremen-multiplayer.log; independent integration log: /tmp/dune-fremen-review-integrated.log. The edge suite was still being edited during the first type/lint run; its released version passed the subsequent type check. Subsequent released-source TypeScript, lint and production build checks passed (/tmp/dune-fremen-type-verified2.log, /tmp/dune-fremen-lint-verified.log, /tmp/dune-fremen-build-verified.log). Browser checks and the 1,388-room restart are recorded in VISUAL_PLAYTEST.md.

Both 96-game Basic studies completed with 56,766 accepted actions and zero rejected candidates, stalls, exceptions or checked invariant failures. The source files stayed unchanged during both runs; AI_FREMEN_MOVEMENT_CALIBRATION_20260907.md preserves hashes, exact boundaries, paired changes and non-monotonic difficulty outcomes. These are four-player Basic studies. The preceding 312-game player-count checkpoint remains historical evidence, not a claim that every prior simulation was rerun on this changed engine.

Two isolated browser rooms verified the human cancellation and replacement controls, including a disabled invalid route, a completed legal replacement and a pending response restored after the 22:45UTC controlled server restart. All 1,388 saved rooms retained exact versions/state hashes through the restart. Their names explicitly mark QA; no real human room was staged. Full Advanced setup and game acceptance, the remaining Guild/Truthtrance rules and all unfinished expansion systems remain required. The removed automation stays removed.

A subsequent setup ordering audit found that this historical checkpoint dealt private cards before BG prediction and starting Treachery before normal traitor/force choices. The following staged setup implementation corrects that defect for new tables. Old saved setup rooms retain their already-known cards and continue without redealing.

AI battle legality checkpoint (2026-09-07 local date)

AI plans now require an available controlled leader or Cheap Hero, retaining the explicit no-leader and forbidden-Hero exceptions. Leaderless plans cannot carry battle cards or the Kwisatz Haderach. Voice compulsion uses each held card’s default role, while prohibition and actual usage use the selected battle slot. This preserves legal Chemistry/Weirding Way alternatives and canonical Portable Snooper behavior.

An own Prescience commitment now restricts the leader, weapon or defense candidates before scoring and slot validation. It no longer overwrites a validated plan afterward, so one physical card cannot be introduced into both slots and the final leader determines KH eligibility. Dial commitments retain typed casualty/support checks. Existing Truthtrance completion hints, Stone preflight, custody and hidden-information boundaries remain active. The authoritative engine and difficulty profiles were not changed.

AI battle selection now uses public fighter presence, storm order and an accessible same-territory path. Polar Sink, advisors, allies, earlier aggressors and storm-separated groups are excluded. The Hidden Mobile Stronghold uses its pointing sector for storm blocking. Concealed No-Field values are never consulted; public marker presence alone supports battle selection.

1,418/1,418 registered rules/client/component tests and 113/113 persisted/API tests pass, plus TypeScript, lint and production build. New coverage is three root Prescience cases, seven independently authored plan cases, nine independently authored battle-choice cases and three independent worm-ride regressions, each testing all four difficulties. Every candidate in those fixtures is applied through the authoritative engine, with private-view invariance checked separately. Final logs: /tmp/dune-battle-ai-final-full.log, /tmp/dune-battle-ai-final-multiplayer.log, /tmp/dune-battle-ai-final2-type.log, /tmp/dune-battle-ai-final-lint.log, /tmp/dune-battle-ai-final-build.log.

A broader player-count run exposed one Fremen worm ride aimed back at its origin. Ride candidates now exclude that territory and apply public destination-entry conditions before the target limit, while preserving unlimited ride distance, multiple source sectors, elite custody and the separate free-reinforcement rules. All original four-player accepted traces remain identical in the final reruns.

The original and second 96-game Basic calibration batches now complete 192/192 games with zero rejected candidates, across 58,238 accepted actions. No deadlock, action-limit, exception or checked invariant failure occurred; every accepted action was the first offered candidate. All 96 original-seed accepted traces/final states match the preceding mobility run exactly, while 92/96 second-seed traces match. The second seed is a previously observed regression set, not a new blind strategy validation. Sources stayed stable. See AI_BATTLE_CALIBRATION_20260907.md for preserved hashes, changed rows and non-monotonic difficulty outcomes.

The final separate two-through-six-player study completed 120/120 Basic games, with 24 at each player count, 51,547 accepted actions, zero rejected candidates and no checked failures. Its only earlier rejection was the now-corrected worm ride. All recorded non-timing row fields match the initial study except that one rejection’s fields. The older harness does not record complete trace/state hashes or seed UUIDs, so no byte-identical replay is claimed. See AI_PLAYER_COUNTS_20260907.md. Combined with the final four-player pair, the current frozen code completed 312 games with zero attempted-candidate rejections; these different studies are not pooled as independent strength trials.

A live Basic two-player game also completed after the human Fremen enabled Brutal autopilot against the Hard Guild. The Guild won on turn 3 with four strongholds; a fresh invitation restored the completed v112 state and exact private seat. No battle occurred in that browser game, so its evidence is online progression, completion and recovery. See VISUAL_PLAYTEST.md. The full Advanced/expansion scope and reliable difficulty ordering remain unfinished.

The independent base Advanced readiness audit separates concrete base-game gaps from unrelated expansion work. Immediate targets are the BG setup AI prerequisite, Fremen movement Karama cancellation, distinct Guild rate/transport cancellations, and unfinished Truthtrance obligations. Some special-Karama settlement policies still await authoritative resolution. Existing Advanced subsystem simulations bypass genuine Advanced setup, so authentic setup, complete games and browser recovery remain required before enabling that mode.

AI movement legality checkpoint (2026-09-07 local date)

All four profiles now filter ordinary movement using the actual selected force group, faction range, city access, Ixian cancellation, CHOAM bonus, storm geometry, occupied strongholds and advisor arrival/lock rules. Legal destinations are filtered before the ranked target limit, preserving reachable alternatives. Easy explicitly includes the minimum required cyborgs when ordinary troops cannot fill its chosen group. Allies can remain legal transit points while prohibited arrivals stay excluded; Baliset and mobile-stronghold exceptions retain their authoritative behavior.

Fremen ordinary reinforcements use static distance from the Great Flat and remain distinct from paid allied Guild transport. Advanced Fremen storm reinforcement remains available. Guild transports use the rounded total shipment cost, own available spice and explicitly pledged ally funds. Hidden opposing hand contents, unpledged spice and foreign No-Field denominations do not enter these choices. Authoritative engine rules and difficulty profiles were not changed.

The ordinary shipment control also explains and disables Fremen destinations outside that radius. Nonzero storm destinations disable ordinary movement and shipment, with the printed Advanced Fremen reserve-shipment exception retained. These are destination checks; full route previews, broader legal-action guidance and card-specific movement controls still need further acceptance. The final UI follow-up passes TypeScript, targeted lint and production build (/tmp/dune-mobility-ui-build.log).

The registered suite passes 1,396/1,396 rules/client/component tests and 113/113 persisted/API tests. New coverage comprises three transport-budget tests and eight independently authored reachability tests across all profiles; existing shipment tests now require legal Fremen radius and funded Guild transport. TypeScript, lint and production build pass. Logs are /tmp/dune-mobility-full.log, /tmp/dune-mobility-multiplayer.log, /tmp/dune-mobility-final-type.log, /tmp/dune-mobility-lint.log and /tmp/dune-mobility-build.log.

Two unchanged-harness Basic simulations completed 96/96 games each, including the original comparison seed and a held-out seed. The original seed's rejected candidates dropped 94.01% (5,508 to 330); the held-out run had 471. Neither new run produced a movement/shipment rejection, stall, action-limit, exception or checked invariant failure. Source fingerprints stayed stable. Medium/Hard/Brutal strength ordering remains unverified, and battle-candidate legality remains an active improvement target. See AI_MOBILITY_CALIBRATION_20260907.md for the complete design, categories, shared-win handling and limits.

A documentation-only CHOAM Auditor audit identifies setup, traitor, capture, revival, privacy and post-battle integration points. It corrects the overbroad historical claim that Auditor cannot use a Ghola card: foreign Tleilaxu acquisition is the specific prohibition. The audit does not implement Auditor; repeated revival cycles and some combined timing remain unresolved. Full Advanced/expansion starts remain gated, and the complete goal remains active.

Browser acceptance completed ordinary Fremen free shipment and movement, then observed the Hard Guild AI's paid shipment and move in a new unmodified two-player Basic table. Fresh invitations restored both that table and the preserved Stone battle QA seat. The corrected radius/storm warnings were inspected in the live UI. Manual restart and final comparison preserved all 1,265 pre-existing room versions and exact state hashes. New QA room JJPGBA2Q remains atv78 with a genuine turn2 movement choice. Details and limits are in VISUAL_PLAYTEST.md. No maintenance automation was recreated; live server session97328 started around21:46UTC and its next manual maintenance is due around22:46UTC during active work.

Stone Burner, complete ordinary portraits and recovery checkpoint (2026-09-06)

• Canonical Stone Burner now uses the weapon slot without changing its saved kind: special identity. It has a named Voice role, Prescience/Truth-compatible original commitments, a private precommit availability check, and an event-bound owner choice after both plans reveal. Kill mode kills both participating leader discs; ignore mode preserves other weapon attacks. Both replace ordinary strength with undialed physical-token comparison, with the aggressor winning ties. Neither adds the Kwisatz Haderach bonus or kills that companion. Normal support, bounty, traitor/explosion precedence, casualty choices and winner/loser/Moritani retention remain shared with the existing battle flow.
• Physical counting enumerates every legal casualty allocation. A winner is accepted only when every permitted pair agrees. The printed Advanced Emperor example includes three possible remaining-token totals; where all give the same winner, the winner still chooses its normal casualty allocation afterward. Where the choice could change the winner, a conservative check rejects Stone before either hidden opposing plan is inspected. Foreign No-Field values are represented by public possibilities, never read to decide availability. Compulsory Stone Voice must leave a common zero-spice completion across those public possibilities.
• Two actual interpretation questions remain unanswered: the commitment procedure when Advanced or Basic Ix physical allocations change the winner, and the priority of opposing Stone/Poison Tooth revealed choices. No policy was inferred from silence. A public Ix-configuration guard prevents accepting a Stone plan whose combined timing cannot yet finish. This is an explicit implementation boundary, not a printed prohibition. Mirror/copied weapons and unfinished modules remain uncertified. See STONE_BURNER_ENGINE_AUDIT.md.
• Player controls show both original plans, exact undialed counts or honest possible totals, the mode choice and a complete internal guide. No victim/death confirmation is added. The card stays physically reserved until standard cleanup; stale events, duplicate requests and corrupted source custody fail before resources change. All four AI profiles use public force possibilities, legal low-dial plans and revealed leader/bounty information. They preserve leader value when Artillery suppresses bounty and leave traitor/explosion precedence intact.
• 1,385/1,385 registered rules/client/component tests and 113/113 persisted/API tests pass, together with TypeScript, lint and the production build. New coverage is eight pure Stone cases, seven root engine cases, nine independent reviews, five AI cases, three persisted recovery cases and four special-art cases. Logs: /tmp/dune-stone-final-full.log (34.28 seconds), /tmp/dune-stone-final-multiplayer.log (16.22 seconds), and /tmp/dune-stone-final-{type,lint,build}.log. All original card identities and the full expansion start gates remain intact.
• Browser QA selected Stone in the normal weapon selector and reached a real revealed choice in synthetic room QPNV5XJJ. The manual hourly restart saved all 1,235 rooms and preserved every version and exact state hash, including the pending choice at v60, event 20d21df3-8e58-4039-b6be-44db4f0d661a. A fresh invitation restored the exact decision with no payment/death. After choosing kill, Harkonnen won 4–0 on undialed tokens; Feyd-Rautha and Ein Calimar each died once, the normal 11-spice bounty was paid, one dialed force was lost, and Stone was retained normally. Final v68 has four Harkonnen forces at Pasty Mesa, 19 spice, one Stone in hand and none in discard, with no battle or decision. All other 1,234 saved room hashes remain unchanged. The enlarged card/guide and corrected decision heading/counts were inspected. Backups: /tmp/dune-maintenance-20260906T1215/; snapshots: /tmp/dune-stone-browser-pending-v60.json and /tmp/dune-stone-browser-complete-v68.json. Live server session11092 started around12:15 UTC; the next manual maintenance is due around13:15 UTC if development continues. The removed automation remains removed.
• Ecaz and Moritani each gained five original portraits, completing 60/60 ordinary leaders across all twelve factions. The separate Duke Prad Vidal portrait brings special-disc coverage to one without adding him to an ordinary roster or traitor inventory. All prior assets and provenance records were preserved. Full-resolution inspection, asset tests and actual192px/80px browser review passed. Duke's actual component additionally passed custody-label, inspector, identity-fallback and real404-fallback checks in an isolated byte-identical harness. Its temporary server was stopped. See ECAZ_PORTRAITS.md, MORITANI_PORTRAITS.md and DUKE_VIDAL_PORTRAIT.md. Auditor, Kwisatz Haderach and other nonordinary component artwork remain separate unfinished work.
• Semuta Drug, Mirror Weapon and Juice of Sapho remain inactive. Source audits now identify Semuta's fresh-discard continuation requirements and Sapho's scoped ordering requirements; these are not runtime completion claims. Other unfinished faction/module systems, mobile acceptance, difficulty-strength calibration and complete Advanced/expansion games still prevent goal completion. No start gate was removed.

Balanced Basic AI calibration (2026-09-06)

A new balanced four-player study completed 96/96 Basic games with no stalls, action limits, exceptions or checked resource/hand invariant failures. Each difficulty appeared 96 times, with balanced faction, seat and physical-circle marginals. Wins were Easy 1, Medium 30, Hard 28, Brutal 37. Easy was weaker in this sample, but the two seed replicates do not establish a reliable Medium → Hard → Brutal ordering. No resource bonuses or unauthorized information were used. The run accepted 28,379 actions; 911 first candidates and 5,508 total candidates were rejected before legal fallbacks progressed, chiefly movement reachability and Fremen entry. Those candidates and 243 unaffordable Guild transports remain concrete improvement targets. Source fingerprints were stable during measurement and a four-game prefix replay reproduced all non-time results. This is Basic completion evidence, not expansion or human-strength certification. See AI_CALIBRATION_20260906.md and tools/ai-calibration-stone.ts.

Portable Snooper runtime and Richese portrait checkpoint (2026-09-06)

• Portable Snooper now supports its ordinary poison-defense slot and optional play after both plans reveal, for all twelve holders in Basic and Advanced development fixtures. Exact canonical role predicates preserve saved kind: special identities without admitting unrelated cards. Normal plan searches, Voice, Prescience, structured Truthtrance names, player selectors and AI use that same role. It stops ordinary poison and weapon Chemistry, but not Tooth, Artillery, Lasgun or the projectile half of Poison Blade.
• Late play uses the spare battle-card slot and preserves the complete original plan. A lone Worthless in either slot is allowed; a real defense, weapon-plus-Worthless or two occupied slots blocks it. Voice compulsion must be met originally when possible, and forbidden poison defense remains forbidden late. The existing own traitor-declaration opportunity is the explicit application deadline, independent of hand contents; no extra holder-only public window or acknowledgement was added.
• Battle.lateDefense records the public played card separately, with exact battle-event and physical-custody validation. The card stays reserved in its owner's hand through remaining decisions and appears in the public component inspector only after play. The effective defense feeds combat, while the original plan remains the source for inspected and structured promised slots. Winner, loser and Moritani retention cleanup all account for that one physical card. Current decisions, Truthtrance and responses retain priority; duplicate and stale requests cannot replay protection or cleanup.
• Source review corrected an earlier retention assumption: the official November 2020 FAQ permits winning battle-card retention even without a keep footer, while explicitly naming Tooth/Artillery exceptions. Portable therefore uses ordinary winner retention. Mirror's ordinary retention follows the same source; inheritance of a copied Tooth/Artillery discard exception remains a separately pending user ruling. PORTABLE_SNOOPER_ENGINE_AUDIT.md and MIRROR_WEAPON_ENGINE_AUDIT.md record provenance and boundaries. Mirror itself remains inactive.
• 1,352/1,352 rules/client/component tests and 110/110 persisted/API tests pass, plus TypeScript, lint and production build. This adds five pure, five root engine, seven independent review and six all-profile AI cases, plus three persisted recovery cases. The recovery race forces both first-commit orderings between late defense and own traitor declaration. Logs: /tmp/dune-portable-final-full.log (35.29 seconds), /tmp/dune-portable-final-multiplayer.log (17.89 seconds), /tmp/dune-portable-final-type.log, /tmp/dune-portable-final-lint.log, /tmp/dune-portable-final-build.log.
• Browser QA verified the ordinary defense selector, sealed an empty original defense, played Portable against revealed Chaumas, and inspected the separate public late card. A fresh invitation preserved the exact pending v46 state and event before resolution. Feyd-Rautha survived, Harkonnen won 8–6, and the normal keep/discard choice retained Portable. Final v51 has three forces at Pasty Mesa, eight spice, Maula Pistol plus exactly one Portable, no Portable in discard, no battle or decision, and a living Feyd-Rautha used in that territory. The enlarged guide was visually inspected. Snapshots: /tmp/dune-portable-browser-pending-v46.json and /tmp/dune-portable-browser-complete-v51.json. All other 1,174 saved room hashes still match the last maintenance backup. This is a focused battle/reconnect check, not complete expansion-game acceptance.
• Final integrated review fixed a late-defense AI omission for Cheap Hero accompanied by the Kwisatz Haderach. All four profiles now preserve the +2 when protection changes defeat into victory; an ordinary zero-strength hero still does not consume the card. The real Advanced Atreides regression follows actual power preparation, legal spice support and both traitor decisions. Portable’s enlarged inspector now opens its specific timing/interaction guide, and its summary explicitly offers both normal and late use. The final 18 guide/reference tests also pass.
• Five original Richese portraits bring ordinary coverage to 50/60, completing both factions in each of the first two expansions as well as the six base factions. All forty-five prior files and manifest entries are unchanged. Full-resolution inspection, four existing asset tests and actual 192px inspector / 80px circular browser review pass. The exact temporary review server was stopped. See RICHESE_PORTRAITS.md. Ten Ecaz/Moritani ordinary portraits and separate special-disc artwork remain unfinished.
• Four Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon and Juice of Sapho. Complete faction/module interactions, mobile acceptance and full Advanced/expansion games remain unfinished. No start gate was removed. The live development server remains the verified session started during the preceding maintenance; the removed automation stays removed and the full goal stays active.

Residual Poison runtime and CHOAM portrait checkpoint (2026-09-06)

• Canonical Residual Poison now has engine, private controls and all four AI policies. Before either combatant commits a leader, it uniformly selects one living, currently controlled opposing leader available in the battle territory, sends that physical disc to the Tanks and discards once. Same-territory reuse remains eligible; dead or elsewhere-used leaders, Cheap Heroes and the Kwisatz Haderach are excluded. There is no payment, bounty, force loss or automatic battle victory.
• A hand-independent shared preparation step gives both combatants an actual opportunity before leader commitment in Richese tables. Both choose readiness; no nonholder is silently passed. This is a disclosed application timing procedure, not a claimed publisher ordering rule. Active interactions retain priority. Exact saved battle events bind both actions and retries. No additional confirmation is added to the random death.
• Foreign ghola revival custody and Duke Vidal's physical disc/death history are preserved. Involuntary death reconciles impossible battle promises and reopens an impossible non-leader Prescience answer without redrawing the victim. All candidate death transitions and prospective hand commitments are validated before randomness. The still-secret Harkonnen captive disclosure ruling remains unresolved: Advanced Harkonnen tables guard the card based on their public configuration, never based on hidden captivity. See RICHESE_RESIDUAL_POISON_ENGINE_AUDIT.md.
• The full registered suites pass 1,329/1,329 rules/client/component tests and 107/107 persisted/API tests, with TypeScript, lint and production build passing. New focused coverage comprises seven pure, six root engine, seven independent review and four AI cases, plus three SQLite/CAS recovery cases. Logs: /tmp/dune-residual-final-full.log (34.00 seconds), /tmp/dune-residual-final-multiplayer.log (16.26 seconds), /tmp/dune-residual-final-type.log, /tmp/dune-residual-final-lint.log, /tmp/dune-residual-final-build.log. Existing No-Field tests now perform the genuine readiness actions; independent-battle privacy comparisons normalize only the new random public event IDs.
• The manual maintenance restart preserved all 1,175 saved room versions and exact state hashes, including a real browser-created open preparation step in synthetic QA room QPNV5XJJ v29. Backup: /tmp/dune-maintenance-20260906T1117/database.sqlite. The known human room remained idle and unchanged. A fresh invitation restored the exact event and opponent readiness. Browser play then killed Flinto Kinnis once, left spice and forces unchanged, removed the card from hand and placed exactly one in discard. Ready resumed normal planning; the AI sealed a valid plan. Refresh retained v34, the same event, one death and one discard. All other 1,174 saved room hashes remained unchanged. No automation was recreated. Snapshots: /tmp/dune-residual-browser-complete-v31.json and /tmp/dune-residual-browser-planning-v34.json.
• Five original CHOAM portraits bring ordinary coverage to 45/60, completing the six base factions plus Ixians, Tleilaxu and CHOAM. All forty earlier files and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and actual 192px inspector / 80px circular browser review pass. The temporary contact-sheet server was stopped. See CHOAM_PORTRAITS.md. Fifteen ordinary portraits and separate special-disc artwork remain unfinished.
• Five Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon, Portable Snooper and Juice of Sapho. Other incomplete faction/module systems and unresolved interactions remain tracked. No full Advanced or expansion game was certified and no start gate was removed. The full goal remains active.

Ornithopter runtime and Tleilaxu portrait checkpoint (2026-09-06)

• Canonical Ornithopter now supports both printed movement choices in the engine, player controls and all four AI profiles: one group moves up to three territories, or two different groups move with normal movement range. The played physical card leaves the hand for public played-card custody until the effect finishes, then enters discard exactly once. It grants no additional reserve shipment.
• Two-group movement records the original remaining ordinary and elite forces separately. Later arrivals from the first move cannot replenish those quotas, and the second group must also fit current physical custody. Exact No-Field token/event identity is tracked; an eligible marker revealed during the effect contributes its actual revealed forces to the remaining group, without permitting a moved marker or moved forces to be reused. Event and custody checks survive saved reactions, stale submissions and recovery.
• The movement controls expose both modes, active progress and remaining eligible groups; a source containing only already-moved forces is disabled. All four AI policies use the authorized movement projection and handle the continuation. Prior movement/Hajr composition and the fixed-three-territory interaction with Kulon remain explicit interpretation guards. Six other Richese card effects and broader combined interactions remain unfinished; no Advanced or expansion start gate was removed.
• Focused coverage adds 28 pure/engine/review/AI cases (eight pure, eight root engine, six independent review and six AI), plus four persisted/CAS cases. The full registered suite passes 1,305/1,305 rules/client/component tests and 104/104 persisted/API tests, in /tmp/dune-ornithopter-final-full.log (36.51 seconds) and /tmp/dune-ornithopter-final-multiplayer.log (17.40 seconds). Final UI TypeScript, lint and production build all exited successfully; the initial lint findings were fixed before the successful rerun. Logs: /tmp/dune-ornithopter-ui-final-type.log, /tmp/dune-ornithopter-ui-final-lint.log, /tmp/dune-ornithopter-final-build.log.
• Real browser QA in the synthetic room moved two forces from Red Chasm sector 7 to Pasty Mesa sector 5 (v23→24). Reusing that moved group was disabled. A fresh invitation restored the exact v24 state and three-force remaining quota. The second browser move advanced to v25: five total forces in pasty_mesa:5, two completed moves, eight spice, fifteen reserves, only Maula Pistol retained, exactly one Ornithopter in discard and no pending played card. Snapshot: /tmp/dune-ornithopter-browser-complete-v25.json. All other 1,114 room hashes remained unchanged against the controlled-maintenance backup. This is focused movement/recovery evidence, not a complete expansion-game claim.
• Five original Tleilaxu portraits bring coverage to 40/60 ordinary leaders, completing all six base factions plus Ixians and Tleilaxu. All thirty-five prior assets and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and coordinating-agent browser inspection at actual 192px square and 80px circular sizes pass. The temporary review server was stopped after inspection. See TLEILAXU_PORTRAITS.md for exact names, prompts, local paths and hashes. Twenty ordinary portraits and separate special-disc artwork remain unfinished.

Nullentropy Box runtime and Ixian portrait checkpoint (2026-09-06)

• Canonical Nullentropy Box now charges two uncommitted own spice to the bank before granting a private discard search. The paid search is persisted, owner-only and bound to an exact event, player, turn, phase and discard signature. Selecting a non-Box card transfers that physical card, commits one shuffled remainder order and places the used Box on top. No Emperor income, purchase bonus, recipient acknowledgement or Karama cancellation window is introduced.
• The private search layout now uses available container width, keeping candidate cards readable in the narrow decision sidebar. Final reference/presentation/art checks pass all 22 cases, including two new reference cases. Final reference/layout type checking and targeted lint pass.
• The Box remains reserved in hand while the real discard pile is locked. Existing response, decision, pending Karama and phase opening are saved and restored exactly. Early Truthtrance, CHOAM, gift and Distrans mutations, discard recycling and automatic continuation cannot alter the search. Seat recovery and voluntary autopilot takeback remain available. One eligible card completes automatically after payment; multiple eligible cards require the genuine private choice. A refresh or duplicate request neither pays again nor rerolls a committed result.
• Full-hand activation, empty/only-Box searches and the existing provisional Guild shipping-Karama refund conflict remain explicit guards. Active Truthtrance keeps answer-first priority; payment cannot break a binding battle promise. Semuta's future discard reaction, remaining Richese card effects, broader timing disputes and full combined-game acceptance remain unfinished. No Advanced or expansion start gate was removed.
• Owner controls and all four AI profiles use the authorized paid-search projection. Before payment, the projection contains no discard faces; after settlement the search entitlement expires. The current original portrait registry also reaches 35/60 ordinary leaders, adding the complete five-leader Ixian roster. Twenty-five ordinary expansion portraits and separate special-disc artwork remain. The Ixian sources were visually inspected and four existing asset tests pass; actual 192px inspector and 80px circular browser inspection now passes in the root-reviewed contact sheet. See IXIAN_PORTRAITS.md.
• Focused Box verification passes 17 new rules/AI cases (six root engine, six independent review, five AI) and four persisted recovery cases. The seven pure Box cases were already registered at the previous checkpoint. Review coverage includes paid privacy, exact parent restoration, real Truthtrance fee constraints, gift reservations, central locks, corruption before RNG, automatic singleton completion and duplicate begin/selection CAS. TypeScript and targeted lint pass for the independent review checkpoint.
• Combined test verification passes: 1,275/1,275 registered rules/client/component tests and 100/100 persisted/API tests. Logs: /tmp/dune-box-final-full.log (31.97 seconds) and /tmp/dune-box-final-multiplayer.log. Current aggregate TypeScript, lint and production build pass. After adding two reference cases and extending the existing portrait roster assertion, all 22 targeted reference/presentation/art tests pass (/tmp/dune-box-final-reference-art.log). Root browser review passed the five Ixian portraits at actual 192px and 80px sizes. A real paid Box search survived a controlled server restart with all 1,115 room state hashes unchanged; browser selection of Maula Pistol then advanced v21→22 with the same eight spice, one Box on top of discard and the exact earlier Richese gift restored. The other 1,114 rooms remained unchanged after that deliberate QA action. No automation was recreated. The current development server restarted successfully at approximately10:12UTC; the next manual maintenance check is due around11:12UTC if active development continues and human play permits.

Distrans engine, controls and recovery checkpoint (2026-09-06)

• Activated canonical Distrans for any faction holder: select another player and a different card from the owner hand, transfer it intact, then discard Distrans once. No fee, purchase bonus, recipient acknowledgement or new Karama response is added. Donor/recipient cards stay private, and the public history identifies only the played Distrans and transfer participants.
• Shared transfer validation checks both outgoing cards against exact gift, plan, prescience, retention, Black Market and accepted Ix replacement commitments, including saved parent responses. Prospective completion preserves binding Truthtrance answers, compulsory Ambassador discards, the Harkonnen returner's required card count and the target's reserved incoming slots. It improves those same saved-context protections for existing Richese gifts.
• The synchronous action preserves a pending response, decision or phase-opening window. Tests show a recipient can free space for a pending gift, or another legal Distrans transfer can fill that space and make gift settlement abort cleanly. Active Truthtrance has priority. Unpaid open lots and self-transfer remain named guards pending the existing questions; a completed purchase income/bonus response is distinct from an unresolved bid. Semuta reactions and the remaining eight Richese effects remain unfinished.
• The hand panel has recipient/card selectors, both inspectors, unavailable reasons and an explicit give-and-discard action. All four AI profiles use entitled choices to give Worthless cards to suitable allies or share duplicate ordinary weapons/defenses/Karamas from a full hand. They do not inspect other hands and respect existing decision priority. Full expansion starts remain gated.
• Integrated verification passes 1,247/1,247 registered rules/client tests and 96/96 persisted/API tests, TypeScript, lint and production build. Distrans coverage comprises six pure custody, six root engine, six independent review, five AI and three persisted cases. The root matrix spans all twelve donor factions, nine phases and both modes. Logs: /tmp/dune-distrans-full.log, /tmp/dune-distrans-multiplayer.log, /tmp/dune-distrans-type.log, /tmp/dune-distrans-lint.log, /tmp/dune-distrans-build.log; card/reference checks pass22/22 in /tmp/dune-distrans-reference.log.
• Real browser QA used only the synthetic roomQPNV5XJJ: a staged Harkonnen hand held Distrans and Shield while its incoming Richese gift awaited an observer's Karama response (v18). Clicking the explicit transfer button gave Shield to Richese, discarded Distrans once and preserved the exact pending gift event (v19). A fresh invitation tab restored the empty donor hand and same pending gift, without replay. Root visually inspected the selectors and result. Fixtures: /tmp/dune-distrans-browser-before-v17.json, /tmp/dune-distrans-stage.ts, /tmp/dune-distrans-browser-complete-v19.json. No human table changed.
• Four original Bene Gesserit portraits complete all six base-faction portrait rosters, bringing ordinary leader coverage to30/60. Root inspected all four final full-resolution images; the agent also checked192px inspector and80px circular presentation. Exact names, prompts, corrections and hashes are in docs/BENE_GESSERIT_PORTRAITS.md. All prior26 manifest records and Irulan remain unchanged. The existing four asset tests are now registered in npm test, and their roster assertion covers all six base factions.
• Nullentropy Box now has a source/insertion-risk audit (docs/NULLENTROPY_BOX_ENGINE_AUDIT.md) and pure custody helper (game/nullentropy-box.ts) with seven passing registered cases. Payment, private search, event-bound selection, automatic one-choice completion, discard locking, parent restoration and AI/UI remain the next runtime work. The existing full-hand question remains pending; provisional Guild discard-refund custody also requires an explicit guard or resolution before search can compose with that case.
• Final combined verification:1,258/1,258 registered rules/client/component tests,96/96 persisted/API tests, TypeScript, lint and production build pass. Final combined logs are /tmp/dune-distrans-final-full.log, /tmp/dune-distrans-final-type.log, /tmp/dune-distrans-final-lint.log, /tmp/dune-distrans-final-build.log; the unchanged runtime's96-case multiplayer evidence remains /tmp/dune-distrans-multiplayer.log. No test files are left unregistered. Full expansion compliance remains unproven.
• No automation was recreated. Manual maintenance remains due around10:10UTC, subject to active human play. Nullentropy Box's private paid search and the remaining portrait inventory are the next independent slices; no broad compliance claim is made.

Richese gift integration checkpoint (2026-09-06)

• Integrated the Basic Richese alliance gift for exact canonical cards already held by the donor. A transfer creates no spice payment, auction income, bonus draw or replacement. The gift can suspend ordinary decisions, responses and phase opening; resolving it restores their exact ownership, passes and pending Karama. Active Truthtrance still has priority.
• The card stays reserved in the donor hand until its separate Karama opportunity resolves. Only donor and recipient see its pending identity. Declaration and settlement revalidate custody, mutual alliance, capacity and commitments, including auction slots, battle promises and accepted exchanges. Random Harkonnen extraction is rejected before RNG when it would disturb a reserved gift. A Harkonnen bonus rechecks actual capacity before drawing.
• Independent review found a stale-alliance defect that could overwrite the old recipient hand using the new ally hand. Settlement now validates the full original owner/recipient/card intent before assigning either hand. Engine and real SQLite CAS regressions confirm all hands remain unchanged on stale-alliance abort.
• A further real Harkonnen special-Karama regression verifies mandatory return capacity: gifts cannot fill slots needed by the return, but remain legal when the recipient still has room afterward. Both restored exchanges complete without lost or duplicated cards.
• Owner controls provide inspectable card selection and unavailable reasons; both allies can privately inspect pending gifts. All four AI profiles gift the functional canonical Karama to free a full bidding hand when public ally counts support it. Other nine Richese effects and broader gift strategy remain unfinished. Same-card retry after cancellation during the same phase explicitly awaits a ruling; no complete mode gate was removed.
• 1,230/1,230 registered rules/client and 93/93 persisted/API tests pass, along with TypeScript, lint and production build. Gift coverage comprises six pure custody, five root engine, eight independent review, four AI and three persisted cases. The root matrix exercises all ten identities in both rule modes across nine phases. Logs: /tmp/dune-gift-final-full.log, /tmp/dune-gift-final-multiplayer.log, /tmp/dune-gift-final-type.log, /tmp/dune-gift-final-lint.log, /tmp/dune-gift-final-build.log.
• Real browser controls in synthetic QA room QPNV5XJJ gave Karama to the ally automatically when no one could cancel (v13→14). The exact completed state is /tmp/dune-gift-browser-complete-v14.json. A second staged case retained an observer Karama, declared the gift through the UI (v15→16), and restored that exact pending response/card in a fresh invitation tab. /tmp/dune-gift-browser-pending-owner-v16.json preserves the original pending owner fixture. Only synthetic role IDs were then swapped (v17); the recipient browser showed the exact pending card, an empty private hand and no spurious acceptance button. Both donor and recipient presentation were visually checked with the existing authenticated QA seat. No human table was modified, and this is not real seat-switch coverage.
• The next Distrans slice has a source/insertion audit in docs/RICHESE_DISTRANS_ENGINE_AUDIT.md and an immutable pure helper in game/distrans.ts. Six registered pure tests pass across all twelve structural donor factions, ordinary and Richese targets, custody, capacity and replay. The card is not activated in engine/UI/AI. Open-bid timing and self-transfer were asked once and remain unanswered; next work is synchronous action integration after Truthtrance priority with both-card reservations and the new mandatory incoming-capacity guard.
• No automation was recreated. The server remains the one started at 09:10 UTC; next manual hourly restart is due around 10:10 UTC if development continues and human activity permits. This bounded checkpoint does not certify complete Richese or combined expansion games.

Allied No-Field shipment and recovery checkpoint (2026-09-06)

• Added a persisted Richese offer-or-pass opportunity before the ally’s normal shipment. This preserves a human supplier’s decision when the active ally uses AI, regardless of seating order. The supplier privately selects a different token, destination and payment; the recipient accepts and selects its physical ordinary/elite mix or declines without cost. Denomination, typed offer details and recipient finances remain private to their entitled viewers.
• Successful shipment first reveals an existing supplier marker, immediately materializes the allied token from the recipient’s available reserves, updates shared no-repeat history and uses the recipient’s shipment slot. Prices are one spice in a stronghold or two elsewhere. Either ally can pay the full cost, or both can explicitly pay one for a two-spice shipment. Guild income and Heighliner accrual use the appropriate recipient/payment identities.
• Exact consent and token events fence stale/replayed actions. Richese cancellation and Guild prevention preserve token/fund custody; stale post-response allocation aborts safely. Arrival preflight catches unsupported simultaneous reactions before consent becomes committed, leaving decline available. AI tries legal acceptance and retains decline as a fallback after authoritative rejection.
• Fremen’s ordinary reserves are on-planet, so they do not satisfy this off-planet-only shipment method. Guild-recipient/active-Karama price and routing conflicts have been asked explicitly and remain guarded. HMS/Homeworld and combined arrival work, mixed No-Field battle arithmetic, whole-plan prescience and other expansion systems remain unfinished. No incomplete mode gate was removed.
• Final verification: 1,207/1,207 registered rules/client tests, 90/90 persisted/API tests, TypeScript, lint and production build pass. The new allied tests comprise eleven engine, seven independent review, seven AI and three persisted cases. Six additional pure Richese-gift tests pass, but gift engine/control/AI integration is not yet implemented. Final logs: /tmp/dune-allied-final-full.log, /tmp/dune-allied-final-multiplayer.log, /tmp/dune-allied-final-type.log, /tmp/dune-allied-final-lint.log, /tmp/dune-allied-final-build.log.
• Browser roomQPNV5XJJ made a real private No-Field3 proposal (v10), then recovered that exact pending decision in a fresh invitation tab after the 09:10 UTC server restart. For recipient-control QA only, the two synthetic player-role IDs were swapped in a saved fixture (v11), preserving the authenticated QA seat; this was not a claim of switching real user seats. Clicking Accept then created three Harkonnen forces in Arrakeen, reduced its reserves20→17, charged Richese one spice, and used only the recipient’s shipment (v12). Root visually inspected the recipient terms and buttons. The original proposal fixture is saved in /tmp/dune-allied-browser-owner-v10.json.
• Controlled hourly maintenance backed up995 tables to /tmp/dune-maintenance-20260906T0910/. Every table’s exact state hash and version matched after stop, restart and browser reconnect, before subsequent deliberate QA actions. The known human table remained v14, idle203minutes at restart. Health returnedHTTP200. No recurring automation was recreated. Next manual maintenance is due around10:10UTC if active development continues and human play permits.

No-Field engine, controls and recovery checkpoint (2026-09-06)

• Integrated own concealed shipment at the one-force rate, selected allied funding, separate Karama/Guild responses, immutable token custody, stale-event fencing, marker-only and mixed physical movement, voluntary reveal, effective occupancy/control/collection, exposed storm and unprotected worm losses. Physical force arrays contain actual units only; the marker never fabricates a reserve or Tank token.
• Marker-only battles support all three secret values, scarce reserves, joint plan revelation, zero-token leader/card resolution and ordinary Atreides dial restrictions. Mixed ordinary/No-Field battle dialing and entire-plan special prescience remain guarded pending source resolution. Allied token shipment, protected-worm/Truthtrance/other optional combinations remain unfinished; Richese and other incomplete mode gates remain intact.
• Trip to Gamont reveals a marker in the selected sector, including when ordinary forces share it, then returns one actual force if present. A zero-result play still uses the card. Karama cancellation preserves concealment; a changed restored marker event aborts the pending effect without consuming the card.
• Owner controls show private inventory, payment, last-use restrictions, marker movement and reveal. Opponent board markup is identical across secret values. All four AI profiles use their entitled views for own shipments, marker moves/reveals and marker-only Basic/Advanced battle fixtures.
• 1,176/1,176 registered rules/client tests and 87/87 persisted/API tests pass. TypeScript, lint and production build pass. Logs: /tmp/dune-no-field-full.log, /tmp/dune-no-field-multiplayer.log, /tmp/dune-no-field-final-type.log, /tmp/dune-no-field-final-lint.log, /tmp/dune-no-field-build.log. New tests include eight presence, ten engine, eight independent review, nine AI and four persisted recovery scenarios. Full game acceptance for Richese remains outstanding.
• Browser QA room QPNV5XJJ advanced through real token-5 shipment (one spice, reserves unchanged), marker-only Arrakeen→Imperial Basin sector10 movement, invitation reopening in a fresh tab, and voluntary reveal exactly once. Final v8 has nine spice, fifteen reserves, five actual forces in Imperial Basin and token5 faceup as last used. Root visually inspected the board and private inventory. Initial QA fixture staging was backed up to /tmp/dune-no-field-browser-before.json; no human table was modified. Battle/Gamont/mobile browser acceptance remains outstanding.
• No recurring automation was recreated. The development server from the 08:10 UTC controlled restart is still running; the next hourly maintenance is due around09:10 UTC if human activity permits. This checkpoint advances the active goal and does not certify full rules compliance.

Richese acquisition, No-Field model and Guild art checkpoint (2026-09-06, 08:19 UTC)

• Richese special Karama now validates and buys one secretly selected canonical cache card for three uncommitted own spice, discards the activating Karama and consumes its once-per-game Advanced power atomically. Full-hand timing and consuming the final cache card remain explicit unresolved guards; the user was asked about full-hand timing. Offered auction cards remain reserved.
• Emperor receives the purchase payment through a separate cancellable income response. Cancellation never reverses the uncancelable special purchase. The persisted continuation preserves the original response, decision and pending Bene Gesserit conversion, then restores them once. Direct cache purchase creates no Harkonnen bonus or Ixian allied replacement.
• Private hand controls provide both selectors, card inspectors, price, payment recipient and authoritative availability explanations. All four AI profiles can conservatively buy the currently usable canonical Karama; nine other Richese card effects remain unfinished. A browser-discovered generic Karama purchase button outside an ordinary auction is now disabled with a visible reason.
• No-Field has an isolated immutable three-token model, single concealed deployment, shared own/allied consecutive-shipment history, capped materialization and private projection. Independent review fixed sparse inventory validation. Root review fixed Polar Sink’s sector-zero address. Thirteen focused model tests pass; shipment, board, battle, casualty, victory, AI and multiplayer adapters are still outstanding.
• Four original Guild portraits complete its five ordinary leaders. Original art now covers26/60 identities. Root visually reviewed the complete Guild row and all four new enlarged portraits in the browser.
• Final verification: 1,141/1,141 rules/client tests, 83/83 persisted/API tests, TypeScript, lint and production build pass. Logs: /tmp/dune-acquisition-final-full.log, /tmp/dune-acquisition-multiplayer.log, /tmp/dune-acquisition-final-type.log, /tmp/dune-acquisition-final-lint.log, /tmp/dune-acquisition-final-build.log. Focused acquisition tests include eight engine, nine independent review and four all-profile AI scenarios; two new persisted race/restart scenarios extend the Richese recovery suite to nine.
• Browser roomQPNV5XJJ purchased a cache Karama via real controls, restored its private seat and pending Emperor income through the invitation in a fresh tab after the controlled restart, and paid income exactly once. Finalv4 has Richese7 spice, Emperor13 spice, one acquired Karama, nine cache cards and a consumed special power. The final ordinary purchase button guard and both internal reference topics/links were checked in the browser.
• Hourly maintenance saved905 rooms under /tmp/dune-maintenance-20260906T0809/. All original states matched after stopping; after restart and verification only the deliberately advanced QA room changed. The known potentially human table remained v14, idle142minutes at restart. Local server was restored; no recurring automation was created. Gifts, Distrans, Box, No-Field integration, other faction/modules, full Advanced/expansion games and mobile/component audits remain unfinished. No mode gate was removed and the overall goal remains active.

Richese bidding and component checkpoint (2026-09-06)

• Added all ten separate Richese cache identities and the missing five CHOAM/five Richese ordinary leaders. There are now60 ordinary leaders and22 original portrait matches; Auditor remains a separate unfinished advanced component. Ten Richese guides have printed categories and enlarged inspectors; ordinary card-effect integration remains incomplete, with Karama inheriting the existing generic handler in development fixtures.
• The engine wraps ordinary bidding with a first/last cache auction and optional advanced Black Market prelude. Cache supports Once Around/Silent; Black Market supports all three methods for other buyers. Exact card custody, selected own/allied payment, private sealed submissions, storm-order ties, zero outcomes, seller income, Atreides inspection, Harkonnen bonus and source-specific Ixian ally replacement are integrated. No fake normal auction object is used for a special sale.
• Independent review fixed concealed physical-ID leakage, a reserved Truthtrance queue deadlock, and malformed funding-error probes of private allied bids. Full-hand participants automatically pass or submit zero; a full-hand owner automatically removes an unbid cache card. Losing bids release reservations, and a normal pool is not drawn and lost when all hands fill. Automatic room recovery uses the existing CAS fence; legitimate waiting states produce no writes.
• Controls and all four AI profiles handle the supported auction paths. AI currently declines an optional Black Market offer, while responding legally to its three offered methods. Browser acceptance covers cache declaration, Once Around purchase, Silent private bid restoration and all ten enlarged card guides; it found and fixed rule-link expansion and unsupported hand-action presentation defects.
• Explicit unresolved guards remain for cache-auction cancellation count, exhausted-cache arithmetic, positive Black Market seller bids and Advanced Ixian Technology on special lots. No-fields, the special cache purchase/gift, nine card effects and other full faction/module interactions remain unfinished. These guards are implementation limitations, not assertions that the official rules prohibit the interactions. Live Advanced/expansion starts remain disabled.
• Final verification:1106 rules/client tests,81 persisted/API tests, TypeScript, lint and production build pass. The120-game Basic regression study completed with unchanged per-game outcomes and no stalls; it does not certify an expansion mode. See RICHESE_AUCTION_RULES.md, RICHESE_COMPONENTS.md, CHOAM_RICHESE_LEADERS.md, AI_CALIBRATION.md and VISUAL_PLAYTEST.md for scoped evidence.
• The07:06UTC controlled restart preserved all843 then-existing room states and versions. No recurring automation was recreated.

Shipment funding controls and Atreides artwork (2026-09-06)

• Ordinary reserve shipment now displays its selected price, normal price when discounted, available own/pledged funds and selected payment split. Invalid force/elite counts, invalid explicit shares and insufficient selected funding disable the submit button with accessible reasons. An obsolete explicit share is ignored when the player has no ally, so a hidden old field cannot block a later shipment. The server remains responsible for geometry and all final action validation.
• The pure presentation component consumes only caller-provided values. The parent uses the same ordinary reserve price helper as server/AI and the same default-own-first contribution calculation as the engine. Independent review found no new pricing or privacy defect. This does not implement Guild rate cancellation.
• Four additional original portraits complete the five Atreides native leaders: Lady Jessica, Gurney Halleck, Duncan Idaho and Dr. Yueh join Thufir. Ten of the 50 currently cataloged ordinary leaders now have artwork. Each new asset is inspected, 1254px square, with its exact prompt preserved and exact identity mapping. All required twelve-faction art/component work remains incomplete.
• Desktop QA restored S85SLVRR, used an isolated version40 fixture with two Guild spice, showed three forces costing two and five costing three, and disabled the unaffordable action. Submitting three forces reached version41 with exactly two spice paid and three placed. EN4L8NTV retained version83 while its complete Atreides roster and expanded Lady Jessica were inspected. TypeScript, lint and production build pass. No engine/bot behavior changed in this slice; the prior 951-rule/45-persisted test checkpoint remains the latest full regression run.
• GUILD_RATE_KARAMA_RULES.md now records publisher support for separately canceling discounts, transport permission and income, with the later November FAQ overriding the older April transport answer. The user was asked how to handle a declaration made unaffordable by cancellation. That answer remains pending, so the new cancellation engine is not activated.

Portraits, shipment proposals and Extortion accounting checkpoint (2026-09-06)

• Six original leader portraits now appear in authorized roster and expanded identity views: Thufir Hawat, Feyd-Rautha, Hasimir Fenring, Stilgar, Staban Tuek and Princess Irulan. Exact ID/name matching prevents inferred identities; unknown identities and failed assets retain existing vector components. Names and current strengths remain interface text. Six of the 50 currently cataloged ordinary leaders have portraits; this is not the complete twelve-faction component inventory.
• Ordinary reserve shipment pricing is shared between authoritative payment and AI budget filtering. Bots preserve existing destination, amount and candidate order, removing only unaffordable proposals using their own balance plus projected pledged aid. Seven tests cover all difficulties, Guild rounding/alliance, Karama beneficiary, free Fremen, aid and hidden balances. Existing Guild transport and movement candidate filtering are unchanged.
• A paired 120-game Basic run at seed20260907 completed without deadlocks or checked invariant failures before and after filtering. Every recorded per-game field other than elapsed time and rejected-candidate diagnostics matched, including assignments, winners, finishing turn and accepted-action count. Rejections fell26,146→9,081 (65.27%); 16,735 insufficient-spice proposals and330 proposals rejected earlier for occupancy disappeared. All other rejection-reason counts match. See AI_CALIBRATION.md; the four-level strength ranking remains unproven.
• Extortion now has an isolated, immutable accounting helper and nine tests for the reserved five spice, Mentat collection, storm-order three-spice payment, affordability and recovery outcome. It has no engine, UI or AI activation. The official rules do not resolve collection/recovery versus the same Mentat's Terror placement order; the user's interpretation is pending. Do not count this helper as a working Extortion effect.
• Independent review confirmed a preexisting missing Guild rule: ordinary Guild or ally half-rate shipment can be canceled once with Karama under November2020 FAQ p7. Current pricing preserves existing rates and does not implement that cancellation window. This remains on the full-rules completion backlog.
• Validation:951 rules/client tests and45 persisted multiplayer tests pass; TypeScript, lint and production build pass. The hourly manual restart at04:52UTC restored exact hashes and versions of all four selected QA saves; HTTP health and the Atreides saved browser seat recovered. The removed automation remains removed.

Moritani allied card retention checkpoint (2026-09-06)

• A defeated Moritani ally may choose one eligible card from its revealed Battle Plan when the battle has a winner, or decline. The same mandatory-discard predicate serves winner cleanup and ally eligibility, including hero, Tooth, Artillery and traitor-preempted effects. Moritani itself and mutual-loss outcomes do not gain this benefit.
• The engine reserves the exact played cards as soon as combat settles. Winner casualty/card cleanup continues first, then ally retention, then the existing CHOAM income, technology, capture and Face Dancer continuation. Selecting a card declares the ordinary faction-power use with Moritani as Karama owner; cancellation discards all played cards, otherwise only the chosen card remains. No combat outcome, payment or RNG step is repeated.
• Controls use single-choice radios, full existing card rules and inspectors, an explicit decline and a visible declared-card inspector during the response. Reserved Bene Gesserit cards cannot be converted to Karama; reserved CHOAM cards cannot be cashed in. Public projection exposes only the previously revealed played cards and declaration, not the rest of the hand. All four AI profiles handle the choice and response.
• Twenty-three focused engine/AI tests cover actual combat, exact custody, no-eligible-card paths, owner/target rejection, JSON recovery, cancellation and nested Worthless conversion, hidden hand boundaries and continuation into income/capture/Face Dance. Full validation reached 935 passing rules tests and 45 passing persisted multiplayer tests; TypeScript, lint and production build pass. The targeted 18-case engine file was also rerun after replacing a redundant predicate test with an actual no-retainable-card battle.
• Browser QA S85SLVRR versions37–39 inspected Crysknife, selected it, refreshed during the response, allowed the ability and continued to Spice Collection with Crysknife/Baliset retained and exactly Snooper discarded. This is an isolated scenario, not a complete expansion game.
• This ordinary alliance ability is integrated, but full Moritani remains gated. The November 2020 official FAQ explicitly allows cancellation of alliance abilities; the exact serialized postbattle ordering remains a documented composition without a dedicated publisher ruling. See MORITANI_ALLY_RETENTION_RULES.md. Terror Atomics/Aftermath, Extortion, advanced assassination and other expansion interactions remain unfinished.

Native leader revival consistency checkpoint (2026-09-06)

• The server now projects owner-specific native leader eligibility, normal/discounted prices, early-revival status and affordability through one pure helper used by action validation. Reading a table does not advance revival cycles. Kwisatz revival uses the same projection boundary.
• The Revival selector uses those options and rejects empty, stale or unaffordable selections in the interface. A spent leader slot is explained. All four bot profiles continue an opened ordinary revival cycle even while an earlier returned leader is alive; unavailable leaders and unaffordable revivals no longer enter their ordinary action candidates. Bots avoid unnecessary new early-service requests when ordinary revival is available while preserving existing quotes and foreign-ghola buybacks.
• Sixteen added tests cover actual server actions, capture/ghola boundaries, face-down repeat deaths, phase/slot/prevention, discounts, JSON restoration, owner projections and all four AI profiles. Full validation: 912 unit tests and 45 persisted multiplayer tests pass. This does not certify complete expansion rules.
• Browser QA in isolated room S85SLVRR showed four remaining eligible Atreides leaders after an earlier return, a disabled empty selection, Lady Jessica revived for five spice, and the consumed slot surviving refresh. See VISUAL_PLAYTEST.md.
• Ecaz's special five-dead threshold and shared Duke revival remain unfinished. ECAZ_REVIVAL_RULES.md records the verified price/threshold, unresolved post-revival custody and repeated six-disc cohort handling. Shared Duke has not been appended to native rosters or silently made revivable by this change. MORITANI_ALLY_RETENTION_RULES.md records the next battle-cleanup implementation contract; that ability is not implemented yet.

Latest card and recovery checkpoint (2026-09-06)

• Shared pure availability rules now drive Weather Control, Family Atomics, Hajr and Harvester server checks and hand controls. Invalid timing shows an explanation linked to the disabled action; inspection remains available. Eight focused tests cover timing, ownership, pending-decision precedence, card disposal, advisor-only forces, repeated Harvesters, input immutability and hidden-information independence.
• Public spice-pile top cards and the authorized private Atreides preview have separate read-only inspectors. The component receives only its projected card, displays base amount/sector or worm/Sandtrout identity, and separates original guidance from card values. Desktop Cielago North and mobile Rock Outcroppings inspection passed; mobile Close restored focus. Gated advanced double-pile and private-preview browser journeys remain outstanding.
• Current validation: 797 unit tests, 34 persisted multiplayer tests, TypeScript, lint and production build passed. Tests do not certify full Advanced or expansion modes.
• Controlled local restart at approximately 01:49 UTC preserved EN4L8NTV version76 and ZUUFRHF6 version8 byte-for-byte state hashes; both browser seats restored their pending decisions. Consistent backup: /tmp/dune-maintenance-20260906T0148/database.sqlite. No maintenance automation was recreated.
• Primary component evidence now verifies the three Ecaz treachery faces and quantities; see ECAZ_TREACHERY_RULES.md. Battle timing and late-Recruits accounting questions remain explicit; this source evidence does not enable an expansion.

Revival correctness and Ecaz component checkpoint

• Fremen normal revival shares one server/view/UI/AI allowance calculation. Correction: official November2020FAQp5 permits paid Fremen revivals when Tleilaxu is seated, subject to the current three-force or granted five-force limit. Without Tleilaxu, the free-only restriction remains; an Ix module flag alone does not grant the exception. La La La blocks free returns but leaves legal paid returns with Tleilaxu. Nine focused tests cover the correction, payment settlement, cancellation, JSON recovery and all AI profiles. FREMEN_REVIVAL_AUDIT.md explicitly retracts the earlier contrary interpretation.
• Player.freeForcesRevived records actual settled free normal returns, separately from total normal revival. Pending/canceled requests and special/leader returns do not consume it. Missing legacy usage remains unknown after prior revivals and resets at the next Revival phase. Five focused settlement, conservation, private-view and JSON/lifecycle tests pass; existing prices do not change.
• game/recruits.ts supplies isolated turn-scoped arithmetic from explicitly resolved current rates, limits and usage. Eleven tests cover ordinary caps, unlimited physical rosters, typed pricing and prevention. The helper is not yet called by the engine: late-paid accounting and pending-transaction policy await the user clarification recorded in RECRUITS_RULES.md.
• game/ecaz-cards.ts supplies exactly one each of the three verified cards, immutable source/coverage metadata and original gameplay paragraphs. Canonical authorized cards receive full expanded text in the existing inspector; metadata remains developer-only. Eight tests cover the 50-card manual inventory composition, no implicit activation, exact identities and existing presentation regression. The live deck factory still rejects the unfinished variant.
• Live turn-four playtesting caught a storm draft shared with battle dials. Separate storm state now renders and submits the legal first/later-turn range; the later-turn browser submission revealed3+3. The test game continues and is not a completed visual acceptance run.
• Final runtime checkpoint:797 unit tests,34 persisted multiplayer tests,TypeScript,lint and production build passed. A subsequent text-only reference correction received its focused reference check. Full Advanced and all expansion starts remain gated.

Voluntary seat control checkpoint

• A human can opt their own setup/playing seat into Easy, Medium, Hard or Brutal AI, then take back control. autopilot remains distinct from a permanent bot, preserving credentials and recovery. Control changes preserve pending/sealed game state; the server rejects ordinary human actions while delegated and rejects foreign targets. Public control labels and responsive explicit controls are integrated.
• AI uses the same private projection for both kinds of seat. Server background batches re-read saved control and CAS-fence every update; competing takeover and continuation tests pass. Existing botsPending recovery is retained. Durable unattended scheduling after server interruption remains missing; see AUTOPILOT.md for the full boundary and traceable ledger.
• Seven engine/control tests, five SQLite continuation tests and six HTTP recovery/completion tests were added. Current complete suites:797 unit and45 persisted/API tests pass, along with TypeScript,lint and production build.
• Browser room2SG3ZS3E verified opt-in, refresh, same-seat takeback, mobile Hard control and a completed Basic game (Harkonnen,turn7). A separate three-human HTTP game completed through server continuation after all opted intoAI, with no later gameplay POSTs. These do not establish relative difficulty strength or complete expansion support.
• New primary Moritani audit records all six Terror effects, hidden token lifecycle, official FAQ/Karama anchors and legible printed leader values. MORITANI_TERROR_RULES.md distinguishes implementation-ready rules from remaining reaction-order and exceptional-custody questions. Faction starts remain gated.

Verified Ecaz/Moritani ordinary leader inventory

The publisher-authored page3 illustration was independently inspected by two agents. All five Moritani and all five Ecaz native names/strengths now have stable component instances in game/cards.ts, with seven roster/traitor/regression tests. Duke Prad Vidal6 stays separate and has no traitor; his special custody lifecycle remains unimplemented. The total available ordinary leader definitions is50; CHOAM and Richese remain missing. Faction starts stay gated. After these additions the full797-unit suite, TypeScript, lint and production build passed; the45-test persisted/API suite passed after the seat-control integration.

Required remaining work

1. Complete base rules: leader/captured-leader edge cases, auction deadlines, temporary allied-territory entry, remaining Karama powers, Truthtrance and explicit timing windows. Audit interactions among card play and committed battle elements, plus supported cancellation windows.
2. Printed-board audit: geometry adapted from MIT Truthsayer, approximate generated connectivity must be compared to printed GF9 map; verify terrain categories, spice sectors, starting positions. SVG sectors now oriented 1=SW, 2=S, increasing counterclockwise.
3. Advanced game: finish BG advisor timing/forced-flip cancellation audit, Worthless auction edge-case verification, remaining cancellation timing and expansion special Karamas; summoned-worm/card sequencing, Atreides full-plan timing and Guild canceled-shipment settlement clarification. KH, captured leaders and increased stronghold spice income now have engine/UI support, with repeated-revival and expansion-interaction audits remaining. Double spice blow, Fremen storm forecasts/half losses/additional worms and out-of-order Guild movement now have engine/UI support; full advanced-game integration and scenario audits remain. Elite accounting, spice combat and deferred casualty choices now have engine/UI foundations and focused tests; complete-game advanced support is still blocked.
4. All six expansion faction engines, cards and remaining optional modules: skills, stronghold cards, homeworlds, Nexus cards, discoveries. Tech-token support exists for 3+ players; two-player allocation and unfinished-faction/module interactions remain.
5. More complete phase scenarios, property/conservation tests, six-seat integration, security request checks, runtime build and UI validation where authorized.
6. AAA presentation refinement: readable tactical overlays, cards and leader portraits, reveal/event animations, responsive/control polish. Original art is integrated; Browser playtests and screenshots are explicitly authorized. Initial lobby, setup and storm checks have been performed; the remaining critical journeys and responsive layouts still need visual validation.
7. Register WebMCP read tool implemented; supported-context validation remains unperformed. Add task-completing mutation tools after game journeys stabilize.
8. AI players: legal action selection through private projections, host-controlled bot seats, distinct Easy/Medium/Hard/Brutal policies, and automated turn progression. Basic-game implementation now exists and passes complete-game simulation and multiplayer tests. Relative playing strength needs calibration; advanced/expansion policies remain.
9. Complete the rules reference: current searchable /rules has action guides, phase topics, card coverage, faction/module placeholders, examples and related links. Tooltip infrastructure and inline phase guidance exist. Base faction rules and six advanced faction rule topics are written; full advanced/expansion content and interaction examples still need completion alongside implementation.
10. Publish complete validated site with Sites hosting, not this incomplete slice. Registered project exists; never create again.

Moritani setup and hidden placement checkpoint

Implemented the isolated setup/placement slice, with expansion starts still gated. Moritani deploys six forces last into an unoccupied printed territory, retaining fourteen reserves and twelve spice. Advisors count as occupation. Six shuffled, opaque physical Terror IDs keep private faces separate from public placement. Mentat opens one optional placement or relocation before the existing victory check; decline and Karama cancellation consume the opportunity for that turn. The pending private intent survives JSON reload, commits only after responses and never leaks through the public response or log. Cancellation leaves custody unchanged.

Rule family	Runtime	Controls	AI	Verification
Setup last, six deployed/fourteen reserves	Implemented	Board/sector selection	All four profiles	Completion order, occupied/advisor targets, invalid sectors, conservation
Hidden supply and placed token privacy	Implemented	Six original token illustrations and readable inspectors; public hidden map marker	Owner projection only	Seven pure model tests and equivalent public views for different secret declarations
One Mentat placement or relocation; storm permitted	Implemented	Private token/destination selectors; explicit declare/pass	All four profiles	Later-turn relocation, no duplicate custody, decline, stale rejection
Placement Karama	Implemented	Standard response window	Pass/legal response support	Allowed/reloaded settlement, canceled relocation, preserved source and consumed turn
Mentat continuation	Implemented for this slice	Pending decision ownership	Legal progression	Deferred victory and CHOAM market/final-opportunity continuity
Terror entry/revelation and six effects	Unimplemented	Rules/inspection only	Unimplemented	Source audit only; no expansion full-game claim

Files: game/moritani-terror.ts, game/engine.ts, game/bots.ts, components/moritani-terror.tsx, components/game-table.tsx, game/reference.ts. Added 17 named tests in tests/moritani-terror.test.ts and tests/moritani-placement.test.ts. Full814-unit and45-persisted/API suites, TypeScript, lint and build pass. Browser QA used a separately named local fixture, not an enabled expansion start: mobile inspector, restored focus, private declaration, refresh during response and final placement/map marker passed. See VISUAL_PLAYTEST.md for limits.

Next: explicit persistent entry continuations with committed force-cohort accounting, all six effects, Enemy of My Enemy, Aftermath, Extortion and advanced powers. Do not restore pre-Atomics Fremen storm casualty counts against forces already destroyed. Previously revealed Extortion must receive a fresh opaque public ID before hidden redeployment. The full expansion remains unavailable. The final owner-only pending-declaration reminder passed24focused tests, TypeScript, lint and build after the full814/45check. Controlled02:49UTCmaintenance preserved exact versions/state hashes for four saved QArooms and restored both the Basic Nexus and placed Terror token in the browser.

Terror entry, Robbery and Sabotage checkpoint

Persistent entry records now capture the entrant, location, committed force/elite counts, cause, turn/phase, effect stage and worm-ride continuation. Hooks cover ordinary shipment, cross-territory movement, Guild transport, spiritual-advisor arrival and worm rides. No-Field and Face Dancer modules remain outside this implementation. Self/allied entry and moving within the same territory do not open Terror. Existing occupation alone does not trigger it.

The Moritani owner may leave a token hidden or reveal an implemented effect. Robbery transfers half the entrant’s available spice rounded up, or draws before enforcing a chosen hand discard. Sabotage randomly discards once, then offers an optional own-card gift. Only authorized hands are projected; unrevealed identities and random discarded cards do not enter public logs. Reload preserves the stage and never replays shipment payment or the original force transfer. Truthtrance completion reconciles an already-cleared Robbery overflow. Fremen’s summoned-worm interruption now opens its owed Nexus before remaining rides after Terror completes.

Work	Controls/AI	Evidence	Remaining boundary
Entry opportunities and optional decline	Human controls; all four AI profiles	18entry tests across five arrival paths, hidden-face invariance and JSON recovery	Arrivals with another pending response/decision reject atomically; timing question awaits user clarification
Robbery and Sabotage	Reveal, choices, own-card discard/gift; legal AI choices	Full-hand draw, spice rounding, random discard exactly once, gift/decline, Truthtrance	Exceptional Sabotage gift overflow remains explicitly unsupported; no full-faction certification
Worm/Nexus interruptions	Existing Karama/Truth/Nexus controls continue	3new overlay regressions include actual alliance decisions and no extra draw/force transfer	Destructive Terror effects and their cohort reconciliation remain unfinished
Revealed/returned token custody	Reveal integrated; return helper ready	11pure custody tests	Return helper is not yet wired to Enemy of My Enemy or Extortion; it rotates all available supply IDs and shuffles positions before hidden redeployment
Assassination, Atomics, Extortion, Sneak Attack and advanced powers	Rule inspection only	Primary-source audit	Unimplemented

Full843-unit suite passes with TypeScript, lint and production build. All45persisted/API tests also pass. Browser QA completed the Robbery draw/forced-discard journey through refresh in the isolated S85SLVRRfixture. The table banner now prioritizes an interrupted decision’s owner over the original active mover. Combined arrival timing and later-ally Aftermath semantics remain unresolved in MORITANI_ENTRY_TIMING.md. Full Advanced and expansion starts remain gated.

Local operation

• npm run dev -- --host 0.0.0.0 (port 3000).
• npm run db:local applies Drizzle migrations to .wrangler/state (local only).
• npm test; npm run test:multiplayer.
• npm run typecheck; npm run build.
• Current app preview http://localhost:3000/ was opened via open_in_codex (tool returned queued; no tab ID available).

Sources and evidence

• GF9 base: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf
• Text mirror: https://www.rulespal.com/dune/rulebook
• Base PDF mirror: https://cdn.1j1ju.com/medias/37/57/71-dune-rulebook.pdf
• Ix: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf
• Ix mirror: https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf
• CHOAM: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf
• Ecaz: https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf
• Ecaz mirror: https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf
• Designer source hub: https://futurepastimes.com/dune-launch
• Reference aid (secondary): https://www.orderofgamers.com/downloads/Dune2019_v2.pdf
• https://www.landsraad-vegas.com/rules mixes GF9 and tournament house rules: do NOT silently adopt house rules.
• GF9 downloads currently give 403/non-PDF responses. tools/fetch_rules.py records original URLs, saved files only to /tmp/dune-rules.
• Board reference: https://github.com/marekyggdrasil/truthsayer ; THIRD_PARTY_NOTICES.md retains MIT license. tools/import_board.py consumes /tmp/dune-config.json; generated JSON already checked into workspace.

Sites

Project ID persisted in .openai/hosting.json. Private unpublished registration only. No source push, save version, or deployment yet. Workspace .git is read-only/empty; hosting will need a writable source staging Git repository or approved repository initialization when complete. Source credentials expired; obtain fresh credential for existing project when ready. Never store credentials in source or print them.

Current reaction and funding design

• Game.decision is a single server-gated decision union: advisor / wormProtection / wormRide / battleCards. spiceResolution persists resumable worm draws; wormRides resolves after all Nexus choices. Existing JSON rooms normalize missing fields on the next action.

• Game.aid holds spice earmarked by a donor for its ally in phase 3 or 5. A bid records its exact ally contribution. Unspent funding can be revoked unless committed to the current high bid; remaining funds return at phase end. Projections show only the player’s own pledge and ally credit.

• Harkonnen is an additional traitor voter when allied to a combatant, regardless of whether it holds a relevant card, preserving secret hand information. Resolution waits for its affirmative reveal or decline.

• Printed base PDF is downloaded at /tmp/dune-rules/base.pdf, extracted with layout at /tmp/dune-rules/base.txt. Reviewed pages 9–12, 16–19 confirm group movement, ally funding, optional discards and faction choices.

• Battle.preparation owns Voice/prescience steps. prescience.value commits a single element only after an existential legal-plan check, so Voice cannot force an impossible answer. components/battle-preparation.tsx owns these action forms. Karama cancellation now covers Voice and prescience. Add Truthtrance on top of these explicit windows.

Official FAQ priority

The November 2020 official FAQ is indexed at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf although direct fetch is still 403. Use targeted web searches to read its indexed sections. It supersedes the older base PDF mirror where they differ. Implemented: Weather Control and Family Atomics may be played after the dial distance is known but before actual movement. Remaining corrections: bribery is intended as advanced; Karama auction acquisition wording updated; audit simultaneous expansion stronghold victories. Storm-contested occupation is now excluded from victory counts. Truthtrance may ask any game-related yes/no question including current-turn commitments; unknown answers allow another question or later play. Full enforcement will need explicit structured commitments plus handling for freeform questions; do not silently limit its semantics and call it complete.

Latest windows and cards

• Game.stormPending reveals the total before movement; all players confirm and card changes reset confirmations. Weather Control can replace revealed dials.

• Game.spiceWindow keeps each base spice blow open for Harvester before Nexus/charity. Harvester doubles new spice only; the old incorrect collection multiplier was removed.

• Game.response suspends normal play for a public power use. Every seat may allow; another faction may spend Karama to cancel. Supported: Voice, prescience (before answer), spiritual advisor, Emperor auction income, Harkonnen bonus card. More response kinds remain.

• Auction winner now receives an auctionPayment decision: pay bid or use Karama. Holding Karama allows overspice bids; an eligible player may take the current card directly. Full-hand limits still apply. Payment, income and bonus-card resolution are separated.

• Exact official Karama list was retrieved via targeted search site:gf9games.com/dune/wp-content/uploads/2020/11 "unlimited"; indexed page 7 gives rules, superseding the April FAQ. Shipment with Karama costs Guild rates paid to the bank (not free); implemented with a benefit for the active recipient, who chooses their own shipment. Remaining base cancellations include Guild rates/transport, Fremen movement. Guild income and Harkonnen ally traitor support now have cancellation windows.

• Rule UI: /rules is searchable reference; /rules/coverage retains implementation ledger. Data in game/reference.ts; client in components/rules-reference.tsx; reusable HelpTip and TooltipProvider integrated in layout.

• AI: game/bots.ts accepts personalized views for candidate selection; authoritative rules filter candidates. runBots copies input state and advances up to 96 actions per transaction, with botsPending allowing authenticated continuation. Host-only lobby actions manage seats; no player cookie is issued for bots. game/bot-profiles.ts supplies UI descriptions without importing the engine into the client.

• Player-facing external hyperlinks have been removed from lobby and rule pages. Research provenance remains in developer documentation. Rule topic deep links open their target details.

• Fremen setup accepts sector-specific allocations and retains compatibility with earlier territory-level setup actions.

• Emperor alliance actions: immediately spendable spice gifts, and up to three extra allied force revivals at two spice each. Both have cancellation windows; canceled uses cost no spice or quota. Extra revivals are tracked separately from normal revival. Gift amounts are projected only to Emperor and recipient.

• Full base-faction reference topics now describe printed starting conditions, powers, allies and special victories. Six advanced-faction reference topics document their powers while clearly marking execution support as planned.

Advanced combat checkpoint

• game/combat.ts enumerates casualty combinations matching both dial strength and spice support. Exhaustive independent small-army assignments verify the solver, including the printed Sardaukar example.
• Optional Player.elites tracks subsets of the existing total forces in reserves, tanks and individual sectors. Shipment, cross-shipment, multi-sector movement, worm rides, kills, revival and Ghola preserve elite counts. UI has explicit elite selection inputs.
• Advanced plans accept half-strength increments, seal support privately and reserve its spice against gifts/bribes. Prescience checks whether any legal support commitment permits the chosen dial without revealing that support.
• Battle resolution pays support (except a traitor winner), then gives the normal winner a battleLosses decision before card discards. Casualty options preserve the player's choice of token types; traitor/explosion losses include all elite tokens.
• Elite revival quota resets at the next turn, not when Revival starts. Ordinary revival, Ghola and Emperor extra revivals share it. November FAQ page 2 explicitly confirms no Ghola/Emperor/Tleilaxu exception.
• Advanced bot battle policies now evaluate feasible spice support and preserve valuable elites in casualty choices. Complete advanced AI games remain unverified because the remaining advanced rules are not implemented.
• Guild alliance transport now includes half-price off-planet shipment, on-planet cross-shipping, and Fremen paid cross-shipment from southern reserves. Only Guild may ship back to reserves. Allied cross-shipping pays the Guild, except the Guild-funded share, which pays the bank. Guild funding of its ally's ordinary shipment goes to the bank; only the recipient's paid share becomes Guild income.
• New primary evidence: November FAQ page 2 allows temporary allied-territory entry during shipping/movement provided the entrant moves out. Current allowedEntry still rejects allied destinations; must implement the complete movement obligation without creating unresolvable turns or inventing a voluntary-loss rule. Passing through an ally's territory is already possible.
• Latest full checkpoint: 141 unit/reference/combat/advanced tests + 3 persisted multiplayer tests, lint, typecheck and production build all pass. No deployment yet.

Advanced storm/spice and foresight checkpoint

• Each advanced blow has its own discard pile and completes its Harvester/Nexus/ride sequence before the next blow. First-turn worms return after both blows. Additional worm placement is optional; its Karama cancellation blocks further placements for the current turn only.
• Fremen worm survival and optional allied protection have separate response windows before devouring. Only a surviving Fremen group can ride after the Nexus. Cancellation of one protection does not silently cancel the other.
• Advanced Fremen privately forecasts a randomly selected 1–6 storm card after movement. The next turn reveals that card instead of dialing; Weather Control can override it. Foresight cancellation hides the card without changing the distance. Without Fremen, normal dials remain.
• stormResolution resumes sector traversal around elite casualty decisions. Half losses round up per exposed group, and repeated laps recalculate against survivors. Legal Fremen reserve shipments into storm damage the arriving group only. Storm-protection responses cover the current storm movement or that individual shipment.
• Atreides auction and movement spice peeks now pause before private revelation. Each auction card gets a fresh response; a full Atreides hand does not suppress its peek. Movement shows one card even with double blow. An empty spice deck refills before foresight, preserving the revealed top card.
• Corrected allied Guild cross-shipment payments using the current GF9 base rulebook FAQ, page 23: all allied shipments pay Guild. The Guild's own contribution still pays the bank (November 2020 FAQ page 2). This supersedes the earlier implementation note saying cross-shipments pay the bank.
• End-of-game fallback is now implemented from base FAQ page 23: Fremen when Guild is absent; highest individual stronghold counts including ties when both are absent. Expansion victory interactions and optional extra-turn ties remain to implement.
• Advanced starts and all expansion starts remain disabled. These tests verify individual rules in advanced fixtures; they do not establish full advanced compliance.

Guild timing and integrated checks

• movementRemaining tracks uncompleted turns independently of fixed storm order. Advanced Guild gets a now/wait choice at each boundary, may take its whole turn first/last/between others, and cannot interrupt an active player. Once Guild completes its turn it is removed from the queue permanently for that phase.
• The first attempt to take an early turn or delay the normal slot has a guildTiming Karama response. Cancellation locks normal order for that phase. Allowing a delayed turn grants the timing use; Guild can decide at subsequent boundaries without declaring its eventual position in advance. Flags reset at the next movement phase.
• Allied co-occupation resolution uses actual completed movement turns, which matters when Guild changes order. Temporary allied entry still needs implementation; the current entry check remains restrictive.
• Fixed a pre-existing recursive phase-transition bug: skipping an empty battle phase could invoke spice collection twice. The transition now returns after advancing; a regression test checks the exact per-force collection cap.
• Bot elite revival choices respect the shared one-per-turn limit, and stronger policies deliberately deploy elite reserves. Hard/Brutal scenarios combine the currently implemented advanced storm/spice/combat/timing systems and finish without stalling or violating elite conservation. This is not a claim of complete advanced play.
• Verified current checkpoint: 141 unit/AI/reference tests + 3 persisted multiplayer tests; typecheck, lint and production build pass. No deployment yet.
• Next advanced implementation: advisors and remaining cancellation/special Karama powers, followed by full timing audits. Then all expansion mechanics and full integration.
• Primary base page 13 explicitly resolves blow A and its Nexus before revealing blow B. Its combat example and increased spice-flow rule were retrieved directly from the indexed official GF9 PDF.

KH and advanced economy checkpoint

• Advanced Collection adds 2 spice for Arrakeen, 2 for Carthag and 1 for Tuek's Sietch, stacking separately from ground-spice collection. Empty-battle transitions still pay collection only once.

• Plan.kwisatz is a privately sealed optional bonus. Validation requires advanced Atreides, seven accumulated battle losses, a living KH, a leader/Cheap Hero, matching per-turn territory and no cancellation. Loss counter/activation/used territory are projected only to Atreides. The battle's response window is identical whether KH is active or not.

• A surviving accompanying leader/hero adds +2; a killed one adds nothing. KH blocks traitor calls, including allied Harkonnen support through the shared voter path. A lasgun/shield explosion kills KH only if actually played and the explosion resolves; traitor victory overrides it. KH never increases normal leader bounty. Seventh-loss activation is immediate for another battle that turn; territorial use resets at the next turn.

• Normal KH revival costs 2 and shares the phase's one-leader revival quota. Eligibility tracks the required Atreides revival cycle independently; KH never participates in the five-leader cycle calculation. After revival, a subsequent KH death requires the next cycle. Ghola can return it early/free without using normal quota. The repeated/late-cycle interpretation still needs broader source and expansion-interaction audit before advanced mode is enabled.

• AI plans account for KH strength and traitor protection and can revive a dead KH. Advanced simulation fixtures remain partial rules integration, not full advanced-game certification.

• components/revealed-battle.tsx renders complete public plans for combatants and spectators, including card names, support and KH. The server supplies labels for played cards only after both plans reveal; unrelated hands remain hidden. Ghola now has an explicit force/leader/KH target selector.

• Primary evidence: GF9 base page 13 (stronghold income/combat), page 17 (KH/captures), November FAQ pages 3 and 7 (immediate activation and Karama), page 6 (Tleilaxu can offer KH revival). Official indexed GF9 source URLs remain above.

• Remaining timing audit: the guaranteed KH cancellation window currently precedes Voice/prescience. Broader legal card timing, including intervention after other preparation choices, still requires verification before full advanced compliance is claimed.

• Final verification for this checkpoint: 141 unit/AI/reference tests pass, plus the three persisted multiplayer journeys. TypeScript, lint and the production build pass. Advanced/expansion starts remain disabled; the full goal remains active.

Harkonnen capture checkpoint

• Leader records remain with their original faction. capturedBy determines temporary control, and controlledLeaders is the common server source for battle validation, prescience feasibility and resolution. This avoids duplicating leaders or losing their death/revival history.

• A winning advanced Harkonnen battle queues capture after casualty and card choices. Harkonnen can decline; acceptance opens a Karama response before any random draw. Only surviving eligible leaders enter the draw, including the just-used leader in the same territory. Then Harkonnen privately chooses retention or execution.

• A concealed snapshot preserves outsiders' pre-capture knowledge without exposing the captive's identity through the original owner's leader roster. Captor and owner see actual state; Tleilaxu additionally sees concealed executions, not living captives. Revealed use or revival clears concealment. Turn resets clear obsolete territory markers from both current and concealed records.

• Execution pays 2 spice and places the leader face down, with at least two deaths. Live captives return after one battle; dead captives enter their original owner's tanks. Losing every native Harkonnen leader immediately returns unused captives. Captured leaders can turn traitor and retain their territory restrictions.

• Original-owner revival now treats capture as unavailability when opening a leader revival cycle. Executed face-down leaders remain restricted until their later cycle, with Ghola able to revive them early. KH cycle initialization avoids non-finite values when all native leaders are captured.

• Captive UI, ownership-aware leader selectors, AI capture/use/return policies and a searchable internal capture reference are implemented. Basic/advanced test suites include twelve capture scenarios and JSON round-trip privacy checks.

• Primary sources: GF9 base page 17, November 2020 FAQ pages 5–7, Ix Karama table. CHOAM FAQ page 12 says captured leaders provide only battle-use skill effects; leader skills and further expansion interactions remain to be implemented.

• Verified capture checkpoint: 141 unit/AI/reference tests and 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment; advanced and expansion starts remain disabled while required rules are incomplete. The goal remains active.

Combat cancellation and endgame checkpoint

• Advanced battle preparation now queues separate public response windows for elite strength and Fremen free spice support, alongside KH. Emperor gets no redundant elite-strength response against Fremen, where Sardaukar is already ordinary. No elite response is offered without elite forces in the battle.
• Canceling doubled strength changes combat arithmetic for that battle only; the physical elite token identity remains intact through casualties, reserves and revival. Canceling Fremen support requires spice for full strength, permits unsupported half strength, and retains the traitor-winner payment exemption. AI plans and player support forms use the same flags. Both cancellation notices are visible with the battle.
• Eight focused combat tests cover independent cancellations/card consumption, support, casualty identity, ownership, secrecy, atomic rejection, fresh-battle reset and basic-mode isolation. Full legal intervention timing after other preparation and before reveal remains a required audit: these guaranteed windows currently precede Voice/prescience. Advanced starts remain disabled.
• Victory counts exclude strongholds with opposing occupants, as specified by November FAQ page 1. Sole occupation under storm still counts. Final-turn fallback now awards Fremen when Guild is absent, or the highest individual qualifying stronghold count (all ties) when neither is present. Normal wins retain priority over special/fallback outcomes, and BG prediction cannot replace Guild/Fremen special wins.
• Six new endgame tests cover contested/sole occupation, missing factions, priority, ties including zero, earlier turns and prediction. The shared test setup now predicts a different seat when Bene Gesserit is the first player. The internal victory topic and Mentat guidance describe these cases without external links.
• Primary evidence: GF9 base rulebook pages 18 and 23; November 2020 FAQ pages 1 and 7; Ix expansion Karama table. Expansion extra-stronghold/tech ties, advisor occupation and the complete expansion victory system remain unimplemented.
• Verified checkpoint: all 155 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The full goal remains active and advanced/expansion starts stay disabled. No deployment yet.

Bene Gesserit advisor checkpoint

• Player.advisors records one stance per territory, with optional arrival-turn locks; existing force totals and sector counts stay canonical. game/advisors.ts distinguishes physical force counts from fighter counts, plans arrival stance and removes obsolete advisor records. Lone advisors promote automatically.
• Advisor presence no longer contributes to battles, normal/fallback stronghold victory, Fremen special-condition blocking, stronghold entry limits, ornithopters, collection/stronghold income or Atomics eligibility. Area destruction still includes advisors. Wrapping action results settles stance after a whole action, avoiding mid-explosion promotion. Collection, victory and battle enumeration settle before calculating their result.
• Initial placement follows Fremen setup. Direct shipments, including allied Guild cross-shipment, enter as fighters unless joining existing advisors. Normal movement can preserve advisors, match existing fighters/advisors, or request an optional fighter flip after arrival. Arrival locks are carried when moving/joining advisors. Advanced starts remain disabled, so setup is exercised in controlled fixtures.
• Intrusion choices interrupt ordinary shipments, movement and worm rides, including repeated entry. The optional whole-territory flip has a Karama response. Free accompaniment follows intrusion, and a worm ride resumes its spice/Nexus sequence only after the reaction resolves.
• Advanced free accompaniment offers valid sectors in the shipment territory as well as the Polar Sink. Successful advisor accompaniment locks that territory’s group for the turn. Before the first shipment, eligible advisor territories receive individual prepare-for-battle choices/responses; allies and storm-inaccessible battles are excluded.
• November FAQ page 4 supersedes April’s conflicting same-type/arrival text. Primary sources: base page 18 and November FAQ pages 4 and 7. Remaining audits include the full declaration timing range between Nexus and first shipment, mandatory/matching flips under Karama, precise scope of carried arrival locks, and all expansion interactions. Advanced charity and Worthless-as-Karama are still pending. Do not claim complete BG advanced compliance.
• Advisor setup, stance decisions and movement options are available in the existing table UI. Dashed map rings and territory labels identify advisors. AI handles intrusion/declarations/accompaniment and uses fighter counts for enemy control/strength estimates. The internal advisor reference now documents these behaviors as Partial.
• The advisor storm test exposed a pre-existing graph bug: distance(from, from, blocked) returned zero before checking the blocked sector. Checking blockage first now prevents battles under storm even when both armies occupy the same location.
• Seventeen focused scenarios cover occupancy, economy, Atomics, movement/type matching, intrusion sequencing, setup, arrival locks, worm rides, storm/worm/explosion casualties, sector choices and JSON round-trip state. Verified checkpoint: all 172 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Bene Gesserit charity and Worthless Karama checkpoint

• charityTurn enforces one charity claim per turn for all factions, closing repeated claims after bribing proceeds away. Advanced BG receives +2 even from one spice and on turn one. At two or more spice the claim has a bgCharity response; cancellation consumes the claim without paying. The private view exposes claim availability only to the owner.
• game/karama.ts is the shared eligibility predicate used by engine, AI and player forms. Advanced BG can select Worthless cards for all currently implemented Karama uses, and holding one enables overspice bidding. Full-hand acquisition checks run before discarding. Sealed battle cards and prescience-committed cards cannot be spent again.
• pendingKarama stores a structured continuation for cancel/shipment/purchase/auctionPayment. A Worthless card is discarded before its worthlessKarama response. Allowed conversion completes the original use; canceled conversion grants no benefit and never returns the Worthless card. A canceled attempted cancellation restores the suspended response and its previous passes. The stored continuation is not projected, preventing private Emperor-gift amounts from leaking. Real Karama has no additional conversion window.
• Auction payment UI now selects the exact card. AI can claim advanced charity and use Worthless payment/cancellation. Internal searchable guidance covers the implemented behavior and remaining limitations.
• IMPORTANT unresolved source edge: the primary GF9 November FAQ confirms discarded Worthless cards on cancellation but does not specify an unfunded winning bid afterward. Current provisional recovery offers another funded payment or available Karama; otherwise it resets bidding for the same unseen card, original opener and unchanged ally funds. Do not treat the passing recovery test as proof of printed-rule compliance. Research surfaced similar restart rules in nonofficial compilations, which are NOT accepted as authoritative default rules. Confirm or replace this branch before enabling advanced mode.
• Primary sources: base rulebook page 18; November FAQ pages 7 and 9; Ix expansion Karama table. Advanced starts remain disabled. Twelve new focused scenarios cover charity thresholds/quota/cancellation, conversion timing, privacy and resumability, hand limits, bids/payments, commitment protection and private-view AI. All 184 unit/AI/reference tests and 3 persisted multiplayer journeys pass; typecheck, lint and production build pass. A final public-intent display check follows the same privacy test. The goal remains active, with no deployment.

Emperor and Harkonnen special Karama checkpoint

• specialKaramaUsed persists once-per-game usage publicly per faction. The special card action validates advanced mode, phase, actual Karama ownership and unused power before applying effects. Ordinary Karama uses remain available afterward.
• Emperor’s Revival-phase power returns up to three own forces or one own dead leader for free, independently of normal quotas/cycle. The shared one-elite-per-turn limit applies and token totals are conserved. Living/captured/foreign leaders, combined force-plus-leader targets, wrong phases and ally-force targets are rejected atomically. Expansion revival/income and full timing audits remain.
• Harkonnen’s Bidding-phase power draws 1–4 unseen random cards from another hand, temporarily exceeding the hand limit if necessary. Its owner then returns exactly that many distinct cards from the combined hand, including any newly acquired ones. The card is discarded and game usage is consumed before the draw.
• pendingExchange privately suspends an existing auction decision/response. During the exchange all ordinary actions are gated. Completion restores the exact response including its passes and private amount, or resumes the pending payment. The continuation is never projected. Card IDs are absent from public exchange logs/decisions; each owner sees only their own current hand.
• Losing the only Karama backing a winning bid now uses the existing provisional unfunded-payment recovery. Auction finalization checks funding as well, so taking the backing card before the final pass cannot stall the game. This recovery remains a source-verification gap; tests prove conservation/resumability, not official printed-rule compliance.
• Player forms provide blind-draw amount/target, private return checkboxes, Emperor force/leader targets and help tips. Internal faction and special-Karama topics describe the two implemented powers and identify the remaining powers. AI selects targets from public hand counts and return cards from its own hand; Emperor can invoke special revival then continue normal revival.
• Twelve focused tests cover conservation, transient hand limits, privacy/JSON projection, suspension/resumption, atomic rejections, once-per-game usage, revival quotas and private-view AI. The AI invariant permits excess cards only for the active Harkonnen exchange, within its declared count.
• Primary evidence: GF9 base page 14; November FAQ page 3 (phase restrictions/once per game), page 6 (blind draw, inspect, equal return and temporary hand limits), page 2/base page 19 (one elite per turn). No tournament compilation was adopted as a primary rule source.
• All 196 unit/AI/reference tests and 3 persisted multiplayer journeys passed, along with typecheck, lint and production build. Final guidance-only validation follows. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Guild special shipment-stop checkpoint

• Ordinary off-planet shipments now validate destination, availability, elites, cost and private ally contribution before opening a Guild decision. The decision appears regardless of the Guild’s hidden hand until its once-per-game power is spent. Fremen southern reinforcements and on-planet cross/return transport are excluded; Guild’s own off-planet shipment can also be allowed/stopped under the rulebook’s “any one player” wording.

• pendingShipment stores the validated shipment privately. No payment, troop/elite placement, Guild income, intrusion or accompanying advisor happens during the pause. Only the Guild can allow it or spend its actual Karama to stop it. The special power resolves directly and cannot open a normal Karama counter-response. Mutation stays atomic and private projections never include pending funding.

• Allowing invokes the shared shipment commit once and resumes Guild income, then intrusion/advisor choices. Stopping spends Guild’s card and once-per-game power, consumes the shipper’s shipment opportunity, keeps troops/spice/allied credit untouched and leaves ordinary movement available. Any shipment-rate card is tracked privately and returned to its original owner on stop; allowed shipment consumes it normally. Converted Worthless benefits are tested as well.

• Unverified settlement details: GF9 base page 14 confirms one off-planet shipment of any one player; November FAQ page 3 supplies phase/once-per-game scope and page 7 establishes Fremen’s reserve immunity. Those retrieved primary passages do not settle retaining/returning rate cards, consuming the canceled shipment opportunity, stopping a separate spiritual advisor, or special-power counter timing. Current settlement is provisional engineering behavior, not a full-compliance claim. Historical/Avalon Hill/tournament and unofficial compilation text must not silently supersede GF9. Audit this before enabling advanced starts and extend it for homeworld/expansion interactions.

• UI provides declared target/count/sector, an allow button and a special-stop button only for actual cards in the Guild’s own hand, plus internal tooltips and rule links. AI at every difficulty resolves the decision from its private projection; higher difficulties protect occupied territories or contest substantial stronghold shipments and preserve allied shipments.

• Fourteen focused tests cover deferred effects, canceled and allowed payment accounting, elite conservation, allied contributions, gifted/converted rate cards, private projection, invalid/bypass attempts, once-per-game scope, movement after stop, basic/Fremen/cross-shipment exclusions, all AI difficulties and JSON-persisted intrusion continuation. Existing rate-benefit shape assertions now include the tracked card internally, while the public view preserves its prior shape.

• Primary sources: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf (p14); https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (p3/p7). Product references remain internal only.

• Verified checkpoint: all 210 engine/AI/reference tests and all 3 persisted multiplayer tests pass, as do TypeScript, lint and production build. Advanced/expansion starts remain disabled. No deployment; the full goal remains active.

Atreides full battle-plan inspection checkpoint

• Advanced Atreides now receives a special-Karama offer after Voice and ordinary prescience are resolved or declined. The offer occurs independently of its hidden hand and is available even in an unrelated battle. Declining preserves its card and game-wide usage; the offer cannot be reopened after sealing has begun.

• Spending an actual Karama consumes the once-per-game power and chooses either combatant. Battle.fullPlan records observer and target; the target must submit a fully validated plan first. Dial, leader, weapon, defense, spice support and KH are committed using the ordinary battle plan store, so existing support reservations and sealed-card protections apply. Invalid actions are atomic.

• Full-plan inspection now persists privately until public reveal without an acknowledgement decision. Its entitled Atreides owner can be an external ally; the assisted ally does not receive the private projection. Legacy saved fullPlanRead normalizes through authoritative recovery. Target-first sealing and the normal reveal/traitor sequence remain intact.

• A canceled ordinary prescience request still leads to the special offer. An answered element and the Voice remain binding during the full-plan submission. The special resolves without a normal cancellation window. Its game-wide usage persists across later battles/turns.

• Added a private plan panel and request/acknowledgement guidance. Existing battle form handles target commitment; other players see the specific wait. Internal faction, card, special-Karama and coverage topics include this behavior and identify incomplete timing coverage.

• AI can initiate, answer, decline and acknowledge the inspection at all four difficulties. When Atreides has inspected its own opponent, its battle scoring uses actual enemy dial/leader/weapon/defense, survivor strength and explosion risk. Unseen hand contents and traitors cannot alter the chosen candidates. Broader difficulty calibration still remains.

• Twelve dedicated scenarios cover Voice/prescience ordering, targeted commitment, selected-card privacy, acknowledgement ownership, unrelated battles/allies, hidden-hand-independent offers, ordinary cancellation, invalid input atomicity, once-per-game scope, sealed Worthless protection, all four AI difficulties, actual-information tactics and KH visibility. Existing advanced combat/KH/advisor fixtures now explicitly decline the new offer before testing their original mechanics; their original assertions are retained.

• Primary evidence: GF9 base rulebook p14 (once-per-game Karama; inspect any one player’s entire Battle Plan), November 2020 FAQ p3/p9 (advanced power scope/once-per-game). The exact post-prescience commitment/acknowledgement order is an engineering timing choice pending the remaining pre-reveal card audit. Re-answer/replanning rules after other card effects, interaction with cancellations already committed, and all expansion plan components must still be audited. Historical/unofficial compilations were not adopted as proof of GF9 compliance.

• Advanced and expansion table starts remain disabled; no deployment. The full goal remains active.

• Verified checkpoint: all 222 engine/AI/reference tests and all 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. The full goal remains active, with advanced/expansion starts still gated.

Fremen summoned sandworm checkpoint

• Added once-per-game Fremen Karama during Spice Blow and Nexus, restricted to sand. The call does not draw/discard a spice card or mutate the existing discard-pile order. Destruction, optional ally protection, ordinary Karama cancellation of protection, elite conservation and worm rides reuse the existing worm engine.

• summonedWorm.resume privately suspends the interrupted response/decision, Worthless conversion, fresh-blow window and spice sequence until protection/destruction finishes. Only the called territory is projected. Resumption preserves response passes and private payloads; devoured fresh spice is marked unavailable to Harvester.

• Timing corrected to primary evidence: November 2020 FAQ p3 explicitly places the called worm’s Nexus at the end of the spice-blow phase, not immediately before remaining draws. The initial local interruption prototype was replaced before release. A pre-draw call now defers its Nexus while preserving its ride queue; normal draw completion opens negotiations. In advanced play this follows the current pass’s ordinary Nexus point before proceeding to the other pile. Calling during an open Nexus adds the new ride and resets confirmations. A call during an unmade ride requeues it and opens negotiations; a completed ride’s pending BG intrusion/flip resolves before the new Nexus.

• UI adds a sand-territory picker and summon control to Fremen’s actual Karama card, with internal tooltip/reference guidance. AI uses public sand-territory threats and its own available card. All four difficulty policies can initiate the call; existing response/Nexus/ride policies perform the continuation.

• Fourteen focused tests cover deferred Nexus ordering, unaltered deck/pile state, troop/elite/spice effects, protection cancellation, merged Nexus rides, JSON suspension, interrupted additional-worm choice, Harvester prevention, invalid/repeated actions, first-turn token versus drawn-card behavior, private-view AI, pending rides, BG intrusion and suspended Worthless conversions.

• Rule precedence: https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf p3 supplies summon timing, destruction/protection, rides and second-Karama survival cancellation. It supersedes the older contradictory “no Nexus” answer still printed in the current base PDF p22. Base p14 supplies sand placement/one-use scope. Remaining audit: simultaneous/late card timing, whether a called worm changes subsequent additional-worm counting, first-turn token interactions and expansion discovery/Homeworld/Nexus mechanics. Advanced starts remain gated pending the complete audit.

• Verified checkpoint: 236 engine/AI/reference tests and all 3 persisted multiplayer tests pass. Final TypeScript, lint and production build pass after the UI handler and test declaration corrections. Advanced/expansion starts remain gated; no deployment; the full goal remains active.

Tech-token module checkpoint

• Added game/tech-tokens.ts with the three printed tokens, designated initial owners, per-phase triggers, public escrow and a one-owner stronghold-set helper. Host-controlled lobby selection is independent of expansion factions and resets human readiness. Three or more players are currently required.
• Initial Fremen/Ixian/Tleilaxu assignments occur at setup. After the first storm, shuffled missing tokens go to factions without tokens in storm order. The printed-map/seat-order audit remains separately outstanding.
• Charity, free revival and off-planet arrivals trigger their matching token once per phase, excluding BG-only charity, Tleilaxu-only revival and Guild-only shipping. Income is based on the owner's full token count and paid at the phase boundary. Actual BG advisor arrivals can trigger Heighliners; Fremen reinforcements, cross-planet/return transport and stopped Guild-special shipments do not. Ghola and Emperor special free revival use the Axlotl hook only in Revival. These card-revival and free-arrival readings follow the printed trigger wording; expansion interactions still need a comprehensive audit.
• Battle outcomes preserve pending token transfer through advanced casualty and winner-card decisions, then resolve one automatic token or an owner-only choice before Harkonnen capture. No token changes in mutual destruction; single traitor victory takes a token even when it overrides lasgun/shield. Surviving winning forces are not required.
• Victory includes one extra stronghold only when a single player owns all three tokens, including in alliances. Collect all normal qualifying winners before BG prediction, so a token-assisted win can tie another normal win. Tokens also participate in the existing final-turn fallback count.
• Added public holdings/income to player panels, capture-choice controls, lobby tooltip, searchable internal tech-token topic and updated coverage. AI considers enemy token holdings, complete-set victory pressure and legal token selection without access to other hands.
• Evidence: GF9 Ixians & Tleilaxu rulebook pages 4–5 (https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf; same primary document at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf); November 2020 FAQ page 9 confirms the tech-token normal-victory tie. Ecaz & Moritani rulebook page 15 reiterates that allies cannot combine token holdings and says homeworld shipments trigger Heighliners (homeworld engine still unimplemented).
• Verification: full 251-test suite passed before the final focused battle-outcome addition; all 15 focused tech tests then passed, bringing total tested cases to 252. All four persisted multiplayer journeys pass, including a complete six-seat human/AI game with tech tokens and reconnect checks. TypeScript, lint and production build passed. No browser visual QA or deployment performed. The full goal remains active.

Ix combined/alternate battle-card checkpoint

• Added four typed card identities via ixBattleCards() and shared game/battle-cards.ts logic. Poison Blade requires both projectile and poison protection; Shield Snooper supplies both and remains a shield for lasgun explosions. Weirding Way defaults to projectile weapon and can fill the defense slot with another weapon; Chemistry defaults to poison defense and can fill the weapon slot with another defense. Each occupies exactly one slot.

• Authoritative plan validation, combat casualties, feasible prescience answers, Voice prohibitions/compulsions, UI selectors and AI now use the same card roles. Voice can name each special card directly; generic prohibitions follow the played role, and compulsion considers default roles so it does not force an alternate use. Prescience reveals only the actual selected slot and preserves the other card's privacy.

• AI evaluates full-plan inspection with the shared lethality/explosion functions. Ordinary prescience now identifies the explicitly revealed card through the catalog instead of guessing from its label; Hard/Brutal select Shield Snooper against revealed Poison Blade. No opponent hand or deck data enters those decisions.

• Added internal searchable rules, readable Voice labels and descriptions on the new hand cards. Complete expansion deck assembly is not enabled: this is tested subsystem support, not a claim that Ixians/Tleilaxu are playable.

• Primary evidence: GF9 November 2020 FAQ pages 3–5 for effective-slot prescience, generic/named Voice and default-role compulsion; page 9 for Weirding Way versus lasgun and Shield Snooper. Ixians & Tleilaxu rulebook page 11 confirms ordinary Shield does not stop Poison Blade while Shield Snooper does. CHOAM & Richese rulebook page 4 says revised Poison Tooth and Artillery Strike replace their Ix versions; implement those revised effects next, not the superseded text. URLs are retained in the earlier source sections and the tech-token checkpoint; no external links were added to player-facing pages.

• Still audit printed card edge cases involving Worthless as the complementary slot and Chemistry/Weirding Way together (current representation permits both assignments when both slots are occupied). Complete Ix card inventory, card text revisions, Cheap Hero traitor, Sandtrout, Amal, and faction integrations remain. A base-deck name audit is also needed: Basilia Weapon appears in the current base list, while sources suggest it belongs to the Ix expansion and the base card should be Ellaca Drug; verify against printed primary components before changing the catalog.

• Verification: all 265 unit/engine/AI/reference cases and four persisted multiplayer journeys pass; TypeScript and lint pass. The new 13-test file includes a 36-pair lethality matrix, authoritative leader death/explosion outcomes, failed-plan immutability, generic/named/default-role Voice, JSON/private prescience, legal AI choices at all levels, and targeted Hard/Brutal defense selection. No browser visual QA or deployment. Full goal remains active.

• Production build completed successfully for this checkpoint; final subsequent UI edits only replace the card-type label with its readable label and update the coverage text.

Poison Tooth and Artillery Strike checkpoint

• Added poisonTooth and artillery card identities to the implemented Ix battle-card catalog. Full room decks still use the gated base setup; no partial expansion deck is offered.
• Battle revelation now opens an owner-only Poison Tooth activation decision before traitor choices. This is separate from the sealed plan and ordinary prescience commitments. Activation is public, serialized and immutable once submitted. No leaders, forces or spice are changed until battle resolution. The queue can handle multiple tooth-bearing plans in storm order for future card-copy effects; complete Mirror Weapon semantics remain unimplemented.
• Shared battleCardEffects handles attacks on both leaders. A tooth can be declined, or activated against each side's defense; Chemistry as defense protects while Snooper/Shield Snooper do not. Unused winning tooth is optionally retained; used tooth is discarded. Artillery attacks each side's shield, suppresses surviving leader/KH strength and all leader bounty, and is discarded after use. Other weapons still apply, and advanced spice support/casualty accounting is preserved.
• Traitor victories bypass these effects and preserve the winning faction's otherwise single-use weapon; explosions take precedence. This follows the base rule that the successful traitor caller loses nothing. Opposing leaders/forces/cards follow normal traitor losses.
• AI models both leaders' exposure and artillery suppression during planning. At the revealed tooth decision it compares public totals with/without activation, preferring a win and preserving its leader and unused card when possible. Easy retains variation; Medium/Hard/Brutal choose based on these outcomes. The UI shows revealed plans to the tooth owner, activation/decline controls and the submitted result; internal card topics describe effects, timing and current coverage.
• Evidence: GF9 November 2020 FAQ p8 explicitly covers Chemistry versus tooth, Snooper exceptions, used/unused tooth discard and Shield Snooper explosions; p9 confirms Shield Snooper versus Artillery and the Weirding Way exception. Pages 4–5 govern named versus generic Voice. CHOAM & Richese rulebook p4 directs replacement of the original tooth/artillery cards. Direct retrieval of the replacement printed card faces remains incomplete, so do not claim that printing audit is finished; the implementation currently follows the FAQ-backed behavior and known card text. Do not use the separately found Dune movie-game rulebook as classic-game evidence. Stone Burner, leader skills, Mirror Weapon and other later card interactions still need implementation/audit; specifically confirm artillery/KH suppression against later clarifications.
• Verification: all 277 unit/engine/AI/reference tests and all four persisted multiplayer journeys pass. The 12 new tests cover ownership, invalid-action immutability, JSON/private revelation, activation, retained/discarded tooth, defenses on both sides, self-exposure, suppressed bounty, traitor/explosion precedence, Voice, four AI levels and advanced force/spice/KH outcomes. TypeScript, final lint and production build pass. Final coverage text was updated after build. No visual browser QA or deployment; full goal remains active.

Sandtrout spice-deck checkpoint

• Added a Sandtrout spice-card variant and optional 22-card Ix deck construction. Start chooses that deck when the Ix expansion is selected, but the existing expansion-start gate still applies. The 21-card base deck remains unchanged.
• Drawing Sandtrout breaks alliances, clears offers and returns any outstanding ally credit to its donor. It is represented as a public set-aside card while waiting, so it cannot re-enter a reshuffle before consumption. Normal territory draws do not consume it, including between advanced piles and across turns.
• A subsequent active drawn Shai-Hulud consumes Sandtrout without destruction, protection responses, Fremen rides or its own Nexus. Only an immediate territory replacement receives double spice. A second worm resolves normally against the preceding effective card and cancels the bonus. Suppressed discard entries carry metadata so they do not count as normal worms for Fremen extra placement; reshuffling strips that metadata.
• Harvester doubles the enhanced amount; storm still prevents it. First-turn ignored worms currently do not consume a waiting Sandtrout. A Fremen summoned worm is not a drawn card and does not consume it. A prior already-triggered Nexus is preserved when Sandtrout appears later in that draw sequence.
• Added a public pending-status notice, an internal searchable Sandtrout topic, and the previously missing table display for Atreides' private spice foresight (territory, Shai-Hulud or Sandtrout). The existing server projection controls who can see the next card. Status notices sit outside the play grid so they do not displace its columns.
• Primary evidence: GF9 Ixians & Tleilaxu rulebook p4 (add one Sandtrout) and p11 (immediate alliance cancellation, next Shai-Hulud suppression, immediate land doubling or second-worm normal Nexus), at https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf. First-turn ordering, the exact suppressed-card discard layout, prior-worm Nexus and special-summon interpretations remain audit items; later discovery and other expansion spice interactions are not implemented. Live expansion starts stay gated pending full integration and that audit.
• Verification: all 292 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 14 Sandtrout scenarios cover deck inventory, alliance/escrow cleanup, pending-state JSON, suppression versus normal worms, both advanced piles, Fremen protection/placement, Harvester/storm, reshuffle metadata and private foresight. An additional full-game AI test runs Hard/Brutal with Sandtrout and checks exactly one card across deck/discards/set-aside state plus force conservation. Final TypeScript, lint and production build all pass. No browser QA or deployment; full goal remains active.

Thumper checkpoint

• Added the implemented Thumper entry to ixSpecialCards(). The full expansion treachery deck is not yet assembled/enabled; Amal, generic expansion duplicates and Cheap Hero traitor setup remain.
• Playing Thumper before the first Spice Blow draw discards it once and passes a virtual Shai-Hulud into the shared spice resolver. It targets the prior effective card in pile A, pauses for normal Fremen/allied protection before drawing any real card, opens the ordinary Nexus/rides, and counts toward advanced extra-worm placement. Pile B continues separately.
• Virtual worm markers retain their identity in serialized discard history and are removed on refill rather than becoming extra Shai-Hulud cards. Sandtrout suppression preserves the virtual marker and doubles only an immediate land replacement. First-turn ignored Thumper is never returned to the spice deck. Pending ordinary/summoned worm continuation remains unchanged.
• Added public beforeSpiceDraw timing to the view, a disabled-until-legal card button and hand guidance, plus an internal Thumper rule topic. AI uses only the public prior territory and force counts to prefer hitting enemies while preserving the card when Sandtrout would suppress it; Easy retains variation.
• Source status: the GF9 Ix rulebook establishes the expansion inventory and shared worm/Sandtrout framework. The Thumper card's opening-phase/instead-of-reveal wording was located in transcribed card references (https://www.scribd.com/document/745862168/DUNE-Factions-TreacheryCards-EXP1-3-v2 and the classic-card section of https://www.landsraad-vegas.com/rules/gencon). These are secondary and the latter includes tournament/house amendments; do not treat the whole source as the target rules. Direct primary card-face verification of first-turn allowance, exact opening timing and Sandtrout handling remains required before enabling expansion starts. The implementation currently permits first-turn use but ignores its worm effect, and limits play to the phase opening before pile A.
• Verification: all 302 unit/engine/AI/reference tests and four persisted multiplayer journeys pass; final TypeScript, lint and production build pass. Ten focused Thumper tests cover treachery consumption, deck order/conservation, JSON-paused protection, ally responses, Nexus/rides, extra worms, second pile, Sandtrout, first-turn handling, refill and timing rejection/AI policy. No browser QA or deployment. Full goal remains active.

Cheap Hero traitor checkpoint

• Added game/traitors.ts: one expansion traitor identity maps both Cheap Hero treachery cards without inventing a faction leader disc. The deck builder includes it only for the Ix expansion; full expansion starts remain gated.
• Setup, authoritative traitor calls and private-view AI share this identity. Normal traitor losses apply, with zero hero bounty and no fake leader in the tanks. The holder retains the card for subsequent opponents. Harkonnen ally calls use their existing Karama response; KH protects an accompanying hero.
• Resolved traitor calls now retain public identity history in revealedTraitors; uncalled selections remain private. Player panels display the history. Medium/Hard/Brutal plan scoring avoids publicly exposed leaders held by an opponent or its Harkonnen ally, unless KH protects the plan. Setup scoring handles the hero identity and all four AI levels can call it.
• Added a searchable internal rule entry with related links. No player-facing external navigation added.
• Primary evidence from the previously indexed GF9 Ixians & Tleilaxu rulebook p11: Cheap Hero traitor may be revealed against any opponent playing a hero, can be used repeatedly, and is known after its first revelation. Base rules p17 protect KH-accompanied heroes and permit Harkonnen ally support. Sources: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf and https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf. Direct retrieval of the Ix PDF remains intermittently forbidden. Later Face Dancer/Tleilaxu and other expansion interactions remain unimplemented. Public identity becomes visible at simultaneous call resolution; canceled Harkonnen support does not publish it, pending the broader timing audit.
• Verification: all 314 engine/AI/reference tests and all four persisted multiplayer journeys pass, as do TypeScript, lint and production build. Twelve new tests cover inventory, private setup, both heroes, repeated use, no leader/bounty fabrication, invalid-action immutability, KH, Harkonnen cancellation, mutual traitors, all difficulty levels and public-knowledge-only AI planning. No browser QA or deployment; full goal remains active.

Amal and phase-opening checkpoint

• Added Amal to the implemented Ix special-card catalog. On play each player's available spice becomes its floor-half; the card is discarded once. Unpaid bribes and deferred token income are separate balances. Full expansion deck assembly and starts are still gated.
• Refactored phase entry into openPhase and beginPhase. Ix-enabled tables receive the same public window at every phase opening, regardless of who holds Amal. Everyone plays or passes; an Amal play resets passes. After all passes, the saved initializer runs once. This includes the initial Storm and the post-storm Spice Blow entry, serializes through JSON, and preserves the Fremen storm-forecast response.
• Automatic auctions, movement preparation/prescience, empty battle skipping, collection, Mentat bribe payout/victory and new-turn resets wait for the opening. Previous-phase tech income and unused alliance credit settle before it. The window blocks normal phase actions and special Karama play; advanceBots remains a harmless polling continuation. More beginning-of-phase powers and universally timed cards will need explicit integration here.
• UI supplies an opening panel, pass count and owner-only Amal control with its exact personal spice loss. Hand controls disable Amal outside the opening. The public view does not reveal hidden card holdings, rival spice or internal continuation details. A searchable internal rule topic describes the timing and current limits.
• All four AI policies can pass openings; the Amal policy uses only its own low spice balance (and Easy variation), without inspecting rival wealth. Hard and Brutal complete games with all phase windows and exactly one Amal conserved across deck/hand/discard.
• Source status: transcribed printed-card wording specifies beginning of any phase, half of spice behind shields rounded up, then discard. References are the previously recorded classic-card transcription and https://www.scribd.com/document/851223590/ (Chinese card reference). Official Ix PDF confirms the expansion framework but direct primary card-face retrieval is still incomplete. The earlier PDF search results remain indexed despite direct 403 responses. Do not claim the printed-face or simultaneous beginning-of-phase audit is complete. CHOAM inflation, homeworld reserves, Richese auctions and other unreleased economy interactions remain unimplemented. Current pass commitment/reopening semantics are the digital timing protocol and require the complete card-window audit.
• Verification: 328 engine/AI/reference tests and all four persisted multiplayer journeys pass. Fourteen new Amal tests cover exact rounding, bribe/collection ordering, deck draws, prior income/credit settlement, charity, setup/turn boundaries, empty phases, hidden information, ownership/timing/immutability, all difficulty levels, full games and Fremen forecast/Thumper continuation. Final TypeScript, lint and production build all pass. No browser QA or deployment; the full goal remains active.

Tleilaxu Face Dancers and Zoal checkpoint

• Obtained a readable mirror of the publisher's 12-page Ix rulebook at https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf. Stored genuine PDF/text as /tmp/dune-rules/ix-official-mirror.pdf and .txt; the older /tmp/dune-rules/ix.pdf remains invalid HTML. Rendered and inspected printed p3 to verify all ten Ix/Tleilaxu leader names and strengths; catalog includes both sets. The printed rulebook's older ghola-buyback answer is superseded by November 2020 FAQ p6 (a foreign ghola cannot be sold back while alive).

• Tleilaxu are excluded from ordinary traitor dealing/selection. After others select, the unused deck is reconstructed from valid faction cards minus held traitors, shuffled and dealt as three private Face Dancers. The reserve is stored authoritatively and never projected. Staged fixture setup covers conservation and secrecy; live expansion-start gates remain in place.

• Every other faction's battle victory opens an optional Tleilaxu decision independently of its hidden holdings, after winner losses/card choices/tech transfers/Harkonnen capture. A matching unrevealed Face Dancer returns the winner's surviving forces to reserves, preserving elite subsets, and allows replacement from Tleilaxu reserves and any board locations up to that count. Killing a living winning leader adds no bounty and does not repeat an earlier death. Cheap Hero identity survives its treachery discard for matching; KH cannot prevent Face Dancing. Karama cannot cancel it. Winner rewards remain unchanged.

• Replacement currently removes the winning faction's forces, preserves peaceful BG bystanders, permits zero replacement forces, and lets Tleilaxu choose a sector in the battle territory. These sector/zero/bystander readings and later mobile-stronghold/homeworld/terror/ambassador interactions remain explicit cross-module audit items. Captive release is rechecked when a Face Dancer kills Harkonnen's last native leader.

• Revealed Face Dancers are public and unavailable for reuse. Revealing the third shuffles all three into the reserve and deals three new cards. During Mentat, Tleilaxu may replace one unrevealed card with a cancelable response. The selected identity is hidden from other players in the response projection; cancellation preserves the cards and uses the turn's replacement opportunity. Full simultaneous timing and Mentat/victory ordering still require the global audit.

• battleLeaderStrength copies the opposing disc for Zoal, excluding KH, and uses zero against a hero. Ordinary totals, poison/weapon bounty and traitor bounty share the helper. Zoal retains a separate effective ordinary revival value of three through his catalog strength; battle selectors display X. AI sealed-plan estimation and Poison Tooth evaluation use dynamic leader strength.

• Added an owner-only Face Dancer control component with sources, sector and counts; private hand and public revealed-card panels; Mentat replacement buttons; searchable rule/faction entries. AI at all four levels can reveal/decline using its own private identities, preserves one force in source strongholds, and replaces dead-leader Face Dancers during Mentat. Tleilaxu revival strategy is not yet implemented.

• Closed a start-validation gap: an expansion faction supplied with an empty expansion selection is rejected, so direct API construction cannot silently start an unfinished faction. All expansion starts remain gated pending actual completion.

• Primary evidence: Ix printed p3, p6–7, p10–12; November 2020 FAQ p6 and p8 at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf. The FAQ confirms unlimited Tleilaxu force/own-leader revival, their own free-revival income, Zoal revival value three/no copied KH bonus, Emperor extra-revival payments to Tleilaxu and the separate Karama effects. Revival income/discounts/negotiation, foreign gholas, special Karama and their UI/AI are the next major Tleilaxu work, not completed here.

• Nineteen focused scenarios pass: private setup/deck conservation, reward ordering, force/elite conservation, invalid-action immutability, declined/unmatched reveals, Cheap Hero, KH, dead leaders, third-card recycling, private/canceled Mentat replacement, Zoal totals/bounty, all AI difficulties, unfinished-faction gating, BG bystanders and Harkonnen captive release. The fixture's Guild-to-Tleilaxu substitution now remaps dealt identities before setup; an earlier randomized fixture failure was corrected. Final regression/build results are recorded below.

• Setup finalization is shared by all successful setup actions and bot continuations. This prevents the Harkonnen–Tleilaxu two-faction combination from waiting indefinitely when neither faction has an ordinary traitor-selection prompt. A nineteenth scenario covers automatic completion and deck conservation for that pairing.

• Final verification: all 347 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and production build pass after the setup-finalization and UI/reference edits. No browser visual QA or deployment. The original goal remains active and incomplete; the next required Tleilaxu work is revival economy/negotiation, foreign gholas and special Karama.

Tleilaxu revival commerce checkpoint

• Added shared revival quoting and transactions in game/revival.ts and the authoritative engine. Tleilaxu can revive their own forces without the ordinary three-force limit, revive multiple own leaders before all five are dead, and pay half normal prices rounded up. Other factions retain their native revival-cycle and one-leader restrictions. Elite revival remains limited to one per turn across ordinary, Ghola and Emperor-funded revivals.
• Tleilaxu can grant another faction up to five normal force revivals and grant their current ally half-price ordinary revival. The recipient pays; no implicit Tleilaxu funding is created. Dedicated Karama responses occur when the extra limit or paid discount is used. A canceled limit aborts the transaction without partial revival; a canceled discount restores the normal price and aborts if the payer cannot afford it.
• Other factions privately request an early dead leader or KH, and Tleilaxu quotes or declines. Acceptance revalidates eligibility, funds and the one-leader allowance before its Karama response. A zero-spice agreement is allowed. When all native leaders are unavailable, including capture, ordinary revival rules apply instead of the early negotiation path. Early-revival cancellation blocks that selected leader for the phase without revealing a concealed identity to outsiders.
• Paid revivals now route to Tleilaxu through a separate income response. Normal free revival rewards one spice once per faction per turn, including Tleilaxu themselves; split free-force actions and canceled income cannot repeat that reward. A Ghola treachery play has its separate one-spice reward, including outside the Revival phase. Income cancellation preserves the completed revival. Emperor-funded extra allied forces also pay Tleilaxu, and their separate three-force quota can combine with a granted normal five for eight forces.
• Pending transactions serialize safely and remain internal. Quote records are visible only to Tleilaxu and the requester; payment amounts only to Tleilaxu and the payer. Target IDs are validated against actual players before indexing request records, including rejection of prototype-property targets. No hidden rival spice enters AI quotation or revival choices.
• Added components/revival-commerce.tsx, private quote/accept/decline/withdraw controls, Tleilaxu permission controls, remaining-limit/free-revival/price guidance, response labels and an internal searchable revival rule entry. All four AI levels can quote, grant permissions, request/accept eligible early returns, use discounts and complete the phase through response windows.
• Primary evidence: printed Ix rulebook p7 and November 2020 FAQ p6 and p8. The FAQ confirms unlimited own leaders, one leader for other factions, half-price rounding, KH negotiations, captured-leader unavailability, ally self-payment and Emperor extra-force income. Sources are the genuine publisher-rulebook mirror and official November FAQ recorded above. Foreign gholas, special Karama, Ix cyborg pricing and later expansion economy remain unimplemented. Exact cancellation duration/scope, combined paid/free-income cancellation, ally-permission timing, Emperor special free-revival income and full card-window integration remain audit items; tournament-wide free-income cancellation rules have not been silently adopted.
• Verification: all 368 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 21 focused revival scenarios cover private quotes, rejection/immutability, zero-price and KH revival, captured/concealed leaders, repeated free-income prevention, canceled discounts/limits/payments, Zoal rounding, elite/tech-token accounting, Emperor funding and complete AI phase progression. Final TypeScript, lint and production build pass. No browser visual QA or deployment. The original goal remains active; expansion starts stay gated until their full rules and interactions are complete.

Foreign ghola checkpoint

• Added game/leader-control.ts and persistent Leader.gholaBy. Every leader remains a single record under its original faction, preserving traitor identity and death history; ghola control overrides native use, and temporary Harkonnen capture overrides ghola control. The engine, battle preparation, battle selectors and AI share the controller predicate. Public ghola pools are projected without copying authoritative identities.
• Advanced Tleilaxu can acquire dead foreign leaders during Revival at their discounted bank price while their active controlled pool has fewer than five leaders. Multiple acquisitions are allowed up to that pool limit. Face-down executed leaders remain eligible and retain death counts. KH and the Auditor are excluded. The full-price discount cancellation still reprices before any payment or transfer.
• Acquisition has a dedicated Karama response. Cancellation aborts it without spice or leader mutation and blocks that particular foreign leader for the current turn; another eligible leader can be chosen. Selected pending identities and canceled-identity history remain private to Tleilaxu. The turn key persists independently of Revival-phase initialization.
• Foreign gholas remain associated with Tleilaxu after death. A living ghola cannot be sold back. The native faction may request a private dead-ghola buyback through the existing quote/decline/accept controls even when all its native leaders are unavailable. Acceptance restores native control and uses the one-leader revival allowance. Stale quotes are revalidated. Ordinary paid revival and Emperor special revival cannot bypass ghola ownership; the Ghola treachery card can revive an existing leader in the acting faction's controlled pool.
• A foreign ghola is unavailable to its native faction for ordinary cycle eligibility. It can fight for Tleilaxu, turn traitor under its original identity, die again and retain the death history. Capture of a foreign ghola now reveals the captured identity to its current controller and Harkonnen; the original faction is an outsider to that capture. Capture logs identify the losing controller. After one Harkonnen use, capture clears and Tleilaxu control resumes.
• Added foreign-ghola revival controls, price/limit checks, pool status, dead-ghola buyback labels and a searchable internal tleilaxu-gholas rule topic. All four AI difficulties select affordable gholas from their personalized projection, recognize combat control and request eligible buybacks when their native leaders are unavailable. No player-facing external links were added.
• Primary evidence: publisher Ix rulebook p7 (acquisition and five-active-leader pool), p10 (buyback permission) and p12 (Karama table); November 2020 official FAQ p6 supersedes the older living-ghola buyback wording, confirms multiple foreign revivals and face-down leader history. CHOAM rulebook p8 excludes the Auditor. Original sources and the genuine PDF mirror remain recorded above. Remaining audits include exact buyback pricing/normal-revival and card exceptions, captured-leader pool counting, returning own leaders above five total active leaders, Harkonnen native-ghola/captive-release edges, cancellation timing and all leader-skill/homeworld/Ecaz interactions. Tleilaxu special Karama remains unimplemented; expansion starts remain gated.
• Sixteen focused scenarios cover acquisition/payment/identity conservation, JSON/public pools, five-leader cap, authority/timing/funds, specific cancellation and privacy, discount cancellation, face-down leaders, living/stale/declined buybacks, original-owner cycles, Ghola card ownership, traitors, illegal native battle use, capture and return, all AI difficulties and complete AI revival progression. Final full verification passes all 384 engine/AI/reference tests, including the additional AI buyback-selection regression. All four persisted multiplayer journeys also pass. TypeScript, lint and the production build pass. No browser visual QA or deployment. The full goal remains active and incomplete.

Tleilaxu special Karama checkpoint

• Added an authoritative revivalStop decision before another faction's advanced normal revival commits. The window appears independently of Tleilaxu's hidden card holdings while their once-per-game power is unused. Only Tleilaxu may allow or spend a real Karama. The decision exposes the recipient and force/leader category, not the pending identity, price or private continuation. A successful stop consumes the card once, marks the special power spent permanently and cancels the pending transaction without spice, force, leader, elite or ordinary-revival quota mutation.

• Current implementation prevents the selected faction's remaining normal force and leader revivals for that turn's Revival phase. It covers ordinary revivals, negotiated leaders, buybacks, KH and Emperor-funded allied extra forces. Requests for the stopped faction are cleared; later requests/revivals reject, while other factions and the next turn remain eligible. Already completed revivals are not undone. Ghola treachery and Emperor special Karama currently remain separate. No ordinary cancellation response is created for the special use itself.

• Emperor allied extra revivals now use the shared pending revival transaction after their ordinary Emperor-power response. The Emperor remains the payer; the ally receives forces and the separate extra quota; Tleilaxu receives paid-revival income only after completion. A stopped extra revival consumes neither the Emperor's spice nor the ally's force/elite/extra quota. Shared transactions carry explicit payer/source fields and serialize through JSON.

• Added a player decision panel, matching tooltip, public prevention status, blocked-revival guidance and updated internal faction/special-power/coverage references. All four AI difficulties allow without a Karama, protect allies and use public tank/leader threats to choose when to spend it. Blocked bots pass normal Revival and continue the game; the policy does not inspect rival spice or concealed leader identities.

• Primary source: printed publisher Ix rulebook p6 and indexed official PDF describe preventing a player's revival, forces and/or leader. This wording is brief and does not independently settle every duration or exception. November FAQ p7–8 clarifies ordinary Karama effects, which must not be confused with this special power. WBC 2022's explicitly amended tournament reference describes full-turn normal-revival prevention and a Ghola-card exception, but is not itself proof of target GF9 rules. The current full-turn scope, guaranteed declaration window, Ghola/Emperor-special exceptions, interactions with prior partial revival and later CHOAM/card-prevention effects remain explicitly provisional audit items. Expansion starts remain disabled; do not label the full Tleilaxu rules certified.

• Eleven focused special-power tests cover private/public windows independent of holdings, ownership and card validation, immutable rejected actions, permanent one-use tracking, stopped force/leader/KH/elite transactions, private negotiated requests, continuation into ordinary response chains, Emperor-funded payment/quota accounting, card exceptions, public-knowledge AI policies and complete blocked-phase progression. Existing revival and foreign-ghola test helpers now explicitly allow the new decision where those tests exercise a completed revival. Final verification: all 395 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass after a test-only const correction. No browser visual QA or deployment; the original goal remains active.

• Next concrete expansion work: Ixian cyborg/suboid force model and casualty substitution, then setup/auction technology and Hidden Mobile Stronghold. Printed Ix p8–9 establishes 7 cyborgs/13 suboids, initial 3+3 in the mobile stronghold, cyborg strength 2/movement 2/collection 3/revival 3, suboid strength one-half and post-loss substitution. The current combat model assumes normal strength one (or unsupported one-half); it must be generalized before Ix is enabled.

Ixian combat and suboid substitution checkpoint

• Generalized CombatForces with a fixed-half-strength normal-force mode. Ixian suboids always contribute one-half in basic and advanced play and cannot consume spice support. Basic cyborgs contribute two; advanced cyborgs contribute one unsupported or two for one spice. Other factions preserve their existing basic/advanced arithmetic. validatePlan, casualty resolution and AI now accept the Ixian half-strength basic dial range, with matching human/prescience input controls.
• Ixian leader/force identity stays within the existing physical-force model: seven cyborgs are tracked as a subset of twenty total forces, with thirteen suboids as the remainder. The lobby initializes seven cyborgs; changing factions clears or restores that subset appropriately. Base-game start also clears stale force-type metadata. Mobile stronghold setup remains gated and unimplemented.
• Basic Ixian double-strength cancellation now enters the pre-plan Karama queue. The November FAQ specifically limits this cancellation to basic cyborg strength; advanced cyborg and suboid strength do not receive that response. Suboid substitution has its own separate cancellation window when the owner chooses the exchange.
• Winning Ixians choose matching physical casualties in both game modes. The engine records cyborg losses by sector. If surviving suboids remain, ixSubstitution allows a partial/full exchange or decline. Selected surviving suboids go to the tanks and an equal number of cyborgs lost in that battle return to their original casualty sectors. Total physical casualties and the seven-cyborg inventory are preserved; unrelated prior cyborg deaths cannot be recovered. The loss and recovery transaction serializes, rejects invalid sources/counts immutably and resumes winner card choices/tech transfers/capture/Face Dancers after its response.
• Added components/ix-substitution.tsx with sector/count controls, distinct suboid/cyborg casualty labels, dial guidance/tooltips, internal faction rules and a searchable ix-forces topic with the printed example. All four AI policies generate legal basic/advanced plans using the shared solver and can make legal substitutions. Relative strength and opponent force-type estimation still require calibration.
• Primary evidence: publisher Ix rulebook p9 (force strengths, fixed suboid support, movement/collection/revival, substitution) and p10 (two cyborgs plus six suboids dialing six, then sacrificing the two surviving suboids to retain both lost cyborgs); November 2020 official FAQ p7 (basic-only cyborg-strength cancellation, substitution cancellation, no suboid-strength effect). The genuine local PDF/text remains /tmp/dune-rules/ix-official-mirror.pdf and .txt. Exact multi-sector loss selection/substitution restoration, later mobile-stronghold sectors, additional card timing and expansion interactions remain audit items.
• Fifteen focused tests cover the printed example in both modes, independent exhaustive token assignments, unsupported/supported cyborgs, unboostable suboids, half-strength basic plans, physical/typed conservation, optional/partial/canceled substitution, ownership and input validation, multi-sector restoration, traitor destruction, all AI difficulties and lobby force-type cleanup. Final verification: all 410 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass, including the final basic-Ixian 20.5-strength input-range correction. No browser visual QA or deployment; the original goal remains active and expansion starts remain gated.
• Next required Ixian work: cyborg movement and collection capacity, per-type revival pricing and free-revival selection/limits, complete Hidden Mobile Stronghold setup/occupancy/movement/protection/income, auction/setup technology and its ally/special Karama interactions. Combat support does not establish complete Ixian play.

Ixian movement, collection and revival checkpoint

• Cyborgs in the selected group now allow two-territory movement, carrying accompanying suboids. Cyborgs left behind do not grant speed. Ornithopters still grant three to either type. A move needing cyborg speed stores the validated group/sector/type choices in pendingIxMove, opens a Karama response before removal, and resumes through shared completeMove if allowed. Cancellation preserves the army and movement opportunity but restricts cyborg speed for that movement index; a shorter move remains legal. Exact cancellation duration across Hajr and broader simultaneous movement windows remain audit items.
• Normal spice collection now counts cyborg capacity as three per token while suboids retain the normal two/three ornithopter rate. Collection remains sector-specific and excludes storm/advisors. This is ordinary ground collection; mobile-stronghold travel income is still unimplemented.
• forceRevivalPrice and paidForceRevivalCost share typed prices between engine, UI and AI. Each paid cyborg costs three spice and suboid two. The free allowance may be assigned to either type via an explicit free-cyborg count; the UI offers cyborg-first or suboid-first selection. Default allocation uses free cyborgs first. Mixed Tleilaxu discounts halve the paid total and round up; discount cancellation restores the original typed total before payment. This aggregate mixed-price rounding remains part of the complete cross-faction economy audit.
• eliteRevivalRemaining distinguishes the one-per-turn Sardaukar/Fedaykin restriction from cyborg inventory. Cyborgs may fill their ordinary force-revival allowance with multiple cyborgs, and Ghola can return several more without consuming the ordinary allowance. All paths retain physical and typed counts. The official November FAQ p2 names Sardaukar/Fedaykin explicitly; it does not impose their limit on cyborgs.
• Emperor-funded extra returns now validate and pay each selected force's actual type price, with no free allowance. The Emperor is still the payer and the ally's extra quota remains separate. Cyborgs therefore cost three each in the current implementation; the printed Emperor ability pays revival costs without a cyborg-specific exception. That expansion interaction remains an explicit primary-source audit item alongside later homeworld/CHOAM effects.
• Added seven-cyborg-capacity force selectors, movement/cost guidance, free-type selection, correct mixed price previews and typed selectors for Ghola cards and Emperor allied extras. The Emperor's own elite choice and its ally's extra-revival choice are separate UI state. AI revival candidates now enumerate affordable amounts/type mixes using the same prices and proper special-force allowance; existing movement candidates can use the newly legal speed and complete response windows. Stronger economic/movement cancellation strategy still needs calibration.
• Thirteen focused scenarios cover mixed/selected-only/multi-sector movement, saved continuation, canceled retry and shorter move, ornithopters, collection capacity, explicit free-type pricing, multiple cyborg returns/Ghola and base elite limits, Tleilaxu discounts/cancellation, Emperor funding/funds rejection, shipment count/type conservation and all AI difficulties. All 423 engine/AI/reference tests and all four persisted multiplayer journeys pass. Final TypeScript, lint and production build pass, including the explicit Ghola/Emperor ally selectors and a test-only const correction. No browser visual QA or deployment. The goal remains active and incomplete.
• Primary sources: printed publisher Ix p8–9 and November 2020 FAQ p2/p7. Remaining Ixian work: complete Hidden Mobile Stronghold setup/occupancy/entry/movement/protection/income, setup and auction technology, allied card replacement, special Karama and full interaction audit. Live expansion starts remain gated.

Hidden Mobile Stronghold checkpoint

• Added room-local mobile-stronghold state and an explicit virtual territory at hidden_mobile_stronghold:0. gameTerritories includes it only after placement; gameDistance connects it through its pointing sector with a one-territory entry/exit cost. Shared printed board metadata and other rooms remain unchanged. Normal movement, battle enumeration, stronghold victory and allied co-occupation checks now enumerate room territories. Expansion starts remain gated.
• The future Ix setup branch assigns three cyborgs and three suboids inside, with four cyborgs and ten suboids in reserves. The initial placement decision occurs after first-storm destruction and before the Spice Blow opening/advanced Fremen forecast. It accepts canonical sectors in non-stronghold territories, including Polar Sink. Advanced BG setup cannot use an unplaced mobile stronghold.
• Later Storm initialization offers an occupied Ixian stronghold relocation before dials or the advanced storm-card reveal. Declining resumes that initialization once. A route consists of adjacent printed sector locations, charges one per territory transition, forbids duplicate locations and ends in a non-stronghold territory within three steps. The normalized declaration survives JSON persistence. A public Karama response precedes movement/income; cancellation preserves pieces, location and spice, consumes that opportunity and resumes storm initialization.
• Relocation keeps every occupant inside. Current collection interpretation takes up to two spice per Ixian force from each visited spice sector, including departure and arrival, optionally declined for the whole route. It does not grant cyborg/ornithopter collection bonuses inside. This per-pile capacity and the no-repeat/within-territory sector-route interpretation are explicitly provisional pending further primary clarification, not certified full compliance. Storm-sector traversal is corrected in the later checkpoint below using the explicit printed p11 answer: relocation into, out of or through storm is forbidden. Passage through printed strongholds and the relationship between entry cost and separate movement opportunities remain audit items.
• Ixians may ship directly inside at ordinary stronghold rates, regardless of controller, subject to normal capacity/alliance restrictions. Other factions, including Guild cross-shippers, cannot. Advanced BG accompaniment is supported. Ordinary forces enter/exit only through the pointing sector; a storm there blocks transit. Inside forces remain separate from outside territory worms/storms and battles. Captured control counts toward the controller's win but never grants relocation authority. Contested/advisor-only occupation does not grant a winning hold.
• Advanced Ix special Karama relocates at most two territories on its own Shipment and Movement turn, requires occupying Ixian forces, spends a real card once, and leaves normal shipment/movement counters intact. It uses the same provisional route/collection interpretation. Later special-power cancellation and expansion interactions remain audit items.
• Added an original SVG stronghold marker, dotted attachment line, destination/force overlays, a keyboard-native sector-route editor with undo/collection preview, public pending-route display, special-Karama route controls, tooltip and searchable partial rules topic. No player-facing external navigation was added. No browser visual QA was performed or authorized.
• All four AI levels can place and relocate via private projections, use profitable special relocation, and move armies into/out of the virtual territory. Fixed movement-candidate filtering so unreachable high-scoring destinations cannot crowd out all reachable options before the 24-candidate limit. Relative strength and strategic placement remain uncalibrated.
• Twenty new scenarios cover room isolation, serialized timing/cancellation, invalid placement/routes and rollback, direct/Guild/BG shipping, movement cost/storm obstruction, capacity, inside/outside worms/battles, controller/contested/advisor victory, captured/empty movement restrictions, advanced reveal ordering, special Karama, all AI levels and BG setup validation. 443 unit/AI/reference tests and 4 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment. Goal remains active and incomplete.
• Primary evidence: publisher Ix rulebook p8–10 (initial forces, mobile stronghold, BG accompaniment), p6 (special Karama) and November 2020 FAQ p7 (movement/collection cancellation), using the genuine publisher PDF mirror already recorded above. The currently indexed publisher copy at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf confirms p9 wording. Do not adopt tournament/house amendments to fill the provisional items silently.
• Next concrete work: Ixian setup/auction technology and allied purchased-card replacement, including their Karama/timing/private-information handling; then complete Ix deck assembly and the remaining advanced/expansion audits. CHOAM/Richese and Ecaz/Moritani engines and optional modules, full rules compliance, art/presentation polish and final validated deployment are still required.

Ixian setup and auction technology checkpoint

• Wired the future gated Ixian start path to draw one starting card per faction into a private choice. Selecting one shuffles and privately deals the remainder; Harkonnen then draws its extra card from the deck. Pending choice prevents setup completion, is owned by Ixians, and survives JSON serialization. The decision/dealing path is exercised in setup fixtures; public expansion starts still reject unfinished rules and are not claimed end-to-end complete.
• Beginning an Ixian bidding round offers a public Karama window before any cards are drawn or inspected. Allowing draws the eligible-bidder count plus one, then offers a private card/top-or-bottom choice. The remaining cards are shuffled for bidding. Canceling draws only the ordinary count, with no Ixian inspection. A full Ixian hand does not disable this faction advantage; zero eligible bidders skip it. The chosen deck end is publicly logged, while card identity remains private.
• The private projection records an unordered inspected pool. It never exposes the actual next card to Ixians or the pool to other factions. The record includes cards already auctioned and deduplicates an earlier purchase returned through technology; it is not an inferred view of remaining hidden hands. UI labels make this distinction explicit.
• Advanced technology is offered before each card's bidding and before Atreides' independent inspection response. Ixians commit a hand card without seeing the incoming card; a separate Karama window precedes the swap. Declining preserves the option for another card. Declaring uses the round's attempt even if canceled. Successful exchange preserves hand count and makes the replacement the card Atreides can inspect. Canceling pool inspection does not also cancel advanced substitution.
• After an ally purchases a card, the buyer may keep it or request replacement before Emperor income and Harkonnen's separate bonus draw. The replacement response belongs to Ixians and names the buyer publicly; only the buyer sees the purchased identity. Success discards that exact purchase and draws the top deck card privately. Spice payment remains settled exactly once, canceled/declined replacements preserve the purchase, and Karama-paid purchases qualify without Emperor income. Bonus cards do not recursively receive this purchased-card privilege.
• Existing Harkonnen special exchanges can interrupt these windows. A pending offered card that no longer belongs to Ixians skips the stale swap and resumes Atreides inspection; a stale purchased-card decision exposes no replacement and can be declined to settle the sale. These recovery paths preserve card ownership and progress. The exact legality/order of such interruptions remains a primary timing audit rather than certification of every interaction. Bene Gesserit Worthless conversion cancellation restores the suspended private Ixian response correctly.
• Added the IxTechnology decision component, setup-aware decision routing, inspected-pool details, tooltip, searchable partial technology rules, updated faction guidance/coverage page, and all four AI policies. AI chooses starting cards, prepares pools, evaluates offered cards against known pool values and replaces weak allied purchases; complete advanced bidding phases terminate through legal private projections at every level. Strategic strength remains uncalibrated.
• Twenty-one new technology tests cover pre-draw cancellation/privacy, eligible/full-hand counts, top/bottom placement, invalid/unauthorized choices, order-independent pool projection, pre-Atreides swaps, one-attempt timing, setup/Harkonnen conservation, paid/free/allied/Harkonnen purchase sequencing, Worthless reactions, stale-card recovery, empty/short decks and every AI level. Short-deck fallback permits a lone available card to auction without removing it; multi-card insufficient-pool behavior remains an explicit rules audit, alongside Richese/other auction modes and exact Amal phase-opening order.
• Primary evidence: publisher Ixians & Tleilaxu p8 (initial and bidding preparation), p9 (advanced substitution and alliance), p11 (explicit Harkonnen extra setup draw), and November 2020 FAQ p7 (three distinct cancelable advantages). Publisher URLs and the genuine mirror remain in the source ledger. No tournament amendments were adopted.

Mobile stronghold storm correction

• The same printed Ix rulebook p11 explicitly answers No to relocation into, out of or through a storm. This contradicts the earlier provisional allowance. validateMobileMove now rejects storm departure, arrival and transit before any special card or resources are spent. AI route generation and the sector-route control share the restriction; an occupied stronghold whose pointer is currently in storm can remain in place until the storm clears.
• Ordinary stronghold storm obstruction also applies to battles inside: the battle check uses the pointing sector, not the virtual internal sector zero. Storm/worm casualty immunity remains. A contested stronghold covered by storm grants no winning control; uncontested control still counts like a printed stronghold. This follows the general stronghold obstruction clarification in the November 2020 FAQ p1; no separate HMS battle exception was found.
• Two added scenarios reject ordinary/special storm routes without mutation and ensure AI routes avoid storm, including blocked origins. The existing internal-battle test now verifies storm obstruction and resumed battle after the pointer clears. Updated tooltips, searchable rules and the earlier provisional ledger note.
• 466 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The focused 21-test technology suite also passes after the final public deck-end log refinement. No browser visual QA or deployment. Goal remains active and incomplete.
• Next concrete work: audit and assemble the complete fourteen-card Ix expansion inventory, resolve remaining card/auction/mobile-stronghold interpretation gaps and integrate the advanced/base systems. CHOAM/Richese, Ecaz/Moritani, optional modules, full rules compliance, presentation/art refinement and final validated deployment remain required.

Complete Ix treachery inventory checkpoint

• Added the six remaining ordinary-type cards: Hunter Seeker, Basilia Weapon, Shield, Snooper, Harvester and Kull Wahad. ixDeck() composes these with the six special battle cards, Thumper and Amal; treacheryDeck(['ix']) returns 47 distinct cards. Existing base and Ix IDs remain stable; factories return fresh instances. Repeating the Ix option does not duplicate the set. Requests for unimplemented CHOAM/Ecaz/unknown decks fail explicitly. The future gated start path now uses this deck assembler; public expansion starts remain disabled.
• Corrected the base poison at treachery-7 from Basilia Weapon to Ellaca Drug. Projections and action processing normalize that exact legacy ID/name in hands, deck, discard, auction and private Ix pools after cloning state. Expansion Basilia retains its own name and identity; original input states and historical logs are untouched.
• AI prescience recognition now looks up the complete implemented card catalog, including the additional ordinary weapons and defenses. Ordinary rule kinds preserve matching defense, Voice, lasgun/Shield and advanced BG Worthless conversion behavior without special duplicate-name dispatch.
• The second Harvester exposed the old one-use-per-blow assumption. Current behavior allows each physical copy to double the open fresh blow again, leaves pre-existing spice unchanged, resets table acceptance, and tracks the number of plays. Storm still prevents placement. Worm destruction explicitly closes the Harvester window, so adding another copy cannot resurrect spice. A shared availability helper drives engine, AI and guidance. Ambiguous legacy harvested windows stay closed; old live base rooms have only one Harvester.
• Multiple-Harvester timing and multiplier interpretation remain provisional pending primary card-face verification. The card names/count are corroborated secondary inventory facts, with the publisher independently establishing the fourteen-card total. This step improves the implementation without claiming that every card interaction is certified. Full provenance and unresolved limits are in docs/CARD_INVENTORY.md.
• Added a searchable internal Ix deck topic, corrected stale faction/coverage descriptions and updated fresh-blow guidance. No external navigation or copied publisher art was added to the app. Harvester coverage is now honestly marked partial for the multi-copy audit.
• Nine new tests verify exact card names/counts/identities, independent factories, rule types/Voice/Karama, duplicate Harvester conservation and timing, worm/storm restrictions, authoritative Shield explosions and poison leader kills, immutable legacy-name normalization, all AI Harvester choices, and complete six-base-faction Hard/Brutal games with all 47 cards conserved. These full-deck games are engine simulations; the four persisted multiplayer journeys still cover the currently enabled base/tech-token modes.
• 475 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. No browser visual QA or deployment. Goal remains active and incomplete.
• Source evidence: publisher Ix p4; unamended inventory portions of the Landsraad compilation corroborated by Ludopedia component-sheet listings; primary designer video page identifying the fourteen-card overview. Designer captions/transcript and the located retailer card photo could not be retrieved, so no card-by-card primary inspection is claimed from them. The source audit explicitly avoids importing tournament changes or the compilation's incorrect Ellaca defense description.
• Next substantive work: close base Truthtrance and binding-choice support, then continue the remaining base/advanced timing and expansion engines/modules. Card-face audits, mobile-stronghold collection/entry interpretations, CHOAM/Richese, Ecaz/Moritani, skills/strongholds/homeworlds/Nexus/discovery, complete internal guidance, generated card/leader art and presentation polish, and final validated deployment all remain required.

Truthtrance question-flow checkpoint

• Added game/truthtrance.ts with a persistent overlay (priority → ask → answer, plus unknown for retry/save). The original response, decision, auction, phase opening, storm/spice state and sealed battle remain in place, so completing a question does not reconstruct or replay their effects. The engine rejects unrelated actions while the overlay is active. Setup completion also waits for the overlay to finish.
• Competing declarations are collected before any question is asked, then sorted by storm order. A holder can declare either or both physical copies. Each definite answer discards exactly its own card; an unknown answer leaves that card available for a different question or later play. The original input state remains immutable, and JSON round-trips preserve pending questions.
• Structured facts cover exact named cards currently held and selected traitor identities, including Cheap Hero. AND/OR combinations expose only the combined Yes/No answer. The server rejects dishonest fact answers, forged targets/card identities, invalid answers and malformed or excessive predicate trees. Only the target's personalized projection includes the expected fact answer before publication; no hand, traitor list or matching disjunct is revealed to other seats.
• Freeform game-related questions accept public Yes/No/unknown responses. An explicit current-turn scope records promises for the table; the engine does not yet enforce the meaning of freeform questions or arbitrary promises. The app/reference state this limitation. Future-turn scope is rejected by the structured payload; natural-language meaning still relies on human players. Facts and promises are recorded with turn/phase and retained in authoritative history.
• The dedicated React action panel remains available above suspended phase/faction controls. Hand cards can declare Truthtrance during those windows. It offers named-card/traitor clauses, AND/OR, a freeform question field, public answer controls, retry/save and current-turn history. Existing internal rule navigation is used; no external links or copied publisher assets were added.
• All four AI levels pass priority, answer server-verified facts through their private view, ask a structured question when resolving their own declaration and save an unanswerable question. AI freeform interpretation and proactive strategic use of Truthtrance remain unfinished. Bots return unknown instead of inventing a freeform answer.
• Twelve focused tests cover storm-order races, separate two-copy disposal, privacy, dishonest/malformed actions, immutable interruption of five window types, sealed plans, JSON reconnects, unknown/retry/save, current-turn records, incomplete setup and all four AI levels. The existing persisted multiplayer journeys cover the unchanged authoritative action/version/private-seat boundary; a dedicated persisted Truthtrance journey is still required.
• Source: GF9 November 2020 FAQ p8, https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (indexed primary text). It establishes any-time play, game-related yes/no questions, current-turn commitments and impossibility, AND/OR, storm order, and unknown/retry/save. The base rulebook p23 supports Truthtrance during Voice/prescience interactions. Exact printed card-face/immediate-pause wording and a general simultaneous-action timing audit still need primary verification; secondary tournament amendments were not adopted as certification.
• Remaining Truthtrance work: binding current-battle plans and current-turn shipment/other decisions with feasibility escape; arbitrary human commitments and disputes; AI interpretation, question selection and use of learned facts; guaranteed interrupt opportunities between currently atomic game effects; priority/timing audit and complete persisted multiplayer scenarios. Full base/advanced/expansion compliance remains incomplete, with advanced and expansion starts still gated.
• Verified checkpoint: 487 unit/AI/reference tests + 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. New form styling includes consistent dark controls, keyboard focus, grouped fact fields and wrapping for long questions. No browser visual QA or deployment was performed. The active full-game goal is not complete or blocked.

Binding battle Truthtrance checkpoint

• Added game/battle-promises.ts: validated conditions for dial equality/ranges, spice support, named weapon/defense slots (including empty slots and duplicate physical cards), exact leader/Cheap Hero identity, Kwisatz use, and bounded AND/OR combinations. Definite current-battle answers create public constraints attached to that battle; the recorded question receives the actual territory from the server. Arbitrary freeform/current-turn promises remain available and explicitly unenforced.
• The engine searches full legal completions for an answer, including previous active Truthtrance conditions, Voice, prescience, card-role pairings, controlled leaders, support, elite strength and Ixian half-strength suboids. It only offers answers with a currently legal completion; a sealed plan fixes its answer without exposing its other elements or acquiring new mutable commitments. The search consults the questioned player's private choices and public opponent properties, never the opponent's hidden plan or hand.
• Battle-plan validation enforces all active answers while leaving unrelated elements free. AND/OR conditions preserve alternative completions instead of secretly selecting and locking a witness. Contradictory later answers and prescience values are rejected. The prescience existence check now uses full-plan search when Truthtrance restricts an unshown element, removing the old assumption that all other numeric values can be zero.
• Integration exposed and fixed an existing basic Ixian prescience bug: the API now accepts legal half-point dials for Ixians, matching the existing UI and battle validator. A test specifically reveals 2.5 under a bound Ixian dial.
• A pending Voice response resolves before impossibility releases are considered, so a canceled Voice retains the original answer. After an opposing effect completes, promises are evaluated in their declaration order; an impossible one is publicly released while feasible earlier obligations remain. Canceling Fremen free support and elite strength participates in this search. Voluntary card spending, bribes and aid pledges that would make the actor's still-feasible battle promise impossible are rejected atomically.
• Personalized views expose answer options only to the target, and a legal example plan only to its owner. The React interface adds battle condition fields, public bindings/release status, and a private preview that can populate the editable battle form without sealing it. Tooltips and the internal rules explain the feature and its limits. All four bot levels can choose a feasible answer, filter their candidate plans against existing commitments, and use an authoritative private completion when their heuristic candidate set lacks a required exact dial/support/Kwisatz choice.
• Seventeen new tests cover immutable/public-versus-private state, overlapping Yes/No answers, OR alternatives, dual-role Ix pairs, sealed plans, prescience, pending/canceled/completed Voice, voluntary spice/card evasion, optional Kwisatz flags, duplicate cards and Cheap Heroes, basic Ix half dials, malformed payloads, all four AI levels, Fremen/elite cancellations, and comparison of offered answers against an exhaustive authoritative basic-plan oracle. The full Truthtrance-focused group is 29 tests.
• Still partial: feasibility explores currently available plans, not multi-action futures such as reviving a currently dead leader before committing, additional Karama/card sequences, or acquiring a new choice later. Released answers currently stay released; exact revalidation behavior, cancellation timing, self-caused impossibility and multi-promise ordering need a primary-source interaction audit. Guaranteed interrupt opportunities between atomic engine actions also remain unfinished. Do not call this full Truthtrance compliance.
• Source basis remains the official GF9 November 2020 FAQ p8 (current-turn obligations, impossibility, AND/OR, storm order) and base rulebook p23 (Truthtrance during Voice/prescience and freedom to alter unaffected plan components). Tournament amendments requiring reactivation of previously invalid answers are not silently treated as the printed publisher rule.
• Next work: current-turn shipment and broader binding decisions, future-action feasibility/card-sequence audit and persisted Truthtrance game scenarios; complete remaining base/advanced interactions and all expansion faction/module engines. CHOAM/Richese, Ecaz/Moritani, optional skills/strongholds/homeworlds/Nexus/discovery, AI calibration, complete guidance, generated art/AAA polish and final validated deployment remain part of the active goal. Advanced/expansion starts remain gated.
• Verified checkpoint: 504 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. No browser visual QA or deployment. The full-game goal remains active and incomplete.

Reachable Ghola battle preparation checkpoint

• Expanded battle-answer feasibility from currently legal plans to plans reachable through actual Ghola cards in the questioned player's hand. A bounded-by-card-consumption search explores eligible controlled dead leaders, Atreides' dead Kwisatz, and valid force/elite revival choices. Each physical card is consumed in its simulated branch, so one Ghola cannot revive both a leader and KH. Revived forces remain in reserves and never inflate the current battle's army.
• Extracted applyGholaEffect from the existing card dispatcher so real play and lookahead share revival/control/quota/income logic. The search uses independent state clones and never spends a real card, changes a real leader or leaks rival hands/plans. Selected preparations are suggestions, not locks: other legal ways to satisfy an OR condition remain available. Diverting the last needed Ghola to an incompatible revival is rejected atomically by existing promise enforcement.
• A pending Tleilaxu revival-income response is modeled as a possible future receipt, not currently spendable spice. This includes the original income response suspended beneath a BG Worthless Karama conversion. Promise feasibility waits for the outcome; allowing income enables the supported plan, while successful cancellation releases an otherwise impossible answer without undoing the actual revival. Another faction's income and deferred tech-token income cannot fund the questioned player's current battle.
• Prescience also recognizes Ghola-reachable leaders, including when there is no preceding Truthtrance. A player's personalized battle view exposes compliantPreparation (needed card actions, possible plan, income-wait flag) separately from compliantPlan, which remains immediately legal. The React guide offers a real Ghola play, disables it during other pending windows, and leaves final plan review/sealing separate. All four AI levels execute a required preparation before committing or answering a prescience element.
• Twelve tests cover untouched authoritative state and private projections, pending JSON reconnects, Ghola-to-leader completion, prescience with/without a prior promise, physical-card limits, KH/hero dependencies, native/captured/foreign-ghola control, incompatible diversions and OR alternatives, Tleilaxu income and real/Worthless Karama outcomes, unavailable third-party funding, reserve-force conservation, all four AI levels and sealed-plan immutability. The full Truthtrance-related focused group now contains 41 tests.
• Primary evidence: official base rulebook FAQ p22, https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf, explicitly permits a leader revived by Ghola during Battle to fight in that Battle Phase. The November 2020 FAQ p8 supplies the Truthtrance current-turn obligation/impossibility principle. KH and foreign-ghola treatment reuse the existing engine's revival rules; their outstanding broader source audit is not claimed complete by this step. Older PBEM/tournament restrictions forbidding same-phase Ghola use were not adopted.
• Still required: other future card/power sequences, precise interruption and reactivation rules, current-turn shipment/other obligations and freeform commitment enforcement, dedicated persisted Truthtrance journeys, remaining base/advanced rules and every expansion/module. This addition does not enable advanced/expansion starts or establish full rules compliance. No browser visual QA or deployment was performed.
• Verified checkpoint: 516 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; the 41-test Truthtrance group also passes after expanding AI prescience scenarios. TypeScript, lint and the final production build pass. The full-game goal remains active and incomplete.

CHOAM charity and hand-limit checkpoint

• Publisher CHOAM & Richese rulebook pp. 7–8 and p. 12 cancellation table, verified through the indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . CHOAM takes two spice for each faction, including itself, before other claims. Other factions take their charity from CHOAM. Karama cancels the income and sends charity to the bank, with ordinary charity still available to eligible CHOAM. Printed hand limit is five.

• Added game/charity.ts for shared entitlement and payer selection. beginPhase opens a public CHOAM-income response after any Ix/Amal phase opening. Settlement persists the turn and cancellation state. Ordinary and advanced Bene Gesserit claims transfer actual spice from CHOAM; wealthy Bene Gesserit still has its own cancellation window before any transfer. Cancellation restores bank payments for this turn only. Claimed charity continues to trigger existing Spice Production rules.

• Private projection exposes only the current player's entitlement and the public payer/status. Other players' spice and claim flags remain private. Shared hand limit now supports CHOAM's fifth purchase, and the hand tab displays current count/capacity. UI names the income response and payer; internal rules include a linked, explicitly partial CHOAM economy topic. All four bot levels resolve the response and claim eligible charity; Brutal may spend Karama on enemy income and preserves allied income.

• Fifteen focused scenarios in tests/choam-charity.test.ts cover income timing, ordinary/advanced payout conservation, both cancellation layers, next-turn reset, Amal order and JSON roundtrip, six-player funding, private views, deferred tech income, fifth-card purchase/full-hand Karama exclusion, AI and retained start gates. Existing Bene Gesserit and reference suites pass alongside them (29 focused tests).

• Deliberate unresolved boundary: the publisher text does not explain insolvency if CHOAM spends away its funds before a claim. The engine rejects an unfunded payout atomically rather than inventing a bank subsidy or negative spice. This is not certified full compliance. Inflation, whether CHOAM's automatic income itself triggers Spice Production, self-claims after spending income, and all later module interactions need source audits. CHOAM remains gated.

• Additional primary findings for upcoming work: start two spice/twenty reserves/free revival zero; paid force revival one spice and unlimited. Karama limits it to three (five with Tleilaxu permission) at two spice each. Mentat Inflation places a Double/Cancel token for the following turn, flips at the next Mentat, then is removed from the game at the subsequent Mentat. Karama prevents initial placement, never the mandatory flip. Double face in play prohibits bribes. Exact doubled ordinary charity entitlement, combined Tleilaxu revival discounts and insolvency remain to verify.

• Remaining CHOAM powers: end-phase duplicate sales, Worthless sales/six special effects, once-per-turn two-way allied card trade, allied battle support, advanced Auditor and battle-support income, special Karama, printed leader data and full setup. Auditor checks two random unused opposing hand cards if alive, one if killed (not win/loss); opponent may pay one spice per card to cancel the audit. It cannot be acquired as a foreign ghola by Tleilaxu, be captured or gain a leader skill; CHOAM’s own Ghola card revival is not prohibited (corrected by the 2026-09-07 Auditor audit). The p. 12 cancellation table also covers card sales/Worthless effects, single-battle force income and the audit.

• Validation for this checkpoint: all 531 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM force revival checkpoint

• Primary rulebook p. 7: no native free revivals, no quantity limit for paid forces, one spice per force. Primary p. 12 Karama table: restore three-force limit (five if Tleilaxu permits) and two-spice price. Indexed official PDF verified again: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Genuine Ix rulebook mirror text /tmp/dune-rules/ix-official-mirror.txt p. 6 states allied force/leader revival at half price rounded up.

• RevivalRules.choamBlocked tracks this combined CHOAM cancellation separately from Tleilaxu quantity/discount cancellation and resets on entering Revival. Shared forceRevivalPrice accepts the cancellation status; CHOAM's native cost precedes any separate Tleilaxu discount. forceRevivalLimit preserves native CHOAM unlimited revival when Tleilaxu permissions are canceled.

• choamRevival response belongs to CHOAM and precedes spending/movement. If canceled, a request beyond the newly applicable total allowance aborts without partial payment or revival. A valid request is repriced; insufficient funds abort without changes. Prior revivals remain completed and count against the new total allowance. Applicable Tleilaxu five-force/discount response windows follow. Canceling only Tleilaxu's discount retains active CHOAM native price. This avoids treating the two independent abilities as a single generic half-price flag.

• Free Fremen allowance remains free and is tracked across requests; a completely free request within the normal three-force allowance does not invoke CHOAM's paid/quantity advantage. Emperor extras retain their existing two-spice price and separate allowance. Tleilaxu income receives actual payment, and advanced Tleilaxu special prevention occurs before the CHOAM response. No leader revival prices changed.

• Private views expose the cancellation flag for the player's force quote; UI displays native pricing and the separate allied discount. All four AI levels use the shared quote before spending. Internal CHOAM reference now links to its force-revival topic; remaining powers and faction start gates are retained.

• Seventeen scenarios in tests/choam-revival.test.ts verify quantities through twenty, cancellation/repricing/affordability, independent powers, actual Tleilaxu income, free and Emperor extras, next-phase reset, earlier completed revival, Tleilaxu prevention, JSON reconnect and private projections, AI budgeting and force/spice conservation. All 53 focused CHOAM/Tleilaxu/Ix economy/reference tests pass.

• Interpretations still needing final combined-expansion audit: applying Tleilaxu half-price to CHOAM's native one-spice rate, aggregate rounding per declared transaction, cancellation recovery by repricing versus a fresh player confirmation, and exceptions introduced by Recruits/homeworlds/leader skills. These tests verify the implementation, not publication certification of unresolved interactions. Full CHOAM starts remain disabled. Printed CHOAM leader data, Auditor, Inflation, Worthless powers/sales, ally trades/support and special Karama remain required.

• Validation: all 548 unit/AI/reference tests and four persisted multiplayer journeys pass. TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM Inflation checkpoint

• Verified primary CHOAM rulebook p. 8 Inflation and p. 12 cancellation table at https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Place either side during Mentat; the following turn doubles/cancels all charity including CHOAM income and advanced Bene Gesserit; next Mentat flips; subsequent Mentat removes from the game. Double face in play prohibits bribes. Only initial placement can be canceled by Karama.

• Newly located primary FAQ p. 10 resolves an earlier open question: CHOAM income alone does NOT trigger Spice Production, and Inflation does NOT affect the tech-token payment. Existing separation is retained and directly tested. Same page also confirms Auditor payment is bounded by cards actually available and cannot be partial, and duplicate-card sales require identical cards (Shield Snooper/Portable Snooper do not match Snooper). Record these for subsequent CHOAM work.

• Added persistent Inflation with side, placement turn, update turn and flip flag; inflationUsed prevents reuse after removal; inflationAttemptTurn prevents retry in a canceled placement phase. choamInflation action is available to CHOAM during Mentat, clears table readiness and opens a public Karama response. Successful placement spends the token; cancellation preserves it for a later Mentat.

• Shared charityMultiplier modifies all ordinary and advanced BG claims and CHOAM per-faction income beginning the turn after placement. Cancel records charity initialization without creating a zero-income response; all claim amounts are zero, including wealthy advanced BG. Karama cancellation of CHOAM income retains Inflation and pays doubled ordinary charity from the bank. BG cancellation still resolves before any charge to CHOAM.

• beginPhase flips/removes the token during Mentat after the existing Ix/Amal opening, without a cancelable response. updatedTurn prevents duplicate advancement. Existing bribes still settle; all new bribe actions are rejected while Double is active, including before the first affected Charity phase. Optional placement occurs during normal Mentat controls after existing automatic victory settlement; a finished game needs no subsequent-turn token placement.

• UI shows the public side, affected turn, next lifecycle event and Double bribe prohibition, plus CHOAM placement buttons/save-by-ready guidance and response explanations. Private entitlement and projected income reflect the multiplier. AI levels choose an initial side using their own wealth/forces (Easy varies); Brutal may cancel enemy Double placement. Bots skip suppressed charity and finish their normal phase actions.

• Fourteen scenarios in tests/choam-inflation.test.ts cover both sequences, once-per-game removal, phase/owner/side validation, canceled placement/retry, ordinary/advanced payouts, both cancellation layers, no repeated flips, bribes and deferred payments, unchanged tech income, Amal ordering, persistence, private/public status and all four AI policies. All 43 focused Inflation/charity/BG/reference tests pass.

• Explicit interpretation still under audit: ordinary charity eligibility remains zero or one spice, and Double multiplies the received amount (four from zero, two from one), rather than changing the threshold or automatically raising wealth to four. Primary wording says charity is doubled but the one-spice example was not located. Canceled placement's later-turn retry and full interactions with homeworlds, leader skills, end-phase sales/trades and other unimplemented modules also require final combined-expansion audit. Complete CHOAM faction starts remain gated.

• Validation for Inflation: all 562 unit/AI/reference tests, all four persisted multiplayer tests, TypeScript, lint and production build pass. Check processes exited successfully; logs are /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM end-phase sales and allied exchange checkpoint

• Verified publisher rulebook p. 7 Treachery and p. 8 Alliance: exact duplicates may be revealed and surplus cards discarded for three spice each at phase end; Worthless cards may be discarded for two spice. One two-way allied card exchange per game turn, at the end of any phase. Primary p. 10 FAQ rejects Shield Snooper/Portable Snooper as duplicates of Snooper. Primary p. 12 cancellation table says prevent discarding a card for spice. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . No tournament changes adopted.

• Game.choamMarket provides an always-present closing decision when CHOAM is in a playing table, independent of hidden hand contents. Normal nextPhase now opens this window; advancePhase performs the original continuation only when CHOAM finishes. Storm's separate continuation is handled by resume: storm and advanceAfterStorm, preserving the existing forecast/opening sequence. Automatically skipped phases still receive their closing opportunity.

• game/choam-market.ts builds private sale choices and validates exact-name witnesses. Any distinct matching copy may be retained. CHOAM declares one physical sale at a time; its card (and duplicate name where applicable) is publicly revealed, then a choamSale Karama response precedes discard and payment. Cancellation leaves the card in hand and blocks that physical card from another sale in this closing window. Other cards may still be sold.

• choamTradeReply lets the ally choose a return card or decline; choamTradeConfirm gives CHOAM final approval or decline. Successful exchange atomically swaps the two cards, preserves hand sizes and spends choamTradeTurn. Declines do not consume the turn's successful trade. The market tracks an attempted offer only to avoid AI repeat loops; the human may renegotiate. Trade cards and sale choices appear only in authorized private projections; public decisions contain no card identities.

• Transactions revalidate card custody at settlement. An interrupted sale with a missing card/witness pays nothing; an impossible trade moves neither card. Truthtrance remains available as an overlay and is tested consuming a pending sale card. Other special powers are currently held until the closing decision completes; bots suppress those competing special-card choices while the market exists.

• components/choam-market.tsx provides sale, offer, reply, confirm/decline and phase-finish controls. UI names all new windows. AI sells eligible surplus/Worthless cards, offers a private exchange, handles empty hands/declines, and finishes the phase; higher levels compare the offered/returned values. Internal reference adds the linked CHOAM market topic. Existing CHOAM test helpers now explicitly finish closing decisions rather than assuming an immediate phase transition.

• Twenty-two focused scenarios verify ownership/timing, invariant public windows, delayed sale payment, exact duplicates and arbitrary retained witness, failed/forged sales, Karama/card preservation, private two-way consent, declines/empty hands, custody changes, tech income and auction escrow settlement, storm/automatic battle/auction continuations, persistence, Truthtrance interruption, AI progress and once-per-turn trade across boundaries. All 66 market/CHOAM/reference focused tests pass.

• Remaining audit boundaries: multi-card simultaneous sales versus serial declarations, whether Karama blocks only the selected sale card or the whole sale power for that phase, required ordering among concurrent end-phase income/refund/sale/trade effects, and other anytime card/special-power interactions in the closing window. The current implementation prioritizes the market before deferred tech income and escrow refunds. Full CHOAM starts remain gated. Worthless special effects, allied battle support, Auditor, printed leaders, special Karama and other expansion modules remain required.

• Validation: all 580 unit/AI/reference tests, four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM special Karama cash-in checkpoint

• Publisher CHOAM & Richese rulebook p. 4 permits the special Karama to discard hand Treachery Cards, including Worthless cards, for three spice apiece at any time. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Implementation applies the existing advanced-game, real-Karama and once-per-game special-power restrictions. The activation Karama is discarded separately and earns no income; a second Karama may be among the selected cash-in cards. The activation-card interpretation and exact interruption boundaries still require final source audit.

• New shared game/choam-karama.ts filters available cards against the player's sealed battle plan and exact prescience commitments. The authoritative action requires distinct owned physical IDs, at least one selected card and a separate activation card; invalid requests are atomic. It preserves a winning auction's funding using available spice plus the auction's actually committed allied payment, or another retained real Karama. Uncommitted ally pledges never count as already committed funding.

• CHOAM may cash in across all nine playing phases, phase-opening decisions, responses, pending revival and market/trade decisions, preserving the interrupted continuation. An active Truthtrance question still resolves first. A pending sale or trade whose offered card was cashed in is revalidated and aborts without duplicate income or partial exchange. Private projections expose only the acting player's eligible cards; public logs reveal counts and income rather than discarded identities.

• components/choam-cash-in.tsx provides activation selection, eligible-card checkboxes and a live gain preview above the private hand. It excludes stale/committed selections and prevents submission during an active Truthtrance question. Internal faction/reference topics explain the implemented power and its outstanding audit boundaries without external player-facing links.

• Battle-plan reachability now explores actual cash-in preparations alongside Ghola through shared authoritative effects on independent clones. Each branch consumes physical cards and the once-per-game power; retained promised weapons/defenses and leaders remain necessary for the resulting legal plan. The existing battle guide shows the required cash-in and lets the player execute the next preparation. All four AI levels can follow a binding promise that needs the proceeds, then seal a compliant plan. Outside battles, bots sell low-value Worthless cards when short of spice while preserving committed auction funding.

• Fourteen tests cover all nine phases, pricing and once-only use, ordinary disposal of an extra Karama, atomic malformed/forged selections, advanced-game restrictions, response/opening preservation, actual Amal order, funding an interrupted revival, invalidated sales/trades, winning-bid funding, sealed/prescience reservations, private JSON projections, all four AI policies and a binding battle promise requiring both cash-in-funded support and a retained defense. The focused cash-in/Ghola/market suite has 44 passing tests.

• Remaining work includes other future battle preparation sequences, special-power timing and activation-card source clarification, CHOAM Worthless effects, allied battle support/income, Auditor and printed leaders, plus remaining factions/modules and full interaction audits. This step does not enable expansion starts or establish complete rules compliance.

• Validation: all 594 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

CHOAM combat funding and force-payment income checkpoint

• Primary CHOAM & Richese rulebook p. 8 verified through the publisher's indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Its alliance rule permits paying some or all of an ally's forces in battle. Advanced Forces pays CHOAM half of other players' force payments, rounded down; its own payments go to the bank, and any revealed traitor prevents the income. Primary p. 12 permits Karama to cancel force-payment collection for one battle. The base November 2020 FAQ p. 7 permits cancellation of alliance powers. Direct publisher PDF fetches remain 403; no local genuine CHOAM PDF was obtained.

• Extended existing authoritative allied escrow to advanced CHOAM during Battle. A new choamBattleFunding decision gives CHOAM a guaranteed chance to set its pledge before ordinary battle preparation begins. Ordinary phase controls can adjust the unspent pledge. A mutual alliance is required; other factions cannot pledge combat funds. A choamBattleAid response precedes sealing and can block the alliance benefit for that battle without consuming the escrow. Later battles get fresh funding/response opportunities.

• Plan.allyPayment records the sealed CHOAM share separately from total support; it is not a prescience-selectable field. The default split spends the combatant's own spice first, then covers its shortfall from eligible escrow. Explicit shares may use more CHOAM funding. Validation bounds total support by actual available resources, rejects foreign/oversized shares, and prevents withdrawal of a committed contribution. Bribes reserve only the combatant's own committed share. Final payment uses the same atomic allied-payment helper as bidding/shipment.

• Unused combat escrow returns after the Battle closing market, alongside the existing phase-end settlement. Pledges remain private to donor/recipient views; an ally does not gain access to the other's spice or sealed plan. Private legal-plan search, prescience feasibility and binding Truthtrance completion now include actual eligible CHOAM funds. Pledged spice cannot bypass a canceled alliance benefit or become a general-purpose transfer.

• Battle resolution records pending CHOAM income from each non-CHOAM combatant's own payment, rounded down separately. CHOAM's own support and the amounts it pays for its ally are excluded. A sole traitor winner spends neither own nor allied support; mutual traitors still pay both commitments. Any traitor suppresses all CHOAM income. An explosion without a traitor still produces normal paid support and income. After casualty/winner-card choices, choamBattleIncome opens a response before technology/capture/Face Dancer continuations. Allowing pays once; canceling sends the amount to the bank without refunding combatants.

• Added private funding controls, payment-split inputs, response explanations, revealed/compliant-plan payment details, linked internal combat reference and tooltip. All four AI levels allocate CHOAM support before allied battles and use it in legal plan generation, including binding support promises. Hard/Brutal may counter an enemy alliance benefit; Brutal may cancel enemy force income. No player-facing external links were added.

• Twenty new scenarios cover funding ownership/timing, mutual alliances, affordability and malformed requests, locked payment shares, explicit splits, per-payer rounding, once-only income, real and BG Worthless Karama responses, canceled funding across two battles, phase refunds, one/two traitors, CHOAM's own payments, Fremen free support, basic-game exclusion, explosions, private projections and JSON reconnects, preserved Atreides full-plan offers, and all four AI levels including a five-spice binding promise with zero own spice. The focused combat/CHOAM Karama/full-plan group has 54 passing tests.

• Remaining audit boundaries: per-player versus combined rounding when both pay odd amounts, exclusion of CHOAM-funded allied contributions under the own-payment clause, exact timing of the alliance cancellation and income versus simultaneous post-battle powers, and later module interactions. The implementation follows the literal payment interpretation, but these edge cases lack explicit publisher examples. Worthless special effects, Auditor/printed leaders, other factions/modules and full-game interaction work remain. Advanced/expansion starts stay gated.

• Validation: all 614 unit/AI/reference tests and all four persisted multiplayer journeys pass; TypeScript, lint and final production build pass. The first full run found only an existing case-sensitive error-message assertion, corrected by restoring compatible wording; the entire suite then passed. All check processes exited successfully. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed. The goal remains active and incomplete.

CHOAM Kulon and La La La checkpoint

• Verified publisher CHOAM & Richese rulebook p. 7 and cancellation table p. 12 through indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Kulon adds one territory on CHOAM's Shipment and Movement turn. La La La prevents a player's Free Revival during Revival. Karama prevents discarding a Worthless card in that phase for its special effect. Both are basic faction advantages and also work in advanced play.

• Added a shared CHOAM Worthless declaration/settlement path with pendingChoamWorthless and the choamWorthless Karama response. The physical owned card and declared target are validated before announcing. Discard occurs only on successful settlement. Cancellation retains the card and tracks its physical ID as blocked for that phase. Card custody is rechecked: if special Karama cash-in consumes the pending card, no special effect occurs and an interrupted revival continues.

• Kulon requires CHOAM's active movement turn and an available move. Its turn-stamped bonus adds to normal range and ornithopters; it does not grant extra actions or bypass storm, occupancy or allied-entry validation. The current interpretation applies the bonus to both available Hajr movements. A later turn ignores the old bonus. Private views now include the actual number of allowed movement actions for controls/AI.

• Added freeRevivalRemaining shared by authoritative revival quotes and the private projection; UI and bots use that projected entitlement. RevivalRules.freeBlocked denies ordinary free forces for the rest of Revival, including a Fremen allied allowance granted before or after the denial. Normal paid revival and separate Ghola card returns remain possible. Earlier force returns and quota consumption stay unchanged; the next Revival initialization clears denial.

• Every CHOAM table opens a choamFreeRevival decision when another faction declares a normal force revival with a free portion, independently of CHOAM's private hand. CHOAM may allow the request or declare La La La. Success stops the entire pending request without payment, force movement or quota use; the requester can explicitly select a paid revival afterward. Cancellation/missing card resumes the original quote through the existing Tleilaxu special-prevention window and later revival responses. This ordering avoids automatic spending at a newly increased price.

• New components/choam-worthless.tsx supplies private phase/reaction controls, target selection and allow/pass. Phase UI shows extra movement range and free-revival denial, and a linked internal topic/tooltip explains the two implemented cards. All AI levels use Kulon when movement is available. Easy saves La La La; higher levels may deny an enemy's free request while preserving allied requests. AI revival budgets use the denied entitlement rather than faction defaults.

• Sixteen new scenarios cover basic/advanced range, ornithopters, storm/alliance restrictions, Hajr action counts and next-turn expiry, ownership/phase/timing rejection, Karama retention/retry, earlier free returns, hand-independent public decisions, mixed request aborts, cancellation resumption, cash-in interruption, later Fremen grants, Ghola exception, Tleilaxu continuation, next-phase reset, private JSON reconnects, AI policies/budgets and unsupported/forged effects. The focused Worthless/CHOAM revival group has 33 passing tests. One preexisting revival scenario now explicitly allows CHOAM's new free-revival decision before testing Tleilaxu cancellation.

• Still required: Baliset, Jubba Cloak, Kull Wahad and Trip to Gamont effects; Auditor/printed leaders; remaining factions/modules and combined-expansion audits. Outstanding interpretations include physical-card versus whole-power Karama scope, Kulon with Hajr/ornithopters, reactive La La La request cancellation versus repricing, ordering with other prevention effects and later free-revival exceptions. Full CHOAM/advanced starts remain gated.

• Unit validation: all 630 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript and lint pass; lint caught an obsolete faction import after centralizing AI revival entitlement, which was removed. The final production build passes; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

Trip to Gamont and deferred CHOAM Mentat victory checkpoint

• Primary CHOAM & Richese p. 7 permits returning any one force belonging to another player to its reserves during Mentat Pause; p. 12 supplies the Worthless-effect Karama cancellation. Official indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Primary base p. 11 checks occupied strongholds during Mentat; November 2020 FAQ p. 1 excludes unresolved opponent co-occupation and discusses ties with extra strongholds/tech. The ordering below ensures a legal Mentat return can affect the board used for victory; the detailed schedule is an implementation interpretation requiring later interaction audit.

• Extended the CHOAM Worthless declaration with Trip to Gamont, target player, board sector and ordinary/elite choice. Rejects self, absent player/force, reserves, invalid sector, unavailable force type and quantities other than one. The public response includes the selected recipient, sector and force type. Settlement rechecks both card and typed force, then moves exactly one token to that player's reserves. Elite totals/type are preserved; no tanks, battle-loss count, revival allowance, spice or transport income changes.

• The return can select forces in storm, Bene Gesserit advisors or occupants of the Hidden Mobile Stronghold. Returning a stronghold occupant does not relocate the stronghold. Existing advisor stance settlement runs after the return so removal of the last opposing force is reflected in control. A missing card/force aborts without an extra discard or reserve token. Karama keeps the selected force and card, blocking that physical card's effect for the phase.

• At tables containing CHOAM, beginPhase(8) still settles bribes and Inflation once but defers victory. Ordinary Mentat actions and readiness lead to the existing closing market. advancePhase then opens a hand-independent choamMentat decision; a newly exchanged Trip card remains usable before victory. After each Trip response, this final decision reopens. CHOAM's explicit completion calls victory on the resulting board and only advances the turn if play continues. Other tables retain the existing entry-time victory behavior. completePhase isolates that continuation without repeating settlement or the market.

• New components/choam-gamont.tsx offers owner/sector/type choices and final victory confirmation. Public Mentat guidance explains the delay; internal faction, phase and Worthless topics now link to a detailed Trip to Gamont topic. All four AI levels can select and return an enemy force and finish the window. Higher levels prioritize single stronghold occupants and elite forces. Bots preserve a usable Mentat Trip from proactive cash-in, market sale and their own trade offer so the final chance is not accidentally lost.

• Nineteen new tests cover deferred/unchanged winning boards, ordinary/advanced returns, public empty/full-hand windows, readiness, Karama, ordinary/elite conservation, invalid actions, storm/advisors, automatic advisor stance, mobile stronghold occupants, closing allied acquisition, interrupted card/force custody, JSON reconnects, final-turn Guild fallback/BG prediction, once-only bribes/Inflation, tech-token victory and all four AI policies. The focused Gamont/market/Inflation/reference suite passes 53 tests. The shared Worthless reconnect case now covers both La La La and Kulon; the first full run caught optional response fields serialized differently, fixed by emitting force/recipient fields only when applicable. One existing exchange-limit test now completes the additional Mentat decision before asserting the next turn.

• Remaining timing audit: exact ordering of sales/trades and Trip versus other simultaneous Mentat abilities, opportunities to revisit an already closed market after a canceled Trip, future force-type/stronghold/module exceptions, and the existing advisor-force cancellation rules. Baliset, Jubba Cloak and Kull Wahad remain unfinished, alongside Auditor/printed leaders, all other remaining factions/modules and complete-game audits. Advanced and expansion starts remain gated.

• Validation: all 649 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and final production build pass; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active and incomplete.

Baliset and development reliability checkpoint

• CHOAM’s Baliset has proactive player/territory controls and a public response decision before another player enters a CHOAM-occupied territory by movement. The response is offered independently of the private hand. The declared force group remains server-private; public intent includes mover, destination, sector and count.
• Allowing or canceling resumes the original typed force group after rechecking custody, entry, movement availability and route. Successful Baliset leaves forces in place and the movement unspent. Shipment and movement between sectors inside the same territory remain possible. Restriction enforcement checks the current turn/phase, chosen player/territory and current CHOAM occupation.
• All four AI levels handle the response. Movement candidates respect active restrictions without removing shipment candidates; Hajr second movements and Kulon plus ornithopter range are considered. Cash-poor CHOAM preserves a reactive Baliset. The internal Worthless reference and tooltip describe these flows.
• Twenty-two focused scenarios cover basic/advanced blocking, cancelation, typed forces, empty-hand privacy, JSON decision restoration, shipments, expiry, stale custody/routes, lost occupation, cash-in, Ix transport ordering, same-territory moves and AI behavior. All 671 unit/rules/AI/reference tests and four persisted multiplayer tests pass. TypeScript, lint and production build passed at integration; final presentation-only checks are recorded below.
• Interpretation audit remains: exact Baliset duration and destination/transit scope, consumption of a prevented movement, simultaneous prevention ordering, and later module exceptions. These are implementation choices under audit, not certification of complete expansion compliance; full faction starts remain disabled.
• Found repeated Vite page reloads from Wrangler registry heartbeats and database state updates in the running server log. server.watch.ignored now excludes .wrangler; the restarted server no longer logs these reloads. Saved data was preserved.
• The hourly automation was created, then the app reported it removed. The user explicitly requested leaving it removed. Do not recreate it. During active development, follow the objective’s controlled-restart requirements: preserve data, warn before active human play and defer until safe, verify health/reconnection/restoration. Do not use restarts as a substitute for fixing root causes.
• Revised objective read from /home/quintine/.codex/attachments/b71d2b8c-373e-499e-801d-5bdce7d72e33/goal-objective.md. It preserves the full twelve-faction scope, official source precedence, complete-game acceptance gates, original internal guidance, all four AI levels, and explicitly authorizes browser screenshots/playtesting.
• Current local development server: exec session 97563, log /tmp/dune-dev-server.log. Sandbox network-interface restrictions required approved escalation to launch it. Tests use approved escalation because tsx requires local IPC pipes.

Parallel review, card inspection and browser acceptance

• Latest controlling objective: /home/quintine/.codex/attachments/70120c7b-5b79-41a3-b429-edac4afcf059/goal-objective.md. It additionally authorizes proactive parallel agents and requires authentic, inspectable physical components and a verified complete component inventory. No recurring automation: the user explicitly requested leaving it removed.
• Independent read-only Baliset review found no confirmed crash, deadlock, duplicate-force or hidden-hand leak. Its observer-context suggestion is implemented: non-CHOAM seats see the public pending mover/destination/sector/count. Additional passing tests cover BG Worthless Karama, countering that conversion, multisector elite custody and advisor arrival locks. Exact timing interpretations still require authoritative resolution before full starts.
• Integrated CardRules and CardInspector from the card-presentation agent into the authorized private hand. Both receive only a visible card; they do not read game/deck state. Enlarged cards include crisp original gameplay guidance and internal explanations, accessible dialogs, focus return, keyboard dismissal and reduced-motion handling. Normal cards are wider for readable text. These are current gameplay guides, NOT verified complete printed card text; all-card inventory/text acceptance remains open.
• Reviewed and integrated docs/COMPONENT_INVENTORY.md from the inventory agent. It distinguishes factory counts from official verification, records replacement-card versus additive-deck distinctions and separate caches, and traces inventory/text/engine/UI/AI/test gaps. Its UI matrix describes the pre-inspector baseline; this checkpoint records the newly verified subset without implying every component was inspected.
• Browser playtest room EN4L8NTV, Atreides human test seat + Medium Harkonnen AI: created room, added AI, ready/start, private traitor selection, sealed storm choice/confirmation, spice reveal/acceptance, charity readiness, auction powers, bid/counterbid/pass, payment and private card receipt, revival readiness, shipment and map-selected movement all worked. Atreides shipped one force to Arrakeen and moved one to Imperial Basin sector 9. Refresh restored 1 spice, 9 reserves, 10 forces at Arrakeen, 1 at Imperial Basin and the Kulon/Snooper hand; the spent movement stayed spent.
• Browser-discovered control fixes: auction bids now default to at least the current minimum, reset for a new auction card and disable unaffordable raises; spent movement disables Move forces and explains that the turn can be finished. The server remains authoritative for all legal-action checks.
• Visually inspected enlarged Kulon at normal desktop and 390×844 mobile viewport. Dialog fits mobile width, its body scrolls to expanded rules, Close remains reachable, Escape closes and focus returns to Inspect Kulon. Temporary viewport override was reset. Full forty-seven-card normal/enlarged review, unseen component families, mobile whole-game flow, sound and combat visual QA remain open.
• Initial refresh briefly renders the landing page before restoring the room. Restoration works, but a dedicated restoration/loading state would avoid this misleading flash; this is a remaining UX refinement.
• No recurring .wrangler hot reloads appeared in the new dev-server log after exclusion. Browser test room is paused at its test human’s completed movement turn; no unattended progression is required. Current browser tab 4 may be kept for later authorized QA.

Jubba Cloak and bounded client recovery checkpoint

• Latest objective read: /home/quintine/.codex/attachments/3c2d7613-9ed4-4489-a95a-5502776c4a29/goal-objective.md. It preserves complete classic/advanced/all-expansion scope, parallel development, complete component text/inventory and browser acceptance. The user explicitly left the hourly automation removed; no replacement automation was created.
• Jubba Cloak now opens a hand-independent CHOAM decision before storm traversal when CHOAM has exposed forces. The owner can declare an available physical Jubba for one threatened territory or continue. Successful settlement discards the card and protects only CHOAM's forces in that territory for this storm movement; spice and opponents remain exposed. Multiple sectors of the chosen territory share protection. Further threatened territories are offered again before continuing into Fremen protection and normal casualties.
• The shared Karama response retains a canceled card and prevents its special reuse in that phase. Missing/cashed-in custody aborts the effect and restores storm continuation. Private projections include the owner's exact pending Worthless card so AI cash-in cannot consume its own declared card, including while BG conversion is nested. Human cash-in remains possible and correctly aborts the pending effect.
• Added components/choam-storm.tsx, public waiting context, internal linked Jubba guidance and all four AI policies. Independent source/code review found and reproduced the poor-CHOAM pending-card cash-in bug; the integrated fix passes direct and nested regression tests. No additional confirmed defect was found in that review. Exact multi-sector scope and simultaneous priority remain interpretations under audit; CHOAM starts remain gated.
• Twenty new Jubba tests verify basic/advanced scope, multi-sector and separate territories, conservation, Karama/counter behavior, custody interruption, privacy/JSON restoration, sheltered terrain/HMS, zero movement, destroyed Shield Wall, Weather Control/Atomics, first storm and sector wrap, expiry, Fremen continuation and all AI levels.
• Integrated bounded request helper and client recovery: 15-second fetch plus body deadline, abort, no automatic replay of an uncertain POST, GET-only reconciliation, completion-scheduled/coalesced polling, monotonic versions and recovery epochs, immediate duplicate-click guard, explicit reconnect/AI resume, and initial restoration placeholder. Ten focused helper tests pass. Independent review is checking initial-invite failure recovery; browser timeout/reconnect acceptance is still outstanding. Initial create/join receipts and lost-cookie seat recovery remain separate missing server capabilities.
• Click/tap help now uses an accessible popover with hover support; the browser confirmed visible spice help and Escape dismissal. Enlarged private-card inspection and mobile checks are described above. The browser game has reached turn two from Mentat Pause without lost state; this is not yet a complete visual game.
• Integrated validation: 701/701 unit tests and 7/7 persisted multiplayer tests pass, along with TypeScript and lint; all four commands exited zero. The multiplayer command now includes the three recovery regressions. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log. Final client follow-up and production build remain to be checked after the initial-invite recovery review.
• Remaining CHOAM implementation includes Kull Wahad and Auditor/verified printed leaders, plus timing audits. Richese, Ecaz, Moritani, leader skills, stronghold cards, homeworlds, Nexus, discoveries and full combination/AI/component acceptance remain required. No full-compliance or release claim is made.

Owner-proved seat recovery, visual combat and AI calibration

• Added authenticated recovery-key setup and private-proof recovery at POST /api/rooms/:code/control. Recovery preserves player identity, game state and sealed plans, increments the room version, revokes older seat credentials and installs the new token. Storage keeps cryptographic hashes; private keys and tokens do not enter GameView or public history. An exact operation receipt can reissue the current cookie without rotating twice; changed credentials/proof, later rotations and replaced keys invalidate older receipts.

• SeatAuth now contains player ID and token hash. Every authoritative game write checks that exact active credential in the same conditional SQL statement as the room version. Private reads join the live credential with the room. This fences requests authenticated before revocation as well as later reads. Additive Drizzle migrations 0001_fancy_king_cobra.sql and 0002_famous_piledriver.sql are applied locally; apply them before dependent code in other environments.

• Integrated SeatRecoverySetup below the table and SeatRecoveryClaim in the join area. The owner saves the complete generated private kit before enabling it; the setup retains that kit through uncertain and confirmed results. Recovery validates the saved kit and retains the exact operation ID/new session token for explicit retries. No automatic retry or localStorage secret storage. Normal game actions and management share the pending guard. Restored-seat integration isolates owner identity and discards stale epoch/version results, including WebMCP reads from an exited/recovered context.

• Initial invite failures now show a GET-only retry screen for transient errors and a usable join form for missing/auth-rejected seats. HTTP 408/5xx mutation errors are treated as uncertain. Independent client review confirmed both fixes and identified stale read return values; obsolete reads now reject instead of escaping through the WebMCP return value. Additional settlement guards verify seat/epoch as well as room.

• Seven new backend tests pass, covering owner setup/rotation, private state preservation, lost-response receipt replay, altered/stale receipts, same-key/key replacement invalidation, simultaneous claims, actual SQL fencing of an already-authenticated old writer and byte-identical sealed-battle JSON. Existing seven multiplayer tests also pass after the authentication change. Five recovery-kit helper tests and twelve request tests pass within the aggregate 708/708 unit suite. TypeScript/lint/build pass at integration; final presentation/context-guard checks follow separately.

• Browser test completed a Carthag battle: weapon prescience, sealed plans, public reveal, traitor decline, victory, chosen card discard and refresh restoration all worked. It exposed an enabled Reveal traitor button without a matching card; controls now use only entitled traitors and revealed plans to disable with a reason, including hero and Kwisatz cases. The disabled state was visually verified. Detailed evidence and remaining visual limits are in docs/VISUAL_PLAYTEST.md.

• Reproducible calibration completed 120 basic base games across 2–6 players with balanced difficulty/faction/seat rotations: no deadlocks, unhandled exceptions, action-limit failures or checked invariant failures. Win counts across 120 appearances per level: Easy 1, Medium 41, Hard 37, Brutal 41. This separates Easy in the measured sample but does not demonstrate an increasing strength ladder among upper levels. The run recorded 31,388 rejected candidate proposals; first-choice rejection frequency was not measured. Methodology, correlated-sample limits, seeds and deterministic replay are in docs/AI_CALIBRATION.md; source files were unchanged during measurement.

• Lost initial create/join response receipts, intentional seat transfer and prior-consent AI delegation remain missing. Owner recovery requires a previously saved kit; it does not make a completely abandoned unprepared seat replaceable. No advanced/expansion starts or release gates were lifted. Independent backend review is still underway.

• Controlled maintenance at approximately 10:04 Australia/ACT, 2026-09-06: consistent SQLite backup in /tmp/dune-maintenance-20260906T0003, prior server97563 stopped cleanly, new server73638 started with approved network permission. Recent active rooms were test fixtures, and the browser game was paused at its collection decision. Complete saved JSON hash and version47 matched after restart; browser reload restored the same state. No recurring automation was created. New server log remains /tmp/dune-dev-server.log.

• Independent backend review found no confirmed custody/privacy defect. Actual room-module SQLite reproductions verified transaction rollback, key replacement between proof and commit, rotation/key replacement during receipt reads, stale version batches and old credential fencing. Six deterministic rollback/interleaving cases are now permanent tests, including a barrier-controlled race between distinct recovery claims. The prior14-test suite passed after restart; the expanded20-test suite is running. The13-test seat-recovery file includes7 original scenarios and6 new cases.

• Read-only mobile recovery-panel inspection at390×844 confirmed wrapping, reachable controls and no horizontal overflow; no recovery key was enabled for the browser test seat. Detailed record is in docs/VISUAL_PLAYTEST.md. Latest production build, lint and TypeScript checks completed successfully after the context-guard fixes.

• Expanded persisted/database validation completed: 20/20 pass, terminal exit0, including all six newly permanent interleaving/rollback cases. Aggregate unit checkpoint remains708/708. No application source changed during the final multiplayer run.

Battle-wheel presentation checkpoint

• Integrated the independently authored original SVG battle wheel with native range and numeric controls. The parent preserves the existing numeric label as a sibling, supplies the same dial limits/step/commitment as before and disables while sending. The graphic is decorative for assistive technology; native controls remain keyboard/tap usable, with no animation or external assets.

• Added a basic battle-wheel practice example to the internal battle topic and expanded internal recovery guidance. The practice is local UI state and cannot change a live game. Its ten-force dial is clamped to0–10. Tick labels were adjusted to selectable step values after the ten-force example exposed fractional printed labels on an integer-only wheel.

• Browser desktop/mobile checks verified exact-number, arrow-key and range synchronization, explanatory totals, practice bounds and readable mobile controls. Found and fixed pre-existing horizontal overflow of the mobile rules reference caused by its grid’s automatic minimum width. Screenshots and limitations are in docs/VISUAL_PLAYTEST.md; viewport reset and temporary tab closed.

• Reviewed the Richese source/architecture plan in docs/RICHESE_IMPLEMENTATION_PLAN.md. No Richese implementation or mode enabling occurred. The immediate architecture work is a bidding schedule separate from ordinary auction state, with explicit sale provenance and sealed bid handling; No-Field requires a separate concealed board object. Printed cache faces and leader roster/strengths still need verified primary components.

• Final checks for this presentation slice: reference-link validation1/1, TypeScript, repository lint and production build all exited0. The most recent aggregate checkpoints are708/708 unit tests and20/20 persisted/database recovery tests. The running server73638 returns200 for the saved playtest; browser tab4 remains available at turn2 collection. No deployment or full-compliance declaration occurred. All three agents' contributions from this checkpoint were reviewed and integrated or retained as explicitly scoped developer plans.

Initial room-entry recovery checkpoint

• Create and join now optionally accept a private operation receipt. The server hashes its operation, exact normalized request identity and session token, atomically stores the room/seat/receipt, and returns the current original private view on an exact retry. Duplicate operations converge without additional rooms, seats or state versions. A mismatched request, revoked credential or cross-room operation cannot claim the receipt. Migration 0003_magical_hawkeye.sql was applied locally before dependent runtime changes.

• The browser saves an immutable, versioned, tab-scoped request before sending. Refresh restores an explicit retry screen; no POST retries automatically, and a cookie-only GET cannot erase the proof. Only a matching receipt or a confirmed fresh already-seated join acknowledges success. A clearly rejected first request returns the form for correction; uncertain and replayed attempts retain their proof. Failed storage writes prevent sending; failed deletion keeps the record visible. Invalid/future records are preserved for deliberate handling.

• Saved-kit recovery and entry attempts cannot silently discard each other's unresolved operation. Uncertain recovery blocks conflicting entry/navigation and retains its exact payload. A deliberate acknowledged abandonment provides an exit when another recovery invalidates that receipt; it does not undo any completed recovery. The original saved kit remains necessary for future recovery.

• Independent backend audit found a concurrent token-reuse classification issue; the fixed path rolls back and returns ENTRY_TOKEN_USED instead of a generic server error. Thirteen permanent entry cases cover accepted response loss, duplicate create/join, normalized/mismatched inputs, cookie precedence, started-game private projection, revocation, competing faction claims, failed receipt inserts and deterministic operation/token collision barriers. An independent eight-case isolated audit found no remaining confirmed custody/privacy defect.

• Ten client entry tests cover frozen payloads, strict parsing, fresh versus uncertain response acknowledgment, storage failures, retained proof through refresh and first-request rejection policy. Aggregate verification: 718/718 unit tests and 33/33 persisted/database tests pass. TypeScript, repository lint and production build pass. Browser creation, refresh, same-seat rejoin, explicit retained-request retry, deliberate abandonment and corrected-invitation flows passed; mobile layout was inspected and improved. See VISUAL_PLAYTEST.md for precise scope.

• Richese source checks are recorded in RICHESE_BLACK_MARKET_RULES.md and RICHESE_LEADER_AUDIT.md. Black Market custody/payment/continuation need separate engine state; self-purchase and pre-bid Ixian exchange remain unresolved. Official indexed evidence did not establish a complete Richese leader roster/strengths or printed Auditor strength. No unverified component data was added.

• Full Advanced/expansion starts remain gated. Intentional seat transfer, prior-consent AI delegation, missing factions/modules, full component text/art, upper AI difficulty calibration and complete combination acceptance remain required. The goal is active. The user-requested removed automation remains removed.

• Subsequent live basic battle-wheel verification exposed and fixed a physical 20-point ceiling that exceeded the two fighters present. The basic non-Ix wheel now derives its maximum from own territorial fighters, excludes advisors and shares a bounded step-aligned value between display/submission. Existing advanced/Ix ceiling remains unchanged. A visible 20 draft became 2 and the authoritative revealed plan was 2. The battle resolved through winner retention controls. Independent review found no display/submission or privacy issue; full details and outstanding advanced/committed UI checks are in VISUAL_PLAYTEST.md.

Prepared special Karama and leader inspection checkpoint

• The eight implemented faction special-Karama paths now separate pure preparation from explicit execution. Serializable typed intents copy declared selections, bind the original turn/phase and relevant battle/shipment/revival declaration, and revalidate exact card custody and resources before effects. Preparation performs no resource changes, discards, once-per-game spending or random draws. Existing public actions still prepare and execute synchronously; this does not implement Kull Wahad's reaction window.
• Independent review found missing dispatcher timing checks in the direct executor path. Preparation now blocks unresolved Truthtrance and preserves the existing faction-specific phase-opening, market and revival gates, including CHOAM's established exceptions. Battle-plan feasibility clears the resolved Truthtrance only in its hypothetical clone while retaining binding battle promises.
• Execution is a mutating helper for a disposable working Game, not a transactional API. Callers must publish the clone only after success; the public applyAction boundary preserves its input even if Harkonnen's random exchange fails. Ten regressions cover all special variants, pure preparation, copied selections, stale contexts/custody/resources, declaration binding, dispatcher parity, exact-once commitment and failure isolation.
• Added a read-only Your leaders roster and enlarged leader/private-traitor inspectors. They use only the viewer's authorized identities and display actual strength, faction and leader status. Original geometric medallions are interface artwork; they do not claim to be verified printed faces or completed portraits. Independent review found and fixed an accessible strength-label issue. Browser checks verified desktop/mobile dialog readability, contained scrolling and Escape focus return. Full component art, printed text/inventory and expansion identity verification remain outstanding.
• Verification at this checkpoint: 728/728 unit tests and 33/33 persisted/database tests pass. TypeScript, lint and production build pass. Browser verification also confirmed the final accessible strength labels and mobile roster keyboard navigation.
• After the previous development process was observed terminated, the persisted database was backed up to /tmp/dune-maintenance-20260906T0048/database.sqlite and the server restarted using the same database. Room EN4L8NTV retained version 72 and an identical state hash; the browser reconnected at turn three Battle. Inspection checks performed no game actions. The removed automation remains removed.
• Kull's precise counter order and Bene Gesserit conversion placement remain unresolved in the retrieved primary sources. A user clarification is pending for a documented provisional interpretation; no dependent Kull policy has been installed. CHOAM and all unfinished Advanced/expansion starts remain gated. The complete goal remains active.

Printed player circles and authorized component inspection checkpoint

• Corrected the base storm's initial sector from 18 to the printed Meridian Storm Start (sector 1 in this board's numbering). The six printed player circles are fixed at sectors 2, 5, 8, 11, 14 and 17. They no longer redistribute with player count. After movement, order proceeds toward the next occupied circle counterclockwise; a circle already reached by the storm waits for the next circuit. Source: GF9 base rulebook pp.4,6–7, with printed map checked independently.
• New rooms persist playerPositions. Players can choose an unoccupied circle for themselves in the lobby; readiness resets, bot readiness remains automatic, and removal/join reuse vacancies without moving other circles. Public labels and six map markers show those positions. The first dialers bracket Storm Start using occupied circles rather than player-array endpoints. First dials remain 0–20; later Basic dials remain 1–3 from the last battle-wheel users, retaining previous storm dialers if there was no intervening battle.
• Existing rooms without positions derive the same six-circle defaults on read without mutation. Their next valid authoritative action persists the mapping and a one-time migration note. In-progress games retain their current storm, phase order and pending choices; the next completed storm uses the corrected order. Old lobbies display and adopt Storm Start 1. Past phases are not replayed.
• Eighteen focused regressions verify all eighteen sector boundaries, two through six players, sparse circles, ownership/range/occupied errors, readiness, bot removal/rejoin, first-dial ownership and secrecy, zero/full/multiple circuits, storm casualties/conservation, Weather Control, later dialers and legacy-state recovery. Three old endpoint expectations were updated to the corrected start. A persisted multiplayer race verifies competing circle choices, occupied retry rejection, owner enforcement and refresh without secret exposure.
• Expanded authorized inspection to setup traitor choices, private Face Dancers, Atreides auction faces, Ixian setup/pool/offered/purchased faces, winner card choices, public revealed battle components and private full-plan insight. Face Dancer guidance is distinct from traitor-call guidance. Action selection remains separate from enlargement; no opponent-hand or deck lookup was added. Setup now disables ordinary card activation until play, while retaining legal setup Karama responses and Truthtrance.
• The CHOAM/Richese rulebook p.4 expressly clarifies that the treachery discard pile is private and may only be searched under an enabling effect. A generic discard browser was therefore not added. Existing server projections keep the pile and deck identities private. Effect-specific inspection, including missing Nullentropy Box support, remains required.
• Independent UI review found clipped outer player circles and undefined CSS color variables; expanded board framing and corrected theme variables fix those issues. Browser verification covered saved circle selection/refresh, occupied-circle controls, setup inspection without selection, and enlarged revealed Stunner on desktop/mobile. See VISUAL_PLAYTEST.md for exact game checkpoints.
• Validation: 746/797 unit tests, 34/34 persisted/database tests, TypeScript and production build pass. Lint found one missing numeric comparator in the new race test; corrected and lint passes. Complete Basic/tech-token AI games continue to pass after the order change. The earlier AI strength calibration is historical and has not been rerun for this revised seating model.
• Added ECAZ_AMBASSADORS_RULES.md with verified core ambassador anchors and integration boundaries. Its official/mirrored Occupy rounding discrepancy remains recorded for resolution. Kull's timing clarification is still pending; Advanced/expansion starts remain gated, and all remaining full-scope requirements remain active.

Assassination and Sneak Attack checkpoint — 2026-09-06

Four Terror effects now have partial runtime, owner controls, private projection and AI support. Assassination immediately selects one random living ordinary native leader, updates its death count and battle-use marker, pays its native strength (Zoal 3), consumes the revealed token and resumes the interrupted entry. A client cannot choose the victim. Missing/unverified rosters, exceptional capture/Ghola custody and empty living pools reject before reveal or RNG. Advanced Harkonnen configurations uniformly reject this reveal so availability cannot disclose concealed captures.

Sneak Attack has a persisted reserve-count decision for zero through five available forces. Positive entry validates the recorded sector, storm and occupancy, transfers reserves without a spice fee or ordinary shipment/movement consumption, and resumes the original continuation. Owner-only limits and unfinished BG/Heighliners combinations are shown before revelation. Zero remains available after revealing; AI retains the hidden token when no positive entry is available. These restrictions identify unfinished implementation, not new official prohibitions.

Fifteen focused force/leader tests cover random selection, all five ordinary discs, Zoal, death history, invalid counts/sectors, resource conservation, reload and duplicate rejection, hidden projections and all four AI profiles including blocked offers. Independent review checked custody, RNG timing and continuation. Full integrated validation: 858 unit tests, 45 persisted/API tests, TypeScript, lint and production build pass. Source boundary: MORITANI_ASSASSINATION_SNEAK.md.

Atomics/Aftermath, Extortion, Enemy of My Enemy, advanced Assassinate Leaders, exceptional leader pools and combined arrival timing remain unfinished. Full Advanced and expansion starts stay disabled; these isolated QA scenarios do not constitute full-game certification.

Enemy of My Enemy checkpoint — 2026-09-06

The special Terror alliance branch now has a persisted declaration, Karama response and entrant accept/refuse decision. Acceptance detaches both former partners, refunds only unused escrow attached to broken pairs, clears affected Nexus offers, forms the mutual alliance and returns the token hidden through the existing identity-rotation helper. Already paid shipment costs and committed forces stay unchanged. Refusal immediately enters the ordinary token effect within the same action; Moritani cannot decline again. Karama cancellation preserves the token and permits reveal/decline but prevents repeating that entry’s alliance offer.

Entrant UI branches before every owner-only token lookup. Public stages, names and alliance consequences contain no hidden face; owner controls show why an offer is unavailable. Unsupported mandatory effects and Ecaz are rejected before an offer, so the entrant is never asked to refuse into an unimplemented effect. All four AI profiles complete offer, response, reply, refusal and cancellation paths from private views. Sandtrout does not impose an invented ongoing special-alliance ban.

A related base-rule correction records allySinceTurn for Enemy and ordinary Nexus alliances. Newly allied co-occupants are not destroyed at the end of the same turn’s movement; the later mover still loses remaining co-occupants in a following turn if neither leaves. Future entry into an ally-occupied territory remains prohibited.

Fifteen focused alliance tests, independent source/code review, the full 873-unit suite, 45 persisted/API tests, typecheck, lint and build pass. An earlier run during test drafting failed only on the new public formation-turn field missing from a test expectation; the completed tests and integrated rerun pass. Browser acceptance survives refresh with hidden token return and exact shipment custody. Source/timing record: MORITANI_ENEMY_ALLIANCE.md.

The exact Karama-before-reply ordering is a tested draft using the existing power-response convention; a user clarification is pending because no specialized official timing ruling was retrieved. Full expansion starts remain gated. Atomics/Aftermath, Extortion, advanced Assassinate Leaders, Duke Vidal and other previously recorded scope remain unfinished.

Duke Vidal shared-leader checkpoint — 2026-09-06

One separate Ecaz-identity disc of strength six now has explicit controller/source/turn custody. It is not appended to any native five-leader roster or traitor deck. Moritani's committed end-of-movement check counts distinct strongholds with actual upcoming battles, excludes Ecaz opponents and uses the existing storm/occupancy geometry; the Hidden Mobile Stronghold counts. A generic Karama window can prevent acquisition, with a once-per-turn marker preventing repeats. A held Duke is not stripped by a new cancellation.

The controller may select Duke in an ordinary supported battle. Death and six-strength bounty resolve on the shared disc; after one battle his controller clears while death history remains. An unused Moritani tenure expires at turn end, and a later qualifying turn can acquire him again. Ecaz permanent custody and unresolved allied-loan return are preserved by the custody helper; no loan-return destination is invented. The next storm clears the shared battle-use marker.

The public original purple/gold component and scrolling inspector show strength, custody, no-Traitor status and complete original-language core instructions. Controller-specific battle choices use explicit shared control, so an Ecaz identity never automatically grants control. Truthtrance battle questions and their readable logs now recognize Duke; traitor questions still reject him. Four integration regressions cover that distinction and legal promised plans.

Verification comprises nine pure custody tests, ten engine scenarios including Basic/Advanced casualties and all four AI candidate plans, four Duke/Truthtrance regressions, independent source/code review, full896-unit suite,45 persisted/API tests, typecheck, lint and build. Desktop browser QA exercises actual end-of-movement acquisition, full inspection, Duke battle use, set-aside status and refreshed second-battle options without Duke. These are bounded component/interaction checks, not complete expansion games.

Advanced Harkonnen configurations and captured/ghola custody remain explicitly unsupported for this acquisition/use slice because they affect the shared capture pool and release destination. Ecaz Ambassador acquisition, loans, Ecaz-only five-spice/Ghola revival and its five-in-Tanks revival threshold remain unfinished. Source details: DUKE_VIDAL_RULES.md. Advanced and expansion starts stay gated.

Ecaz placement, automatic responses, pacing and rules checklists — 2026-09-06

Ecaz now has an eleven-token Ambassador inventory, escalating end-of-Revival placement, owner controls, public compact/expanded inspectors and all-four-profile placement choices. The pure custody model covers original-group recycling, reusable Ecaz, permanent BG removal and destruction return. Runtime entry effects and destruction hooks are still missing. Public unplaced supply is a documented default-open inference; CHOAM market → deferred technology income → Ecaz placement is a composed implementation order, not certified combined FAQ priority. Full Ecaz setup, Occupy, Duke revival, optional modules and expansion starts remain unfinished/gated.

A sole legal Advanced battle casualty allocation now settles immediately, while real typed-casualty, Ixian substitution and card-retention choices remain. Power responses automatically proceed when the owner and all players without a usable physical cancellation card are the only seats left. Shared physical eligibility checks cover Advanced BG conversion, sealed/prescience bindings and Moritani retention reservations. Explicit passes and cancel-card IDs are viewer-local; automatic eligibility is not published per seat. Active Truthtrance/phase opening retains precedence, restored nested windows recheck current custody, and voluntary battle promises are validated before automatic consequences. Promise-constrained physical candidates remain conservative until commit, so this is not yet complete promise-aware option filtering.

Successful casualties, Ecaz placements, Emperor auction income and Harkonnen bonus draws emit server-authored public notice metadata. A local toggle controls a nonblocking, reduced-motion-aware queue with 1.5 seconds per event, consumed disabled events and an initial-history baseline. A two-effect auction browser check showed the Emperor notice followed by Harkonnen's bonus, while bidding had already continued; no drawn identity enters public event text. Untagged powers, acknowledgement-only auction payment/full-plan/collection flows and further animations still require work.

Online AI now commits at most one accepted decision per 1.5-second persisted deadline, including consented human autopilot. Human actions commit immediately. Authenticated reads resume pending work; overlapping reads share one per-room worker within an isolate, with database CAS still fencing separate workers and take-back-control. Legacy uncancelable responses use a separate bounded authoritative continuation, keeping viewGame pure. Offline simulations remain fast. Durable progress while every client stays disconnected is still a liveness gap after the bounded request worker ends. See AI_PACING.md and AUTOMATIC_RESPONSE_AUDIT.md.

The in-app reference now includes five-facet feature checklists for the reviewed Ecaz, automatic-action and pacing slices, with internal cross-links and actual regression evidence. This is a growing traceable checklist, not finished coverage for every rule. Eighteen of the existing fifty ordinary leader identities have original portraits: full Atreides, Harkonnen and Emperor rosters plus the earlier Fremen/Guild/BG pilot faces. CHOAM/Richese component verification, remaining portraits and complete component browser acceptance remain open.

Integrated verification: 991/991 rules/client tests and 63/63 persisted/API tests pass, with typecheck, lint and production build passing. The initial integration identified obsolete mandatory-pass expectations; these were changed to immediate-resolution assertions or genuine pre-held cancellation resources while preserving privacy, custody, refresh and concurrency checks. Fifteen focused automatic-response cases and seven persistence/coalescing cases are included in those totals. Independent reviews covered Ecaz authority/interpretation boundaries, server pacing and automatic continuation. Browser evidence is in VISUAL_PLAYTEST.md; this does not certify complete Advanced/expansion games.

Hourly maintenance first saved a backup at05:52UTC and deferred restart for recent non-QA setup activity. After that room remained idle for over18 minutes, a fresh backup at /tmp/dune-maintenance-20260906T0605/database.sqlite preceded a controlled restart. All812 rooms retained exact versions and state hashes, HTTP health returned200, and the saved Harkonnen browser seat reconnected. The user-removed maintenance automation was not recreated. The full goal remains active.

Ambassador entry and automatic decisions checkpoint (2026-09-06)

Implemented five Ambassador effects end to end: Emperor bank grant, Atreides current-hand snapshot, Harkonnen random held Traitor snapshot (including physical Tleilaxu Face Dancers), CHOAM chosen card sales, and Ixian discard/replacement. Bene Gesserit can copy those supported effects from outside the original six-token supply, regardless current custody zones. Ecaz chooses whether to trigger and its current allied beneficiary; the beneficiary controls its own private choices. Every action binds the persisted event ID and stage. Inspection results remain private snapshots and require no acknowledgement.

The committed entry pauses subsequent work without replaying movement or shipment. Self, ally, advisors and physical-marker faction immunity are applied independently of a copied effect. Cohort replenishment waits until the final triggered effect finishes; BG never re-enters the pool. Exposed-city storm crossings and actual Lasgun–shield explosions return Ambassadors to supply without triggering them. Traitor precedence preserves a token when it prevents an explosion.

Independent review found and fixed two exchange deadlocks: CHOAM cash-in and delayed Truthtrance disposal could otherwise spend the beneficiary’s final required discard. Voluntary interruptions must preserve a legal completion, including queued Truthtrance reservations. Legal interruptions retaining a card still complete through JSON recovery.

Auction payments now execute automatically only when the exact declared own/ally split is funded and no physically usable Karama remains. Genuine payment choices and provisional unfunded recovery are retained. Full-plan inspection has no Finish action; the persistent private inspector also supports an external Atreides ally. Authenticated recovery schedules both legacy decision types and persists only actual changes through the existing CAS fence.

Verification: 1,029/1,029 rules/client tests; 74/74 persisted/API tests; TypeScript, lint and production build pass. Logs: /tmp/dune-ambassador-full.log, /tmp/dune-ambassador-multiplayer.log, /tmp/dune-ambassador-type.log, /tmp/dune-ambassador-lint.log, /tmp/dune-ambassador-build.log. The fresh 120-game Basic calibration completed with no deadlock, action-limit, exception or invariant failure; 47,965 accepted actions, 9,081 rejected candidate actions. Relative to the prior same-seed run, every per-game field except accepted-action count and elapsed time is unchanged.

Limits: Ecaz/Duke/alliance, Fremen movement, Guild shipment, Richese purchase and Tleilaxu revival effects still need completion; competing arrival ordering remains unresolved and rejects the original entry atomically. Occupy, full Ecaz setup, other expansion systems and full-mode games remain unfinished. The first-slice checklist in the internal rules marks these boundaries. No expansion or Advanced start gate was removed, and the user-removed automation stays removed.

Four additional original Fremen portraits complete the five native Fremen faces: Chani6, Otheym5, Shadout Mapes3 and Jamis2 join Stilgar7. Root inspected all four final source files, the complete live browser row, and each new enlarged component. The registry now covers22 of the existing50 catalog identities; full twelve-faction component inventory remains incomplete. Final bundle after assets and guide updates passes (/tmp/dune-ambassador-final-build.log). Final guide tests8/8, TypeScript and lint pass after the prose updates.