Dune/docs/DEFERRED_SHIPMENT_ARRIVAL.md

# Deferred shipment and arrival validation

14 September 2026. A genuine Advanced Ecaz/Fremen/Guild/Bene Gesserit sample
exposed an already accepted shipment whose Guild allowance could not finish.
This continuation repair preserves the existing unfinished arrival-order gates.

## Ambassador child arrivals during overlap — 27 October 2026

**Prototyped / Partial.** When an Ecaz Ambassador and a Moritani Terror token both
respond to the same eligible Basic arrival, the existing overlap preserves the
two owners' opportunities in provisional storm order. The extension
allows the Fremen Ambassador's relocation and the Guild Ambassador's free
shipment to create their own physical child arrival while the original overlap
waits. The chosen group, destination and ordinary force restrictions remain
authoritative; the original entry and any payment are not replayed.

The child resolves its own eligible Terror opportunity before the suspended
Ambassador returns to the original overlap. If the same Terror token is
declined on the child, it remains available to an as-yet-unresolved original
entry. If the child reveals and consumes that token, the original entry cannot
offer it again. A distinct child token and the original token retain separate
opportunities; if the original Terror was already resolved first, the child
only encounters tokens still present. This live-token and child-first sequence
is an explicit online composition, not a publisher ruling on simultaneous
priority.

Sneak Attack remains a real child effect: its physical forces and any resulting
Bene Gesserit accompaniment are preserved, with the follow-up waiting until the
original overlap's outstanding reaction finishes. The Sneak group can then
trigger an Ambassador that remains available, including after an original
entrant declined it. A child Sabotage discard offers the existing Semuta
response before the same Ambassador continuation.
Existing advisor eligibility,
unrelated busy controls, other arrival effects and optional-module boundaries
remain separate. Complete faction rules, broader interaction, recovery, browser
and deployed acceptance remain open.
Frozen changed-path proof passed 108/108 tests in 14 files, type/lint and the
production build. [Fremen](../tests/overlap-fremen-native-runtime.test.ts),
[Guild](../tests/guild-overlap-child-runtime.test.ts), [Sneak](../tests/sneak-overlap-child-ambassador.test.ts)
and [Semuta](../tests/semuta-overlap-child-runtime.test.ts) use real setup and
actions with explicitly controlled original token selections. Rendered
[controls](../tests/overlap-fremen-guild-controls.test.tsx) do not certify
browser or deployed behavior.

## Basic native faction overlap — 27 October 2026

**Prototyped / Partial.** In bare Basic games with selected native faction
decks and both Ecaz and Moritani seated, an eligible arrival may carry both
Ambassador and Terror opportunities through the existing provisional storm
order. The original move or shipment is committed and paid once; its two
owners resolve their separately earned opportunities in sequence. The existing
queue and controls apply; this is not a publisher ruling on simultaneous
effects. Actual in-flight controls remain authoritative. The child-arrival
follow-up above extends the earlier Fremen and Guild boundary; optional-module
combinations retain their separate boundaries. Complete factions, modes and
deployed acceptance remain open.
The new [runtime fixture](../tests/fixture-basic-native-overlap.ts) uses public
Basic setup and real shipments with explicitly controlled, native-token
placements. [Regression cases](../tests/basic-native-overlap-runtime.test.ts)
cover both owner orders, Duke acquisition, Robbery and a native Tleilaxu
entrant. They do not prove every nested arrival or module combination.
Frozen changed-path proof passed 76/76 tests in nine files, type/lint and the
production build. Browser, deployed and full-mode acceptance remain open.

## Native own-arrival continuations — 15 October 2026

Direct native Guild transport now has the same clear owner-view candidate
as its already executable engine path: future earned income is not a current
busy control. Ordinary shipment likewise stops predicting its own future BG
accompaniment as an active decision. Shared movement preflight distinguishes
resulting Intrusion from an actual pending decision. The existing committed
entry queue, not a second timing adapter, waits for those native controls.

Original price, funding, payment, source group, reserve transfer and movement
ownership stay unchanged. Actual response/decision/Terror/Ambassador controls,
pre-entry fighter choice, Fremen storm protection and unsupported paired
reaction/profile guards remain. The subsequent [native rate follow-up](GUILD_RATE_KARAMA_RULES.md#native-expansion-and-nexus-admission--15-october-2026)
also admits expansion/Nexus rate responses while retaining original price
and unaffordable-return policies. Income cancellation itself is not repricing.

**Provisional composition, not publisher priority:** finish the arrival's
own controls before its deferred entry. Accompaniment joining existing BG
fighters creates a distinct eligible child entry before the original shipper.
Declining that child leaves a live token for the original entry; consuming
it leaves no token to offer again. Advisors remain exempt. This retains the
existing callback/queue order; it does not invent FIFO or suppress a BG choice.

Two original-action fixtures cover Guild income allow/cancel and Ambassador
trigger/decline, BG accompaniment accept/decline/cancel, Intrusion flip/decline/
cancel, the fighter child and original movement. No played hand, wallet,
army, phase or decision is staged. Affected six-file **55/55** and **20**
original API/policy paths pass. Four actual styled390px GameTable journeys
exercise Guild transport/income cancellation, advisor accompaniment, accepted
Intrusion, and declined Intrusion with child-then-original offers. Payment
and transfers occur once; original movement resumes; no overflow/browser
errors. In-memory loopback proof only, not saved-room or deployed acceptance.

This supersedes the BG/direct-transport exclusions in the earlier checkpoint
below and obsolete rejection-test pins, not its remaining recovery safeguards.

## Ordinary Guild income before Ambassador entry — 15 October 2026

The original native Ecaz/Moritani/Guild producer exposed a stale preflight:
`quoteShipmentArrival` treated its **future** earned Guild receipt as an
already-busy arrival response. Yet `commitShipment` already records that
income/counter window, and `openTerritoryEntry` queues the committed entry
until the original response/decision finishes. Rejecting the paid shipment
before Guild permission therefore fenced an existing executable continuation.

Ordinary reserve shipment no longer predicts Guild income as a busy control.
The original physical/price/funding validation, Guild permission, payment,
income/cancellation and deferred-entry queue remain unchanged. The shared
ordinary bot adapter follows that same distinction, without reading hidden
funding or rival hands. Actual in-flight controls, Fremen storm protection
and unsupported paired-reaction gates remain. The native own-arrival
follow-up above also connects direct transport and BG's resulting choices.
This reuses the documented income-before-entry order, not a new comprehensive
publisher priority table or an exception to paying for entry.

Actual styled390px GameTable chooses the placed Ecaz token's stronghold,
ships one, receives original Guild permission, debits Moritani12→11/
reserves14→13 and credits Guild6→7 **before** the Ecaz Ambassador prompt.
The real acquisition button grants Duke6; no payment or reserve transfer repeats.
Original battle then opens Moritani's Sanya4 reveal and physical Mentat
replacement. Affected15-file union134/134, types/lint and original API proof
pass; final surface has no overflow/browser errors. No saved/deployed rooms
were touched, and no new cancellation/recovery or full-combination claim is made.
[Native disc/target integration](MORITANI_ASSASSINATE_LEADERS.md#canonical-winning-discs-and-native-targets--15-october-2026).

This supersedes only the historical prospective-Guild-income rejection below.
The historical BG/other-arrival return and safeguards remain distinct.

## Reproduced failure

The fixed seed `202609146` stopped on turn one after 90 accepted actions. Guild
declared four forces to Carthag, sector 11, where an Ecaz Emperor Ambassador was
placed. Allowing that shipment created a Bene Gesserit accompaniment choice,
then the Ambassador overlap guard rejected the arrival. The rejected action was
immutable, but the earlier accepted declaration left the table unable to proceed.

An isolated archive of prior checkpoint `58ae84f` replayed the same setup seed
and all 90 accepted actions. The resulting player state and pending shipment
matched, and Guild allowance failed with the same guard. The defect predates the
Fremen/Ecaz victory follow-up. Private traces and failed snapshots are retained;
the failure was not replaced with a successful seed.

The Basic sample with seed `202609145` finished on turn seven in 563 accepted
actions, using alternatives after 14 guarded shipment candidates. The initial
Advanced sample did not finish. Neither formed the Fremen/Ecaz alliance or
exercised its final-turn exception. Staged endgame checks are separate evidence.

## Rules boundary

The [deferred movement contract](DEFERRED_MOVEMENT_ARRIVAL.md) records the
unresolved ordering of simultaneous Ambassador, Terror and Bene Gesserit arrival
effects. Shipment prevention precedes payment and arrival; an allowed shipment
still needs a supported continuation. Refusing an unfinished combination in this
development build does not mean the physical rules prohibit that shipment.

This work does not choose an Ambassador/Terror priority, suppress an earned
Bene Gesserit choice, or open Advanced, expansion or publication gates. The
existing [Ambassador](ECAZ_AMBASSADORS_RULES.md),
[Terror](MORITANI_TERROR_RULES.md) and
[Guild payment](GUILD_SHIPMENT_PAYMENTS.md) contracts retain their boundaries.

## Continuation contract

Ordinary shipment now quotes the resulting arrival before opening Guild's
interception decision and again before settlement. The adapter shares the
existing arrival guard with movement and includes pending controls, Guild income,
Bene Gesserit intrusion/accompaniment and Fremen storm protection. It does not
spend resources or inspect a concealed No-Field value to choose reaction order.
Own No-Field shipments also preflight before their earlier cancellation window,
which otherwise bypasses the common shipment offer.
Ambassador-generated shipments retain their distinct validated parent and return
path.

An already saved ordinary Guild declaration may return to its shipper when
explicit allowance encounters this typed unsupported-arrival error. Its original
declaration, ownership, price, force pools and funding must still validate first.
Every excluded special-shipment marker must be absent, rather than merely falsy;
forged, null and empty receipt fields cannot be discarded as an ordinary return.
Only the pending shipment and decision are released; the log explains the
unfinished overlap, and the shipper retains its shipment and movement choices.
Unrelated errors and corrupted declarations still reject without writes.

Legacy declarations tied to an Ambassador, No-Field, Smuggler or spent Nexus receipt do
not use this return path: their custody and parent continuation need separate
handling. The repair does not refund or rewrite those receipts. Fresh ordinary
declarations using the shared offer path receive preflight before the Guild
decision can be accepted. This is bounded recovery, not complete arrival-order
implementation or a universal repair for every older pending shipment.

## Focused verification

Six engine regressions cover the original declaration, a supported allowance,
legacy return and replacement, own No-Field preflight, stale prices and forged
special markers. Three authenticated SQLite regressions cover pending and
returned private-seat restoration, exact custody, replacement arrival, wrong
actor/choice, stale/duplicate requests, corrupted declarations and concurrent
allowances committing one return. Fixtures use genuine faction setup followed
by an explicitly staged arrival topology; the historical sample retains its
separate genuine-game provenance.

Independent review found and resolved the earlier No-Field window bypass and
falsy special-marker recovery checks. Its focused union passed 149 cases, and
targeted lint passed. Final broad checks, source correspondence, full samples
and saved-game preservation are recorded with the checkpoint.

## Integrated samples after repair

The same Basic and Advanced setup seeds and four AI profiles were repeated after
the code review. The exact failed Advanced snapshot was also resumed without
editing its state; its first Guild allowance now returns the uncommitted shipment.
The continuation uses seed `202609147`, a new random stream because the original
cursor was not saved. Its input hash and provenance are retained privately.

| Run | Accepted actions | Guarded candidates | Periodic JSON rounds | Result |
| --- | ---: | ---: | ---: | --- |
| Exact saved continuation | 842 additional | 109 (100 shipment, 9 movement) | 22 | Turn 10, Guild |
| Original Basic seed `202609145` | 563 | 14 shipment | 15 | Turn 7, Guild |
| Original Advanced seed `202609146` | 806 | 81 (74 shipment, 7 movement) | 21 | Turn 9, Bene Gesserit |

All games finish using legal alternative candidates after the explicit development
guards. Physical custody and all twelve terminal private views pass. All 216
game-file hashes remain unchanged throughout the samples. Both Advanced runs
form Ecaz/Fremen alliances but never co-occupy Sietch Tabr or exercise its special
victory. The saved continuation ends with allied Habbanya co-occupation, correctly
outside the supported Tabr exception. These samples demonstrate bounded repair
and continuation, not full rules-combination acceptance or AI strength calibration.