Dune/docs/STORM_WORM_PREFLIGHT_REVIEW.md

Storm/worm cancellation prerequisite review — 2026-09-07

Scope and confirmed risks

This independent review covers continueStorm, devour, wormSurvival, afterWorm, and the finishResponse branches for storm protection, worm placement, worm ally protection, and worm survival. Ownership/source signatures already bind a cancellation to its original response. The additional requirement is a pure semantic check of current casualty custody and required continuation fields, both before spending a physical cost and when an allowed BG conversion resumes. A whole-game effectful clone or automatic normalizer is not an appropriate prerequisite check.

Concrete existing hazards:

• continueStorm ends only when traversed equals distance. An invalid fractional distance or already excessive traversed count can fail to terminate. Validate the counters before advancing; legal first-storm dials each permit 20, so a distance of 40 must be accepted.
• kill derives casualties from current physical and elite maps. Excess elite custody throws late; negative/fractional physical counts and invalid tank counts can produce invalid losses or arithmetic instead of rejection. A BG conversion can otherwise spend its Worthless before its saved suffix reaches those checks.
• stormProtection previously treated every resume other than storm as a shipment. Require the exact shipment branch and its actual active/shipped Fremen cohort, valid current-storm board location, and physically feasible ordinary/elite casualty quantities. The shipped cohort may share its location with earlier occupants, which must survive cancellation.
• revealPlayerNoField validates token custody and controller only when the disaster reaches the marker. A malformed token list, mismatched deployed/last-shipped identity, wrong controller, invalid reserves, or invalid board location must fail before a BG cost is committed. Pure revealRicheseNoField can quote the physical amount without consuming RNG, issuing a marker event, moving reserves, or logging.
• A natural worm requires its actual sequence/resolution. A summoned worm before the first natural blow genuinely has neither; its matching saved parent is the authority. Cancellation must preserve that valid case.
• Worm ally protection cancellation produces a further Fremen survival response. Its guard must validate the permitted continuation rather than incorrectly performing or requiring immediate Fremen death.
• Canceling additional worm placement continues the existing spice sequence; it does not devour the chosen territory. Guard prerequisites must follow that branch.

Runtime contract coordinated with owner

The owner implemented pure disaster prerequisite helpers in game/disaster-preflight.ts, invoked before initial cost and final cancellation execution, and from actual continueStorm/devour. The shared storm traversal validator must permit valid pending typed casualty queues, even though the initial protection response itself is offered before traversal. Relevant counters, board keys, duplicate pending entries, current affected force/tank/reserve arithmetic, and concealed marker custody should be checked without selecting elite losses or altering queue order.

Source parent signatures continue to exclude newly added worm rides/Nexus, as established by the preceding actual summon restoration regression. Matching summoned parent context must remain available to the source-bound BG conversion. No new broad freeze of hands, balances, other overlays, or a global second-BG-conversion prohibition is introduced by this review.

Independent tests

Owned file: tests/storm-worm-cancellation.test.ts.

All initial component cards are physically taken from the base deck. Tests use actual production dials, ready actions, shipments, spice draws, Fremen decisions, special summons, printed Karama, and BG Worthless conversions; corruption is applied only to explicit cloned saved positions.

Genuine scenarios already verified before the new guard release:

1. Printed and BG costs cancel Fremen exposure after actual 20+20 first-storm dials; all four forces and two elites die once, and the storm ends at the correct sector after 40 movement.
2. Printed cancellation of a BG conversion restores ordinary Fremen protection and the typed half-loss decision; selecting one elite resumes traversal and preserves both ordinary/elite totals.
3. A real three-force/one-elite Fremen shipment into the Great Flat storm is canceled; four earlier occupants, including two earlier elites, remain intact.
4. Both forms separately cancel actual natural survival, ally protection, and extra-worm placement, verifying their different effects.
5. A valid three-No-Field with only two available reserves reveals two and then loses those two under storm/worm, without inventing reserves or duplicate reveal.
6. A pre-blow special summoned worm has null natural sequence, and both forms cancel its survival while restoring original pre-blow controls and an unchanged spice deck.

Additional tests cover pre-cost corrupted typed force/tank/No-Field and branch context records across both forms, plus revalidation after BG has already spent its physical card. Deliberately nonterminating legacy traversal inputs were not executed against the old unguarded loop.

Final verification

Final owned suite: 10/10 passed. The initial rejection loops cover 70 corrupt pre-cost attempts, plus 3 already-paid BG final-allowance rechecks. Each rejects without mutating its input or consuming an additional physical card.

The counter-cancellation test now preserves TWO genuine same-sector typed-loss groups: the second group remains in stormResolution.pending across the first decision/JSON restoration and resolves separately. A further genuine test covers Sihaya Ridge's printed rock-territory spice card and both cancellation forms.

Named regression run: 61/61 passed across this new file plus existing automatic-responses, choam-jubba, bots, and ix-deck files (63.80 seconds). This rerun includes all five failures from the owner's first historical regression run. Formatting, named-file lint, and full TypeScript checks passed. Logs: /tmp/dune-storm-worm-focused-regression.log and /tmp/dune-storm-worm-cancellation-tsc.log.

No engine/package/shared-production files were edited by this reviewer. The owner corrected the old automatic-responses fixture's physically invalid the_great_flat:14 to actual sector 15; no gameplay assertion needed weakening. Legacy initial storm position zero remains accepted by the traversal helper, alongside legal distance 40. The new malformed-origin test uses -1.

Additional defects found and fixed during independent review

1. An accepted legacy natural worm could have spiceSequence=null and malformed spiceResolution.skipped=null. The original helper checked only presence of a continuation. BG could commit its cost before continueSpice later tried to spread the missing skipped list. The final helper validates that deferred list. The durable ninth test reproduced the acceptance and now rejects before either cost.
2. A genuine summoned worm with corrupted resume.wormRides=null could commit a BG cost before afterWorm spread its restored null list. The final helper checks current/parent ride arrays and parent Nexus shape while preserving genuine pre-blow null sequence/resolution.
3. A blanket sand-only validateWormDevouring rejected natural worms after printed rock-territory spice cards, producing the observed AI stalls. The final helper accepts sand OR territories listed on actual SPICE_CARDS for natural devouring/survival and restored natural rides. Player-selected additional worms retain the existing sand-only restriction. This is preservation of current component behavior, not an imported rules interpretation.

Evidence and coverage limits

Physical custody and reveal behavior follow the existing source contracts in docs/RICHESE_NO_FIELD_RULES.md and docs/RICHESE_NO_FIELD_ENGINE_AUDIT.md. Karama conversion boundaries follow docs/KARAMA_PREFLIGHT_AND_CONVERSIONS.md; this review adds no expansion/timing ruling. Printed spice identities are taken directly from game/cards.ts:SPICE_CARDS and compared with actual board territory types. First-storm input bounds are the existing production two-dial 0–20 contract.

These tests cover engine action atomicity and JSON continuation. They do not claim production SQLite/CAS coverage, whole-game malformed-save validation, future random-outcome preflight, or complete expansion support. The helpers inspect casualty prerequisites without allocating a No-Field reveal event, drawing/shuffling cards, selecting losses, paying resources, or replaying a continuation. No concrete unresolved live-action regression remained in the covered paths at release.

Historical reviewed-source hashes: engine 9c61af56477cec657e40fbf7e8cc3380f301462639188c83dcf5c4dfe62eb708; helper 7858d08906b556af1e4e1c48621d145b2241b0c7caeb1201a8ca3a390d721ae1; owned test 4def7d68445c45285df9a13f5ec79c28023d5baa7872653e807c646323d90e81. Later owner edits may change these historical hashes.