15 KiB
Ordinary consumed-card continuation checkpoint
7 September 2026. Hajr, Ghola, Harvester, Weather Control and Family Atomics now retire through the shared saved-discard infrastructure after their existing effects have completed. Normal actions automatically drain the frame within the original action; recovery restores suspended controls without playing the card again. This checkpoint does not activate Semuta or broaden supported card timing, faction rules or expansion starts.
Five completed effects, one restoration boundary
The live ordinary-card dispatcher retains its existing timing, selection, ownership and promise checks. Each accepted effect, its physical discard and its public played-card log are committed before staging. The new ordinaryCardDiscard continuation contains player, card, the explicit five-effect discriminant, the four suspended controls and stateSignature. The single public batch has cause ordinary:<effect> and the actual used card's former owner.
| Card | Already committed before the frame | Recovery must preserve |
|---|---|---|
| Hajr | The owner is added once to the movement allowance. | Completed movement, the one extra allowance and the current movement queue; no third move or early turn ending. |
| Weather Control | The validated selected distance, including zero, replaces stormPending; ready seats are cleared. |
Original storm position, dial records and selected distance; storm movement waits for ordinary confirmation. |
| Harvester | The open fresh blow doubles, its Harvester count increases and readiness clears. Outside the storm, only the previous fresh-blow amount is added to ground spice. | The resulting blow and ground amounts; older ground spice is not multiplied, and no ground spice appears in the storm. A second physical Harvester creates its own later event. |
| Family Atomics | The Wall is destroyed, all existing Wall force losses are applied through the existing casualty helper, and readiness clears. | Ordinary and elite losses/tanks and surviving groups elsewhere; the owner may already have lost its qualifying Wall fighters. |
| Ghola | The selected force, leader or Kwisatz Haderach revival, applicable technology accrual and Tleilaxu income response are established. | Exactly that revived state, leader custody/cycle, banked technology and unpaid income; no second revival, accrual or payment. |
The suffix marks the discard sequence resolved, clears the frame and restores response, decision, pendingKarama and phaseOpening. It does not replay the original action, repeat availability checks against the post-effect position, regenerate randomness or restore a whole older Game. Normal finalizers run only after restoration. A newly restored Tleilaxu income response may wait for its real cancellation opportunity or settle automatically under the existing rules.
11 October 2026 Semuta update: in the explicit Richese development preview, a completed ordinary Ghola may offer its consumed card during battle. The same receipt binds the revived pieces and original battle, including a sealed opposing plan. Claim or all-seat decline restores controls without reviving again, then normal planning may use the returned leader. Competing parents and other unsupported producers retain their original boundaries.
Ghola custody and earned income
Ghola's existing helper remains authoritative. Force revival transfers the chosen ordinary/elite counts once, preserving normal revival usage and the existing Ixian cyborg exception. An owned dead leader keeps its identity, original pool, death count and control record; only the existing revival changes occur. A controlled foreign leader remains in its original owner's leader array. Captured-leader denial and native-owner denial while foreign control persists remain unchanged. Kwisatz Haderach's revival cycle advances only in the actual Ghola effect, never during recovery.
The signature includes player leaders and control records, Kwisatz state, normal revival ledgers and the shared Duke Vidal record. Binding Duke Vidal preserves that authoritative state; it does not introduce a new Ghola eligibility rule. These receipts do not decide unresolved leader/revival-cycle interactions or grant foreign Auditor eligibility.
A seated Tleilaxu's Ghola reward is a separate one-spice revivalIncome response, including self-Ghola under the existing rule. The revived pieces remain revived whether that income is allowed or canceled. Ghola does not consume an already-recorded normal free-revival income allowance. Axlotl accrual is separate: where eligible in Revival, it banks the number of technology tokens held by its owner once that turn and pays at phase end. It is neither immediate cash nor the number of pieces revived.
For this ordinary-card source, the validator permits the expected Ghola income response and requires its exact Tleilaxu owner, Ghola recipient, amount one and initial empty passes. It rejects unexpected suspended decisions, Karama conversions or phase openings. The general continuation shape is not permission to insert arbitrary parents into an ordinary play.
Saved-state validation and privacy
Shared validation requires the current playing-state discard sequence, turn/phase, one public physical receipt and unique card custody across real zones. The ordinary validator matches the exact player/card/effect, checks the resulting effect state and validates suspended controls without applying them. Its signature binds relevant movement, storm, spice, battle/promise, leader/revival, player resource and technology state. Private hands and seat AI control are excluded from the outcome signature and are never restored from it; normal card-custody checks still apply.
A signature is a saved-state consistency check, not authentication against coordinated rewriting of every bound value. The frame is internal evidence, not another physical copy of the card. Projection exposes the generic automatic-continuation marker and the already-public played-card log, while keeping receipt/signature and other seats' private state hidden. Shipment and battle preparation-completion projections remain suppressed while a discard frame is pending.
Production room recovery uses the existing compare-and-swap version fence. A pending discard reaches engine validation even if conflicting live controls or a finished status would otherwise make the scheduler wait. Corrupt frames reject before a write; duplicate workers can produce only one committed continuation. Retired sequences and stale original card plays cannot repeat the effect.
Preparation searches remain simulations
Battle and shipment preparation use different paths. Battle preparation already calls the pure Ghola effect helper and performs trial discard accounting on its cloned position. That path remains free of live discard frames.
Shipment preparation previously called the ordinary inner dispatcher directly, so live frame staging would otherwise strand its hypothetical Ghola before later pledge withdrawal, shipping Karama or shipment. It now passes the explicit internal execution argument shipmentPreparation. The deterministic effect, card accounting and trial state remain equivalent, while the ordinary tail omits live frame staging. This argument belongs to the private function call; user action JSON cannot select it. Public card plays always use the live path.
The search does not run a general game normalizer, re-enter public action promise reconciliation or advance unrelated phases to complete a trial. Returned preparations remain owner-only, immutable during repeated reads and executable as genuine actions. Live Ghola frames restore their income context before ordinary promise reconciliation, so a conditional Tleilaxu support promise is not released merely because its response was temporarily suspended. Cancellation of the restored income can still release an infeasible promise under the existing rules.
Focused verification and fixture limits
The new engine suite covers first-move Hajr, zero/pre-dial and post-dial Weather Control, successive Harvesters and storm loss, Atomics after its qualifying fighters die, ordinary/elite Ghola, native leaders, Kwisatz cycles, real foreign-Ghola acquisition followed by a documented later-death scenario, Ixian cyborg revival, technology and Tleilaxu income. It also checks conditional battle funding, a shipment requiring Ghola plus escrow withdrawal and Karama, all four AI profiles, public/private projections, corrupted outcomes and attempts to select the internal execution argument through action JSON. These are bounded engine scenarios, not full expansion games.
The five new SQLite tests in tests/ordinary-card-discard-recovery.test.ts passed in the focused run (6.01 seconds; /tmp/dune-ordinary-card-discard-recovery.log). They run real migrations and production room modules with authenticated room identities. Their explicit component positions use one physically sourced expanded deck and conserved force inventories. Actual movement and fresh-blow actions establish the relevant prerequisites; a test-only VM observes the production inner card dispatcher before automatic drain without adding a runtime export.
The SQL cases verify typed Ghola revival with two-token Axlotl accrual, actual income allowance/cancellation and later technology payout; Hajr after a real first move followed by exactly one extra move; Weather zero; two real Harvesters over a fresh blow and existing spice; and Atomics typed casualties. Concurrent recovery preserves committed resources, forces, cards and logs. Duplicate Ghola/Weather requests commit the complete effect and retirement within one original CAS. Fifty-four malformed-frame variants reject with zero writes, followed by retired-frame replay checks for all five effects. Named formatting and lint passed. These fixtures do not claim a publicly started Advanced expansion session, browser acceptance or complete faction-rule coverage.
Final integrated verification
1,766 rules/client/component tests and 184 multiplayer tests pass (1,950 total). The new coverage comprises 24 engine scenarios and five SQLite scenarios. The engine scenarios include 197 corrupted-state/replay variants, separate from the SQL malformed-frame cases above. Full logs are /tmp/dune-ordinary-frame-final4-rules.log (49.49 seconds) and /tmp/dune-ordinary-frame-final-multiplayer.log (27.97 seconds). Final TypeScript and lint pass in /tmp/dune-ordinary-frame-final2-type.log and /tmp/dune-ordinary-frame-final2-lint.log; the production build passes in /tmp/dune-ordinary-frame-final-build.log.
The new physical-custody checks exposed old fixtures that copied a selected catalog card into a hand while its identical physical ID remained in a shuffled deck or another zone. Those bounded fixtures now use tests/fixture-hand.ts to relocate the selected component. Production custody validation was not weakened. The earlier failing runs remain recorded; the final complete run passes after these fixture corrections. This fixture helper is not a full-game initializer or an inventory-repair routine.
Twenty current-source Basic games, covering two through six players and all four homogeneous AI difficulties, completed 10,931 accepted actions, zero rejected candidates or stalls, and 495 JSON round trips in 104.82 seconds. The public-start runner is /tmp/dune-sapho-base-fullgames.ts, with seed 20261007 and output /tmp/dune-ordinary-frame-base-fullgames.json. Source hashes did not change during the run. Its card actions used the two Karama IDs, not these five ordinary effects; this is general Basic regression evidence, while the new dedicated scenarios provide direct effect/recovery coverage. It does not certify Advanced/expansion games or comparative AI strength.
Browser acceptance used only the existing named QA room 8S3MRDEK. A documented staged position followed a real first move; the UI then played Hajr, showed one remaining move after refresh, accepted the additional move to Carthag, and displayed movement complete with the move control disabled. A second refresh preserved that result. The saved room at version 57 contains one Hajr discard/log, resolved sequence 1, no pending frame, two completed moves and one force each in Imperial Basin, Arrakeen and Carthag. Spice 20 and reserves 17 remain unchanged. Private snapshots are /tmp/dune-ordinary-qa-before.json, /tmp/dune-ordinary-qa-staged.json and /tmp/dune-ordinary-qa-completed.json. The browser board and controls were visually inspected; this is a staged playtest, not an entire browser game.
The coordinator reviewed both complete new test files, all production edits and the independent runtime review. Final engine SHA-256 is 2e7eed285be1f2b74279c0436c7be5fae29ee9b5bd007cc56dab5986282e2433; the current-source matrix combined fingerprint is ec4dd25d4671e2753c2afa3116e5dff2d5a1bf1d90ed38b9bc8fe4f3a7df7e2f. The complete checkpoint hash manifest is /tmp/dune-ordinary-frame-final-hashes.json.
Remaining scope
Semuta activation and its reaction/capacity rules remain unfinished, as do other consumed-card producers. Ordinary Karama has a separate pre-effect cost/continuation problem; special Karama, Distrans, Amal and Thumper are not silently included in this five-card source. Existing Hajr/active-Ornithopter timing and Family Atomics/concealed-No-Field guards remain in place. This persistence slice does not resolve those rules or broader Ghola, faction, optional-module, mobile and full-game expansion requirements.
Contract: NEXT_CONSUMED_DISCARD_CONTRACT.md. Producer inventory: SEMUTA_DISCARD_CONTINUATIONS.md. Prior checkpoint: TRUTHTRANCE_DISCARD_CONTINUATIONS.md.