Guild shipment payments and transport previews

Integrated checkpoint, 2026-09-07 local date. This closes the contributor-routing defect and adds transport price controls; ordinary rate/permission Karama cancellation and nonbattle Truthtrance commitments remain incomplete.

Distinct permission and independent typed pricing — 15 October 2026

Native cross/return permission now has its own unpaid counter before native rate. Ordinary purchased Karama price remains independent on original typed routes, with the whole approved donor/own invoice paid to bank and no ordinary Guild income. Original special-stop card-return policy is reused rather than leaving a spent grant active. Allied marker reapproval and authoritative fresh supplier/AI prices preserve each original approval without reading other wallets. Current source contract and explicit remaining Junction/purchased-price gate.

Native rate admission follow-up — 15 October 2026

The separate prepayment rate window now also admits expansion/Nexus native reserve, cross-planet and Guild-return declarations, including Cunning's original second allowance. Affordable full repricing and unaffordable return/ full-price replacement retain original sources and approved funding. Three actual390px journeys prove these controls; income remains distinct. Canonical source, evidence and remaining source-specific boundaries.

Native direct transport continuation — 15 October 2026

Direct guildShip already committed positive Guild income before queued Ambassador entry; its stale owner-view candidate now accepts that same path. Original on-board source6→5 plus destination1 costs one to the shipper without using reserves. Real Karama income cancellation prevents Guild's receipt without refunding the shipper or repeating transport; the original Ecaz offer and next movement owner follow. Allow/decline and cancellation variants pass in the native arrival contract. The subsequent native rate follow-up above supersedes this checkpoint's expansion/Nexus exclusion; income cancellation itself is still not repricing.

Ordinary income then Ambassador arrival — 15 October 2026

Original ordinary reserve shipment may now proceed into a placed Ambassador when it earns Guild income. The stale preflight predicted that future receipt as an already-busy arrival control; the commit's existing income/ counter-then-deferred-entry sequence already handles it. No tariff, contributor destination, pledge, cancellation or physical transfer changes. The ordinary bot preflight matches this distinction. The later direct transport follow-up above supersedes its earlier separate candidate boundary.

Actual styled390px native controls ship one Moritani counter, use original Guild permission, settle Moritani12→11 and Guild6→7, then open Ecaz's real Ambassador/Duke acquisition. The same invoice and force never repeat. Affected15-file134/134, types/lint and original engine/API proof pass; this is not new saved-room, deployed, cancellation-matrix or full-mode evidence. Canonical current entry contract.

Publisher contract and precedence

The November 2020 FAQ, printed page 2, directs an ally's shipment contribution to the Guild (bank if absent) and sends the Guild's own contribution to the bank. This replaces April's instruction to transfer funding to the shipper first. The implementation therefore routes payment by contributor identity, including a non-Guild ally funding Guild's own shipment. The Guild's personal share still goes to the bank. The FAQ supplies a general funding rule, not an explicit Guild-as-shipper worked example; this application of the later funding-specific wording is the coordinating review's source adjudication. No old-edition or tournament rule was adopted. November FAQ, superseded April FAQ.

Root independently retrieved the official indexed November page and compared its full funding answer to April. This is not evidence of a newly downloaded PDF binary. Rate and transport-cancellation source boundaries remain in GUILD_RATE_KARAMA_RULES.md.

Implementation

guildShipmentIncome computes both contributors' destinations once, shared by ordinary commitShipment and direct guildShip. Previously both paths suppressed all income when Guild was the shipper, losing the non-Guild ally contribution. Independent Karama still routes all payment to the bank. Guild-funded allied shipment still sends Guild's contribution to the bank. The current income response can cancel the receipt without refunding payment or undoing force arrival. A new automatic chronicle event explains receipt or prevention. Existing distinct shipment settlement paths, No-Field restrictions, special-stop policy and mode gates are retained.

guildShipmentCost centralizes the rounded transport tariff used by the authoritative engine and bot mobility helper. Shared contribution bounds retain the default minimum required pledge and explicit escrow limit. Funding is checked before income; future Guild receipts cannot finance the same payment.

guildTransportQuote consumes only the personalized view. It previews the submitted single or combined source group, selected regular/elite counts, destination, own spice and authorized pledge. Combined-sector counts override the unrelated scalar amount exactly as on the server. The UI displays selected physical forces, price and both shares; invalid or unfunded choices have linked reasons and disabled buttons. Cross-planet, southern reserves and returns each have their own quote. A blocked or expensive board destination does not disable a legal cheaper return. All submissions remain authoritatively revalidated; this helper is neither future-action feasibility nor a persisted shipment-intent model.

Verification

Nine payment-routing tests cover both donor directions, zero/partial/full/default shares, reserve/cross/return, missing Guild, cancellation, independent rate card, JSON continuation and atomic invalid action rejection.
Ten quote tests compare enabled choices with actual engine acceptance and debit, including combined groups, paid Fremen reserves, elite defaults, storm/entry/advisor restrictions, invalid inputs and private-state perturbations. Independent review additionally compared 10,320 synthetic settled-state selections without a quote/server mismatch. A malformed destination initially defaulted to return; root fixed it and the regression now passes.
Three production-room SQLite tests cover both reserve and cross routes with restart, duplicate same-version CAS, pending income allowance/cancellation, exact payment/arrival/card/log counts, wrong actors, stale requests and private projections.
Full registered suites: 1,474/1,474 rules/client/component tests and 126/126 persisted/API tests pass. Logs: /tmp/dune-guild-full.log and /tmp/dune-guild-multiplayer.log. TypeScript and lint pass: /tmp/dune-guild-final-type.log, /tmp/dune-guild-final-lint.log. Production build passes: /tmp/dune-guild-final-build.log. The earlier 648-game calibration was not rerun for this payment change.

Browser and restart evidence

At 23:45 UTC, all 1,502 rooms were backed up using SQLite's backup API to /tmp/dune-maintenance-20260906T2345/database.sqlite. Following the controlled restart, every room's exact JSON hash/version matched and HTTP returned 200. PRAVNYBG restored the private human seat and legitimate Storm wait. The first sandboxed restart failed before serving because local network-interface access was denied; the authorized development-server launch with required access succeeded. No database restoration or repair was needed. The removed automation was not recreated.

Created separate room 6XMTUD6U through browser lobby/setup: human Guild and Hard Emperor/Atreides. At v10, only this QA room was staged to Shipment with five Guild forces split across Wind Pass sectors 14/15, personal spice 1 and Emperor escrow 2. All physical force totals and card identities were preserved. The staging and original state are recorded in /tmp/dune-guild-browser-original.json and -staged.json; this is a focused fixture, not a full-game claim.

Actual controls priced a 1+2 combined group at two spice despite scalar amount 19. Increasing the group to five made Red Chasm transport cost five and unavailable, while a three-spice return remained enabled. The real return button moved all five into reserves, spent personal 1 plus escrow 2, and credited Guild the donor's 2. Final v13 has 20 reserves, no on-board Guild forces, spice 2, pledge 0, shipped true and movement unspent. Original card and traitor remain private. Root inspected a full-page desktop screenshot; quote labels, counts, costs and controls were readable without clipping. Final state: /tmp/dune-guild-browser-finished.json. A fresh invitation restored that private seat, 20 reserves, spice 2, no repeat shipment control, and the still-available Finish action. Mobile and full-game acceptance are not claimed by this slice.

Remaining boundaries

The pending ordinary shipment audit found stored-intent validation gaps under manually corrupted or stale state (cost, contribution, forces and context). Fresh actions rejected those invalid inputs; no valid-action remote exploit was demonstrated. The subsequent physical shipment integrity change now revalidates ordinary custody, context, current price and authorized contributions before continuation or special-stop card disposal. Concealed No-Field contracts, shared normalized intents, ordinary Guild rate/permission responses and current-turn Truthtrance commitments remain separate work. No unaffordable-cancellation policy was introduced. Full expansion/module and Advanced acceptance remain unfinished.

10 KiB Raw Blame History