Dune/docs/IMPLEMENTATION_STATUS.md

Dune implementation status

7 October 2026 — distinct Mentat replacement and reproducible suites

replaceMoritaniAssassinationTraitors now draws the first distinct physical Traitor Card from the reserve instead of the reserve's first entry, because the face-up set-aside card can still sit in that list: re-drawing it produced a receipt whose replacement equalled the revealed card, which the assassination integrity check rejects mid-Mentat. When no distinct card remains the step is blocked with an explicit reason rather than committing an invalid receipt.

Four genuine tests were also made reproducible after measuring their real failure rates; a suite that fails for random reasons cannot act as a checkpoint gate:

• discovery-native-typed-runtime (~15–25%): the chosen Discovery Spice Blow card now has every other card for the same territory removed from the deck, so one blow deposits the printed amount instead of stacking a second deposit. Measured 0/20 after the change.
• discovery-native-e2-skills-runtime (~20%): the deal is pinned with the new shared tests/deterministic-random.ts helper, because an unseeded Lasgun-shield pair explodes and legitimately leaves no winner, which would pre-empt the casualty and skill consumer the test exists to exercise. Measured 0/12 after the change.
• ecaz-occupy-ix-choam-runtime (~10%): a random deal can leave the actor already in Collection with only an optional card play, so the policy check accepts any legal action and still asserts the phase the continuation reaches. Measured 0/30 after the change.
• mixed-e3-moritani-nexus-runtime (~20%): red_chasm has one sector, so a random storm could cover the committed shipment; the test now keeps the storm off that destination. Measured 0/25 after the change.

No product behaviour changed for the three test-only repairs. Full offline suite, typecheck and lint are green at this checkpoint.

7 October 2026 — operations report the database size

The owner aggregate sample now also reports the SQLite database size and page count, read through PRAGMA page_count/PRAGMA page_size in the same authority-checked batch as the lifecycle counters, with non-numeric or negative values clamped to zero. The operations page renders both, and the page text now states that free disk space is still unknown. Evidence: tests/admin-operations.test.ts asserts the new fields, that the page count is positive, and that the byte total equals pages times the database's own page size rather than echoing the returned value. No game, seat, saved state or deployment changes.

7 October 2026 — administrator failed-attempt history

Rejected administrator authentication and authorization attempts are now recorded durably in a new additive admin_attempts table with a fixed reason (invalid_key_format, unknown_or_disabled_key, missing_session, unknown_or_expired_session, role_denied), the attempt kind, the attempted role and an already-known account id. No key, key hash, session token, session hash, request body, origin, address or user agent is stored, and the unknown/disabled distinction is deliberately collapsed so the lookup cannot become an account-enumeration oracle.

GET /api/admin/operations?attempts=1 returns seven-day per-reason counters plus the twenty most recent attempts, newest first, to a live owner only, with no-store and the same query guard as the other reads. The operations page adds List failed attempts with the counters and the bounded sample, truncating each account id to eight characters. Recording is best-effort inside the rejection path, so a rejected request keeps its own answer even when the table is unavailable; the history never locks out, disables or revokes anything by itself.

Evidence: tests/admin-attempts.test.ts asserts every recorded reason, the kind/role/account fields, that successful sign-ins and privileged reads record nothing, that no credential text appears anywhere in the page, the reporting window, the twenty-row bound and owner-only recheck after demotion, and that a dropped attempts table leaves the original rejection answer unchanged. The anonymous HTTP boundary also denies ?attempts=1. The shared AdminError moved to db/admin-error.ts so the recorder and the access module no longer form a value-import cycle. No game, seat, saved state or deployment changes.

7 October 2026 — Sneak Attack composes the Bene Gesserit arrival reactions

A positive Moritani Sneak Attack now resolves its committed Terror entry first — placing the reserve forces and accruing the Heighliners token — and then offers the Bene Gesserit reactions the same adopted shipment classification already uses for ordinary off-planet arrivals: an eligible Advanced Intrusion choice when Bene Gesserit fighters stand in the destination, carrying the free spiritual-advisor follow-up, and the advisor shipment itself when the intrusion is declined, with its existing territory, storm and occupancy validation. A zero-force resolution still opens none of them.

This selected order is an implementation interpretation, not a located ruling; it is recorded in the source note and the pending-interpretation registry, and the last Sneak Attack combined with Bene Gesserit arrival reactions guard is removed rather than left as a duplicate check.

Evidence: tests/moritani-force-leader.test.ts asserts the post-entry Intrusion offer and the full decline → advisor decision → placement chain with nothing left pending; the former gated-interaction pin was replaced by the composed behaviour. docs/COMPONENT_INVENTORY.md, the source note, the registry and the status paragraph record the reduced boundary. No game, seat, saved state or deployment changes.

7 October 2026 — Sneak Attack adopts the shipment classification for Heighliners

A positive Moritani Sneak Attack in Shipment and Movement now accrues the Heighliners token once for its owner through the same techIncome helper as an ordinary off-planet arrival. The token still enforces its working phase, its printed Guild exception and one accrual per turn, and a zero-force resolution accrues nothing; the previous phase-5 guard is removed rather than duplicated.

This is an explicitly adopted implementation interpretation, not a retrieved publisher ruling: the printed verb is “Send”, and classifying the expressly off-planet reserve transfer as a shipment is the supported reading already recorded in the source note. The Bene Gesserit spiritual-advisor accompaniment and Intrusion rows remain gated because their ordering inherits the unresolved arrival-timing boundary, and a Spice Blow worm-ride Sneak Attack stays outside the token's working phase.

Evidence: tests/moritani-force-leader.test.ts asserts the accrual, the once-per-turn guard, the unchanged zero-force resolution and the altered-sector rejection; the former "unsupported technology classification" pin was replaced by the adopted behaviour rather than re-pinned. docs/COMPONENT_INVENTORY.md, the source note and the pending-interpretation registry record the reduced boundary. No game, seat, saved state or deployment changes.

7 October 2026 — Tleilaxu Ambassador force return wired

The last unimplemented Ambassador effect is now reachable. A placed Tleilaxu token gives its beneficiary — the Ecaz owner or its ally — a private ecazAmbassador decision at stage revival: one to four physical counters return from the Tanks to reserves at zero cost, quoted by the existing game/tleilaxu-ambassador-forces.ts, which also enforces the shared Fedaykin/Sardaukar one-per-turn counter and keeps Ixian cyborgs uncapped. The player view projects the maximum, Tanks and elite inventory and current elite usage to the beneficiary only; the entry control offers a per-count button and an explicit "Return no forces" decline; all four AI profiles choose a legal return from the decision owner's own view or decline when the Tanks are empty.

Kept gated exactly as recorded: the printed leader alternative (leaderAlternative: false), ordinary force/free/leader allowance accounting around this independent grant, dead-twice eligibility, and Tleilaxu free-income repeat scope. No ordinary revival allowance, price, phase or income path changes; the Tleilaxu special Karama keeps its FAQ-resolved Revival-only timing.

Evidence: tests/tleilaxu-ambassador-engine.test.ts drives a genuine arrival into a placed token and asserts the beneficiary-only projection, the typed return with unchanged spice, the shared elite limit, malformed/over-maximum rejection with immutability, the ordinary-only return and the decline path. The four-profile tests/ecaz-entry-bots.test.ts loop now covers tleilaxu, and its former unsupported-effect pin was replaced by the supported offer/decline expectation rather than re-pinned. No game, seat, saved state, deployment, public start or played-save conversion changes.

7 October 2026 — administrator stalled-decision diagnosis

The owner-only operations page gains List stalled decisions: a bounded, read-only sample of at most ten live rooms whose public pending interaction — decision, response, truthtrance or phaseOpening — has been idle longest, reported as room code, idle duration, interaction kind, turn and phase. The aggregate sample adds stalledRooms and oldestStalledChange for the same predicate. GET /api/admin/operations?stalled=1 repeats live owner authority, answers no-store, rejects any other query combination with 400 and stays read-only: it repairs nothing and pause/close/remove/archive keep their own audited controls.

Paused, closed, removed and archived rooms are excluded, as are unreadable JSON states and non-playing rooms. Only public coordination facts are selected — no hands, orders, private decisions, seat credentials or raw saved state — and the sample is bounded to ten rows, oldest first. A stall is inferred from the room write time, so a slow human turn also counts; the sample does not diagnose why a decision is stuck, disk capacity or backup recoverability.

Owner-only unit coverage asserts the counters, the oldest stalled write, the bounded oldest-first order, every exclusion boundary, idle arithmetic, the absence of private content and the owner recheck after demotion. The anonymous HTTP boundary now also denies ?stalled=1; the full HTTP integration suite passes 55/55 against a local build of this revision. No game, seat, saved state, deployment, public start or played-save conversion changes.

7 October 2026 — mixed E3 programme evidence and the deferred Terror entry

The withdrawn mixed E3 programme pairs are green: Moritani9/9 and Ecaz14/14 (stable across 20 consecutive full-file runs). The recorded resume constraints became real fixture repairs, not re-pinned assertions: Moritani starts in an unoccupied printed stronghold, a pending Leader-Skill posture is concealed before both plans are submitted, a normal Traitor call requires the card that matches the opponent's plan leader, the winner's automatic casualty is not an assassination effect, the public history never carries the private Mentat replacement, and the Moritani Terror/Cunning window uses its own real shipment. Two restored consumer omissions were corrected against the engine: the Discovery entry asserts the token's actual random face and conserved counters, and the Suk rescue asserts the winner's own dialed casualties with the loser never rescued.

New engine behavior. Game.pendingArrivalReaction queues a committed Terror entry whose arrival also opened its own interaction — Guild income, a Bene Gesserit fighter Intrusion or advisor choice, or Fremen storm protection — and settleAutomaticContinuations opens the oldest queued entry once nothing is pending. Payment, force transfer and the original movement never replay; a Terror entry already in flight and every Ambassador combination still reject. The selected order is a provisional implementation interpretation, not a publisher priority ruling.

Former limitation pins now assert the accepted, deferred outcome and drive it to completion instead of the removed rejection: bot-arrival, ambassador-terror-overlap-worm, moritani-entry, both Richese No-Field files, homeworld-grumman-engine, karama-movement-preflight and ornithopter-discard-continuations.

Pre-existing failures inherited at 45e6084 were repaired against current engine behavior rather than re-pinned: the stale Discovery module gates in both native skills integrations, the Ix prototype and Ix skills gates, the advanced Moritani skill boundary, the expansion-faction prototype and recovery gates, and the Richese Nexus betrayal sale-credit expectation (the authorized Advanced source sends Richese's own contribution to the Emperor, or the Bank with no Emperor seated). One incidental gate message ("excludes other optional modules") and one flaky Collection-readiness assertion in the Ecaz Homeworld victory runtime were also corrected; the flake reproduced at HEAD.

Offline suite 7,793/7,793 with typecheck and lint clean at this checkpoint; no game, seat, saved-state, deployment, public-start or played-save conversion is claimed.

7 October 2026 — Mixed E1/E2 and paired E3 Nexus

Original both-family Ix+CHOAM/union47 or both Ecaz+Moritani/ecaz33 with classics preserves all12 Nexus, optional all14/HW/Discovery7/8/Tech3+/ Advanced Strongholds2+ through existing initializers and consumers. 312 original fresh admissions reach setup versus four before. New31 physical programmes plus two Loyalty-stock regressions and the final489/489 affected checks across42 files pass with types/lint/build. Native Ecaz assassination, omitted separate Loyalty stock and exact paired overlap admission repair actual captured consumer gaps. Obsolete old mixed/paired rejection rows are removed, not re-pinned.

All64 original six-seat families finish258/288 with338,931accepted/ 339,426attempted/9,013JSON across three frozen trees and original-prefix continuations. All receipts and30 retained source-guard traces are read. Actual390px original native offers/training, Maker/both piles/card draws, paid typed native/visitor transport, free Suboid plan and separate living Duke preserve20 physical counters in3AVHJN76v765/PSDLV4FJv121. Human Ixian loses: no winner-only rescue or unobserved nested entry claimed. Canonical source and runtime qualifications. Final489/489 union, bundle and actual390px guide pass. Exact pushed 05ab2c92b0 build/owned cutover shows full SHA markers, original765/121 native pools/Duke and exact guide390. Terminal run37565696416/job112612773421 completes success: isolated7 ends03:17:43Z before publication9 starts03:17:44Z,7 October2026; the full final record is read. Complete rules, protected deployment and deferred assurance remain open.

7 October 2026 — Single-native E1/E2 Nexus

Original one-native Ixians OR Tleilaxu/Ix47, or CHOAM OR Richese/CHOAM35 plus native cache, composes Nexus with or without Skills and optional Homeworlds/Discovery/Tech3+/Advanced Strongholds2+. Existing original initializers and source-local consumers remain; paired predicates still require both natives.192 admissions reach setup versus eight before. New15 programmes/affected398 across35 files and types/lint pass. All32 original six-seat families yield190/192 completed208,205accepted/ 208,213attempted/5,539JSON across two frozen trees: one real shared ordinary-skill omission is repaired and its original Smuggler capture finishes40/40/one JSON; two printed ruling guards remain preserved. The obsolete solo-Ix rejection is deleted, not re-pinned. New physical Smuggler5 plus ordinary Collection1 pays one six-spice pile exactly once. Actual original390px Ixian offer/training/typed entry/Cunning/free support/ equal nested Cyborg substitution and no-training Richese one-spice5+3/ concealed reveal preserve20 counters in4CR7JHULv160/LNHZXDEEv102. Canonical source/game/human qualifications. Final types/lint/build and actual compiled390px guide pass; only the owned QA worker reloads, retainingv160/v102 and physical pools. Exact pushed 30a0bdbbb6 build/owned cutover shows both full SHA markers and the compiled guide; its terminal container job 112576050305/run37554058440 succeeds isolated7 before publication9. Canonical evidence records the source-qualified receipt; no full-mode, protected deployment or comprehensive-assurance claim.

6 October 2026 — Standalone E3 Nexus without Skills

Original Ecaz OR Moritani/classic ecaz33/all12 Nexus now composes optional Homeworld/Discovery/Tech3+/Advanced Strongholds2+ without training, through the generic existing initializer and original native aftermath.48 original admissions reject before and reach real Traitors afterward. Ecaz's legal no-Skills Harkonnen roster does not lift its separate Cunning exclusion; Advanced Moritani/Harkonnen, mixed families and pending effects stay gated.

New15 semantic cases and affected372/372 across32 files, types/lint/build pass. Actual continuation, foreign-Homeworld no-Traitor rule, Grumman decline, sole-token automatic transfer and separate ordinary Collection correct fixture assumptions without suppressing game rules. Old no-Nexus native Discovery assassination retains its physical regression with conserved ordinary unplayed land ordering; private view-copy pins are removed.

Sixteen runner families preserve seeds/bands12600–14100. Eight new trace name collisions are repaired by the original faction/roster name branch; partial artifacts are preserved. Original unaffected24 gives23 completions; only interrupted24 is rerun at original seeds and gives23 completions. Combined46/48 across two frozen trees completes44,796/45,084 actions/ 1,189JSON, not one uninterrupted certificate. Two source guards remain.

Original human390px W6SCKGAAv114 plays actual supply-only Cunning then reveals Assassination on Guild's paid native1 Polar arrival: original Staban dies once, one token/card is consumed, bounty5 credits Mori12→17, Guild 14reserves/Polar1/Tanks0. WFEGQTRUv94 randomly inspects/reveals Cistern, freely enters native2 after real parent payment, finishes Maker/both piles/ alliance/closing draw, pays for native Junction visitor1 and spends Ecaz for the living Duke with unchanged purse7 and original20 counters. Exact source/game/control evidence and limits. Final types/lint/build and compiled no-training Nexus guide/evidence pass at viewport/document390. Owned QA cutover retains originalv114/v94; all tabs close and temporary helpers are removed. Private source/human receipts and partial/ruling artifacts remain. Exact checkpoint receipt follows; no complete-mode or protected-deployment claim.

6 October 2026 — Native Homeworld Nexus optional modules

Original paired E1/E2 skill/Nexus and no-Skills Nexus module/Discovery envelopes, plus standalone Ecaz OR Moritani skill/Nexus, now retain Homeworlds with optional Discovery/Tech/Advanced Strongholds. Original setup/private offers/native custody remain. Richese Cunning uses those existing Homeworld paired profiles; no second initializer or revival adapter, public start, played-save conversion or new ruling is added. Twenty-three native runner profiles preserve older names/seeds and prerequisite/resume dispatch.

New15 meaningful cases; affected307/307 across25 files. Fixture corrections use actual pending CHOAM income, physical rescue returns, leader-death rewards, legal funded declarations/Charity and available untrained leaders after posture closes. A fake-auth-name/copied-hand/staged-army test is deleted, not re-pinned. Across all23 families,59 of68 original six-seat games finish71,137 accepted/71,484 attempted actions with1,894 JSON on one unchanged source tree. Nine preserved captures reach existing rulings: seven CHOAM low-opening income, Basic Ecaz odd-force rounding and an Imperial revival crossing a Homeworld high threshold.

Actual390px original AB7UKV8Kv145 draws native Richese after real Maker/ both-pile/alliance settlement; native5+3 Cistern Cunning pays one spice once: reserves12/Cistern8/Tanks0, wallet4, no concealed marker. Original 8Q2WZQMAv88 chooses its random Warmaster/Sanya offer, pays for one native Wallach visitor, then spends Ecaz Nexus for the living Duke with original training intact and unchanged Cunning purse12. Choice/result screenshots, fresh state and document390 prove these bounded human paths. Final types/lint/build and compiled390px guide pass. An observed old lazy chunk after rebuilding under the owned QA worker clears after its restart; originalv145/v88 states retain their changed-path custody. All tabs close and our temporary TypeScript helpers are removed; private receipts remain. Exact programme/source receipts and retained boundaries. No complete-mode, comprehensive assurance, calibration or protected-deployment claim.

6 October 2026 — Classic Homeworld Nexus optional modules

Original classic Homeworld/Nexus now composes all14 Skills, Discovery7/8 or both with optional Tech3+/Advanced Strongholds2+, and no-Skills/no-Discovery Homeworld/Nexus retains the industry/card modules. Three existing envelopes are amended; original setup, typed native returns and physical consumers remain. Native optional-module families and pending rulings are not opened. Fifteen runner profiles keep stable8800–10200 bands and older names/seeds.

New13 meaningful cases and affected242/242 across20 files, types/lint/build pass. Incidental raw/input/view/default-shape and fake identity assertions are removed rather than re-pinned. An observed zero-sample false pass for unsupported Basic Strongholds is repaired using the existing prerequisite guards; two-seat Tech also rejects before producing a report. Twenty-two original six-seat games across all15 families finish14233/14233 actions with375 JSON continuations on one unchanged source tree.

Actual human390px RCGZK4CFv167 keeps its originally offered Suk, draws Fremen after a real closing Nexus, declares a paid typed invasion and zero rescue, then spends the actual card for2 normal/1 Sardaukar revival: Kaitain14/Salusa5, native reserves19/5, Tanks0/0, original visitor1 and uncharged return wallet6. A3LV8Y3Uv74 randomly reveals Shrine, enters with3 original Imperial counters, votes a genuine Maker majority and rides 2 native Fremen including1 Fedaykin inside, then randomly draws Moritani after both actual Advanced piles and settled alliance. Atreides losses2 do not repeat; original source armies/custody remain. All tabs close; temporary scripts are removed. Exact programme/source receipts and limits. No full-mode, comprehensive assurance, calibration or protected deployment claim.

6 October 2026 — Native Homeworld optional modules

Original supported native E1/E2 and standalone Ecaz OR Moritani/classic Homeworld entries now retain Skills, Discovery or both with optional Tech3+/Advanced Strongholds2+. Existing family decks, native setup and pending rulings remain. Exact Ixian pre-training nullable custody and same-quote residual Cyborg Tanks repair reproduced admission/Suk crashes. Native CHOAM invoices/support, Richese caps/nested invoices, Tleilaxu revival, Ecaz Arrakis Occupy and Moritani skill-first assassination retain original consumers. Twelve native runner families preserve old names/seeds.

New35 cases; affected180/180 across19 files, final repair46/46 and types/lint/build pass. Original six-seat14/19 completions and all12-family Advanced three-seat134/144 initial completions retain exact source trees and ruling captures. Two actual Ambassador bot deadlocks finish from their preserved states after base-board target enumeration is repaired; every difficulty legally advances both captures. Not an uninterrupted144 pass or a final-tree certificate. A genuine Guild cancellation and natural-Storm fixture boundary are repaired with explicit legal programme choices, not altered shipment/storm rules.

Human390px original HTTP/private CLI 4AG8J2ZXv74 chooses its original Ixian starting card/training and typed paid native invasion; TYH3JS3Cv56 chooses native Moritani Suk rescue after a genuine defensive Homeworld win. Original armies, Tanks, skill custody and Collection continuation remain. Both tabs closed; temporary scripts removed. Source-qualified evidence and limits. No full-mode, comprehensive assurance, calibration or protected-deployment claim.

6 October 2026 — Classic Homeworld optional modules

Original classic Homeworld Skills/Discovery families now compose either or both with original Tech3+ and Advanced Strongholds2+, under existing fresh private entries. Original all14/DS7+8 setup, native placement, typed nested/ native/visitor Suk, phase-end industries, source-local held benefits and cleanup before mandatory winner Tech remain; no redundant force/payment model. Ten runner profiles retain stable old bands/names/seeds. Nexus/native Homeworld rosters, unrelated previews and pending specific rulings stay separate.

New cases14/14, affected145/145 across17 files, types/lint/build pass. Fourteen completed original six-seat samples total9008/9008 actions/237 JSON across two unchanged source batches. One internal undefined-property view copy assertion falsely stopped an Advanced original sample; that incidental assertion was deleted, not re-pinned. Its preserved capture finishes19 more actions, and the repaired original sample finishes1129/1129/30. Physical custody, rival-privacy checks and real JSON continuation remain.

Actual human390px XJCJ3H3Wv17 submits trained nested Suk and retains Cistern3normal, reserves17/5, Tanks0, Kaitain11+1/Salusa1+4 and separate Cistern2 income. WM8E7CFGv17 selects Spice Production after real Homeworld cleanup, retaining one actual visitor, empty native home and reserves14/4, Tanks2/0. Both tabs closed; temporary human scripts removed. Exact programme, source hashes, capture and limitations: Homeworld runtime. No full-mode, comprehensive assurance, calibration or deployment certification.

6 October 2026 — Classic Homeworld Skills and Discovery

Private fresh Basic/Advanced two–six unique base-faction profiles now compose Homeworlds with either original all14 Skills or Discovery7/8. Original setup and force placement remain; Skills custody stays nullable until placement. Typed Suk native/visitor/Arrakis rescue, explicit human split-home Emperor returns, minimal legal bot choices and Bureaucrat invoice support are connected. External return placement is an implementation interpretation, not the ordinary-revival ruling. Existing Discovery mechanics are reused.

New cases17/17; affected union94/94 across12 files; types/lint/build pass. Four genuine six-seat games complete2330/2330 actions with61 JSON continuations on two unchanged source trees. Original human rooms 3NM6MS4Tv11 and CLQYLURHv11 actually submit Suk allocation and Cistern entry, respectively; physical native/visitor counters and390px surfaces observed afterward. Exact source hashes, programmes and boundaries are in Homeworld runtime. Other overlays/native rosters, specific pending rulings, public starts, protected deployment and comprehensive certification remain separate.

6 October 2026 — Native trained Skills/Nexus/Discovery

Only the existing paired E1/E2 and standalone E3 skill/Nexus family predicates gained the private Discovery envelope; nativeExpansion/nativeDiscovery and the original initializeLeaderSkillsGameForAudit already route them, so no duplicated setup/legality was added. richeseCunningModeSupported admits selected Discovery only through the exact supported paired-skill profile. Original actors/hands/offers/native components and the mandatory Ecaz coalition plus Moritani assassination/own-revival consumers are inherited unchanged.

Affected205/14files, types/lint and build pass. All eight new six-seat profiles were exercised:23 of24 original samples complete25,751accepted/25,751attempts/ 685JSON across source-bound acc980c0 and b1177766 batches. Trained consumers are physical: E1 Suk rescue before one equal Cyborg Tank substitution then cleanup/Tech/ matching Face Dance; E2 signed one-invoice nested pair with private caps; Ecaz quiet living/unclaimed Duke then owner-labelled mandatory Occupy; Moritani skill-first assassination/printed bounty/one private replacement. One Richese sample (seed20273010) is preserved at turn-10 Bidding with an empty cache under the existing richese-settlement exhausted-cache count guard (1,726accepted/1,727attempts/46JSON); no bypass.

Four new isolated human rooms preserve original CLI setups and offered training (BWHS4DU6 Rihani/Prana/Suk/Smuggler; GRM4XMUH Master of Assassins/Suk/Mentat/ Warmaster; 5JS3SUYY Killer Medic/Smuggler/Bureaucrat+Duke Vidal; VFQCEVFB Sandmaster/Killer Medic/Master of Assassins+Duke Vidal+Atomics). New5600–6300 sample bands use full roster/expansion names, leaving earlier profiles/defaults/ seeds unchanged. Fixture repairs preserve real progression: actual auction purchases, forced-loss-to-Suk ordering, valid native setup flags, coalition targets and trained-leader posture. No protected deployment or complete-mode acceptance is claimed.

Verified 2270c07f97 pushed. CI37387218604/container112023319943 job completes successfully: isolated storage/HTTP7 before verified-image9. Exact build/own worker reload and fresh390px screenshots retain the four native rooms and full 2270c07 marker at document width390 without overflow; owned tabs closed. No protected NAS/operator/provider approval or live acceptance.

6 October 2026 — Classic Skills/Nexus and paired native Nexus Discovery

Fresh original classic base33/all14/all12 and separate paired E1/E2 no-Skills 47/35/cache setups compose Discovery7/8, Basic/Advanced2–6, optional unused Tech3+/Advanced Strongholds2+. Exact existing family predicates, original constructors, actors/offers/starting hands and native setup remain. Source-clear revival quotas, training, typed aftermath and held effects stay shared. Richese Cunning keeps its signed one-tariff pair and current revealed destination. At this earlier checkpoint native combined Skills/Nexus/Discovery stayed gated; the newer trained checkpoint above supersedes that boundary. Other overlays, public starts, conversion and unresolved rulings remain gated.

Affected169/14files, types/lint and build pass. Genuine original eighteen six-seat samples finish13,576/13,576/359 JSON on unchanged7c65011d tree. New4800–5500 sample bands/full roster names leave old profiles/seeds/defaults unchanged. Original human BT4SBSLB16/Charity, BZNXHKMU19/Charity and RJF6D6ML24/Movement use connected CLI setups and actual controls: training, free entry, Maker6/2/2 casualties, storm-order votes, two-ordinary/one-Fedaykin free rides, both Advanced piles, reciprocal alliance and end-Spice closing deals. Native unplayed singleton ordering is explicitly controlled, not a natural-history claim. E2 human signed5/3 nested pair settles one fee Richese5→4/Guild3→4, original reserves19→14→11 and Shrine8, no second fee. Canonical scope/proof. Final constructor predicate reuse/live-guide union50, TypeScript, repaired unused-import lint and final build pass. Three original final programme re-runs finish1,659/1,659/44 JSON; these duplicate profile/seeds are not added to18 original samples. CLI help and actual Tech two-seat rejection run. Protected deployment/full acceptance/comprehensive assurance remain due. Verified c8a6d0bb3c pushed. CI37345919728/container111884319700 job completes successfully: isolated storage/HTTP7 before verified-image9. Exact build/own worker reload and fresh390px screenshots retain all three original QA outcomes/full c8a6d0b marker without document overflow; tabs closed. No protected NAS/operator/provider approval or live acceptance is claimed.

6 October 2026 — Original native Leader Skills and Discovery

One exact Discovery envelope feeds existing native family/roster predicates and original all14 setup/starting hands, optional Tech3+/Advanced Strongholds2+. No game/config copies in rule quotes; no public gate or save conversion. Typed entry/range/rescue before Cyborg substitution, original cleanup/Tech before Face Dance, CHOAM stash/invoice/Bureaucrat/green marker, and trained Moritani nested death/assassination/private replacement/own revival compose existing sources. Actual native E2/E3 printed starting hands are preserved.

Affected107 pass. Actual programmes observe rescue3/three Tanks/one real Cyborg loss, six-counter5 fee/receiver3/bank2, and five original battle deaths then turn4 native printed5 revival/optional replacement. Original chronology, support-unit and separate-conflict fixture corrections remove copied math, nonce/default assumptions rather than pinning implementation artifacts.

Three genuine hidden-Smuggler captures had legal human zero-support plans but no bot candidate. Engine projects canonical support; bots stop recomputing full-state module predicates on partial views. The real trainer-plan regression fails before/passes after and keeps modified-strength/multi-pile guards. Original seeds20265473/20265497/20265501 resume unchanged, adding989/387/783 accepted/no rejected actions and26/10/21 JSON on14d66863 tree. All31 six-seat samples finish30,874/30,874/815 JSON including those resumes; initial f2ec1d69 tree evidence is separate, not one frozen-tree/every-effect claim. Earlier filename collisions are retained but un-counted; full original rosters/expansions now distinguish new samples, without changing old names/seeds.

Actual 6NNTCFM2 original CLIv10, natural Bureaucrat/free typed Shrinev12; 5NLWDL68 original CLIv10, natural Killer Medic/Stash inspect12/reveal13/ new-card disposal14 restores5 with no payment; MYPGMSW6 original CLIv8, real nested after-loss target9/human Master Bewt10 returns Guild Bureaucrat, printed10→13, winner cleanup11 and original Mentat12 retires one actual cost/ draws one private replacement. Original hands/offers remain authoritative, conserved positions explicit,390px refresh/tabs closed. Canonical native contract. Full modes, assurance, strategic AI and protected live deployment remain open.

Exact pushed code555afe4070d33e0dd9e6ad7c931920878e51d2e7: CI37320041332/job111796483681 completed/success with mandatory isolated storage/HTTP7 before image9. Final native original-hand/reference36, types/lint/exact build pass. Preserved 6NNTCFM2v12/Storm,5NLWDL68v14/Collection,MYPGMSW6v12/Mentat show local555afe4 at390px after own QA reload. Tabs released; no protected NAS deployment or live acceptance is asserted.

5 October 2026 — Original Discovery Strongholds and mandatory Ecaz repair

Fresh original Discovery classic/E1/E2/standalone E3 and separate classic Skills/Discovery entries retain canonical unused Advanced Strongholds2–6, optional Tech3–6 and actual end-Mentat claims. Source-local benefits compose original entry/tariffs, trained rescue, typed Cyborg/CHOAM invoice and nested No-Field materialization/poison defeat. No nested defense/subsidy inheritance or seventh physical Jacurutu card is created. Other profiles/rulings/public starts and save conversion stay separate.

Affected77 pass. The genuine Ecaz sample's mandatory combined battle exposed the old module guard: two meaningful original cases fail before repair and pass after. Related39, final types/lint/build and actual rule programmes pass. Original Ecaz5/Guild4 loses3 per owner; Ecaz's bank2/own1 is not lent to a Guild-led own3 plan. The existing room-local board primitive already admits nested structural keys; an inferred extra validator repair was withdrawn. Named SukRescueOption fixes a TypeScript recursive-inference boundary without concrete ReturnType coupling. Removed incidental action-trace/default pins.

Four initial genuine six-seat samples complete on b2d64215 tree. Original Ecaz seed20265041 after616 accepted is preserved and resumes557/no rejection/ 15 JSON on9ded0847. Five completed samples total3,096/3,097/81 JSON across two trees; resume does not reconstruct the prior stream. Sixth Richese sample seed20265033 remains captured atturn10/richeseBlackMarket after1,639 accepted/ 1,640 attempts/44 JSON on existing exhausted-cache normal-count ruling. No fake source remedy or rerun to confirm.

Actual UWEH7WNB original CLIv8, natural Smuggler, human held claimv10, free-entryv11 and paid shipment/Guild allowancev13/v14 retain Arrakeen, Cistern4/spice2/reserves15. Native4LBU44PT CLIv8, typed free-entryv10, paid shipment/income allowancev12–14, original HMS copyv16/plansv17–18, Traitor declinesv19–20 and casualty keepv21 leave HMS3/no Cyborg, Shrine4/two Cyborgs/spice3, CHOAM income1 and original Production winner transfer. Both390px refresh; explicit conserved staging/private evidence, tabs closed. Canonical evidence. No production or full-module acceptance is claimed.

Exact pushed codeb0267827b5b16755ff3e091cb78f1543383b7f96: CI37301604738/job111735386439 completed/success with mandatory isolated storage/HTTP7 before image9. Final guide10/types/lint/exact build pass; preserved UWEH7WNBv14/movement and4LBU44PTv21/Battle display local b026782 at390px with original outcomes after own QA reload. Tabs released; publication is not protected NAS deployment.

5 October 2026 — Classic Nexus and original Discovery composition

Fresh explicit nexus --discoveries admits classic/base33/all12/Discovery7/8 Basic/Advanced2–6 and optional original Tech3+/Advanced Strongholds2+. Original setup/first-Storm Tech/end-Mentat custody/next-turn entry, Great Maker worm/vote/typed ride and end-Spice closing Nexus draws remain. Source-clear revival ledgers, native-preserving Guild nested tariffs and actual winner/card/Tech continuation compose existing consumers. Skills, native/HW/variants/previews and unresolved effects remain separate.

Affected64, types/lint/build and actual programmes pass. Two genuine six-seat games finish1,150/1,150/31 JSON on unchanged 761f5ca592af1bd3be766dd0e5654ed18528809855f6139436552428389f5b00. Original CLI room3D7SAG45v8 and explicit undealt order/lottery lead to human one-counter free entryv10, real Great Maker votesv12–14, typed two-counter/ one-Fedaykin reserve ridev15, Advanced blow and actual alliance settlement, then human Guild closing drawv27/Charity: physical Richese/deck12→11, 390px refresh. Source staging is explicit, no natural-every-effect claim. Canonical contract. No production deployment or complete-mode acceptance is claimed.

Exact pushed codea2a92bb40881e6b517e618a5ffd6b3389c960a3d: CI37296234655/job111717999496 completed/success with isolated storage/HTTP7 before image9. Final guide10, types/lint and exact build pass. Preserved3D7SAG45v27/Charity retains real Richese/deck11 and local a2a92bb at390px after own QA reload. Tab released; publication does not satisfy protected live deployment prerequisites.

5 October 2026 — Advanced Orgiz and classic Discovery Skills

Authorized supplied Advanced p24 territory-Collection wording now groups actual positive source keys into one transfer per territory and unique foreign payer. Basic keeps the existing provisional deposit mapping. Mixed/shared/contested sources leave only their transfer unpaid; ordinary facts, bank prefix and already-paid continuation remain unchanged. No new publisher ruling is claimed.

Explicit fresh classic leader-skills --discoveries preserves base33/all14 Skills/Discovery7/8 and optional untouched Tech3–6, Basic/Advanced2–6. Original trained entry, nested tariff, independent Planetologist/fixed-three routes, Harkonnen stash capacity, Suk/Tech ordering and Bureaucrat5→bank2 diversion reuse original consumers. Other overlays/native skill profiles and Banker/Mentat previews remain separate. No public activation or save conversion.

Targeted rule/control/reference75, TypeScript/lint/build and actual programmes pass. Basic3 versus Advanced2 transfers preserve ordinary five-spice collection in controlled conserved positions. Two genuine six-seat games finish 1,578/1,578/42 JSON on unchanged tree 946335ef77745f086cd9bd07bfa405c46c06785a3aae7a684a8e244ce2da4ee5; no natural-every-effect claim. Newly encountered concrete-function return-type coupling uses named owner-defined CollectionQuote/DiscoveryCollectionQuote/ SkillsTechBattleStep contracts.

Actual PCDX5J8M CLIv7, natural human Warmaster/Stabanv8, Cistern inspect/reveal v10/v11 and three-counter free entryv13 preserve training/resources. Original protected turn-two continuationv14 permits a one-force paid shipment; human Guild allowancev16 gives spice3→2/reserves12→11/four Cistern counters. Refresh390px. Actual FCVCEA3R final movement endingv8 automatically collects five and transfers two: owner11→13/payer-own-view10→8, two territorial notices and bank prefix intact. The failed throwaway empty-Battle wait was corrected to the original automatic phase path, not a new confirmation. Tabs released; no unrelated game write.

Canonical source/control evidence. Complete combinations, pending contested/shared/mixed rulings, assurance and deployed acceptance remain open.

Exact source c12b463439 is pushed. CI37273231864 / container111644528093 succeeds isolated storage/HTTP7 before verified-image9. Final reference10/types/lint/exact pushed build pass. Preserved PCDX5J8M v16 showsc12b463 at390px, Warmaster/four Cistern counters/reserves11/spice2; FCVCEA3R v8 retains owner13/payer-own8/two Orgiz notices. Tab released. Publication is not deployment or a protected NAS-prerequisite bypass.

5 October 2026 — native Discovery with original Tech

Fresh classic, selected E1/E2 and standalone Ecaz OR Moritani Discovery entry preserves original decks/native setup and optional untouched Tech at3–6 seats. Typed next-turn entry, paid nested marker shipment/movement/reveal, CHOAM stash 5→6→5 and native Face Dance rewards remain original consumers. Pure No-Field custody recognizes the five known nested IDs at0; live commitment/reveal rejects unknown or unrevealed destinations. No effective-marker reserve allocation.

Actual runtime exposed two Moritani integration defects: the live assassination profile rejected Discovery, and its history accepted only static territories. Both are repaired without disabling the printed different-opposing-Leader restriction or normal-call forfeiture. The nested-source regression pays the actual three-spice Guild Traitor bounty.

Frozen source/consumer union 71/71, TypeScript/lint and build pass. Original programs prove three actual Ixian counters/one Cyborg with no entry fee, one-spice Richese nested marker and one physical reveal, and both original E3 setups with four minimal legal policies.

Four genuine six-seat Advanced Tech games complete on initial tree 6d6c1849d6da9b1e5c2af04e07303f9bec49ec9dac2d8089ae58c77795f48e57; preserved Moritani setup completes at seed20263765 on corrected tree fe22922e7acdea8aea64b75af8ba29247e37b63a63f461efa930f1a8cd2c049c. Completed totals 1,940 accepted / 1,940 attempts / 49 JSON; no single-tree five-game or natural-every-effect claim.

Actual Q3AWYZWC v6 lobby keeps authenticated actors/decks. Original45 controls plus labelled unplayed Spice ordering/placement reach Collection. Human Guild inspection/reveal v8/v9 and original44-action continuation reach Richese v10. Human marker5 + original Guild Allow shipment settle v12 for1spice, reserves20 and effective1; human reveal v13 produces five Cistern counters/reserves15 with no second price. Refresh fits390px. Reload only isolated QA after observed old No-Field validator rejection; actual selector now labels nested sector0 inside the location instead of Polar Sink. Managed tab released; no unrelated room write.

Canonical source/runtime evidence. Contested/shared/mixed rulings, unrelated overlays, normal public starts, complete module strategy, assurance and deployed acceptance remain open. No reset or played-game conversion.

Exact source 67ce690064 is pushed. CI37263699075 / container111615980358 succeeds isolated storage/HTTP7 before verified-image9. Final reference10, TypeScript/lint and exact pushed build pass. Preserved Q3AWYZWC v13 shows67ce690 at390px, five real Cistern forces/reserves15/spice4. Tab released; publication is not deployment or a NAS-prerequisite bypass.

5 October 2026 — printed high Ecaz Homeworld alliance victory

Fresh native Ecaz/Homeworld audit entry marks the actual card conjunction: nativehigh7+, reciprocalalliance oneactualjointstronghold and provedphysically held worlds of twoOTHERnativefactions. Sharedboard andoccupationquotes own legality; duplicateEmperorworlds countone and noTech/advisor/ordinarypoint shortcut. Originalqualifyingwinnerunion precedes BGprediction/finalfallback. Returnedsource disambiguates anEcaz/Fremen printedwin fromFremenfallback. Duke permission unchanged.

Source34/affected119 including guide, types/lint/build and originalprograms pass. Real Movement→Collection→Mentat winneeds onlyonejointsite; all4policies havelegal readiness. High6 and deficientconjunctions do notwin. Original734-action clock reaches turn10 before separatelylabelledconserved Ecaz/Fremen sourceprecedence. Controlledpositions preserve storm, actualTanks/starredfloors andphysicaldecks; there is no syntheticphase/deck/receipt or favorableseed.

Five genuine six-seat Advanced samples finish4,339 accepted/4,358attempts/114JSON on unchanged b0ebb815c973197ca3e3148c4ad447ddc11dba1489f72911de2cd341cafd2f08. 19 rejectedcandidates recorded. Specificnewsource triggering isproved bynative/ humanprograms, not inferredfromwinnerfactions or thesecontinuationcounts. OriginalCLI S8N26ADW v18 setup, realturn-two Ecaz/GuildNexus and labelledsurviving pose preserveactors/deck/clock. Storm7, native7, actualjointHabbanya1, separate Emperor/BGworlds2 appearat390px withoutchangingordinary1/4/Ecaz1/3. ActuallastReady reachesv25/Mentat/finished Ecaz+Guild; refreshfits390px. Drivereligibility andtyped subset issues correctedwithoutweakeninggameguards. Privateproof outsideGit. Canonical source and actual winning evidence. No reset/public/saveconversion/Dukecutover; fullmodes, pendingrulings anddeployment remainopen.

Exact code 17bc4537c3 is pushed. CI37260419689 / container111606286541 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final119 source/consumer/guide cases, types/lint/exact pushed build pass. S8N26ADW v25/Mentat/finished shows 17bc453 at390px with actual Ecaz+Guild and separate ordinaryfalse/sourceTrue. Tab released; no deployed/ reset/privilege or NAS safe-point bypass claim.

5 October 2026 — occupied Tupile capacity, original cleanup and low authority

Fresh native CHOAM/Homeworld audit setup alone marks Tupile slots and the original lease ledger. A server-derived backed flag extends all existing real hand-limit consumers once; old profiles gain nothing. Original Advanced source/reciprocal holder loss retires the lease and queues owner-selected normal-limit excess. Pending old debt cannot borrow a new lease; Basic unknown source preserves its proved state and blocks rather than invents cleanup. Native low intelligence uses known current authority only in this marker, without clearing old answers/use.

Source19/affected143 including guides, types/lint/build, all4 legal policies and original programs pass. Actual ordinary auction admits Harkonnen card9/no card10; one real paid foreign return queues both normal-limit cleanups and retains its remaining movement/counter/price. Fixtures now distinguish a genuinely observed Basic boundary from unobserved expiry, and accept a completed original invoice without manufacturing a pending sale. No wording/error-text pins or fake card.

Ten genuine samples on unchanged 52ccb9305255ecf7234be7a98aea43f7cf44630215639042c50bb0474e93e892: five six-seat Advanced complete4,339 accepted/4,358 attempts/114 JSON; four of five five-seat Basic complete2,430/2,449/64, allfive2,527/2,547/66. Original Atreides5Basic20263432 remains captured at its contested Southern guard. Natural samples containzero owed cleanup choices; native programs/human actual departure supply changed-path proof. No favorable seed or complete-mode claim.

Original backed-up CLI D54MY8JJ v18 preserves deck/actors/clock; a real second-turn Nexus earns Guild/Harkonnen alliance before labelled conserved positions. 390px human Harkonnen8/9 bids5 and holds9/9 atv26, wallet12→7/no tenth bonus. Real last Guild visitor returns to Junction for1 (6→5); Cheap Hero5→4 then allied Jubba9→8 settle atv30 with the original movement still available. v31 finishes only that turn. A separately labelled native1/Fremen1 contact permits private v33 inquiry3 spice/0 weapons; refresh preserves used-faction/history and no rival panel. No overflow/reset/public start/save conversion; private artifacts outside Git. Canonical lease/consumer/evidence. Full combinations, pending Basic/CHOAM and exceptional Duke, final assurance and deployed acceptance remain open.

Exact code 3e79021a6e is pushed. CI37257844991 / container111598626752 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final143 source/consumer/guide cases, types/lint and exact pushed build pass. D54MY8JJ v33 shows 3e79021 at390px, with original private observation/use retained and no reset. Tab released; publication is not deployed evidence and protected NAS prerequisites are unchanged.

5 October 2026 — occupied Homeworld economics, Bidding and Advanced retention

The authorized supplied p22 resolves Advanced qualification/retention: sole foreign presence, continuing until its last force leaves. Original snapshots retain that epoch through contests/native revival/turn changes and replace it only after departure plus a new sole source. Basic historical guards remain.

Fresh Homeworlds alone connects actual Kaitain/Junction/Richese percentage receipts, one completed Southern Collection total, immediate ally allocation, Caladan shared private inspection, sole Ix pool control, Richese card-only choice with native seller terms, and one Giedi bonus using real receiver space/stock. Original paid invoices, hidden custody and source suffixes remain authoritative. Native income/inspection cancellation does not silently cancel printed shares.

Final247 affected cases/24files, types/lint/build and original programs/four legal policies pass. Real wrong-recipient rejection needed the RuleError adapter; actual HTTP409 leaves v42. Human Guild income exposed overwritten BG accompaniment: the signed suffix now restores its original choice through JSON and subsequent actual advisor placement. Conserved random-deal stock/capacity fixtures now stage the exact tested boundary; no favorable seed, invented card or guard weakening.

Pre-advisor-repair50 genuine games on unchanged 09cfdd1957d9ae4c807bce3c7c43edd66fe72b5c239c29cbadf3acca4253de9a: 44 complete18,977 accepted/19,149 attempts/491 JSON; all50 total22,383/22,580/580. Four Basic occupation/two CHOAM captures retain existing rulings. Five exact original Advanced captures finish3,135/3,136/83 at original scenario seeds20263433/453/455/465/475; resume restarts the seed, not its lost stream. After repair, allfive fresh six-seat Advanced games finish4,339/4,358/114 on unchanged 2ada89969c683b3ed263f39b9467f623205d83b765cb3639832ee10adf918aae; 19 rejected candidates remain recorded, not a zero-rejection certificate.

Original backed-up CLI HH7VHT2U v21/4H5CZDMA v18/6K5JFNPH v18 preserve real decks, choices and actors. Actual turn-two alliances precede labelled positions. 390px human controls exercise all four percentages, native Richese terms/card-only selection, full-Harkonnen allied real bonus and sole Ix pool6→5/native-known0. HH7VHT2U actual shipping6 shares Junction3 as1/2 without repeating forces or losing BG; Collection9 retains5/shares4 as1/3 and reachesv72/Mentat with wallets 5/17/11/10/13/9. Richese v29 retains its actual Ornithopter5 invoice/3+2 net split; Ix v25 leaves unrelated Technology native. Allthree refreshed roots fit390px.

Only dedicated QA changes, no reset/public activation/credential disclosure. Private proofs remain outside Git. Tupile capacity/cleanup, exceptional Duke, pending Basic/CHOAM rulings, overlays and complete/deployed acceptance remain. Canonical source, original consumers and evidence.

Exact code 0774ae6f83 is pushed. CI37252859564 / container111583875100 succeeds mandatory isolated storage/HTTP7 before verified-image9. Final247 consumer/10 guide cases, types/lint and exact pushed build pass. Preserved QA rooms v72/v29/v25 show 0774ae6 at390px with Guild spice17/6/6 and their actual original continuations. Tabs released; no deployed claim, reset or NAS privilege/safe-point bypass.

5 October 2026 — stable occupied Homeworld bank income and protections

Fresh original homeworld-occupation enters Basic/Advanced2..6 and selected faction decks with Homeworlds alone. One original continuously present qualifier, no other foreign army/departure/competing qualifier/restored-high history, supports the unambiguous printed bank/defensive effects. Original qualification, physical native population and current garrisons stay separate. No expiry/ replacement policy or old-save conversion is introduced.

Two bounded owners supplied bank queue/component and printed defensive cases; parent integrated original setup/CLI/samples, source history, typed combat/ Voice/FaceDance/Terror, Collection/actual Giedi sources, controls and legal bots. Original captured decision survives the generic dispatcher. Salusa's zero bank icons no longer block unrelated income; its unresolved combat penalty still does. New21/affected262, types/lint/build,24 original setups and real source programs/four legal keep-all policies pass; final clean-Movement regression1/1.

Fifty genuine classic/paired E1/E2/standalone E3 samples ran on unchanged 09f8b0dcdc54bf284f234c6e0f27936689cce1bb1a7b6381548ee13a149d2dae. 37 complete11,762 accepted/300 JSON continuations, with153 rejected candidates. All50 total19,080 accepted/19,283 attempts/491 JSON continuations; not a zero-rejection certificate. Two exact zero-award captures finish7/14 more accepted actions/no rejection at original scenario seeds on correction tree eed8f319ece875181b9412ded145189691db3a8ca56fa6ff00e11f5ca11965ee. Resume restarts the same seed, not the lost original stream.39/50 finish; nine occupation/Salusa-combat and two low-Tupile CHOAM ruling captures remain preserved, not replayed to hide them or forced into invented outcomes.

Original backed-up CLI CPBXKFGD v14 retains actual setup/cards/actors. A real second-turn worm/Nexus earns Guild/Harkonnen alliance before labelled conserved positions. Human390px v21/Mentat settles Caladan2 as1/1, then Wallach1 to ally, with Giedi2 once: Guild3→4/Harkonnen8→12. Source cards, warning, refresh and force inspector show18 Guild reserves/0 Tanks/one visitor on each world with no root overflow. Original readiness reaches Mentat. Native runtime programs exercise protected Voice, two strength-one real starred counters/no Karama restore, an original matching Face Dancer conserved from the unused deck and actual first-Mentat Robbery then paid three-force protected second-Movement entry.

Only dedicated QA changes; no reset/credential disclosure/assurance campaign. Owned throwaway scripts removed; reports/private receipts remain outside Git. Percentage receipts, other occupied powers, unresolved rulings, public/save conversion, complete-mode and deployed acceptance remain open. Canonical source and exact evidence.

Exact code 5e902e384d is pushed. CI37239145022 / container111544136910 succeeds isolated storage/HTTP7 before verified-image9. Final11 clean-Movement/reference cases, types/lint and exact pushed build pass. Rebuilt CPBXKFGD displays5e902e3 at390px and remainsv21/Mentat with actual Guild4/Harkonnen12 and18+1+1 Guild counters. Managed tabs released; no deployed claim. Last observed liveab5c782 and NAS prerequisites remain unchanged.

5 October 2026 — standalone E3 Nexus, Skills and original components

Original leader-skills --nexus-cards now admits Ecaz OR Moritani/classic ecaz33/all14/all12, Basic/Advanced2..6, preserving original Tech3+ and/or Advanced Strongholds2+ (both3+). Two bounded owners supplied connected native rule fixtures; parent integrated admission, engine, original entry/samples, reference/guidance, mandatory Advanced Occupy and human proof.

Fifty-four original setups/four legal policies and26 immutable prerequisite rejects pass. New24/affected224 cases, types/lint/build pass. Fifty-four genuine 2..6 games complete24,845 accepted/no rejection,648 JSON continuations,28 closing choices/five original coalition leads on unchanged tree ceebd866c4de7dfd122c0ddb9754a730b7bbdd93340afddffbd26ec157561816. Three preserved captures finish918/752/21 more actions at their original scenario seeds; continuation restarts that seed, not the pre-capture stream. No skipped fight, reassigned outcome, replaced position or guard suppression. Meaningful coalition cases reproduced wrong-army Suk rescue and missing Diplomat retreat, then verify separate physical commitments and JSON choices. Chosen-plan/own-force skill composition is explicitly inferred, not a new FAQ.

Original backed-up CLI offers/hands/IDs stay authoritative. Human390px YZLNTNEZ v23 uses living-Duke Cunning/normal Warmaster/held poison protection, wins7–5 and releases Duke before original Tech/city income. R2S5UX5U v27 keeps normal Guild Suk, kills unused Master Bewt3 after loss, returns its skill, pays bounty11→14, preserves winner cleanup/Tech and one private replacement, then places supply Robbery Cunning at Red Chasm. L7C8HTQT v23 uses an actual Nexus alliance, trained Sanya4/dial5/support2 with bank2/own0, separate ally2 losses and fixed Ecaz3 rescue:17 reserve/0 Tanks/3 board versus ally16/2/2. Original Emperor Axlotl transfers after cleanup, allied Production stays with Atreides, held Arrakeen stays Ecaz and city2 pays12→14. Actual controls, refreshed force/Terror inspectors and no root390px overflow are observed.

Only dedicated QA rooms changed; conserved positions are labelled. Owned throwaway scripts were removed; source reports/private receipts remain outside Git. Shared-Duke training/exceptional custody, enhanced Terror relocation/ HMS/Grumman, E3 pairs/mixed families/Advanced Harkonnen/HW/previews, public/save conversion and full/deployed acceptance remain guarded. Canonical source and exact evidence.

Exact code 83f825513a is pushed. CI37227846375 / container111511103168 succeeds: isolated storage/HTTP7 precedes verified image publication9. Final13 coalition/reference cases, types/lint and exact pushed build pass; all three preserved human rooms display83f8255 and retain their actual outcomes at390px. Managed tabs are released. This is publication, not deployment; last observed liveab5c782 and NAS prerequisites are unchanged.

4 October 2026 — classic Nexus with Tech and Advanced Strongholds

Two bounded owners supplied original shipment/revival/purchase and coupled battle programs. Parent integrated fresh classic/base33/all12 admission into the existing Nexus seam, original Axlotl hooks, source identity exclusions, sample/resume/entry guidance and human controls. Tech3..6 Basic/Advanced, Strongholds2..6 Advanced, both3..6; Skills, HW, native expansions, other previews, public starts and existing saves remain outside this composition.

New24/affected188, final34 module/guide, types/lint/build and fourteen actual rule programs pass. Four legal free-return policies retain exact3 ledgers, real elite cap and deferred Axlotl. Parent rejected a proposed paid-Fremen Heighliners trigger: authorized physical32 expressly keeps reserves on-planet, and a borrowed tariff is not a new physical origin. Original exclusion remains. Both real free batches activate Axlotl; Emperor extra versus Fremen ordinary allowance stays distinct. Existing bank purchase keeps real wallet/card and does not create industry income. No unresolved ruling was decided.

Eight genuine4/5-seat module games complete4,440 accepted actions, no rejection and116 JSON continuations. Five-seat samples execute five closing Nexus choices; four-seat samples can ally everyone and deal none. Reports capture production unchanged on trees 13367864d40cd778e5b50b5610e97b5819c25f74f37c655d962a884e3314cb28 and ea4f523a732c7c958c4df88fa01f8c335d7c896975348e5403306eda956df012. Later fixture-only undealt-CLI continuation/guide edits do not change engine. No natural free-return or private-inspection claim is made.

Original CLI DPA6UGWKv10/HXEMRA32,FQNN62UGv8 keeps genuine unused setup and exact seats. Human390px HXEMRA32v13/movement returns2normal+1Sardaukar, ordinary/free3/elite1, pending Axlotl1 at wallet12 then13 at real phase end. FQNN62UGv14/Mentat pays Guild3 for5 actual counters, wallet12→9; Heighliners1 pays Harkonnen10→11 only after original movement finishes. DPA6UGWKv18/Collection pays bank2/own4 for support6, retains Shield and1 normal Arrakeen survivor after6 normal/no starred loss. Moritani loser retains played Crysknife before original winner Heighliners; CHOAM reveals only unused Trip to Gamont. Separate city2 yields wallet8. Inspector, controls, refresh and guide are observed, root390px no overflow; controlled positions are labeled. Wider rules/combination/assurance/calibration/public/deployed gates remain open. Code 8ceee7afd0 is pushed. CI37181553391 container job111374984514 completed/success; isolated storage/HTTP step7 preceded verified-image step9: ghcr.io/quintine/dune:sha-8ceee7afd097d36e2ae7471b744d127062e39c29. Final rebuilt worker shows8ceee7a and retains original human v18/Collection, v13/movement andv14/Mentat outcomes. Owned script/tabs removed; store/proof remain. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native Tech and Advanced Strongholds without Skills

Two bounded owners supplied independent E1/E2 and standalone E3 cases. Parent integrated fresh native profile admission into existing faction and Stronghold entries, original Ecaz coalition/Moritani contexts, genuine sample and resume profiles, canonical guidance and original human controls. Tech3..6 Basic/Advanced preserves selected E1/E2 or standalone Ecaz OR Moritani decks/inventories; Advanced may compose six Stronghold Cards. Public starts, old games, unrelated modules and existing rulings are unchanged.

New32 meaningful cases are included in affected187/187. Types/lint/build, thirty actual admission probes/two below-three rejections, twelve actual native programs and four legal original Face Dance policies pass. Final fixture-only generic entropy dispatch passes both original consumers and types/lint. Obsolete Tech rejection, incidental wallet/placement/response pins and error wording were removed, not repinned. Actual printed CHOAM half-income uses two opponent spice→one income, excluding own bank-funded support. Ecaz uses actual affordable support, not a fixture wallet grant.

Ten Tech-only and five Stronghold+Tech genuine3-seat games complete4,902 accepted actions/no rejection/125 JSON. Reports capture unchanged tree 61521366bc68245741ec510546084e7bb7e2395b737474a78eda018f95a92676; final generic repair affects only the fixture, not the game engine. Natural Moritani samples do not claim assassination. Original report roots: /tmp/dune-native-tech-games-20261004, /tmp/dune-native-stronghold-tech-games-20261004.

Original CLI BZVLA22D/YENG8B6Uv8/setup retains unused selected modules and all original seats. Controlled human390px BZVLA22D v21/Mentat selects Ecaz/Sanya4, dial5/support1 against Bashar2/dial2:9–4. Fixed Ecaz3/Guild3 casualties leave2+1 fighters, held Tabr2 income and original Axlotl+Heighliners. No city Collection income is applicable to this Tabr-only position. YENG8B6U v15/Mentat preserves support1/losing Tuek4, printed Master3 death/bounty, wallet18, Guild winner Tech and one private Bashar replacement. Guild independently collects Tuek1 to wallet4. Inspector, decisions, public token labels, refresh and updated guide are observed; root390px has no overflow. The new dedicated QA store preserves these rooms and never touches user saves. Source/rule/faction/module/assurance/calibration/public/deployed gates stay open. Code 2da3c9273b is pushed. CI37175645562 container job111357583598 completed/success; isolated storage/HTTP step7 preceded successful verified-image step9: ghcr.io/quintine/dune:sha-2da3c9273b02efd06c283999c225f56e62214dd1. Final rebuilt/isolated worker shows2da3c92 and retains original human v21/v15 Mentat states. Owned scripts/tabs are removed; room store and proof remain. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — standalone E3 skills with Tech and Advanced Strongholds

Two bounded owners supplied Ecaz ordinary-disc/Duke and Moritani rescue/assassination/replacement programs. Parent integrated existing skill admission, original assassination context, appended sample/resume rows and guidance. Standalone Ecaz OR Moritani ecaz33/all14 admits Tech Basic/Advanced 3..6 and Stronghold Advanced2..6, optionally both. Original setup/first-Storm/ end-Mentat and exclusions remain; no public start, save conversion or ruling.

New15/affected152, types/lint/build and nine actual programs pass. Original probes:22 valid entries/ten retained rule-bound rejections. Eight E3 games:1,531 actions/no rejection/38 JSON; expanded47-game batch: 13,936 actions/no rejection/358 JSON. Captured unchanged tree d9c5e4d1a611f8ab7cf18e4c816161604d18f8aa8c94b25962fc38595fcc71a3. Natural Moritani samples do not claim assassination; controlled/human paths prove it. Legal later Basic dials, prior BG prediction, unoccupied Moritani setup, real Guild allowance/accrual and separate Tuek Collection correct fixture assumptions. Startup wallet/location pins were removed, not repinned.

Original CLI X4YSWBLR/BJH3UVQFv8 and human390px334W75B6v13/Collection, AL6WCG8Bv13/Mentat retain original IDs/pieces. Real normal Warmaster1/Duke6/ Carthag Shield wins7–6 against poison and releases the living Duke. Normal Guild Suk precedes unused Master3 death/skill return/printed bounty, losing Tuek income and one private Caid replacement. Cards/Tech/physical casualties and separately quoted Collection remain; refresh/no overflow pass. Detailed mechanics/evidence: existing runtime. No full rules, assurance, strategic-AI, public or deployed claim. Code 2b72021611 is pushed. Exact CI37165705653, container job111328037714, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-2b7202161170a7e0c108389c273b0cc1591603ac. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — Advanced Skills and Strongholds, with optional Tech

Two bounded owners supplied classic subsidy/defense/income/rescue and native HMS/typed losses/FaceDance/marker programs; parent integrated public-config eligibility, canonical unused-component admission, original Banker/Mentat opt-ins and sample CLI. Advanced classic or supported E1/E2 native2..6 retains all14 skills/six cards; Tech requires3..6. Deck/cache, wallets and actual setup, end-Mentat claims and printed/first-Storm Tech remain. E3/other overlays, Basic Strongholds, public starts, save conversion and unrelated guards remain.

New21/affected277 and final fixture-consumer72 cases, types/lint/build pass. Original setup probes cover26 valid entries/two below-three Tech rejections. Twelve actual programs and twenty-two genuine paired/triple3-seat games pass: 6,672 accepted actions/no rejection,171 JSON continuations, captured unchanged tree 171ecf79ccdef187ca662ddd00c0e5d3c5bce5231d386ee16566ac062ba5dc21. Fixtures use real nonmandatory winner cards before Collection, a funded bribe before cash-boundary rejection, explicit typed casualty choice and original mutual-traitor support payment. The no-spend fixture follows the original response pass queue rather than treating bot recommendations as a legal menu. Two explicit type annotations and exact per-token owner comparison fix fixture inference/lint findings without weakening the custody comparison.

Original CLI J5AAWGEQv8/NY6Y4J4Kv10 and human390px HERCFX3Bv20/Mentat, PG2GR3RCv26/Collection retain original IDs, legal payments, cards/forces and Tech. Actual classic own4 after bank2 qualifies one unavailable Banker grant; trained rescue retains support, and native readiness collects12→13 once. Native copy bank1/own0 preserves wallet10 before original Collection2; typed rescue keeps original subtype custody before winner cleanup/Axlotl. Detailed current scope, source pages and human outcomes remain in the existing skill runtime. No full-module, assurance, strategic-AI, public or deployed acceptance claim. Code f259488a9a is pushed. Exact CI37159813365, container job111310738376, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-f259488a9a6a507d450c5134f6f627ea2151256b. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native E1/E2 Leader Skills with original Tech Tokens

Three bounded owners supplied independent Ixian/CHOAM, Tleilaxu and Richese rule cases; the integration owner extended existing native eligibility, initializer, original Banker/Mentat opt-ins, CLI and canonical guidance. Fresh supported3..6-seat Basic/Advanced retains original deck/roster limits, all14 skills, cache, native wallets and printed Tech assignment. Public starts, E3/other modules, played-game conversion and unrelated ruling guards remain. The supplied Advanced source physical21/38 expressly supports the combination and original winner Tech before Face Dance.

Actual native Richese marker invoices exposed an existing Banker action-key whitelist omission: legal noField/event was rejected. Admit those original fields only for native Richese marker shipping; original validators still enforce source, custody, event and funding. Shared fixture continuation handles actual phase-opening readiness before response passes. Controlled cases use real cyborgs/legal typed commitment and physical winner-card cleanup rather than fabricated dial counts or incidental null/undefined receipt assertions.

Native52/52,261 affected shared cases and the corrected exact obsolete prototype-rejection case, types/lint/build and nine actual programs pass. Seventeen genuine3-seat games (fifteen native) complete5,733 accepted actions, no rejection and149 JSON continuations on unchanged source tree 14be0172b28a45fcabbf0240da12d6718e4fdc871d9a2b639466e6e90d8a1aca. Original CLI VQ3AVFTC/M7HPHNTN/PQ6U2X4S retains native setup atv7. Human390px7RPHJN87v15 typed Suk/card cleanup/sole Axlotl, F244P8DTv8 original Tech-before-FaceDance with mixed real sources, and YWVH5XQFv8 marker5/free companion/price1 retain original outcomes on refresh. The earlier compiled worker rejected native Richese Banker admission; the rebuilt isolated idle QA reload preserves the rooms and exercises the new path. Detailed current mechanics/evidence remain in the existing skill runtime. No full-module, strategic-AI, assurance, public or deployed acceptance claim. Code 219489ae04 is pushed. Exact CI37156345578, container job111300388598, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass: ghcr.io/quintine/dune:sha-219489ae04896ab838735a25091b76a3e4e5bd24. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — classic Leader Skills with original Tech Tokens

Two bounded owners supplied normal payment/free-companion and battle rescue/ reward programs; one owner integrated the existing skill profile, original initializer, separate Banker/Mentat opt-ins, source guidance and sample CLI. Fresh classic3..6 Basic/Advanced keeps base33/all14/three original Tech Tokens. All ownership begins through original setup/first Storm; native factions, Stronghold Cards and other overlays remain separate. No public start or played-game conversion is introduced.

noOtherLeaderSkillModules remains strict. A public-config-only classic Tech predicate admits the exact combination without hidden-card/deal eligibility; ordinary skills, Bureaucrat and existing opted-in Mentat share it. The original audit requires canonical unused tokens before dealing. Separate normal Banker retains earned-faction/separate-payer policy; a phase-end Tech credit is not a new bank-payment producer. Original Smuggler changes priced counters, original Suk/Sandmaster finish before cleanup and mandatory token reward, and no decline is invented for the printed mandatory award.

New25/25 and affected shared/CLI146/146, types/lint/build pass. The CLI case list initially contained a nonexistent Mentat runtime filename; the runner rejected it before executing checks. It was corrected to the exact existing native cases. Two actual fixture defects were repaired: empty Battle automatically advances phase5→7, and that same native transition can collect the ordinary board. The helper now stops at the first clean same-turn native boundary at/after its target; wallet expectations use the independent original Collection quote, not incidental new wallet values or a fabricated battle/phase.

Seven actual native programs cover both-band Smuggler/Banker/Tech through Mentat, both-band skilled Suk then two-token selection, Advanced Sandmaster, private opted-in Mentat fallback and normal single-payer Bureaucrat bribe. The Bureaucrat program reads the original QA v18 without writing it: paid5, recipient unavailable bribe3, Bank2, one phase use and unchanged Tech custody. The Mentat program names Crysknife, observes the target's actual selected Worthless fallback privately, preserves its held card and resumes posture. These are explicitly controlled native programs, not natural-history claims.

Eight genuine Basic/Advanced3..6 games complete2,712 accepted actions, zero rejections and69 JSON continuations on identical before/after source snapshot 0d242f253ae391bccfd8fa3bc0dadbc0421b10b90c9c5475ac1c61582a4922a8. Original CLI WHTKGXEJ v7 retains Banker skill setup; 5YMNGCCT v7 retains original Bene Gesserit prediction before Skills. Both retain three unowned canonical tokens until the real first Storm.

Human390px 63LV57W2 ships Harkonnen physical5 to empty Habbanya17 with the original free-companion checkbox: native wallet10→6, reserves10→5. Heighliners accrues1 for Emperor and Banker fronts1 for Atreides while both owned wallets remain10. Real movement enters v10/Collection: Tech owner11, Banker12 from ordinary city2 with front1 still unavailable. Original human readiness reaches v13/Mentat, Banker13/front0; refresh preserves those facts.

Human390px HC35JG8P follows a real preliminary token capture and chooses the remaining Hagga battle. Hidden skilled Staban5/dial4/support4/Crysknife/ Shield wins9–0 after original optional opposing Diplomat decline. Wallet5−4+2 printed Bashar bounty=3. Actual Suk choice saves3: one kept, two reserve returns, one current Tank casualty; earlier two casualties make total Tanks3/reserves12/ Hagga5. Winner retains both physical cards, then selects only Axlotl from the two real opposing tokens; production stays Emperor. Refresh preserves v18/Collection, wallet9 after separately collecting6 board spice, one token transfer and20 forces. Phone rescue explanation/token controls and the hydrated351px guide within390px are readable without page overflow.

Owned temporary drivers and managed tabs are removed; original game rows, private metadata, captures and QA store remain. No broad assurance/calibration, public activation, completed-modules or deployed claim; live ab5c782 remains last observed. Final guide10/10, types/lint/build and the final rebuilt390px reference pass (351px topic, no page overflow). The final isolated QA reload retains both original human versions and phases. No extra broad assurance suite is rerun.

Code b71f953635 is pushed. Exact CI37146422525, container job111271205483, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-b71f953635e013dab3fd184baf01523681883fdc. Publication is not deployment.

4 October 2026 — standalone Ecaz and Moritani Stronghold composition

Two bounded owners supplied native Ecaz holder-plan and Moritani loss/assassination programs; one owner integrated Advanced profile admission, original setup, canonical ecaz33 deck, CLI samples and guidance. Ecaz OR Moritani with classic opponents and Stronghold Cards alone is admitted; Moritani excludes Harkonnen. E3 pairs, mixed families, Basic and other overlays remain outside this profile. There is no public-start or played-game conversion.

Original end-Mentat ownership and every printed face remain. Ecaz co-control holds the card at Ecaz, but the selected lead receives only its own held effect. Arrakeen pays actual support, never personal cash or fixed free Ecaz strength; Habbanya tie/Tabr income similarly follow the holder-plan. Moritani losing Tuek income precedes original eligible post-loss assassination. Printed bounty, winner cleanup/casualties and one actual private Mentat replacement finish once; normal Traitor revelation forfeits assassination for the game.

Affected native/CLI179/179 pass. Final Richese8/8, types/lint/build pass after repairing a genuine fixture hazard: first Storm dials could let the next random Storm land on the controlled Arrakeen battle, advancing into turn3 and losing card ownership. Legal first-turn dials now keep the target outside that band; no Storm/phase/owner assignment or production rule change is used. Ten actual diagnostic programs retain turn2 and the original Arrakeen effect. Obsolete CLI source-inventory and incidental wallet/placement assertions were deleted rather than re-pinned. Native E3 wallets are never enlarged for the cases.

Four genuine E3 two/three-seat games complete642 actions,15 JSON continuations and3 battles with no rejection. No natural assassination occurs in those samples. Original CLI XK8X548M/HALWWQ6V v6 retain real Traitor setup and six unowned cards. Conserved human boards/cards are staged after original authenticated setup, real alliance and actual card claims, with original identities intact.

Human390px N5SQHZE4 selects Ecaz lead and seals total6/support3/Sanya4/Shield. The wheel shows fixed free Ecaz3 plus Guild-variable3 and bank2/personal1. Native wallet1 reaches0 at winner-card cleanup; real Shield is kept. Original Collection then pays each ally2. Refresh retains v18/Mentat, Ecaz2/Guild1 survivors, Ecaz3/Guild3 Tanks, Emperor8 Tanks, Ecaz wallet2 and Guild wallet7. Human390px ANUJE8L5 starts at original loss with support1/Tuek4 already committed and wallet15. Actual Master Bewt reveal earns printed3, wallet18; original winner cleanup applies Guild's three dial casualties once. Real Collection/Mentat reaches v11 with public Master Bewt retirement and one private Burseg replacement. The traitor and held Arrakeen inspectors are readable.

The isolated QA worker was reloaded only after build, preserving its database and original room states. Full assurance, calibration, public activation and deployed acceptance remain open; live ab5c782 remains last observed. Final guide10/10, types/lint/build and the rebuilt390px guide pass (351px topic without page overflow). The final isolated worker reload retains human v18/v11 at actual Mentat. Owned temporary drivers and managed tabs are removed; the original game records and QA store remain.

Code 39e2954ab4 is pushed. Exact CI37133540369, container job111233294920, completed/success: isolated storage/HTTP step7 and subsequent verified-image publication step9 both pass. Immutable image: ghcr.io/quintine/dune:sha-39e2954ab468aa252d91a33e2e0b52f99a2fe135. Publication is not deployment.

4 October 2026 — Basic even-force Ecaz Occupy composition

Two bounded owners supplied the source-band coalition quote and native Basic runtime cases. One integration owner admitted Basic, migrated production re-quotes, corrected a genuine total-dial validation gap and connected the CLI help, canonical guide and source records.

The coalition quote now requires an explicit advanced boolean with no default or alias. Active Basic requires an even Ecaz count and uses E/2 for the mandatory contribution and ordinary-win Ecaz losses; Advanced keeps its ceiling arithmetic. Canceled Basic permits the preserved odd count through the original own-pool cancellation frame with zero fixed strength. The publisher page-8 paragraph and page-15 example still contradict each other for odd counts, so an uncanceled odd Basic battle is rejected at the original choice before a lead frame exists. It is not rounded, canceled or replaced. Basic has no Emperor/Fremen elite inventory (elites require Advanced or Homeworlds), and the engine normalizes a supplied Basic support amount to zero rather than inventing paid Basic support; the shared editor blocks nonzero support.

A genuine defect surfaced during integration: Basic validatePlan bounded the dial by the ordinary own pool before the coalition quote ran, so a legal total such as six was rejected. The quoted-force branch now includes the actual Occupy profile, and the Basic Prescience numeric dial branch includes the coalition lead; native feasibility still validates the exact total. The board projection gains an optional public Basic-coalition flag so only fresh Basic tables collapse the pair into one battle side; older played Basic games are not retrofitted.

The Basic fixture originally borrowed a wallet so the rival could afford its eight-force sand shipment. Removing that artificial wallet exposed the real unaffordable shipment; the fixture now transfers eight original rival reserves to the battlefield after the genuine Nexus instead, keeping native wallets, phases, alliance, plans and receipts. The genuine Basic fixture does not accept an authenticated lobby yet; the authenticated staging path is separate.

Affected Basic/helper cases47/47 and the affected Advanced/CLI union352/352 on a stable tree pass with types/lint. Five genuine Basic two-through-six-seat games were run: four complete with 2,090 accepted actions, no rejections and 54 JSON continuations; four-seat seed 20261299 is captured at the preserved odd-count conflict after 321 accepted actions. The captured game, report, state and trace remain outside the checkout and are not rerun or bypassed. The four completed natural games contain no coalition lead choice, so the coalition arithmetic evidence comes from the controlled programs and the human path, not from those games.

Authenticated human390px FEJ6SBFB v14 kept the admitted Ecaz/Guild/Emperor seats and native wallets, then staged a conserved even-force board after the genuine Nexus alliance. The table showed the correct Basic labels: a total-dial slider bounded 2..6 (2 fixed Ecaz strength for four Ecaz forces plus Guild's four-force variable pool) with no spice-support control. Real sealed plans — Ecaz Sanya Ecaz 4 with total dial 4 against Emperor Hasimir Fenring 6 — produced an 8–6 Ecaz win. The log and saved state record Ecaz's two mandatory Occupy casualties, Guild's two variable casualties, and the Emperor's eight territory forces to the Tanks; every seat remains at 20 physical forces after refresh. The Basic Karama window, lead choice, plan editor and Collection continuation all use the existing shared controls.

No natural-history claim for controlled positions, reset, public activation, full-mode certification or deployed evidence; live ab5c782 remains last observed.

Code 5f082696a6 is pushed. Exact CI37116854539, container job111185228169, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-5f082696a60ac8b75e3eb4bcaa042826526fbdac. Publication is not deployment.

4 October 2026 — native Ecaz ordinary-disc skills and temporary Duke composition

Two bounded owners supplied native setup/ordinary rescue/revival/Ambassador cases and temporary Duke acquisition/battle/death/revival cases. One integration owner added the exact Ecaz/classic Basic/Advanced native profile, shared family fixture, stable CLI samples, source guidance and real human continuation. Five native discs receive original skills; the separately controlled Duke is not inserted into native rosters or traitor/assignment inventory. Basic Harkonnen remains; Advanced Harkonnen retains its original Duke/capture boundary.

Existing handlers compose without an alternate rule engine: original starting-card/public-skill/Loyalty/traitor/six-force setup, normal versus selected role strength, physically capped native Suk rescue, trained-disc death and optional paid or physical Ghola own-normal-disc skill replacement. Original Ambassador payment/entry/bank grant retains training and the entrant's suffix. Temporary Duke6 with another living face-up native Warmaster gets normal1 only; surviving release or poison death leaves the native trainer/card untouched. Actual bounty remains6; eligible Ecaz paid5 revival keeps the same living set-aside Duke under the earlier user decision. Existing-skilled revival does not establish shared-Duke assignment.

First focused run passes6/9. Two new tests mistakenly pinned dead Duke's incidental usedAt metadata; those assertions are removed, not re-pinned. The Ambassador case omitted the original event; it now submits the actual pending receipt. Final new cases9/9; affected67/67, types/lint/build pass. Twenty actual controlled programs cover Basic/Advanced Duke normal/hidden/ stronger-opponent/death, manual/four-policy native Suk and actual deferred Banker payment. Ten genuine two-through-six-seat Basic/Advanced CLI games finish4,264 accepted actions/no rejection,110 JSON continuations,59 battles, 50 Ambassador decisions and one Suk rescue. New stable ordinals283–292 retain all earlier samples. No strategic calibration or assurance matrix.

Original CLI 24HGMJCD v4 preserves native setup and seats. Human390px LQWE8TZM v18 starts at a conserved pre-Ambassador board after original native setup. Real placement pays1, Emperor's original reserve arrival pays1, and the owner-only Acquire Duke control receives the original living disc. The subsequent conserved Wind Pass/Baliset position retains that actual acquisition, wallets, seat IDs and physical inventory. Real normal face-up Sanya Ecaz/Warmaster, Duke6, Baliset and dial0 face Captain Aramsham5 with two fully paid forces: actual7–7 aggressor tie. An initially over-supported one-force UI attempt is rejected at unchanged v14; correcting the native wheel to2/support2 seals normally. Both actual no-traitor choices, normal winning cleanup and refresh reach Collection/v18/wallet11/eight Wind Pass counters/ Tanks0 and living set-aside Duke. Native trainer/card remain face up; the opponent's owned wallet is7. Enlarged canonical Duke inspection is readable. Its stale unfinished-revival notice is updated to the actual bounded scope.

Shared-Duke assignment, combined Occupy skills, optional modules and other existing rule questions remain explicit. No natural-history assertion for controlled positions, reset, public activation, complete modes or deployment; live ab5c782 remains last observed.

Final native/guide19/19, types/lint/build and visible390px topic (351px width) pass after the affected Duke inspector notice and canonical source updates. The actual reloaded inspector describes paid/Ghola set-aside revival and native ordinary-disc skills without claiming shared assignment or loans. Original human v18/Collection/wallet11/eight counters/living set-aside Duke remains after the final isolated worker reload; CLI v4/setup is retained. Owned temporary entry/rule/staging drivers and managed tabs are removed.

Code f17f4e703e is pushed. Exact CI37110175538, container job111166376104, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-f17f4e703eb09d0870abb3233974da2f31f24bea. Publication is not deployment.

4 October 2026 — native Richese skills and Advanced contribution recipients

Two bounded owners supplied canonical Richese green role substitution and original auction-recipient quotes/tests; one integration owner composed native profiles, engine receipts, force paths, shared fixtures, CLI and current guidance. Basic/Advanced Richese retains original CHOAM-family cards, ten-cache custody, setup and fourteen skills. Native selected decks keep their explicit limits.

Canonical printed green Richese Specials add Planetologist strength without executing their native fee/search/leader-kill effect; weapon-special Stone/Mirror and Snooper defense remain excluded. Marker-only0/3/5 casualties use the actual reserve-capped pool, then original Suk rescue. Normal Smuggler's own companion is one separate physical force, not concealed value. Actual selected-deck games exposed the old single-deck marker admission; the path now shares the native profile. Ordinary allied declaration cancellation retains its original frame, without granting an allied free companion. Original preleader acknowledgments are preserved rather than letting fixture AI consume Residual Poison early.

Authorized Advanced Richese Bidding routes its funded ally contribution to Emperor/bank, even when Emperor buys. The original scalar paid receipt keeps buyer-to-Richese credit separate; cancellation redirects only Emperor's share, never donor escrow twice or physical delivery twice. Basic retains the R2 publisher receipt. Native Banker eligibility uses actual final bank payer legs, not seller/allowed Emperor income or aggregated small payers. Deferred currency remains unavailable until the original Mentat opening.

Final affected rule/CLI union151/151, types/lint/build and eleven actual controlled programs pass: Basic Nullentropy/Advanced Residual Poison substitution, manual/four-policy capped Suk rescue, and original bank/Emperor/cancellation/Emperor-buyer paths. Stable new CLI scenario ordinals254–282 preserve earlier sample assignments. The genuine29-table batch is not green:28 complete11,788 accepted actions, 303 JSON continuations and130 battles; Advanced six-seat seed20261267 is captured after1,523 accepted actions at phase3/richeseBlackMarket. Its exhausted cache reaches the retained ordinary-count ruling guard. Report/state/trace remain outside the checkout; no rerun, artificial card, reset or forced payout. Separate two/three-seat selected-deck follow-ups finish without rejection.

Original CLI FXK6Z8BW v6 retains native setup. Human390px 358WLPYA v16 keeps admitted seats before a conserved controlled zero-marker battle. Actual preleader readiness, skill concealment and sealed plans use Ein Calimar5, Residual Poison as green and dial0; +2 wins the original aggressor tie7–7. Normal cleanup discards the card without its native leader kill. Collection after refresh retains reserves20/Tanks0 and no phantom marker forces.

Human E2K2U5ZW v26 uses actual cache funding controls and the real silent lot: buyer pays4 and Richese supplies4 for one eight-spice Ornithopter. The buyer wallet goes5→1 and acquires exactly that card; seller Richese is5 after its own4 debit plus only buyer4 credit. Absent Emperor, donor4 goes to bank, earning Guild Banker one deferred spice while available wallet stays5. Original normal lots pass, native Revival completes, Guild timing is allowed through actual responses, original shipment turns finish, and the ally declines the separate No-Field opportunity. Collection wallet6 still has front-shield1; actual final readiness opens Mentat, collects once6→7, and refresh retains v26/Mentat/wallet7/empty pile. Fresh accessibility and screenshots show the unavailable-income notice and real controls. The detailed current guide is readable at390px (351px topic), with exact green disposal and recipient limits.

Own mixed No-Field, exhausted-cache count, special-lot Technology, positive Black Market self-bidding, Bureaucrat split funding and other pending rulings remain intact. No full-mode, assurance, calibration or deployed claim; live ab5c782 remains last observed.

Final guide10/10/build and hydrated390px topic (351px width) pass. Necessary isolated QA worker reload retains payment human v26/Mentat/wallet7/empty pile, without replaying the grant or collection. Owned throwaway drivers and browser tabs are removed; original QA records and the guarded captured game remain.

Code 032b41aa87 is pushed. Exact CI37107445770, container job111158645504, completed/success: isolated storage/HTTP verification and subsequent verified-image publication pass. Immutable image: ghcr.io/quintine/dune:sha-032b41aa8721fd869a1b25d0fd29213c22b9ba69. Publication is not deployment.

4 October 2026 — Advanced Moritani skills and winner-skill-first assassination

Two bounded test/fixture owners extended genuine native setup/Terror/physical skill cases and original post-loss assassination cases. One integration owner composed the fresh all14/non-Harkonnen classic profile, original assassination state after setup, separate Banker opt-in, CLI and current guidance. Basic including Harkonnen remains unchanged; no inferred Ecaz/Duke assignment or wider native/module admission.

The first integrated normal-role case exposed actual pending Suk casualties being replaced by the original assassination decision. The unspent receipt now waits at winner skills; Suk rescue and Rihani choice finish first, then the original assassination opens with a no-casualty continuation. Reveal/decline cannot replay those costs. Source-specific regressions and actual programs exercise both decisions. Winning-disc exclusion, printed bounty, public retirement, one private Mentat replacement and whole-game normal-traitor forfeiture remain. Fixture corrections preserve real Storm-source completion at later-turn staging, normal opponent Suk rescue, optional winning Worthless retention and winner-only killed-disc bounty. Removed obsolete guard-forwarding and bare-not-throw checks.

Affected64/64, CLI2/2, final native/guide25/25 and types/lint/build pass. Nine actual controlled cases cover two skill-first decisions, manual/four-policy trained-disc assassination/native replacement and explicit Mentat/Banker opt-ins. Five genuine Advanced CLI games finish1,425 accepted actions/no rejection, 37 JSON continuations and24 battles, but contain no assassination opportunity: that evidence comes from controlled programs and the human path. Stable new scenario ordinals249–253 retain all old Basic samples. Fifteen local canonical anchors resolve; no comprehensive assurance campaign or strategic calibration.

Original CLI 7JGUWMAP v6 preserves native setup. Human390px TQH86DL4 v20 keeps the exact admitted seat IDs, followed by a conserved Wind Pass/physical traitor/Worthless/disc position. Real Captain Aramsham5/Trip to Gamont/normal Warmaster1 defeats Vando1 by6–1. Moritani's original owner-only control reveals the different Hasimir Fenring6, pays exactly6 and returns Warmaster once; own Bureaucrat remains. The real winner discards Trip to Gamont, original Collection readiness advances to Mentat, and one private physical replacement appears. Passing free native Terror placement leaves wallet18/Tanks8 and one held Traitor with Hasimir retired. Owned enlargement and refresh confirm usable continuation. The detailed guide is visually readable at390px (351px topic width).

No natural-history claim for controlled positions, reset, public activation, full-mode certification or deployed evidence.

Final targeted GETs preserve human v20/Mentat/wallet18/Tanks8/one held Traitor/ retired Hasimir and original CLI v6/setup. Sixteen final canonical scope anchors resolve. Owned throwaway drivers and browser tabs are removed/released; QA games and the original isolated store remain.

Code d41a7e03a9 is pushed. Exact CI37100245846, job111138195904, completed/success: original isolated storage/HTTP verification and subsequent image publication pass. Immutable image: ghcr.io/quintine/dune:sha-d41a7e03a94bcc785e1417d26a882c5f6dc2ac4e. Publication is not deployment; live ab5c782 remains last observed.

4 October 2026 — native Advanced Tleilaxu skills and foreign-ghola lifecycle

Two bounded owners composed original foreign-disc ownership/skill validation and genuine native fixtures/rule cases. One integration owner extended the shared Advanced profile, stable CLI samples, human guidance and actual runtime. Native Tleilaxu plus optional Ixians/CHOAM/classic seats keep all fourteen cards, original family decks, starting offers and Face Dancers. Foreign revival never draws a new skill; eligible own revival retains its optional offer.

Actual original capture remains legal. The first new validator incorrectly required a concealed snapshot after the native second plan publicly revealed the captive. The failing real-engine case now passes through the existing revelation, execution and surviving-use return handlers without duplicating death, capture or payment. Original disc/ghola/captor controllers stay distinct. Fixture corrections use genuine trained-disc posture, the real own-revival action and the actual native Auditor inventory. Deleted obsolete Advanced denial and bare-not-throw policy assertions rather than re-pinning them.

Affected56/56, CLI3/3 and types/lint/build pass. Nine actual controlled cases cover manual/four-policy funded foreign revival, capture execution/use-return and explicit native Mentat/Banker opt-ins. Fourteen genuine CLI games complete 6,620 accepted actions/no rejection,171 JSON continuations,62 battles, two foreign and five own leader revivals. Stable new ordinals235–248 preserve old Basic samples. Ten canonical local anchors resolve.

Fresh original CLI H485PLF5 v6 preserves native setup. Human390px VNQ5PF54 v33 uses original admitted seats, followed by an explicitly conserved Revival disc/Worthless/storm position. Actual Bashar foreign revival pays1 from wallet5, with no new offer. Actual two-force Wind Pass shipment pays4. Normal face-up Zoal/Warmaster contributes exactly+1 to Bashar2 using actual Trip to Gamont against Caid3/dial0; the native aggressor wins3–3. Original Traitor declines, card retention and phase opening reach Collection after refresh with wallet0, two board counters and the living foreign disc still controlled by Tleilaxu. The detailed guide is visually readable at390px.

No natural-history claim for controlled fixtures, game reset, public activation, strategic tuning, comprehensive assurance campaign or deployment.

Final native15/15, all nine controlled runtime cases and types/lint/build pass after the foreign public-profile quote is cached only within its current validation call. No allocation or retained-state cache is introduced. Eleven final canonical scope anchors resolve. Final isolated-build GETs retain human v33/Collection/wallet0/two counters/living Bashar and original CLI v6/setup. Own throwaway drivers and browser tabs are removed/released; QA games remain.

Code d86d2088e6 is pushed. Exact CI37095454758, job111124330662, completed/success: original isolated storage/HTTP verification and subsequent image publication pass. Immutable image: ghcr.io/quintine/dune:sha-d86d2088e6acc020e44bda0dfbba5093ec98df8f. No deployed claim; live ab5c782 remains last observed.

4 October 2026 — Advanced native Ixian and CHOAM Leader Skills

Two independent owners extended the bounded native profile/helper contracts and genuine full-deck rule fixtures. One integration owner migrated engine admission, native aftermath and Banker eligibility, preserved existing Basic/legacy entries, and exercised original human controls. The new Advanced subset requires unique two-to-six native Ixian/CHOAM plus classic seats, distinct required family decks and no unrelated overlays. Foreign-ghola, captured replacement and Advanced Atreides Suk/Kwisatz Haderach rulings remain guarded.

Affected122/122, types/lint/build and ten actual controlled programs pass: five Ixian mixed-rescue/manual/four-policy continuations, one CHOAM Smuggler collection, two private Mentat disclosures and two real bank-payment-to-Mentat Banker grants. Three genuine new CLI games accept511 actions with no rejection and twelve JSON continuations; none has a battle, so no battle-effect claim is attributed to those histories. Natural scenario ordinals remain stable; new Advanced Ixian/CHOAM/mixed samples use220–234.

Fresh original CLI KFW75TCB v6 preserves genuine skill setup. Human390px ARRHUS7Z v20 begins with real admitted Ixian/Atreides/Emperor seats, then an explicitly staged conserved Wind Pass position. Actual Dominic Vernius dial5/ support1, ordinary opposing leader/dial0, native Traitor declines and4suboid/ 2cyborg loss controls open skilled Suk. Actual rescue saves one ordinary and one cyborg, keeping the ordinary counter; actual native substitution sacrifices one ordinary survivor for the remaining lost cyborg. Original phase opening finishes through real ready actions; refreshed Collection has wallet9, three board forces including one cyborg, four Tanks and zero cyborg Tanks. This is not a played phase history, exhaustive persistence audit or deployed evidence.

Canonical runtime/guide/native follow-ups record current scope. Ordinary Mentat activation, empty hands, normal Banker earned custody and other pending questions are not settled by this composition. No game reset, public activation, AI tuning or comprehensive assurance campaign.

Final CLI2/2 and native/guide18/18 pass; the obsolete Advanced CLI rejection contracts now exercise original full-deck saved artifacts instead. Types/lint and build pass. The rebuilt isolated worker retains human v20/Collection/ wallet9, and fresh visual guide evidence fits390px (351px topic width). Five new canonical scope links resolve. Throwaway drivers and the owned tab are removed/released; QA rooms and the original isolated store remain.

Code 7ee064df14 is pushed. Exact CI37092109758, job111114441767, completed/success: original isolated storage/HTTP verification and subsequent verified image publication pass. Immutable image: ghcr.io/quintine/dune:sha-7ee064df14b79a06d41317f9f8eb193e078d2219. Publication is not deployment; live ab5c782 remains last observed.

3 October 2026 — native Richese, No-Field and Stone Occupy composition

Two bounded owners implemented physical Stone normalization and native Richese fixtures/zero-marker metadata. One integration owner composed admission, selected-plan inspection, original physical revelation, private legal pools, controls, four-policy filtering and internal guidance.

The pre-existing combined sample failure was a mandatory Ecaz+Ixians versus CHOAM Carthag battle rejected because Richese was elsewhere at the table. Native composition replaces that blanket guard, not the battle itself. Original Richese reveal ownership persists even when Ecaz supplies the plan; zero markers remain original presence through response/Traitor validation and public reveal. Stone preflight/resolution subtract the fixed dial offset and count the separate physical Ecaz remainder; public hypothetical pools remain authoritative. Advanced native Mirror uses the same comparison and original physical cleanup. Basic and existing unresolved timing/disclosure/optional-module guards remain.

Affected363/363 and types/lint/build pass. Twenty-six actual native programs cover ten owner/marker cases, eight Stone/Mirror lead/cancellation cases and eight four-policy private-pool cases, reaching original Collection after JSON reload. Fixtures are explicitly controlled conserved board/card/bank positions after genuine setup. The actual combined seed20260932 completes2424 accepted actions, zero rejection and65 JSON continuations at turn9, versus the prior2353-action stall. No new whole-suite/HTTP/storage assurance wave was run.

Original CLI GQ4FEWNW v8 admits a fresh ready four-seat Advanced Ecaz/Richese/Guild/CHOAM setup. Human390px T78EFNZK v22 uses the same original seat identities and fresh admitted setup before a conserved Carthag position. Actual Ecaz lead/ Sanya Ecaz/total5/support2 controls seal against Guild Representative. Both plans reveal the original No-Field5 into only two Richese reserves. Native Traitor decline, CHOAM one-spice support income and closing-market continuation leave Ecaz2/Tanks3, Richese Tanks2 and original Collection/Ecaz wallet30 after refresh. The physical field, variable losses and payer remain distinct.

Corrected the previous mixed Truthtrance log: eight actual programs, not twelve; nested/joint cases are regressions, and its phase/positions were explicitly staged after genuine setup. Deleted obsolete presentation/wording/wiring pins instead of re-pinning changed labels. No reset, public start or deployed claim.

Final native/reference76/76 passes. The new fixture now explicitly declines an unrelated optional Face Dance rather than depending on randomized native identity draws. Final guide paragraphs are readable at390px after the required isolated worker reload; original T78EFNZK v22 remains at Collection with the same relevant owner losses. The old guide chunk was cached in the managed browser, so final guide navigation disabled that prior-build cache; production cache-upgrade acceptance remains open.

Additional mixed controls FCGZTEGV v11 actually authored outer OR with an inner current-spice>=10/Arrakeen4 AND and alternative Carthag6. Yes at20 spice survived a real12-spice bribe, four-force/four-spice Arrakeen shipment and native end-movement with wallet4. The promise is fulfilled and exact grouped Yes history survives refresh. This is a second human journey, not another program case.

Code 113667da55 is pushed. Exact CI37074437398, container job111061051259, completed/success. Its original isolated storage/ HTTP verifier and subsequent verified-image publication pass: ghcr.io/quintine/dune:sha-113667da55647117082c0a502eded30d8d9bdb2e. Publication is not deployment; live ab5c782 remains last observed.

3 October 2026 — mixed current-fact/shipment Truthtrance

Two bounded owners supplied the public mixed tree/compiler/matcher (including internal frozen-constant storage) and complete nested AND/OR authoring controls. One integration owner owns game/truthtrance.ts, engine projection/promise receipt, bots, the shared table guide and this checkpoint.

Current facts are evaluated once at the definite answer and stored privately as three-valued constants; later legal changes cannot rewrite them, and unknown is never collapsed to false. Future leaves still describe one eventual reserve shipment or its absence under the existing FAQ whole-question truth. Multiple ordinary and mixed promises constrain that same event together. Public projection filters mixed promises to their respondent and keeps only the original grouped question and whole answer in history.

The first frozen run exposed three real integration defects, each fixed before verification: the discard-continuation receipt still required a legacy shipment shape; the pre-existing promise.answer shipment shortcut treated a satisfied mixed promise as if it must ship; and two workspace type errors (target-shipment projection and test literal narrowing). Ordinary shipment-only promises retain their original behavior.

Types/lint, the affected truth/ship/discard batch88/88, mixed/reference23/23 and build pass. Eight actual programs cover OR-true-skip, AND-false-ship, AND-true-required, OR-false-ship and all four legal policies. Nested branches after spending and a second joint pure+mixed promise have rule regressions. Fixtures use genuine base setup followed by explicitly staged turn-two Shipment and Movement, conserved positions and wallets; accepted native Truthtrance actions create the promises.

Human390px 4PVKRRWB v10 authored the actual "hold at least10 spice OR ship4 to Arrakeen" question, answered Yes, spent all20 spice as a public bribe, skipped shipment and fulfilled the promise while the public answer stayed Yes; refresh retained it. Earlier phases, Advanced Guild/other modules, expansion shipment modes, other future actions and arbitrary prose enforcement remain unfinished. No new assurance campaign, public start or old-game retrofit.

The prior full offline run exposed a pre-existing failure unrelated to this wave: the combined Advanced CLI sample stalled at phase6 because the engine's roster guard rejected Ecaz+Ixians versus CHOAM at Carthag merely with Richese elsewhere at the table. The same2353-action failure reproduced at0ceb28b. This was missing native Occupy composition, not an illegal bot offer, a Richese opponent or a new ruling question. The later Richese checkpoint repairs it without suppressing the mandatory battle.

Code cd985c7c34 is pushed. Exact CI37065338944 and job111031663449 completed/success: original isolated storage/HTTP verification and subsequent verified-image publication both pass, image ghcr.io/quintine/dune:sha-cd985c7c34a05057ed98b34838effdbcddb7697d. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — native Banker income and Ixian Nexus replacement

Two independent bounded owners supplied native original setup/payment fixtures and exact Ix47 descriptor support; one integration owner owns shared runtime, controls, CLI, reference and this checkpoint. Existing initializer/action/view/ source APIs remain. No public start, old-game retrofit, broader timing ruling, strategic AI or new save/privacy/custody assurance wave.

banker-income adds already-supported Basic Ixian/Tleilaxu/CHOAM/Moritani skill families and their original selected decks/all14 skills. The exact native self-revival and canceled-income cases first failed after profile admission: Tleilaxu's own cost was skipped, and a canceled native payout had no original bank invoice. The repair uses one actual positive-cost payer leg, binding native payer/kind/recipient/cost to the original response. The separate free reward never increases that payer's threshold amount. Paid3 plus free1 does not grant; paid4 does. Native player-recipient/free/self/trainer policies and provisional original-earned-faction retention stay distinct and unchanged.

Three native collection cases initially stopped at phase8 before the existing Ix Amal opening initialized Mentat. The helper now completes that real opening; engine phase order is not moved to force a passing wallet check.

ixian-replacement adds Basic native Tleilaxu/classic with Ix47 and Nexus alone, Ixians absent. The existing generic Nexus initializer retains genuine setup and alliance-qualified acquisition; the fresh native variant omits optional Sandtrout by the existing bounded-profile convention. Exact purchased Thumper/Tooth/Blade/Hunter and actual remaining-deck draws preserve once-only original payment/income and next-lot/final-lot native continuation. Existing base full-hand/depleted source cases remain rather than artificial duplicates. Harkonnen buyers, special origins and pending Nexus questions remain gated.

Types/lint, coherent affected110/110, final native/guide26/26 and build pass. Twenty-eight actual program cases pass:12 native Banker source-to-Mentat/ recipient/cost cases,12 replacement/card/policy cases and4 legal post-income policy continuations. Fixtures use real original native deals and phase/source actions; revival examples explicitly stage only conserved casualty positions. No full-game, calibration or deployed acceptance claim.

Genuine flagged CLI setups 7B55PLA5 v8 and XLFRHKPF v6 retain native original setup. Human390px 86WQMSZV v18 closes the actual Emperor self-bid4, keeps Ix available10 with deferred1, continues original phases and collects automatically at initialized Mentat to11. NMFTVV6N v8 inspects the purchased Thumper, spends its actual Ixian Nexus, draws Amal, retains buyer3, and allows original Emperor income10→12 once before the phase4 Amal opening.

Final reference10/10, build and both390px bounded guides pass; eleven changed-region local links/anchors are valid. All owned tabs and both isolated workers are closed; five smoke/staging/continuation drivers are removed. Private QA/CLI backups remain outside the checkout. No game reset or supplied PDF publication; deployment and full module/faction acceptance remain open.

Code b83d75d9d3 is pushed. Exact CI36999767861 and job110814548718 completed/success. The original isolated storage/HTTP verification and subsequent verified-image publication both pass; image ghcr.io/quintine/dune:sha-b83d75d9d313d2ff1926e11f2155ea0c78ed1757. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — native Mentat question integration

The existing private preview composes with already-supported Basic Ixian/Tleilaxu/CHOAM/Moritani Leader Skill profiles. Fresh exact-version CLI --profile leader-skills --mentat-question preserves actual original native setup and all fourteen skills; no normal/public start or old-game retrofit. Exact/default weapon names use the existing canonical quote. Weirding Way is a weapon, Chemistry is not; an absent name requires the target's actual held fallback card. Inquiry and disclosure precede posture and faction powers; the shown card remains held rather than committed to a Battle Plan.

Before the change, the Ixian regression failed because the engine skipped straight to posture. Five new behavioral regressions now pass, plus the affected inquiry/lifetime batch45/45. Twelve actual program scenarios pass: eight native exact/fallback battles reach Collection, and all four legal policies finish Ixian naming/disclosure. Fixtures use genuine native setup, assignment and Storm, followed by labelled conserved battle positions; these are not complete naturally occurring games or AI calibration.

The existing uniform-response UX and empty-hand questions remain open. Advanced native skills, extra modules and complete module acceptance stay gated. No new save/privacy/custody assurance campaign.

Related corrections: the Moritani lifetime regression now advances actual native Mentat/Storm/phase actions rather than incrementing its turn field; wording pins are removed in favor of exclusion/rejection behavior. The earlier test's manual turn change was not genuine turn-advance evidence; its separate throwaway native transition was. Reinforcements inspection now identifies its working controls and own-reserve provisional cost and links its own rules topic instead of Recruits. These corrections do not change printed card effects.

Final types/lint, build and guide/inspector12/12 pass; eighteen changed-region local links/anchors are valid. The actual new-option CLI starts BGK6YQCK v6 into native Ixian setup. Human390px 8HTTTZMA v9 asks Weirding Way, finishes the target's private show step, reads and inspects its observation, then conceals the native Mentat and resumes the opponent's posture. Fresh 6ZR8HPWD v6 shows readable Reinforcements availability, its own rules topic and the correct instruction to use a battle-card slot, not “still being implemented.” No existing game is reset or retrofitted. Owned smoke/staging drivers are removed; all managed tabs and both isolated workers are closed. Private QA inputs and the original CLI backup remain outside the checkout; the supplied PDF is preserved and untracked.

Code 589e1b9df2 is pushed. Exact CI36990728282 and job110786065439 completed/success. The original isolated storage/HTTP verification and subsequent verified-image publication steps both succeed; image ghcr.io/quintine/dune:sha-589e1b9df245cff4577f9c1d0094eca3f6db4b29. This is existing-pipeline evidence, not a new assurance campaign or deployment. Live ab5c782 remains the last observed marker.

2 October 2026 — authorized Advanced Moritani normal-reveal forfeiture

The user-authorized supplied revision, physical p35 Assassinate Leaders D, resolves the previously open duration: Moritani must not have revealed its Traitor Card normally this game. A normal own-card reveal therefore forfeits the ability for the rest of the game, across later turns and all opposing factions, regardless of that battle's result.

The persisted normalTraitorCall flag already enforced exactly that scope, so no state-machine change was needed. Owner-facing blocked text, the public reveal log and internal guidance now name the sourced forfeiture instead of an unresolved-duration guard. The change is source alignment, not a newly located GF9 erratum or a Basic ruling; exceptional leader custody and the independent private-step UX/public-preview gates are unchanged.

An exact normal-reveal case passes. A new permanent engine regression advances a genuine turn, swaps to a still-living opposing faction and stages a real later loss: the flag persists, no assassination opportunity or decision appears and the owner sees the game-long forfeiture reason. Throwaway native smoke confirmed the same real-reveal and turn-2 persistence. No database reset, new assurance campaign or preview-gate change.

Final check:quick types/lint, coherent assassination/guide38/38, build and 390px Partial / Development: Prototyped guide pass; four changed-region local links/anchors are valid. The throwaway driver is removed and the verifier worker is closed.

Code 934b2ee4d7 is pushed. Mandatory CI36986837326 and job110773684551 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-934b2ee4d7c5d41905bb339a62b64fb8824d2034. No deployment or new local assurance campaign; live ab5c782 remains the last observed marker.

2 October 2026 — independent Treachery cards with Advanced Occupy

Existing ecaz-occupy now accepts explicit fresh CLI --ecaz-treachery, independently including all three original cards:36 Ecaz-only,50 Ix,38 CHOAM, 50 both. Native original setup/owned cards are retained; no public/default start or started-game retrofit. Basic/unprofiled co-side card battles stay guarded.

Three bounded owners shared owner-labelled Harass total-dial normalization, actual native reveal/outcome integration and original-source cases. Own Ecaz Harass returns its floor count while original mandatory ceil remains fixed/free; selected ally uses typed total-minus-fixed commitment. Opponent/canceled ordinary pools stay separate. Returned reserves remain outside later losses/ explosion/FaceDance. Reinforcements preserves its existing provisional own three-reserve normal-first cost and +2 score-only policy on every revealed outcome, not a new publisher interpretation or ally reserve charge.

Exact first own-Ecaz Harass/Reinforcements cases and types/lint passed. Full-case/native natural play then exposed the mandatory-discard callback's logical-winner/physical-owner mismatch. Explicit fullyCommitted Harass facts also preserve exact selected physical losses instead of unconstrained re-enumeration. Both captured original games now complete after the fix. Independent review additionally restored the outside-profile co-side guard; native before/after reproduction proved Basic accepted before and rejects now. Current regression checks exercise both blockers; old wording/log/default pins were removed instead of re-pinned. Native counter precedence in the advisor fixture was corrected without forcing a reaction or suppressing its window.

Pure/native67, coherent affected284/284, types/lint and27 actual native program cases pass, including all four real card policy seals. Current46 ordinary/variant2..6 games complete26,619 accepted/no rejects/696JSON continuations, source unchanged, with nine actual combined lead choices. Earlier “no combined lead choice” statements were projection-reading errors: compact report.json omits counters; immutable full results.json records one in the five-game and three in the23-game checkpoint. Those reports remain unchanged; current guidance corrects the claims.

Original CLI/human390px T8T3ZYWH v12 used Ecaz Harass total5/support2: Ecaz2 returned to reserves, original fixed3 went to Tanks, Guild2 remained. WW54BZGM v12 used equal real leaders and total5/support2 Reinforcements; its +2 won, three own reserves were spent, Ecaz2/Guild2 remained and six total Ecaz counters entered Tanks. Both reached original Collection.

Final check:quick types/lint, canonical guide10/10, build and390px Partial / Development: Verified guide pass. Ten changed-region local links/ anchors and actual variant CLI help are valid. Both fresh36-card CLI starts were exercised. Owned three native/diagnostic drivers are removed; three managed human/guide tabs and both isolated workers are closed.

Final source/native scoped reviews find no defect. No new recovery/privacy/ custody/seat/getter/wholeDB/HTTP/full6,500-suite assurance campaign; direct current playability blockers were fixed. Full rules/factions/combined modes, later comprehensive review/assurance and deployment remain unfinished.

Code cd532222a5 is pushed. Mandatory CI36980970342 and job110755165940 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-cd532222a5dd098dc7a4a1d3ec6383f5bdde62b2. No deployment or new local assurance campaign; live ab5c782 remains the last observed marker.

2 October 2026 — native Ixian, Tleilaxu and CHOAM Ecaz Occupy integration

The existing Advanced ecaz-occupy profile now admits source-selected native Ixians/Tleilaxu/CHOAM with Ecaz/classic/optional Moritani2..6, distinct E3/E1/E2 decks and ordinary33/47/35 cards. Genuine original setup, offers/HMS/Auditor/ Face Dancers remain. No Richese mixed No-Field, independent E3 Treachery or optional overlays, public start or existing-game retrofit is activated.

Three bounded owners integrated actual physical Ix casualties/Suboid exchange with selected lead card cleanup, native CHOAM original support shares, and external Face Dance returning both actual winning co-side armies while retaining selected winner rewards. Same-side Tleilaxu cannot Face Dance itself. Parent human/four-policy maximum now sums actual co-side fighters without a fake merged player. Two scoped rule reviews find no defect.

First Ecaz-led funded Ix case passed. Exact FaceDance return/replacement passed but an incidental same-phase pin rejected valid automatic Collection; deleted, not re-pinned. Narrow feedback also retained real CHOAM movement decisions/ opening passes and generic RNG original-input forwarding. Native34 cases, coherent affected191/191, types/lint and19 actual native-program cases pass. The program includes accept/decline/Karama-denied Ix exchange, own/other/donor/ traitor CHOAM payments, and zero/full whole-co-side replacement.

Twenty-three unstaged classic/paired/mixed2..6 games complete with13,004 accepted actions/no rejection and339JSON continuations, sourceUnchanged:true. Exact family metadata33/47/35 matches selected decks. Full results.json records three actual combined lead choices; native programs/meaningful cases and human rooms additionally establish the exact typed/replacement boundaries.

Original CLI/human390px 5B4FW8D3 v12 let actual Ixians exchange two surviving Suboids for two lost Cyborgs after Ecaz formed the plan. Ecaz retained its Shield; Collection opened with Ecaz2/Ix4 including two Cyborgs. UVGT4DLN v10 displayed/used combined replacement maximum3, returned Ecaz1/Guild2 to their own reserves, placed three Tleilaxu forces and retained Ecaz’s original Slip Tip and bounty. Both continue original Collection.

Final types/lint (check:quick), canonical guide10/10 and build pass. The final390px guide retains Partial / Development: Verified and the exact expanded rule boundaries; six changed-region local links/anchors are valid. Owned native drivers are removed, three managed human/guide tabs and both workers are closed. Private original setups and immutable game reports remain outside Git.

No new recovery/privacy/custody/seat/getter/HTTP-suite/full6,500-suite assurance campaign. Full rules, combined modes, later comprehensive assurance, administration and deployment remain unfinished.

Code 1057eb2719 is pushed. Mandatory CI36966120859 and job110710144783 completed/success for the exact source SHA. Existing isolated storage/HTTP verification preceded publication of ghcr.io/quintine/dune:sha-1057eb271938a92a651feebeeef13738659ec8c0. This is existing-pipeline evidence, not deployed acceptance or a new local assurance campaign. Live ab5c782 remains the last observed marker.

2 October 2026 — authorized Advanced Ecaz Occupy combined-army rules

The user-authorized supplied revision, physical32/19, resolves the Advanced ceiling-half free Ecaz contribution, floor-half ordinary survivors and selected lead's own army after Karama. Basic is unchanged; specific Ecaz-only Duke/Ghola revival stays above the sheet's contrary exception. Fresh ecaz-occupy is Ecaz/classic/optional Moritani2..6 Advanced, base33/E3 faction source alone, no independent three-card variant or other overlays, public start or retrofit.

Four bounded owners supplied pure rules, native runtime, usable controls and genuine setup/CLI/study entry. Two rule-only reviewers found a whole-army storm eligibility defect and suppressed voluntary BG conversion. The exact supplied physical6/11 wording rejects component-only plans/casualties: whole armies must be clear/connected. Canonical quote membership now preserves BG's native opportunity. Native before/after storm reproduction changes an isolated ally battle offer to none while clear armies retain one. Final reviews find no defect.

Exact first E1 native case passed. Narrow feedback repaired seat-circle no-op, real arrival-decision suffix, exhaustive lead-decision registries and stable closure narrowing. A typed outcome test now checks printed-strength physical alternatives rather than incidental array order; copied plan echo assertions were removed. Named repaired cases18/18, types/lint, seven actual native-program cases and all four actual policy lead/cancellation branches pass.

Original CLI/human390px Q5Z2WH8X v22 selected Ecaz lead, minimum3/total9 with free Fremen/Fedaykin6; native battle left Ecaz2/Fremen0 and unchanged Ecaz spice5. LZHMY454 v14 used real printed Karama after Ecaz lead, recomputed minimum0/own pool3, sealed dial1/support1 and left Ecaz2/Guild4, with exactly1 Ecaz support debit. Both resumed original Collection.

Final coherent affected rule/guide 173/173 passes. The current-rule five unstaged2..6 games complete with2,123 accepted actions/no rejections and54JSON continuations, sourceUnchanged:true, ordinary33/E3 report metadata. Full results.json records one actual combined lead choice; named native cases and human rooms additionally establish the exact arithmetic and counter paths. The earlier pre-storm-fix report is preserved as different-source evidence.

Final check:quick types/lint, corrected canonical guide10/10 and build pass. The final390px guide shows Partial / Development: Verified, not full faction acceptance. Six changed-region local links/anchors are valid. Actual CLI help and both exact-version fresh starts pass. Owned temporary rule drivers are removed; four managed control/guide tabs and both isolated workers are closed.

No new recovery/privacy/custody/seat/HTTP-suite or full6,500-suite assurance campaign was added. Full rules and later comprehensive review/assurance, administration and deployed acceptance remain unfinished.

Code e112df858a is pushed. Mandatory CI36958647494 and job110687174806 completed/success for that exact SHA. Existing isolated storage/HTTP verification passed before publication of ghcr.io/quintine/dune:sha-e112df858a5a3d27992d22478c5c0d4f3dfac642. No deployment was performed; live ab5c782 remains the last observed marker.

2 October 2026 — expanded Stronghold No-Field, Stone and Face Dancer rules

The existing stronghold-factions profile now composes selected E1/E2 native families with classic2..6-seat Advanced and Stronghold Cards alone. Ordinary decks35/47, Richese cache10, native first setup/END Mentat and existing No-Field/Stone/FaceDance handlers are reused. No public-start change, other overlay or pending mixed No-Field/Stone/Poison Tooth/Ecaz ruling is inferred.

Three rule-only owners supplied native Richese and Tleilaxu paths plus paired/ mixed study/entry. Targeted16/16, types/lint and11 actual rule-program cases pass. Eighteen unstaged games complete:11,066 accepted actions/no rejection/ 290JSON restores. A stale report descriptor was corrected; actual two-seat Ixian/CHOAM, Ixian/Tleilaxu and CHOAM/Richese reports now bind47/47/35 ordinary cards and0/0/10 separate cache respectively. Different-source reports remain immutable; no historical evidence is rewritten.

Original CLI/human390px G7VDY6KB v12 chose real Stone kill mode, completed the Habbanya-winning battle and retained Stone. 736HJUD3 v8 chose two reserve forces for actual Face Dance while the original Ixian kept its winner rewards and retained Stronghold card until the end boundary. Native-program cases cover zero/partial replacement, reserve-limited0/3/5 No-Field reveal and both Stone modes. Narrow feedback repaired Once Around null-pass semantics, actual regenerated auction events and RNG typing; whole-Game nonce equality and keep-action echoes were removed, not re-pinned.

The new rules-first schedule used no new save/privacy/custody/seat/HTTP or full6,500-suite assurance campaign. Final rules/valid-combination/recovery/ privacy/custody/administration/deployed acceptance remains required later. Final coherent rule/guide26/26, types/lint (check:quick), build and expanded 390px guide pass. Changed canonical document links205/205 are valid; owned temporary rule drivers and managed tab/service are removed/closed.

Code 288870c842 was pushed. Mandatory CI36949291343 and job110658387235 completed/success for that exact SHA. Existing isolated storage/HTTP verification passed before publication of ghcr.io/quintine/dune:sha-288870c84289bb1172bd8e21dac046fbab3b5704. No deployment was performed; live ab5c782 remains the last observed marker.

2 October 2026 — rules-first development throughput and compact context

The user prioritizes full rules implementation, with comprehensive review, save/recovery, privacy and custody assurance afterward rather than per-feature gates. Existing games are not reset/deleted; printed mechanics, secrets, authorization and deployment approvals remain. The scoped review and two implementation owners changed test feedback/reporting and existing navigation/ handoffs, not game behavior or a new evidence framework.

npm run check:quick runs types/lint only. Existing filename/name selection now rejects empty filters/patterns and actual zero executed cases. Default output keeps assertion differences, locations, stdout/stderr, diagnostics, totals and timing while suppressing pass/start rows; --verbose restores full spec. Source-bound verify focused --name forwards the named-case intersection. SIGINT/SIGTERM remain failures even if the driver exits zero. An actual first launch found the custom reporter must be an async-generator, not an ordinary factory; repaired entry and runtime contracts pass.

Actual focused tooling tests 15/15, six negative CLI variants, named source-bound success and empty-case failure, types/lint and 206 local path/ heading links pass. Final scoped static review has no finding. Same15-case native rule file: concise 278 bytes/12 lines/2.35s; verbose 2,455 bytes/ 27 lines/2.36s. This reduces output, not rule computation. Named Carthag feedback 0.90s, discovery-only list 0.18s; earlier162-case union 100.22s has different coverage, so no speed factor is inferred.

Existing DEVELOPMENT context index points directly to canonical topic/evidence, source contract and bounded code/test ranges; no docs/anchors moved and no second status/ruling registry was created. Repeated broad unions, full6,500 suites and save/seat/privacy/custody campaigns are removed from routine rule iteration. Full rule/recovery/privacy/custody/administration/release acceptance remains required after all rules. Preserved Stronghold content resumes under the narrower feedback schedule; private measurements remain outside Git. Code e9830b6ced is pushed. Mandatory CI36941218637 and job110632894258 completed/success for the exact SHA; isolated storage/HTTP verification precedes publication of ghcr.io/quintine/dune:sha-e9830b6ced80c95253cfa112bb8ed2eb6e50b74c. This existing pipeline proof does not create a local assurance rerun or deployed/full-rule claim.

2 October 2026 — genuine native Ixian/CHOAM Stronghold rule integration

Fresh stronghold-factions reuses the native Advanced setup for Ixians and CHOAM plus classic2..6 seats, exact combined47-card deck and six Stronghold Cards alone. No public expansion start, existing-game retrofit or other overlay. Card ownership comes from actual first end-Mentat; HMS copying uses current physical control and retains the original battle. Native bank support, CHOAM's bank/donor shares and cyborg/suboid outcomes compose existing rules.

Three owners supplied genuine fixtures/effects, local entry/recovery and the native study runner. Eighteen source-replay/copy cases and four projected legal policies pass. Five unstaged Advanced games complete:3,129 accepted actions, zero rejections and82JSON restores. Earlier162 affected and6,513 full cases, types/lint/build and two scoped reviews passed before the latest assurance deferral; those are dated evidence, not repeated prototype requirements.

Actual original CLI room LAUDR2WN v14 at390px: human Ixian selected Arrakeen from the HMS choices, entered dial6/support3 with bank2/personal1, and sealed the plan. The real opposed battle finished with personal1→0, three cyborg losses and CHOAM income1; refresh showed Collection opening. Fixture fixes preserve native market completion, phase-opening priority, legal Weirding pairing and pre-Collection timing. Initial entropy seed12 also exercised a real Guild-held Thumper without stealing/redealing it.

Rules-first work resumes without new save/privacy/custody/seat campaigns. Ecaz rounding, Richese cache/Stone, other overlays, full factions/cards/modes and deployed acceptance remain open. Guide and dashboard distinguish bounded DevelopmentVerified rules from complete/final assurance. Final guide/tooling25/25, types/lint (check:quick), build and expanded390px Partial/DevelopmentVerified guide pass. Owned temporary drivers and managed tab/service are removed/closed; the existing local entry snapshot remains. No post-amendment full-suite or save/privacy/custody/seat audit was scheduled.

2 October 2026 — normal Spice Banker final-bank income and native Mentat collection

Three exclusive implementation owners connect the fresh banker-income classic2..6-seat Basic/Advanced base33/all14-skills-only profile. Parent integrates the small public notice/source guide, actual proof and shipping. Three is the useful slice count, not a five-agent minimum.

The photographed normal band gains1 additional bank spice when ANOTHER payer makes ONE actual bank payment of at least4, once per physical card, turn and phase. Native paid auctions (including Emperor self-purchase), ordinary/cross/return shipment, actual paid force/leader/KH/Emperor-extra revival and resolved support use their original final bank portions. Real counter-free allowances remain automatic; actual held counters retain native suspension/cancellation. Income paid to a player, free/stopped/waived sources, self-payment and smaller individual payer legs do not qualify. Distinct source/payer legs and lower Banker spending never pool into4. Original money/recipient/card/force/suffix costs finish once; deferred income does not fund its source or any pre-Mentat spending.

New grants follow the actual living available trainer and post-battle survival/posture, not hidden pre-reveal plans. A physical-card stamp cannot reset through death/return/reassignment. Already-earned currency stays with its ORIGINAL gaining faction under an explicit conservative LOCAL policy; the earlier death/capture question and universal split interpretation remain open. Real Mentat atomically marks and credits all uncollected grants once before optional actions/victory. Closed fixed-size consistency history does not depend on today's wallet/trainer/card; no arbitrary read heal or fictitious persisted half-phase8 collect choice is used. Public projection exposes only physical owner/count and current-phase use, not source invoices.

Integrated verification reproduced and repaired nonbattle trainer completion, Emperor own-auction final recipient and secret suspended-invoice projection. Genuine fixture repairs distinguish economic payer from final auction actor, native Harkonnen free2/cost2 from Emperor free1/cost4, KH revival cost2, actual skilled death/revival offers and already-held weapon custody. Native bounty/Collection quotes replace incorrect gross-wallet cost assertions. Two final independent money and recovery/privacy reviews have no finding. Types/lint, 6,487 offline tests, 140 focused Banker/profile cases and build pass. Eighteen native payment/trainer/threshold cases conserve all33 Treachery Cards/14 skills through original source and actual Mentat. All four minimal legal policies preserve available-budget actions with deferred money.

Original private-backed-up six-seat CLI rooms 6VZ8G5BY Basic v38 and 8TN8BTLT Advanced v31 retained native setup/decks/offers/identities/circles. Human390px native Emperor self-auction and Guild own-bank shipment/allow earn1 while wallets stay unchanged. Refresh retains the physical notice; actual final Collection readiness opens Mentat once (Banker10→11 and3→4). Phone evidence caught a26px player-strip notice squeeze; moving it into the main column gives354px width. Necessary isolated-worker reload preserved Basicv14/Advancedv13 continuation before further actions. All card/skill/ normal and elite force inventories are conserved;23 prior isolated QA rooms' states/versions are unchanged. Final guide10/10, types/lint/build and expanded 390px Partial/DevelopmentVerified guidance pass. All82 original saved seats across25 targeted QA rooms restore after final guide-worker reload; the two Banker rooms remain at native Mentat without double collection. Local HTTP is 49/55 with six existing upstream503 rejection failures, not green. Owned temporary drivers are removed; private inputs/backups remain outside the checkout; final frozen check after phone repair again passes all6,487. Code 6785e622a7 is pushed. CI36923901367, container job110576362446, completed/success for that exact head SHA. The mandatory isolated storage/HTTP verifier succeeds before verified-image publication: ghcr.io/quintine/dune:sha-6785e622a7bc8b850aa5e3d338c63be5a33a9403. No skipped verifier or deployment is inferred. Full skill/module, combined-mode and deployed acceptance remain open; local49/55 is still not green.

2 October 2026 — original Harkonnen Nexus traitor retirement and Mentat replacement

Four exclusive implementation owners connect fresh local harkonnen-betrayal: native personal/allied calls and original continuation, pure physical/current/ historical obligations, private controls/four minimal legal policies, and authenticated SQLite/private-backed-up CLI entry. Parent integrates source guidance and raw administrator progress, all verification and shipping. Four is this wave's useful slice count, not a restoration of the removed five-agent minimum.

The photographed printed face cancels one revealed Harkonnen traitor, returns that exact physical identity immediately and draws one replacement during Mentat Pause. The profile admits native Harkonnen plus unique classic 2..6-seat Basic/Advanced, base33 Treachery and Nexus alone. No initial Nexus deal, old-game retrofit, public start or optional/expansion overlay. Genuine alliance-qualified closing Nexus rights remain; effect fixtures need at least three seats, with four for two simultaneous unallied receivers.

Original allied Harkonnen Karama/BG counters resolve first; native denial opens no Nexus gate or cost. A personal call gains no invented counter. After genuine allowance, publicly declare the actual canonical matching traitor and roles before outcome; every publicly possible unallied non-Harkonnen held-Nexus owner acknowledges uniformly. Private face controls only own Use. The local ordering/privacy convention is provisional, not publisher/user priority or an answer to the previously asked universal reaction question. Outside-profile Harkonnen Betrayal and arbitrary combined stacks remain gated.

Use spends one physical Nexus, shuffles only that called Harkonnen traitor into the actual reserve, prevents only the original call and resumes the surviving battle once. All-pass retains both cards and original call. One successful-Use obligation survives to real current Mentat opening, where the actual reserve top is drawn privately once before optional work/victory. Final Collection readiness and Mentat opening are atomic; no fictitious persisted due-phase8 auto-recovery state is used. Nonrecursive history binds each Use even after later passing/recycling, without permanent retired-card custody or a second action/confirmation. Returned-card redraw remains legal.

Initial integrated checks exposed missing typings, an invalid Polar Sink battle fixture, unwanted optional prescience commitments, incorrect two-receiver wrong-face assumptions and a test that mutated empty counter passes to the same empty array. Parent retains native source guards: choose conserved legal sand staging/native declines, explicit distinct singleton receiver faces and genuine live original counter evidence. Native counter-free automatic allowance remains legal rather than forcing a false pause. Independent review repaired an orphanable native allowance: it now requires its exact pending or closed acknowledgement. The public declared-Traitor inspector reuses the existing entitled component; original/current replacement identities remain correctly private. Both final scoped native and privacy/ administrator reviews have no finding.

Parent typecheck/lint and 6,401/6,401 offline tests pass; the affected eight-file union passed 138/138. Final reference 10/10 and build pass. Actual program smoke exercises eight Basic/Advanced personal/allied Use/all-pass paths plus two irrelevant-face partial-pass/refresh paths, from original true call/counters through actual native battle/Collection/Mentat. Separate printed and Advanced BG Worthless preemption spend native fuel once and preserve the original Trait/Nexus stock, with no Nexus offer, cost or replacement.

Four exact-version private-backed-up CLI rooms retain their actual admitted undealt setup, identities/circles/decks and native Nexus rights; no redeal:

• SHMPQ4FK v14: Basic personal human Use; actual Lady Jessica Traitor and own Harkonnen Nexus inspectors, immediate exact retirement and one private actual reserve-top Mentat draw.
• ZAYDHGTU v15: Advanced allied human Use; caller and Guild beneficiary remain distinct, Thufir Hawat declaration prevented and replacement once.
• 3ZLRKAYB v19: Basic allied two-receiver wrong-face human Pass/all-pass; Richese/Guild cards retained. Partial v11 refresh and raw administrator projection agree on sole remaining Guild, without private source disclosure.
• GBFG2C75 v16: Advanced personal wrong-face human Pass; original Soo-Soo Sook traitor outcome and native capture/Collection suffix retained.

Original remaining native votes/cleanup/readiness continue through the real HTTP API to Mentat, not a scripted phase jump. Read-only saved proof retains all33 Treachery/all12 Nexus/Traitor identities, typed forces, original names/ circles, exact returned identity and one private pre-Mentat reserve-top draw. Activation has no spice/force/Treachery cost; legitimate battle/income effects are preserved, not hidden in an incorrect unchanged-wallet assertion. Nineteen earlier QA states/versions remain unchanged. Actual 390px public declaration/own-card inspectors and Use/Pass controls are observed; panel width is 354px. After final isolated worker reload, all 70 original seats in twenty-three QA rooms reauthenticate and all saved outcomes remain unchanged. The actual expanded guide displays Partial / Development: Verified.

Current local HTTP integration is 49/55, not green: six requests returned the known Wrangler proxy 503. No automatic write retry, authorization weakening or reset. Complete Harkonnen/Nexus games, universal reaction policy, combined modules, strategic calibration, public starts and live deployment remain open.

Code checkpoint 1cf8ff72c7 is pushed. The source-bound workflow 36890229643 and container job 110463692950 completed/succeeded for that exact SHA. Mandatory Verify isolated storage and HTTP behavior passed before Publish the verified image succeeded. The configured immutable image is ghcr.io/quintine/dune:sha-1cf8ff72c721691f1924e2f27db5936ce79dd4d2. No unobserved CI case count or deployment is inferred; local 49/55 stays not green. Protected NAS snapshot, human safe point and exact point-of-risk interactive approval remain unavailable. The last observed live marker is ab5c782; no saved-game reset or provider-approval bypass follows.

1 October 2026 — Advanced leaderless declaration before reveal

The supplied authorized Advanced PDF, physical page 11 Leaders, requires announcement before reveal when a player cannot use a leader and is not playing Cheap Hero; that plan may include no Treachery Cards. Current validation already enforced leader availability and empty card slots. Its accepted plan lacked the public announcement. Parent rejected a historical scout claim that live Homeworld combat was disconnected: the later runtime checkpoint already connects that path. No duplicate Homeworld implementation was introduced.

Advanced sealing now appends the public announcement before ordinary reveal or the original special full-plan read continuation. The public view derives only leaderless submitted player IDs from the existing sealed plans; no second saved flag or authority is created. A shared pre-reveal table notice names the declared combatant while keeping dial, support and other choices private. The original plan guard prevents duplicate submissions and announcements. Basic behavior remains unchanged by this Advanced-source cutover. Existing legal bots, Voice, Prescience, full-plan inspections, combat and casualty continuations are retained.

The meaningful privacy regression fails before the implementation with missing public announcement after an actual legal seal; it passes afterward, retaining opponent/observer masking, JSON refresh, read immutability, duplicate rejection and original reveal. Parent types/lint and 6,316/6,316 offline cases pass; the selected ninety-file union is 1,025/1,025. Final reference 10/10 and build pass.

Actual native normal Advanced-preview start/setup plus a conserved staged battle with previously used living leaders exercises legal rejection, one pre-reveal declaration, JSON normalization, duplicate rejection and canonical thirty-three card/typed-force conservation. The stage is not a claimed natural full game. Fresh exact-version private-backed-up room 3Y5U53RW starts through the real HTTP preview action, keeps its actual setup/dealt cards/identities, then exercises 390px human Emperor leaderless sealing and the opponent's refresh. The other plan stays private until human Atreides sealing; original Traitor declines advance to Collection v9 once. Read-only saved proof confirms one chronicle announcement before reveal, all cards/typed forces, unchanged identities and the original single native Arrakeen income, not a fictitious unchanged setup wallet. The ready phone notice is 354px wide within a 390px page. The actual guide explains this timing; all 57 original seats in nineteen QA rooms reauthenticate. No reset, public-mode change or deployment is performed.

Code checkpoint 44d90bb9ae is pushed. Exact workflow 36862512991 and container job 110369907670 completed/succeeded for that exact SHA. Mandatory isolated storage/HTTP verification passed before verified image publication. Immutable tag: ghcr.io/quintine/dune:sha-44d90bb9aea4032fb8ffda51daa64cc53d11d7f8. Publication is not deployment and supplies no unobserved CI case count.

Existing genuine faction-games CLI continuation, seed 20261001 and a 3500-action bound, reports all ten classic Basic/Advanced 2..6-seat games complete with unchanged source and custody/JSON checks. The combined Homeworld/Nexus four-sample run completes six-seat Advanced and five-seat Basic; six-seat Basic and five-seat Advanced stop at turn-six CHOAM Charity. Captured actions reject on the existing unresolved low-Tupile opening-income guard, without mutation; automatic normalization preserves the same pending source. The supplied PDF's physical pages 8/22 do not resolve that recorded modifier question. The guard remains; no fallback, automatic cancellation, fabricated payout or reset is introduced. These native samples establish their actual continuation only, not complete factions/modules or strategic AI.

1 October 2026 — Ixian Nexus Betrayal at original native attempts

Fresh local ixian-betrayal integrates native Ixian Bidding inspection/draw in Basic/Advanced and Advanced Technology exchange before the native effect. It admits unique 2..6 seats with native Ixians and otherwise classic/Tleilaxu, the physical Ix47 Treachery Deck and Nexus alone. Natural alliance-qualified Nexus draw remains required; no initial deal, old-save retrofit or public start is enabled. Richese/special lots and wider modules remain excluded.

Actual native printed/BG Karama counters resolve first. Native denial spends no Nexus and opens no new gate. After all native passes, every publicly possible unallied non-Ixian held-Nexus owner gets a face-neutral acknowledgement. Privately eligible Use spends the actual singleton Ixian Nexus and prevents only this attempt; all-pass allows the original native transition once. Exact source/context/canonical stock/history checks reject stale, foreign, orphaned or changed committed parents without mutation. Nonrecursive history retains bounded serialization and later physical card recycling. Bots consume only canonical private Use/Pass projections; strategy remains uncalibrated.

Independent review repaired original BG Worthless-Karama response ownership, retained native Harkonnen hand-exchange suspension, and restored the existing Technology fizzle when a legal pre-offer exchange removes the declared card. The spent native attempt stays used; no swap, Nexus spend or fabricated gate follows. Already-open Nexus source corruption still rejects. Administrator progress now uses only public unfinished acknowledgements, matching the player table instead of the original ordinary bidder; independent autopilot controls remain available during reactive gates. Both final scoped reviews report no findings.

Parent verification: types/lint and 6,315/6,315 offline tests pass; the affected nine-file union is 167/167. Final reference 10/10 and build pass. Actual scripts exercise eight Basic/Advanced allow/prevent/partial-pass scenarios plus both genuine BG Worthless counter interruptions; public administrator ownership goes from two responders to the actual sole remainder. Four exact-version private-backed-up CLI rooms continue their actual undealt setup without redealing, then declare/respond through the real HTTP API:

• MVLVQHVB v11: Basic Bidding human Use spends Nexus, draws only the normal allocation and resumes the original auction without private Ix inspection.
• T2XSABT4 v11: Advanced Technology human Use retains the selected hand card and unseen lot, keeps the attempt spent and resumes original inspection.
• QBVHGDD5 v13: wrong-face Bidding Pass retains Nexus, then human Ix returns Shield from the genuine extra-card inspection and declines Technology.
• 7NKT45P7 v14: two wrong-face receivers Pass; partial refresh preserves the first acknowledgement and exposes only the sole public remaining owner. All-pass performs the original physical Technology swap once.

Actual 390px controls/own inspector/refresh/native suffix and final expanded Partial / Development: Verified guide are observed. Read-only saved proof retains all forty-seven Treachery/twelve Nexus cards, unchanged spice/force cost, exact native suffix/history and fourteen earlier QA games. After the necessary final isolated worker reload, all 55 original seats in eighteen rooms reauthenticate and all saved outcomes remain unchanged.

Current HTTP integration is 52/55, not green: three admin/discussion requests returned the known Wrangler proxy 503. No unsafe write retry, authorization change, game reset or deployment workaround is introduced. Complete Ixian/Nexus games, wider modules, public starts, strategic calibration and live acceptance remain open. The user removed the five-agent minimum: future waves choose useful agent count for speed and integration cost.

Code checkpoint cdfe0e5370 is pushed. The source-bound workflow and container job 110357305474 both completed/succeeded for that exact SHA. Mandatory Verify isolated storage and HTTP behavior passed before Publish the verified image succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-cdfe0e5370d6fd9f6844f064bafd8198ce897252. No unobserved CI test count or deployed acceptance is inferred. This publication is not a NAS deployment; protected snapshot, human safe point and exact point-of-risk interactive approval remain unavailable.

1 October 2026 — exact Ixian Nexus purchased-card replacement

Five implementation lanes integrated runtime, pure source/custody/history, actual controls/four minimal legal bots, authenticated SQLite/CLI entry and existing source guidance. Fresh ixian-replacement admits unique classic 2..6-seat Basic/Advanced with base Treachery/Nexus alone; no public start, existing-game retrofit or wider-module activation. Normal paid and actual printed Karama purchases, including direct zero-bid free acquisition, are connected. Harkonnen buyers and Richese/special origins remain guarded by their material priority/source questions. Native Ixian allied replacement remains a separate ability, not an alias or a Nexus Karama response.

The typed source binds the exact canonical purchased physical ID, original normal lot/payment and independently progressed cursor before Nexus cost or draw. A publicly possible unallied held-Nexus buyer receives a uniform neutral choice, regardless of private face. Only that buyer receives its owned purchase and canonical eligibility; rivals get no face, private price, deck, receipt or blocked reason. Use spends one physical Ixian Nexus, discards that purchase first, draws the actual deck top and continues the native sale once; Keep retains both cards. No refund, extra fee or re-auction. Full hands and recycled same-card draw remain legal. Own-seat control is independent of the pending gameplay lock.

Initial fixture failures assumed a Nexus draw without an alliance. Native publisher semantics were preserved: no initial deal or automatic empty-hand draw, and a qualifying closing phase requires a settled alliance. Genuine nonrecipient allies now open the draw. Original rosters are selected before creation, not added to an admitted game: effect scenarios need three seats, or four for simultaneous unallied recipients. The initializer still admits two-seat base continuation without inventing an unreachable Secret Ally. CLI-produced undealt native setup continues without reinitializing/redealing.

Independent review found recursive history and an enabled-but-dropped Take back control action. Actual nine-Pass reproduction grew to 7,030,825 bytes; bounded nonrecursive event/outcome/replacement head links now use 134,145, with a permanent linear-history/corruption regression. Actual 390-pixel before-fix Take back control sent no POST and retained Easy; after-fix it sends one 200, restores the same seat controller and retains the same paid event. Both final source/persistence/privacy rereviews are clean. Exhaustive decision dispatch/shape consumers are migrated, and incidental attribute-order/attempted-SQL-write pins are removed rather than re-pinned.

Counterfeit depleted tests inflated the allocated row. Those were replaced with a captured native six-seat seed-11 turn-five payment source reached by real auctions, legal Battle Plans and winner discards: seventeen held cards, twelve discards, four reserved lots, empty draw deck, exactly all 33 cards. Actual payment plus controlled native shuffle proves original-card redraw and existing-discard draw while keeping unsold lots and force stock intact. The permanent JSON fixture is synthetic QA source, not human game data.

Final broad check passes types, lint and 6,227 offline cases. The six-file selected union passes 73/73; final reference check 10/10 and build pass. Fourteen actual standalone native Basic/Advanced paid/free Use/Keep, wrong-face, full-hand and two legal depletion outcomes preserve original ledger, Treachery/forces/elites, Nexus cost, JSON and repeat rejection. Authenticated SQLite covers original payment through restart, Pass/Use CAS, foreign/revoked credentials, private-face parity, source/cursor corruption, zero durable rejection and later physical recycling.

Actual ready rooms GTCHEGKU, JUXLJXHC and HJ5Q64T5 entered once by exact-version CLI with private consistent backups, then continued the same native setup/IDs/circles before real API payment and phone choices. Basic paid Use changes buyer 10->8 and Emperor 10->12 exactly once; Advanced printed free Use keeps buyer 12 and skips purchase income; irrelevant-face Keep retains its original physical purchase and Richese Nexus, with no Use or Ixian inspector. Inspection, native income and refresh work. Read-only saved proof conserves original native Treachery/Nexus/force/elite inventories and eleven prior QA rooms. All 42 original seats in fourteen rooms authenticate after required isolated build reloads. Actual expanded internal guidance retains Partial / Development Verified boundaries.

Local built-worker HTTP is 51/55, four known POST 503s, not green. No unsafe retries, authorization weakening, database reset or deployed acceptance is inferred. Broader Ixian/Nexus effects, special origins, Harkonnen priority, combined games, strategy and public/live gates remain open.

Code a2b04dbfba13eeb913c93de87981a58cb6b7d99d is pushed. Workflow 36829040552 and container job 110261177048 report completed/success for that exact source. Mandatory isolated storage/full HTTP verification and subsequent verified-image publication steps both succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-a2b04dbfba13eeb913c93de87981a58cb6b7d99d. This is source-bound publication, not live deployment or invented CI counts.

1 October 2026 — authorized Advanced Storm and allied separation defaults

Five implementation lanes connected the user-supplied revised Advanced source's physical pages 6, 15 and 40 without a source-fork profile or reset. Every newly opened post-first Advanced Storm draws one of the six canonical faces, even without Fremen. First-turn wheels, Basic's protocol and an already recorded current opening remain unchanged; native Fremen alone keeps cancellable private foresight. Public inspection retains the original card face when Weather Control changes actual movement.

A focused canonical policy now quotes the ending player's own shared territories in Advanced without the later-ally/formation-turn grace period. BG advisors are exempt in both directions; native Ecaz and Polar Sink coexistence remain. Basic retains its earlier deadline and formation policy. Native ordinary/deferred endings keep force, elite and concealed No-Field custody, with preflight before parking a retiring Ornithopter. The own clean-turn warning exposes public names only, not counts or source receipts, and adds no forced-loss confirmation. It is a block-layout semantic output; all existing pending controls retain priority.

Independent frozen rules/storage reviews have no finding. Full verification initially found 40 consumers assuming missing original Storm frames or superseded Advanced timing/dial protocols. Four repair lanes retained counter/SQL/privacy/custody coverage, migrated native phase progression and removed an incidental HTML-role pin. Genuine ordinary overlaps use paid Emperor/Atreides Basin groups in opposite sectors separated by first Storm 10, then a natural Nexus alliance; no allied-entry guard was weakened. A permanent captured real 8a562991 Advanced dial save is genuinely Advanced, not a Basic-flag flip, and preserves its original continuation.

npm run check passes types, lint and 6,169 offline cases; the selected 17-file union passes 339/339, and production build passes. Standalone runtime covers seven Advanced loss/exception scenarios, Basic new-alliance preservation and prior recorded dials followed by a new no-Fremen Deck opening. Authenticated SQLite covers first/next Storm, private foresight, restore, concurrency, owned losses, Hajr, exceptions, corrupt sources and durable rejected-action immutability.

Actual admitted previews CA6FVKVD, PTSMVMDY and U5335T2L were privately backed up before exact-version native preparation, retaining the same room, rules, circles, IDs and credentials. Phone-sized human first/later ending sends only Emperor's two physical forces, including one elite, to Tanks, leaves its ally intact and survives refresh. No-Fremen turn-two inspection shows the drawn five-sector face; human confirmation moves Storm from one to six and refresh retains Spice Blow. The final warning is a 354-pixel block within a 390-pixel viewport. Actual expanded guidance exposes the contract and Partial verification boundary. Read-only saved proof conserves original native setup inventory and cards; eight prior Guild rooms are unchanged. All 33 original authenticated seats in those eleven QA rooms restore after required isolated build reloads.

Local HTTP is 51/55, four known Wrangler-proxy POST 503s, not green. No POST retry/auth weakening or database reset was added. The user-owned 44-page PDF remains local/unpublished, including its retained 2.2 editorial heading versus 2.3 filename/metadata. Broader source differences, full modes, strategic AI, public gates and final-revision live acceptance remain open.

Code e1056a4db0a546400fd9a4461507f93ae6ca57d2 is pushed. Workflow 36814701820 and container job 110217121688 report completed/success for that exact source. The mandatory isolated storage/full HTTP verifier and subsequent verified-image publication steps both succeeded. The configured immutable tag is ghcr.io/quintine/dune:sha-e1056a4db0a546400fd9a4461507f93ae6ca57d2. No unpublished CI counts/timings or live deployment are inferred.

1 October 2026 — full funded Guild Nexus Betrayal payment

Five implementation lanes integrated engine, pure funding/custody/history, actual controls and four minimal legal bots, authenticated SQLite recovery and source guidance. Fresh exact-version/private-backup guild-betrayal entry supports classic 2..6-seat Basic/Advanced with native Guild, base decks and Nexus, optionally genuine lobby-enabled Homeworlds; no retrofit/public gate.

Typed reserve, native Guild transport, Homeworld and Junction adapters pause before the original fee/force commit. Actual eligible singleton Guild Nexus spends once; the same payer/authorized escrow funds the full original amount and the holder replaces bank/Guild/occupied-Junction income. Own payment requires existing funds before the later refund; it is not free financing. All-pass leaves native routing unchanged, while free/stopped transport creates no award or Nexus spend. Public possible held-card presence controls neutral acknowledgements, not secret identity; event-only private Use adds no otherwise private price/source or inspector entitlement.

Independent review found an accepted Advanced Richese Secret Ally parent whose resumed shipment failed. Actual reproduction proved spent Nexus and undelivered source; its unsupported offer now blocks before card/parent commitment. A shared native Guild/reciprocal-ally grant is independently revalidated on declaration, restore and commit, separate from purchased rates and protected returns. Both final scoped re-reviews have no finding. Fixture current quotes/native turn progression preserve actual storm rules; real SQLite total_changes excludes durable rejection writes while permitting credential-fenced zero-row CAS. Same-source private-face swaps and existing physical-card allocation repair randomized fixture assumptions.

Final npm run check: types, lint and 6,114 offline tests pass; production build passes. Selected related checks pass 147/147 in nine files. Eighteen standalone Basic/Advanced paid/free cases prove full fee, upfront own refund, donor escrow once, exact native forces and JSON repeat rejection. Authenticated SQL covers all adapters, self-re-signed revoked native grants, corrupt/orphan receipts, privacy, races and later recycling.

Eight actual ready QA rooms were privately backed up and entered once by CLI, retaining the same authenticated seats and admitted code/roster/setup. Real setup/native phases and source declarations preceded 390-pixel controls: Basic own refund, occupied low-Junction whole fee, Guild return and all-pass; Advanced Homeworld bank fee, donor escrow, native Junction and free Fremen. Non-holder Pass has no private Guild inspector/Use. Own inspector, actual contextual guide link and refresh pass. Read-only database proof matches all eight original native force suffixes, exact spice/escrow/card ledger and closed receipt. No existing human games or credentials were reset.

The user supplied the root unofficial Advanced 2.3 PDF as a source of truth. Its 44-page metadata says 2.3 while the rendered editorial heading still says 2.2; exact SHA/physical-page authority and material future Advanced reconciliation targets are recorded in RULE_DECISIONS/DEVELOPMENT and local goal guidance. Relevant Guild/payment/Homeworld/Nexus clauses were compared; this does not certify that all Advanced differences are implemented. The user-owned local PDF is preserved, not republished as an app asset.

Local built-worker HTTP is 48/55, five POST 503s and two timeouts: known Wrangler-dev limitation, not green acceptance. Code 8a56299155d0f12c8c4678bfbe5913be71fea5bb is pushed, and workflow 36798718410 reports completed/success for that exact source. Its mandatory isolated storage/full HTTP verifier precedes publication of ghcr.io/quintine/dune:sha-8a56299155d0f12c8c4678bfbe5913be71fea5bb. Live deployment is separate. Full Guild/Nexus/Homeworld, wider combinations, AI calibration and public/live release remain open.

1 October 2026 — source-aware CHOAM Nexus Cunning Kull

Five implementation lanes connected runtime, canonical fuel/receipt policy, real source/fuel controls and legal bots, authenticated SQLite recovery and internal source guidance. The safe fresh nexus-kull CLI admits native CHOAM plus classic 2..6-seat Basic/Advanced rosters with CHOAM/Ix Treachery and Nexus alone; it supplies no physical Sandtrout or new public/retrofit gate.

Use now requires source/event/card and private plays replaces old cards. Nexus declaration spends actual CHOAM Nexus once; canonical retained fuel is reserved until success. Distinct prevention keeps fuel but not Nexus and resumes the original once. Success discards fuel, retains the original and special once-use, and stamps the actor's activation ban. BG original interception remains before conversion; decline spends neither source cost.

Independent reviews found and repaired canonical self-authorization, native Nexus response discoverability through Kull parents, reserved parent fuel advertised as a nested counter, and loss of CHOAM winning-payment coverage. A retained Karama's canceled Cunning effect is not ordinary payment ineligibility. Verified old printed counter saves receive a bounded immutable source-binding migration; malformed signatures and new Nexus missing-selection frames still reject. There is no source-omitting action shim. Fresh setup's Ix Treachery requirement no longer accidentally admits Sandtrout.

Final npm run check: types, lint and 6,022 offline tests pass. npm run build passes. Engine/production authenticated SQLite cases include native Atreides, Sardaukar, advisor and Guild parents, BG overlays, actual auction payment, races, no-write corrupt/orphan rejection and later recycled custody. The existing Fremen remote-Cunning pre-offer scope guard remains; native special summon and its unsupported remote offer boundary are exercised. Both final scoped independent re-reviews report no remaining finding.

Four actual CLI entries continued owned ready QA rooms from version 5 to setup 6. Genuine setup/Storm/Spice completed before conserved pre-action resources were arranged. Standalone runtime and 390-pixel controls prove Basic/Advanced weapon fuel success and distinct prevention. Actual selectors and separate fuel/Nexus inspectors pass; rivals see no private fuel inspector. Success retains Karama/BG Baliset and bans activation; prevention retains fuel, spends Nexus and resumes original shipment/conversion. Refresh/direct saved-state proof retains full physical inventory, exact source history and unchanged spice. No existing human games, seats or credentials were reset/modified.

Current local built-worker HTTP is 49/55: four POST 503s and two timeouts retain the Wrangler-dev limitation, not green local acceptance. Code 0d9d0a72d63b29d93161857cee2d1a2cd6acd7e3 is pushed, and workflow 36770260638 reports completed/success for that exact revision. The mandatory isolated container verifier runs full HTTP/storage checks before publishing ghcr.io/quintine/dune:sha-0d9d0a72d63b29d93161857cee2d1a2cd6acd7e3. Live NAS, wider modules, full CHOAM/Nexus games and calibrated AI remain open; publication is not deployment and no public gate changes.

30 September 2026 — bounded Richese Nexus Betrayal auction integration

Five implementation lanes delivered pure source/invoice/custody policy, typed prepayment engine continuation, human controls and minimal legal bots, authenticated SQLite recovery, and source-bound internal guidance. Fresh richese-betrayal entry supports Basic/Advanced paired CHOAM/Richese plus classic seats, the physical CHOAM deck and Nexus alone.

A public cache auction won by native Richese may be vetoed before payment: the exact intended card enters ordinary discard, nobody pays or acquires, and the original lot retires once. Another buyer's positive cache or concealed Black Market sale keeps the original price, authorized escrow split, physical delivery and earned Harkonnen bonus; only its recipient changes from Richese to bank. All-pass keeps the Nexus and settles the unchanged original purchase. Public held-Nexus presence determines neutral acknowledgement membership; actual identity affects only own private Use. Independent pending/completed cursor history binds saved source ownership and rejects orphaned frames before disclosure or SQL writes.

Independent review found and repaired donor escrow double-counting and a Harkonnen bonus path that skipped exhausted-cache preflight. Regressions cover a seller funding its buyer with zero unpledged spice and rejection of an unfinishable closing bid before any receipt, payment or delivery. Existing wording/incidental assertions were removed rather than re-pinned.

Verification: npm run check passes types, lint and 5,953 offline tests; npm run build passes. Eight focused files pass 80 cases, including both alternatives/all-pass, private timing parity, actual table controls, four legal bot profiles, JSON/production SQLite restart, competing Use/Pass, no-write rejections and later recyclable physical custody. Final independent economy and persistence re-reviews found no remaining scoped defect.

Actual prototype CLI started four owned disposable rooms from version 5 to setup 6. Genuine setup/bids created typed opportunities; a separate runtime smoke proves Basic/Advanced veto and cache/Black Market diversion. At 390 pixels, real controls prove Basic veto, Advanced all-pass, Basic cache diversion and refreshed Advanced Black Market diversion without an unknown-face inspector. Saved outcomes retain the original completed event, exact card custody and buyer/seller balances. No human games or seats were reset or modified.

Current built-worker local HTTP is 51/55, with three POST 503s and one Advanced-preview timeout; it is not green acceptance. Code checkpoint 9c0000e469935d9f0fae1605358d5e6a2617be56 is pushed, and workflow 36720704874 reports completed/success for that exact source. The checked-in workflow requires tools/verify-container.mjs, including the full proxy-free HTTP suite, before publishing ghcr.io/quintine/dune:sha-9c0000e469935d9f0fae1605358d5e6a2617be56. GitHub's job step array retained stale pending/in-progress entries despite its final success metadata; no individual step timings or test totals are asserted from that array. Full Richese games, hidden normal-deck self-buys, private special-Karama veto, broader modules and live NAS acceptance remain open; image publication is not deployment and no public gate changes.

30 September 2026 — opt-in printed Kull Wahad integration

Five implementation lanes supplied validated activation frames, phase/physical-counter policy, mounted human controls and legal bot participation, authenticated SQLite regressions and source-bound internal guidance. The kull local profile starts only a fresh ready Basic/Advanced CHOAM-plus-classic roster with CHOAM/Ix physical cards, without public expansion starts or optional modules.

A legal ordinary or prepared special attempt pauses before its cost. Every seat sees neutral CHOAM timing regardless of held Kull. The interrupted card stays held and reserved; Kull may be prevented only by another eligible physical card. BG interception precedes conversion. Decline or prevention resumes the original typed effect once. Successful Kull discards its native cost, retains the original, leaves a prevented special unspent and applies a turn/phase activation ban, not an ownership/transfer ban. Native denied Kull remains held but its physical effect is blocked for that phase.

The user deferred unpayable winning-overbid recovery. The preview privately refuses non-CHOAM unfunded bids before commitment, as well as affected activations before cost. The former late guard accepted a bid that the preview could not settle; a targeted smoke reproduced that boundary before the early-fence repair. Numeric UI bounds and non-preview bidding are unchanged; no free award, funding or auction restart is invented. Unproven live-promise cancellation/counter suffixes likewise reject before cost. Pending-frame reconciliation cannot release a suspended promise; Auditor traversal now includes the saved parent; orphaned Kull declarations fail before private views or partial SQL writes.

Focused rules/control/bot/SQLite regressions include real Voice and Auditor parents, distinct/BG counters, orphan rejection, promise-compatible costs, legal progress and profile safeguards. npm run check passed types, lint and 5,907 offline tests; the production build passed. Independent re-reviews of the repaired rules/privacy/persistence paths found no scoped defect. Direct Kull and local-profile CLI smoke passed.

In isolated phone-width Basic/Advanced browser rooms, the actual reactor used Kull, Basic's other seat allowed it, and the original card and phase ban persisted across refresh with no rate-control shortcut. Advanced BG's held original could not counter Kull; its distinct printed card prevented Kull and resumed the original BG conversion. Another cancellation was then declined through the refreshed CHOAM offer and retired the same saved parent once. Kull stayed held, BG's already converted card remained discarded, and no shipment rate or ban was fabricated.

Isolated Wrangler-dev HTTP passed 49/55: five proxy-layer 503s and one 15-second timeout. This is not a green local HTTP suite; proxy-free workflow 36706704939 passed the full isolated HTTP suite for aeae152 and published its image. Nexus Cunning Kull, combined modules and full CHOAM completion remain unfinished. No NAS deployment is claimed.

30 September 2026 — user-approved full-hand Semuta exchange

The user selected atomic acquisition/disposal at the faction hand limit. Engine commitment and private controls now allow a full hand; the claimed card replaces Semuta without increasing the completed hand. Already overfull hands still reject, and the pure exchange quote preserves incoming reservations. The obsolete caller-selectable free-slot policy was removed. Normal and Harkonnen capacity boundaries, physical conservation, private projection, JSON continuation and authenticated full-hand Trip recovery have focused regressions.

The same conversation approved Kull's distinct-card counter and pre-conversion BG interception, while deferring an unpayable winning-overbid remedy. These rulings are recorded in the decision index and source update; Kull runtime is not yet implemented by this capacity checkpoint.

npm run check passed types, lint and 5,854 offline tests; the production build passed. Independent review found no scoped defect. Direct engine smoke kept four cards before and after claiming Hajr. In an isolated authenticated phone-width QA room, the real full-hand seat showed enabled Commit, exchanged Semuta for Hajr and retained 4/4 after refresh. The throwaway staging script was removed. Isolated Wrangler-dev HTTP passed 49/55: five proxy 503s and one timeout. This local HTTP run is not green; proxy-free workflow 36684960601 passed the full isolated HTTP suite for 3285172 and published its image. No live NAS deployment is claimed.

30 September 2026 — Semuta after accepted CHOAM Jubba Cloak cost

In the explicit Richese preview, CHOAM's printed moving-storm Jubba Cloak now discards its named public Worthless card before a neutral Semuta reaction. No territory is protected and no storm casualties or spice clearing occurs before claim or all-seat decline. The saved receipt binds the selected territory, storm traversal, phase, CHOAM force custody and physical card. Claim or decline applies one protection then resumes the existing storm suffix once, including ordinary casualties and the next CHOAM market. A canceled card, Nexus conversion or competing parent retains its previous direct path.

Focused engine checks cover hidden-holder parity, JSON normalization, forged territory/storm/force/card rejection, physical custody, legal AI, one claim or decline and exact casualties/spice movement. Authenticated in-memory SQLite verifies seat views, restart, stale retry and storm completion. Direct engine smoke observed pre-protection card custody, one claim, CHOAM survival and the opponent's three losses in one traversed storm. Full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,853 offline tests; the production build passed. Independent rule review found no scoped defect. The built phone-width guide visibly described Jubba's before-protection offer. Isolated Wrangler-dev HTTP passed 50/55: four requests returned its proxy-layer 503 and one discussion request timed out. This is not a green local HTTP suite. Proxy-free workflow 36676105785 passed the full isolated HTTP suite for 98d556a and published its image. No live NAS deployment is claimed.

30 September 2026 — Semuta after proactive ordinary Trip cost

In the explicit Richese preview, an accepted ordinary Trip to Gamont Worthless response now discards its named public card before the selected opponent force leaves its board sector. Every seat sees the same neutral Semuta offer regardless of the private holder. A claim can take that physical card, and either claim or all-seat decline then returns exactly one ordinary force to reserves. The saved receipt binds target and location, original target force/elite/reserve custody, owner hand and suspended parent state. No second Karama response or duplicate force return occurs. Elite and No-Field returns, closing Mentat decisions, Nexus conversion and competing parents retain the existing direct path.

Focused engine checks cover hidden-holder parity, pre-return timing, JSON normalization, corrupted target/location and force custody rejection, single claim or decline, legal AI, physical cards and subsequent Mentat continuation. Authenticated in-memory SQLite verifies seat views, restart, stale retry, card custody and one actual force return. The full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,851 offline tests. After the in-app guide update, typecheck, lint and 18 focused reference/Semuta cases passed; the production build passed. Independent rule review found no scoped defect. A direct engine smoke observed the accepted public discard, pre-return custody, exact physical claim and single ordinary force return. The built phone-width rules guide visibly named Baliset and ordinary Trip before their effects. Isolated Wrangler-dev HTTP passed 50/55: four requests returned its proxy-layer 503 and one Advanced-preview request timed out. This is not a green local HTTP suite. Proxy-free workflow 36674543364 passed the full isolated HTTP suite for 953be21 and published its image. No NAS deployment or complete expansion claim follows.

30 September 2026 — Semuta after proactive CHOAM Baliset cost

In the explicit Richese preview, an accepted proactive Baliset response now discards the named public Worthless card before a neutral Semuta offer. The chosen player's movement restriction into the occupied CHOAM territory is installed only after claim or all-seat decline; shipment remains possible. The saved receipt binds target, territory, owner forces and hand, existing restrictions, phase and public card cost. It cannot replay the Karama response, restrict twice or remove the original mover's forces. Declared-move responses, Nexus conversion and competing arrival parents retain the prior automatic path.

Engine tests cover hidden-holder parity, pre-restriction timing, card/target/territory and occupancy custody, JSON normalization, one saved block after claim or decline, rejection without mutation, physical card conservation and legal AI claim. Authenticated in-memory SQLite checks cover seat projections, restart, exact stale retry, preserved seat rows and rejected restricted movement. A direct engine smoke observed a public offer, one physical claim and a turn-scoped restriction. Full Semuta and expansion gates remain open.

npm run check passed types, lint and 5,849 offline tests, including 23 Baliset and 13 Semuta recovery cases. The production build passed; independent review had no scoped finding. Isolated built-worker HTTP passed 49/55: four Wrangler-dev proxy 503s and two 15-second timeouts. This does not certify local HTTP. Proxy-free workflow 36673190056 passed the full HTTP suite for 756af19 and published its image. No NAS deployment is claimed.

30 September 2026 — Semuta after proactive CHOAM La La La cost

In the explicit Richese preview, a clean proactive La La La Worthless response now discards its public physical card before a neutral Semuta offer. The selected target's remaining free force revival is blocked only after a claim or all-seat decline. A claimant may take the spent card; the block still applies once without a second response or card cost. Paid revival remains legal. The saved receipt binds the target, original Revival rules, owner/card custody and current phase. Reactive pending-revival requests, Nexus conversion and other Worthless effects remain outside this bounded reaction.

Focused engine checks cover hidden Semuta-holder parity, pre-block timing, target and Revival-rule corruption rejection, physical custody, legal AI claim, decline and paid revival. Authenticated SQLite checks cover restart, exact stale retry, seat/private-view continuity and a later paid revival. A direct engine smoke observed the accepted public cost, one claim and target block. Expansion and full Semuta gates remain open.

npm run check passed types, lint and 5,847 offline tests; the production build and phone-width guide inspection passed. Independent review found no scoped defect. An isolated authenticated browser seat displayed neutral Continue and held-only Commit, took the physical La La La, showed zero free revivals and a two-spice paid quote, and preserved that state after refresh. Direct Wrangler-dev HTTP passed 50/55 with four 503s and one timeout; proxy-free workflow 36671450678 passed isolated storage and the full HTTP suite for b130cff, then published its image. No live NAS deployment or production gameplay check is claimed.

30 September 2026 — Semuta after clean CHOAM Kulon cost

In the explicit Richese preview, a clean accepted Kulon Worthless response now discards its public physical card and opens the same neutral Semuta opportunity before adding CHOAM's turn-scoped movement range. A claimant takes that exact card; all-seat decline leaves it in the pile. Both paths add one range once and return the still-active mover to the same movement turn. The saved receipt binds the spent card, owner, prior bonus, hand and movement state. Reactive movement, fixed Ornithopter range, Nexus and other Worthless effects remain outside this bounded reaction.

Focused engine checks cover hidden-holder parity, pre-bonus blocking, legal AI claim, physical custody, forged receipt rejection, claim/decline and the resulting legal longer move. Authenticated SQLite checks retain the offer and exact bonus through restart, preserve seats/private views and reject stale replay. A direct engine smoke exercised the accepted card cost, one claim and resumed mover. Public expansion and complete Semuta acceptance remain gated.

npm run check passed types, lint and 5,845 offline tests; the production build and phone-width guide inspection passed. A targeted phase-five smoke after genuine Richese/CHOAM/BG setup also restored the active mover and one range bonus after a claim. Independent review found no scoped defect. Direct Wrangler-dev HTTP passed 48/55: six tests saw HTTP 503 and one 15-second Advanced-lobby timeout. The proxy-free container/full HTTP gate for this revision and live NAS acceptance are still open.

30 September 2026 — Semuta after completed CHOAM card sale

In the explicit Richese preview, a clean CHOAM market sale now pays its printed two- or three-spice income and discards the one publicly named physical card before a neutral Semuta offer. A canceled or invalid sale leaves its card in hand and creates no fresh batch. Claim or all-seat decline resumes the same CHOAM market choice without repeating income or disposal. The saved receipt binds owner, exact card, duplicate witness if used, earned balance and the open market. Concurrent market obligations and other sale families retain their earlier automatic paths.

Focused engine checks cover hidden Semuta-holder parity in outsider views, a quoted Worthless sale, income once, exact card custody, rejected altered receipts, legal AI claim and resumed market choice. Authenticated SQLite checks cover restart, stale retry, preserved seats and the next market decision. A direct engine smoke exercised the committed income, one claim and same market return. The public expansion and complete Semuta gates remain closed.

npm run check passed types, lint and 5,843 offline tests; the production build passed. The phone-width built-worker guide showed the sold-card timing. Independent review found no scoped defect. The direct Wrangler-dev HTTP suite passed 50/55: four origin/ validation requests returned 503 instead of expected 403/400, and one Advanced-lobby request timed out after 15 seconds. The proxy-free container workflow 36668822954 passed its isolated storage checks and full HTTP integration suite, then published the 4c07e1b image. This is not a live NAS deployment or production acceptance; no production game was touched.

30 September 2026 — Semuta before private Ixian ally replacement

The explicit Richese preview with the Ix expansion now interrupts a clean normal-auction Ixian ally card replacement at its original private discard, before the replacement draw. The buyer paid for the lot and accepted the alliance; every seat sees the same neutral Semuta offer without its card face or a named claimant. A committed holder can take the exact fresh card; claim or all-seat decline then draws one replacement for the buyer and finishes the saved sale/Richese cache continuation. The original buyer is the discarder, not the Ixians. Cache and Black Market sales, nested interactions and other private discard producers remain guarded.

An engine scenario through genuine three-seat setup checked hidden Semuta-holder parity in both outsider views, unspent deck order, physical custody, one replacement and legal AI claim. An authenticated SQLite scenario checked restart, owner-only controls, stale retry and the owed Richese cache choice. A separate direct engine smoke exercised a paid lot, one private reaction and the replacement. Normal expansion starts and full Semuta acceptance remain gated.

npm run check passed types, lint and 5,839 offline tests, and the production build passed. A phone-width browser view of the built worker showed the private-discard timing in the rules guide. Independent review found no scoped defect. The isolated built-worker HTTP suite passed 49/55; five origin/validation or ordinary-success requests returned 503 and one Advanced-lobby request timed out at 15 seconds. Full HTTP acceptance remains open. This code was not deployed to the NAS and no production game was modified.

30 September 2026 — Semuta after printed Karama winning-bid payment

The explicit Richese preview now stages a second normal-auction Karama discard when the winning bidder chooses its printed card instead of a spice payment. The bid and bidder are already fixed; the card enters the public pile before the same neutral Semuta offer. Claim or all-seat decline settles the reserved lot once, without charging bid spice, and preserves the following Richese cache offer. The saved receipt binds the bid winner, round, cache, deck and hand custody. Richese lots, Worthless conversion and nested responses stay outside this bounded reaction.

Engine and authenticated SQLite tests cover the winning decision, full bid above available spice, legal AI claim, JSON/restart continuation, forged bidder/round rejection, exact stale retry, physical card custody and the following cache choice. A direct engine smoke settled the printed card, lot and cache sequence. Public expansion starts and complete Semuta coverage remain gated.

npm run check passed types, lint and 5,837 offline tests; the production build passed. A phone-width browser view of the rules guide visibly included the winning-bid timing. Independent review found no scoped defect. The prior purchase checkpoint passed its container workflow's isolated storage/HTTP check and published an image; it is not deployed to the NAS. On this paid-payment build, a focused built-worker HTTP Advanced-lobby test timed out at its 15-second request limit; a separate direct QA-room create/join and two authenticated seat reads returned 201/200/200/200 with distinct seat identities. The prior full local HTTP suite passed 51/55; four origin/malformed-request cases returned 503 instead of 403/400. Full HTTP acceptance remains open. No production game was touched.

30 September 2026 — Semuta after printed Karama normal-auction purchase

The explicit Richese development preview now offers a neutral Semuta response after a clean printed Karama pays its public normal-auction purchase cost but before the reserved lot settles. A committed holder may exchange one physical Semuta for that newly spent card; all-seat decline leaves it in the discard. Both paths settle the original free purchase once, with the lot, round, cache, deck and hand custody bound to the saved receipt. A pending Richese cache offer after the normal auction remains owed. Richese lots, paid Karama bids, Worthless conversion, shipping and nested responses retain their automatic paths. Normal expansion starts remain gated.

Engine and authenticated SQLite tests cover the neutral offer, legal AI claim, reserved lot, spent-card custody, JSON/restart continuation, Richese cache suffix, stale exact retry and rejected altered receipts. An isolated engine smoke completed the purchase after the Semuta claim, placing the lot once, exchanging the printed card and closing Bidding. The wider Semuta discard inventory and deployed acceptance remain open.

npm run check passed types, lint and 5,835 offline tests; the production build passed. The isolated built Wrangler worker rendered the revised Semuta guide on a phone-width browser. Its HTTP integration suite passed 51/55 cases, including normal lobby and saved-seat flows; four existing origin and malformed-request cases received HTTP 503 instead of their expected 403/400. Those failures are not attributed to this purchase path, and the HTTP gate is not green. A separate standard Vite server startup timed out before it could host a rerun. No production image or game database was changed.

30 September 2026 — Owner-only manual integrity check

Administration → Operations now has a separate Run integrity check control. An owner-only request batches live owner authority with SQLite quick_check(1) and a bounded foreign-key existence query; the response contains only pass/fail and sample time. It exposes no database diagnostic, table, row, game state or credential and makes no repair. Refresh/owner changes clear stale browser results. A failed check advises a protected snapshot and private investigation, not automatic restore.

Focused in-memory SQLite tests verified healthy structure, an actual orphaned foreign key, unchanged seats and live-role demotion. Both query forms succeeded separately in a disposable Wrangler D1 store; an isolated programmatic Miniflare batch timed out, so it did not prove the combined workerd path. Local HTTP tests covered anonymous denial; the owner UI was visually exercised on phone width with explicitly mocked owner responses, not a real authenticated network integrity request. Independent rules/security reviews found no scoped defect. npm run check passed typecheck, lint and 5,833 offline tests; npm run build and 55 local HTTP tests passed. No production database scan or deployed revision was exercised. Disk capacity, backup restore safety, stalled-decision diagnosis and complete administration remain unfinished.

Follow-up isolated built-worker verification used a disposable migrated D1 database and provisioned owner: authenticated GET /api/admin/operations?integrity=1 returned only time and two pass flags (both passed). After inserting one orphaned test seat while the worker was stopped, the same endpoint returned sqlite: passed, foreignKeys: failed and no row details. The actual owner Operations page displayed both outcomes at phone width, including the protected-snapshot/no-auto-repair warning. The earlier programmatic Miniflare batch timeout remains an initial test limitation; this later workerd run proves the HTTP path locally, not the live NAS database or deployed revision.

30 September 2026 — Semuta after BG Charity Karama

In the explicit Richese preview, a clean printed Karama cancellation of Bene Gesserit Charity now pauses after its public card cost but before that extra charity response settles. A neutral all-seat Semuta offer can transfer only the used Karama to a different holder. Claim or decline restores the original response and finishes its cancellation once: BG's declared charity remains spent without granting spice or undoing CHOAM's earlier income. The new karamaBgCharityDiscard receipt binds the BG charity turn, saved response and physical card/spice custody. Previously saved CHOAM Charity and Inflation receipts retain their distinct kinds and signatures; Worthless conversion and other Karama uses remain automatic.

Focused claim/decline and authenticated SQLite restart/CAS checked owner-only projection, exact card transfer, unchanged balances and saved-seat parity. A direct production-engine smoke run observed the same outcome. Two independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,831 offline tests; npm run build and 55 local HTTP tests passed. The phone-width local guide rendered the new scope. No deployed revision was exercised. e9f9994 passed isolated container verification and image publication in workflow 36659099415; the live footer was separately observed at ab5c782, not this new source.

30 September 2026 — Semuta after printed CHOAM Inflation Karama

The explicit Richese preview now also pauses after printed Karama publicly discards to cancel a clean CHOAM Inflation response. CHOAM's placement attempt has already been spent; the token is not placed until the response settles. A neutral Semuta offer permits a different holder to claim only the used card, or all seats to decline. The saved Inflation receipt binds the attempt turn, absent token, original response and physical card/spice custody. Completion restores and cancels the response once; no Inflation token appears or same-turn attempt reopens. CHOAM Charity retains its existing distinct serialized receipt and signature so a saved pending Charity offer remains readable; a new Inflation receipt has its own kind.

Focused Charity/Inflation paths, authenticated SQLite restart/CAS and owner-only projections passed. A direct production-engine smoke run observed the neutral offer and recovered card without an Inflation token. Independent rules/privacy review found and resolved a saved Charity receipt compatibility regression; follow-up source review found no remaining mismatch. npm run check passed typecheck, lint and 5,829 offline tests; npm run build and 55 local HTTP tests passed. The phone-width local reference rendered Inflation scope. No deployed revision was exercised. Other Karama uses, pending rewards, normal Richese starts and publication acceptance remain gated. Container workflow 36657454120 for the previous d9c67ca checkpoint verified isolated storage/HTTP and published that image; the failed 32d9ef4 image was not published.

30 September 2026 — Semuta after printed CHOAM Charity Karama

In the explicit Richese preview, a clean printed Karama cancellation of CHOAM Charity now pauses after the public activating card reaches the discard but before canceled income settles. Every seat receives the same neutral offer; a different Semuta holder can claim the spent Karama, or all seats may decline. The receipt binds the exact suspended response, spent card and spice/hand custody. Completion retires it, restores that response and cancels CHOAM income once. Prior-turn charity receipts remain valid; no current-turn cancellation is accepted twice. Worthless conversion, other Karama uses and nested responses retain their automatic paths.

Authenticated SQLite restart/CAS, owner-only projection, corrupted receipt rejection, first- and later-turn cancellation and one-card custody were exercised. A direct production-engine smoke run observed the parent response, neutral offer and one cancellation with zero CHOAM income. Two independent read-only reviews found the prior-turn receipt and test type-narrowing defects; both were corrected. npm run check passed typecheck, lint and 5,827 offline tests; npm run build and 55 local HTTP tests passed. The phone-width reference rendered the new scope. No deployed revision was exercised. The previous 32d9ef4 container workflow built but failed its isolated storage/HTTP step; public logs expose only exit code 1, not the underlying assertion. Docker, Podman and authenticated GitHub logs were unavailable locally. Do not treat that image as published.

30 September 2026 — Semuta after clean Residual Poison

In the explicit Richese preview, Residual Poison now pauses after one random opposing leader is sent to the Tanks and its used public card is discarded, before battle inspection reconciliation and shared readiness resume. A neutral offer appears only for an uninspected, unready pre-leader battle without competing rewards or responses. Claim moves that physical card to another holder; all-seat decline leaves it in the pile. The saved receipt binds battle event, victim, leaders, hand/force custody and unsealed preparation. Neither choice rerolls the victim or repeats death. Accepted plays in inspected or partly ready battles retain the existing automatic path.

An authenticated SQLite room restored the offer and a private holder claim without replaying death; focused JSON/custody and automatic fallback tests passed. A direct production-engine smoke run observed offer, one dead leader, a recovered card and unready preparation after claim. Independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,824 offline tests; npm run build and 55 development HTTP tests passed. The phone-width local reference rendered the clean Residual Poison note. No deployed revision was exercised. Inspected/partly ready pauses, other discard producers, full-hand timing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after between-battles Sapho

The explicit Richese preview now pauses after Juice of Sapho commits a clean between-battles chooser reorder and publicly discards its physical card. The next battle has not been selected. All seats see the same neutral offer; claim transfers only that used card, and all-seat decline leaves it discarded. The saved receipt binds the chooser use/event, last battle, unselected board, hands and force geometry. Its completion restores the current chooser without replaying the reorder or opening another battle.

Genuine CHOAM/Richese setup, first/last chooser order, claim/decline, owner-only projection, JSON normalization and authenticated SQLite restart/room CAS were exercised. A direct production-engine smoke run observed the offer, single card transfer and next battle chosen by the preserved actor. Two independent read-only rules/privacy reviews found no scoped defect. npm run check passed typecheck, lint and 5,821 offline tests; npm run build and all 55 local HTTP tests passed. The local phone-width reference rendered the updated Semuta guidance. No deployed revision was exercised. Competing responses, other discard producers, full-hand sequencing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after Once Around Sapho

The explicit Richese preview now pauses after a clean Once Around Juice of Sapho public discard and finite bidder reorder, before the lot's settlement suffix. Previously acted bids and funding remain committed; discarding Sapho can admit its formerly full-hand holder to the still-open lot. Every seat sees the neutral offer, and only an eligible held Semuta owner can claim the used card. Claim or all-seat decline resumes the same saved lot and active bidder once. The receipt binds the auction event, bidding round, order, funding, hands and spice. A Black Market Semuta reserved as the offered lot remains in its seller's hand: the neutral offer persists, but the owner's Commit is disabled and an attempted commit rejects before any card moves.

Genuine auction setup, both first/last and full-hand paths, private projection, JSON corruption checks and authenticated SQLite restart were exercised. A direct production-engine smoke run observed offer, active reordered bidder and one recovered physical Sapho. The independent read-only rules/privacy reviews found two defects: Black Market reservation and unbound bidding-round state; both were corrected with focused regressions. npm run check passed typecheck, lint and 5,819 offline tests; npm run build and all 55 local HTTP tests passed. The phone-width local reference rendered the Once Around guide. No deployed revision was exercised. Remaining battle-choice Sapho, competing parents, full-hand take-before-discard and public Richese starts remain gated.

30 September 2026 — Semuta after pre-plan Sapho aggressor

The explicit Richese preview now stages a clean pre-plan Juice of Sapho discard after its public card and single aggressor/tie-priority choice commit, before either combatant closes shared preparation. Every seat sees the same neutral offer; a different held Semuta owner may recover exactly that card or all seats may decline. The saved receipt binds the battle event, Sapho event, committed priority, unsealed readiness, hands and force custody. A resolved response retires the frame without replaying the aggressor choice or battle; both combatants can still declare ready and choose plans.

Genuine faction setup, owner-only projection, saved JSON, authenticated SQLite room CAS/restart and legal AI claim/pass were exercised. A direct production-engine smoke run observed offer, an unsealed battle and one recovered card with unchanged priority. Focused tests passed; npm run check passed typecheck, lint and 5,816 offline tests; npm run build passed; all 55 development HTTP tests passed. The phone-width local rules page rendered the pre-plan guidance. Two independent read-only rules/privacy reviews found no scoped defect. No deployed revision was exercised. Once Around and remaining battle-choice Sapho, competing parents, full-hand sequencing, normal Richese starts and publication acceptance remain gated.

30 September 2026 — Semuta after Ix-deck Amal

In the explicit Richese preview with the physical Ix deck, playing Amal at a clean phase opening now publicly discards its one held card, halves every faction's available personal spice and resets earlier opening passes before a neutral all-seat Semuta offer. A different holder with hand space may claim only that used Amal and discard Semuta; all-seat decline leaves Amal in the ordinary pile. The exact phase-opening window then resumes once. No auction card draw, Bidding prelude or other opening effect runs ahead, and the same spice is not halved again.

Genuine Ix-deck setup covers prior-pass reset, odd/even spice, owner-only legal AI claim, all-seat decline, physical card census, JSON continuation and later Richese Bidding prelude. An isolated migrated SQLite room restores the paused reaction, commits an authenticated Amal claim and completes the opening without changing saved seats or double-paying. Independent rules/continuation and privacy/recovery reviews found no scoped defect. Nested opening interactions, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

A direct production-engine run completed genuine Ix-deck setup, halved 11/9/7 personal spice to 5/4/3, showed a neutral offer, let the legal bot recover used Amal and restored cleared opening passes. Three real ready actions then opened Richese's Bidding prelude without another halving. The phone-width rules deep link rendered the boundary as Partial. npm run check passed typecheck, lint and 5,814/5,814 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after Ix-deck Thumper

The explicit Richese Semuta development profile now permits a fresh CHOAM & Richese game with the physical Ix deck. Only that deck supplies canonical Thumper. Playing it at a clean Spice Blow opening places its public card on the discard pile, then pauses before the injected worm or next actual spice-card draw. Every seat sees the same neutral offer; another holder may take the used Thumper and discard Semuta, or all seats may decline. Both choices run one saved blowSpice suffix: the prior territory is devoured once, the next land card is drawn once, and phase/Nexus consequences retain the existing rules. CHOAM-only Semuta games have no Thumper to offer; public expansion starts remain closed.

Genuine Ix-deck setup exercises owner-only legal AI claim, all-seat decline, pre-draw deck invariance, one force/spice casualty outcome and physical census across JSON. An isolated migrated SQLite room preserves the undrawn state through automatic recovery and commits one authenticated claim while retaining seat rows. Nested opening responses, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent privacy/recovery review found no scoped defect. Rules review found the initial saved Thumper receipt omitted Advanced mode, elite/No-Field custody, Ix expansion selection and the additional-worm cancellation turn. Failing-before/passing-after regressions now bind those inputs; follow-up rules review found no remaining scoped defect. A direct production-engine run completed genuine Ix-deck setup, undrawn neutral offer and bot claim, then one worm casualty and one spice draw. No original play was modified.

The actual phone-width rules page rendered the Ix-deck Thumper boundary and Partial checklist. npm run check passed typecheck, lint and 5,813/5,813 offline cases after the receipt corrections; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta at first mandatory battle discard

The explicit Richese Semuta preview now pauses a clean public battleResolved discard batch after its combat result and physical used-card disposal but before casualty choices or winner cleanup. A normal battle's used loser defense is one fresh card; a mutual Traitor battle can produce one simultaneous pair owned by both combatants. Every seat sees the same neutral offer. The holder may commit and recover only a card discarded by another player; two eligible cards require owner-only inspection and exact one-card selection. Other cards remain on the pile. The result, losses and later mandatory/optional winner batches continue once, separately.

Genuine setup exercises a normal battle's loser defense, all-seat decline into winner choice, and a two-owner mutual-Traitor batch with committed selection and physical census. An isolated migrated SQLite room recovers both the initial and owner-committed mixed batch without auto-advancing; authenticated selection changes one card without rewriting seats or doubling casualties. Pending battle rewards, other discard producers, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules review found no scoped issue. Privacy/recovery review found that the initial battleResolved metadata did not bind the exact original card/owner pair, permitting a malformed saved batch to reassign a former owner or substitute an old discarded card. Failing-before/passing-after cases now bind the original mandatory entries in the resolved battle receipt and reject both corruptions before projection or claim; frames predating that receipt continue automatically rather than inventing an offer.

Follow-up privacy/recovery review found no remaining scoped defect. A direct production-engine run resolved a mutual-Traitor battle, opened one two-owner public batch, committed Semuta, selected one opponent card and left the other physically discarded without a winner. Phone-width rules showed the three separate battle stages. npm run check passed typecheck, lint and 5,811/5,811 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta between mandatory and optional winner cleanup

The explicit Richese Semuta preview now pauses a clean public winnerMandatoryDiscard frame after the loser/battle discard but before optional winning-card cleanup. A physically used Hero is already in the ordinary pile; every seat receives the same neutral offer. Another holder with free hand capacity may recover that one Hero and discard Semuta. All-seat decline leaves it on the pile. The committed casualty counts and winner remain fixed; finishWinner continues once to the still-held optional weapon decision. Its later discard is a distinct fresh batch, not another chance at the Hero.

Genuine setup covers two combatants, preparation, Hero plus retained projectile, the mandatory Hero offer, neutral passes, legal AI claim, JSON continuation and exact physical census. An isolated migrated SQLite room restores that offer, authenticates the Hero claim, then opens and declines the later optional weapon batch without repeating Semuta disposal or battle rewards. Loser/mixed-owner mandatory cleanup, pending battle rewards, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules/continuation and privacy/recovery reviews found no scoped defect. A direct production-engine run completed genuine AI setup, a mandatory Hero discard, neutral offer and bot claim, then showed the retained projectile in the original winner's optional card decision. Phone-width local rules rendered the two-batch boundary as Partial. npm run check passed typecheck, lint and 5,810/5,810 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta choice among simultaneous winner cards

The explicit Richese Semuta preview now recognizes a clean batch of two or more publicly revealed played cards selected by a battle winner for discard. The battle result and earlier mandatory cleanup are committed; all seats receive the same neutral offer. Only the actual Semuta holder with free hand space can commit, and only after that commit does their private view reveal the fresh candidate list. They must select exactly one. The other cards remain in the discard, Semuta is disposed once, and the resolved battle continues once. All-seat decline leaves the full batch in place.

Genuine setup covers both a single winner card and simultaneous projectile/Shield selections, owner-only candidates after commitment, legal AI choice, explicit alternative human choice, stale foreign selection rejection, exact physical census and resource equivalence. An isolated migrated SQLite room restores the offer and later the committed selection without automatic progress, checks rival candidate privacy and authenticates the exact one-card choice. Other multi-card producers, mandatory/reward-pending battle frames, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rules and privacy/recovery reviews found no scoped defect. A direct production-engine run committed the two-card batch, showed only the owner both candidates and selected Shield while the other played weapon remained discarded. Phone-width local table fixtures showed two owned Inspect/Claim cards and a rival's candidate-free waiting state; the stale hand-help text was updated. npm run check passed typecheck, lint and 5,809/5,809 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after one winner-selected battle card

The explicit Richese Semuta preview now pauses a clean single public winner-selected battle-card discard after the battle result and mandatory cleanup are committed. The played card is physically on the ordinary discard pile; every seat sees the same neutral event. An eligible holder may recover exactly that card and discard Semuta; all-seat decline leaves it in place. Neither path re-resolves battle, re-awards casualties or bounty, nor lets an old card be claimed. The existing battleCleanup frame retires before finishBattle continues the phase once.

Genuine setup exercises a real two-combatant plan and traitor call, mandatory loser-card retirement, optional winner discard, legal AI claim, all-seat decline, physical card census and JSON views. An isolated migrated SQLite room restores the pending reaction without auto-advancing, authenticates the claim and preserves seat rows. Multi-card winner selection, Moritani loser retention and pending battle rewards remain automatic without Semuta; full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A direct production-engine run completed genuine AI setup, battle preparation and plans, a public winner discard, neutral offer and bot claim without replaying the recorded winner. Phone-width rules rendered the battle boundary as Partial. A recovery assertion that searched the entire observer view for an earlier public card ID was too strict; it now checks that the current recipient hand is not projected. npm run check passed typecheck, lint and 5,809/5,809 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after a clean completed Ornithopter flight

The explicit Richese Semuta preview now pauses a completed range-three or second-group Ornithopter as its one public used card leaves escrow. The pilot's exact forces have already arrived and its move counter has advanced; the neutral all-seat event precedes the saved arrival log and territory-entry suffix. A legal holder can claim only that retired card and discard Semuta. All-seat decline leaves the card on the pile. Either choice resumes the one arrival without placing another force or consuming another move.

The bounded roster excludes Bene Gesserit intrusion and Ecaz/Moritani entry reactions, alongside other competing parent transactions. Genuine setup covers a final flight, exact card/force census, JSON restoration, owner-only legal AI claim, all-seat decline and stale action rejection. An isolated migrated SQLite room restores the paused arrival without automatic advancement, commits an authenticated claim and preserves seat rows. The excluded arrival compositions, multi-card batches, full-hand sequencing, normal Richese starts and deployed acceptance remain open.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A throwaway production-engine run completed genuine AI setup, a final flight, neutral offer and bot claim; one moved force remained at its destination, one move was consumed and the active pilot retained control after arrival. Phone-width rules rendered the clean arrival boundary as Partial. npm run check passed typecheck, lint and 5,808/5,808 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after clean movement-order Sapho

The explicit Richese Semuta preview now pauses after Juice of Sapho physically discards its public card and commits a clean first/last reorder of remaining combined shipment and movement turns. Every seat sees the same neutral event before the active turn changes. A legal holder can claim only the used Sapho and discard Semuta; all-seat decline leaves Sapho in the ordinary pile. Both paths resume the already committed order once, retaining protected last and prior Guild timing without restarting any completed turn.

Genuine setup covers first reordering, last protection, all-seat decline, one physical claim, exact card census and JSON views. A corrupted saved queue, newly spent movement, changed Basic/Advanced profile or altered faction roster rejects before claim; an isolated migrated SQLite room restores the paused reorder and commits an authenticated claim with unchanged seat rows. Independent rules review found the initially missing timing-profile binding; the failing-before/passing-after regression now covers both Advanced mode and Guild identity. Auction and battle Sapho, competing parents, full-hand ordering, normal Richese starts and deployed acceptance remain outside scope.

Follow-up rules and independent privacy reviews found no remaining scoped defect. A throwaway production-engine run completed genuine AI setup, Sapho first reorder, neutral Semuta offer and bot claim; the saved turn advanced to the reordered actor exactly once. The phone-width rules guide rendered the bounded Sapho path as Partial. An initial npm run check failed one expansion-roster CLI resume while source edits were concurrent; the focused case passed after source stabilized. The stable rerun passed typecheck, lint and 5,807/5,807 offline cases; npm run build and all 55 Vite development HTTP cases passed after the timing-profile fix. No deployed revision was exercised.

30 September 2026 — Semuta after a final definite Truthtrance answer

The explicit Richese Semuta preview now pauses the public card discard after a clean final definite Truthtrance answer. The asker has spent the actual held card, the respondent's answer is already recorded, and the public history is bound before the neutral all-seat offer. Another holder with hand space may take only that freshly consumed card and discard Semuta; all-seat decline retains the original pile. Neither path re-answers, duplicates a promise, restarts a question, or changes the recorded fact.

Genuine setup and an isolated migrated SQLite room exercise a real declaration, priority passes, privately answerable spice/hand fact, definite answer, persisted reaction and authenticated claim after restart. JSON projections, custody, public answer history, legal AI, owner-only commitment, all-seat decline and saved seat rows remain stable. Setup-era facts, queued follow-ups, promise-bound questions, competing parent transactions, other discard producers and full-hand ordering remain outside this bounded preview.

Independent rules/continuation and privacy/recovery reviews found no scoped defect. A throwaway production-engine run completed genuine AI setup, declaration, definite hand answer, neutral reaction and bot claim with one fixed public history entry. The phone-width guide rendered this boundary as Partial. npm run check passed typecheck, lint and 5,805/5,805 offline cases; npm run build and all 55 Vite development HTTP cases passed. No deployed revision was exercised.

30 September 2026 — Semuta after a completed private Distrans transfer

An explicitly opted-in Richese preview now pauses after a clean Distrans action physically gives one privately selected card to its recipient and publicly discards the used Distrans. Every seat sees the same neutral fresh-discard event, not the transferred card. A legal holder may recover only the public used Distrans, discarding Semuta; all-seat decline leaves Distrans in the ordinary pile. The recipient keeps its transferred card on either path. Existing pending gifts, bid or response contexts remain outside this bounded reaction; ordinary transfers retain their previous completion.

Genuine setup and isolated migrated SQLite room cases cover physical custody, owner-only commit and legal AI participation, all-seat decline, private recipient card projection, saved restart without auto-advance, exact authenticated claim and unchanged seat rows. Incomplete producer families, full-hand ordering, normal Richese starts and deployed acceptance remain gated.

Independent privacy review found no scoped leak. Rules review found that a duplicated transferred card in removed Richese custody escaped the initial saved receipt check; a failing-before/passing-after regression now requires the recipient's card to be unique across all physical non-discard zones. Follow-up review found no remaining scoped defect. A throwaway direct engine run completed genuine AI setup, private transfer, neutral offer and bot claim; the nonrecipient view omitted the given card and the recipient retained it. The phone-width rules guide visibly marks this path Partial. npm run check passed typecheck, lint and 5,804/5,804 offline cases after the custody fix; npm run build and all 55 Vite development HTTP cases passed. No production deployment was verified.

30 September 2026 — Semuta after an early-ended Ornithopter flight

The explicit Richese Semuta preview now interrupts the one public Ornithopter discarded when its pilot ends movement before using every available flight group. The first group has already moved its exact forces and consumed one move; the card then leaves escrow exactly once. Every seat sees the same neutral event before the saved movement queue advances. Another holder with hand space can claim that retired physical card and discard Semuta; all-seat decline leaves it on the pile. Both paths advance the original turn once without moving forces again.

Genuine setup exercises a completed first group, early retirement, JSON restoration, owner-only commitment by the legal AI, all-seat decline, exact force/card census and stale-action rejection. An isolated migrated SQLite room recovers the paused flight without auto-advancing, projects only the owner's Commit control and commits the claim through authenticated room CAS, preserving seat rows. Completed flights with arrival/intrusion follow-up, competing suspended transactions, multiple fresh cards and unresolved full-hand ordering remain gated. This is not a complete Semuta or deployed Richese path.

Independent rule/continuation and privacy/recovery reviews found no scoped defect. A throwaway direct production-engine run completed genuine AI setup, moved one group, showed a neutral offer with owner-only Commit, recovered the played card and advanced to the next seat with one move and one arrived force. A phone-width local rules page rendered the new boundary and Partial checklist. npm run check passed typecheck, lint and 5,803/5,803 offline cases; npm run build and 55/55 Vite development HTTP cases passed. No production deployment was verified.

30 September 2026 — Semuta after a completed paid Box search

The explicit Richese Semuta preview now opens the same neutral all-seat response when a clean paid Nullentropy Box search finishes and places its used physical Box on the discard pile. The search owner has already paid two spice, privately recovered its chosen card and shuffled the remaining pile once. Another holder may commit Semuta and take only the freshly discarded Box; declining preserves the Box on top. Neither path re-pays, reselects, reshuffles or reopens the search. Older discard cards and the privately recovered card are not fresh targets.

Genuine-setup engine cases verify both claim and all-pass paths, exact card census and discard order, every-seat JSON restoration and stable two-spice payment. An isolated migrated SQLite room restores the Box reaction after the paid selection, leaves automatic recovery idle until a real choice and commits the claim through authenticated seat control without changing saved seat rows. Independent privacy and continuation reviews found no scoped issue. This extends the previous phone-width neutral control surface; no new browser POST was sent. Auction/CHOAM-market overlaps, multiple fresh cards, other producer families and full-hand ordering remain gated. This is not a complete Semuta, Richese or deployed claim.

npm run check passes typecheck, lint and 5,802/5,802 offline cases; npm run build and the 55/55 local development HTTP cases pass. The phone-width rules deep link shows the updated Box target boundary and partial checklist. No authenticated production Box/Semuta play or deployed revision was exercised.

30 September 2026 — neutral Semuta clean-discard prototype

The bounded runtime uses an explicit fresh Richese development profile. A real Hajr discard after genuine setup opens an identical public event for all seats; only the actual holder sees Commit, no one inspects a fresh face before commitment, and the sole eligible other-player card transfers automatically with Semuta's physical disposal. All-seat passes preserve the card and effect. Free hand space is a conservative, provisional guard. Other discard producers and full-hand sequencing remain unfinished; normal Richese/public starts remain closed.

Focused engine cases preserve exact custody through JSON, hide possession under an equal-card-count private swap, reject stale/forged actions and corrupt saved reactions, and complete each original effect once. An isolated production room module with migrated SQLite restored the same owner-private offer and committed one of two competing Semuta requests under room CAS; the fixture's seat rows remained intact. The actual start-prototype.ts --profile semuta CLI started a fresh disposable ready lobby with its seat preserved. Mobile browser GET fixtures showed the owned Commit button and rival Continue-only panel at the same event; no browser POST or real local room was mutated.

Independent privacy review found no scoped leak. Rules review identified and prompted fixes for a deleted-reaction auto-retire, duplicate Semuta custody, a suspended CHOAM sale crossing the clean gate, and a forged all-passed deadlock. Deleted-reaction, duplicate-card and all-passed corruption each have failing-before/passing-after regressions; the CHOAM sale exclusion was source-reviewed without a direct fixture. A final read-only review found no remaining scoped issue. Focused Semuta/ordinary-continuation and room-start tests pass; full-game and deployed acceptance do not follow from this bounded preview.

An unstaged six-seat Basic Richese preview at RNG seed 20260930 completed 916 accepted actions, zero rejected candidates, 24 JSON view restores and six neutral passes at one ordinary-card discard. No natural Semuta acquisition/commitment occurred in that game; the focused genuine-setup and production-D1 fixtures cover the committed claim. npm run check passes typecheck, lint and 5,801/5,801 offline cases; npm run build and all 55/55 local development HTTP tests pass. These results and one complete sampled game do not certify the remaining card sources, full Richese mode or deployment.

30 September 2026 — owner key rotation and safe re-enable

The account panel now rotates another enabled or disabled administrator’s personal access key with one exact tab-scoped request. A disabled target becomes enabled only with the new key; all old sessions are revoked and historical hashes prevent A→B→A key reuse. The owner reviews name, ID, role, enabled state, reason and revocation impact; one-time key disclosure remains confined to the confirmed tab. Additive migration 0020 preserves previous account receipts and games. Live SQL owner/version/key checks, one durable rotation receipt and actor-attributed safe audit prevent stale or duplicate changes.

Independent persistence review found no scoped issue. Security review identified an exact historical replay that could show a superseded key as currently usable. The client now compares its receipt with the last-read account metadata, warns when changed/unlisted, and advises sign-in verification even when matching. The focused security follow-up found no remaining issue in those changed lines. A phone-width authenticated local page showed exact pre-send confirmation; a completed-record fixture showed the superseded warning without sending a mutation. The isolated built-worker network smoke provisioned, rotated, replayed, disabled and re-enabled a disposable target, rejected old keys and sessions, refused key reuse and preserved safe audit and origin denial. No live account or saved game was modified.

npm run check passes typecheck, lint and 5,787/5,787 offline cases; npm run build, drizzle-kit check and all 55/55 development-server HTTP cases pass. A second full HTTP run against the local production bundle did not pass: workerd intermittently returned 503 mid-request under the suite. Draining oversized admin bodies removed an early unread-stream return; isolated built requests returned 413 and later requests remained healthy, but the full bundle load issue remains unresolved. None of this proves a deployed revision, complete administration or production recovery.

29 September 2026 — natural Advanced Moritani reveal and replacement

A source-unchanged genuine six-seat sample at base seed 20261307 completed 1,666 accepted actions, no rejected candidates and 45 JSON continuations. The Easy Moritani bot declined one turn-six opportunity, then revealed its held emperor-1 Traitor Card against a different Emperor leader on a later normal battle loss. The target was already dead, so bounty was zero. At accepted action 987 the card remained physically held; automatic Mentat replacement at action 995 moved it face up out of hand and privately drew fremen-4. A separate replay JSON-restored all six projected views at both custody transitions. The runner verified physical inventory after every accepted action through final turn ten.

The bounded feature record links the source-bound private report. This demonstrates a natural dead-target reveal, not a living-target kill, all optional modules, publication readiness or deployed acceptance.

29 September 2026 — worm-ride arrival candidate correction

A natural six-seat Moritani Advanced sample at base seed 20261007 completed 1,541 actions with two rejected Fremen worm rides into a placed Terror while a BG intrusion would open. Both were rejected without mutating the game. The owner-view preflight now quotes that public worm destination and excludes the unsupported combined reaction before the bot selects an action. A focused engine regression reproduced the rejection first and covers four legal AI fallbacks. The same genuine game finishes 1,541 accepted attempts, zero rejects and 41 JSON continuations. Two assassination opportunities were declined; no natural reveal/replacement was proved. The authoritative reaction-order gap and public expansion gate remain.

npm run check passes typecheck, lint and 5,782/5,782 offline cases. No app route or persistence schema changed; build and HTTP checks were not repeated for this bot candidate filter.

29 September 2026 — Guild transport arrival preflight

The arrival preflight now filters single-source Guild cross-planet transport candidates before they enter a publicly unsupported Terror/Guild-income reaction combination. A six-seat Advanced Moritani game at base seed 20260930 first completed 1,262 accepted actions, six rejected Guild candidates and 34 JSON continuations. Same-seed replay after the fix completed 1,262 accepted actions, no rejected candidates and 34 JSON continuations. Two real assassination offers were declined; neither sample shows a natural reveal.

A focused engine test reproduced the illegal action before the fix, then covered all four bot filters and accepted Guild-funded transport with no income response. No card face, hidden rival data or unsupported arrival ordering enters the quote. Existing expansion start and publication gates stay closed.

npm run check passes typecheck, lint and 5,781/5,781 offline cases. No app route or persisted database changed; the production build and HTTP suite were not repeated for this bot-only correction.

29 September 2026 — owner account management prototype

The account page lists only safe metadata to a live owner. Provisioning uses a tab-scoped, browser-generated 256-bit key and an exact durable operation receipt; only its SHA-256 hash enters the database. Owners can change another account’s role or disable it after reviewing the name, ID, current/desired role and reason. Database writes repeat live owner authority and target-version checks, retain the final-owner trigger, and attribute the single successful provision/role/disable audit event. Disabled sessions fail immediately; room and seat rows remain untouched. Rotation, re-enable, failed-attempt audit and complete administration remain pending.

An isolated direct D1 smoke provisioned a disposable account, changed its role, disabled it, confirmed its old key/session fail and verified safe owner-attributed history without a raw key. An isolated Request/Response route-handler smoke confirmed owner provision, exact replay, directory read and foreign-origin denial without contacting a persistent database. Focused account/access/audit regressions include an additive migration preserving existing room, seat, credential and audit bytes. The local browser showed signed-out denial at phone width; intercepted owner fixtures displayed exact owner-role disable confirmation, retained a one-time key after refresh and hid directory/key controls after a focus-triggered demotion. Browser fixture POSTs never reached an account database. Authenticated positive network HTTP and live NAS acceptance remain untested.

Independent security review found and corrected unchanged-role audit no-ops and incomplete final disable confirmation. A separate persistence review reproduced a logout-all timestamp rollback; the account version is now monotonic and a stale disable rejects. Both follow-up read-only reviews reported no remaining scoped finding. The first focused HTTP run found a test assuming JSON for Vite’s foreign-origin 403; the corrected boundary test passes 3/3, and the full local HTTP suite passes 55/55.

npm run check passes typecheck, lint and 5,780/5,780 offline cases; npm run build and drizzle-kit check pass. These results do not certify complete administration, authenticated production mutations or deployment.

29 September 2026 — Advanced Moritani assassination sample matrix

The reusable offline runner now supports the explicitly gated moritani-assassinate profile with native Moritani and supported classic opponents excluding Harkonnen, across two through six Advanced seats. Initialization uses the actual preview path; resume requires both its saved marker and ability state, and the external physical Traitor census includes publicly retired assassination cards only after Mentat replacement. The existing six default samples and their ordinals are unchanged.

At base seed 20260929, all five games completed in 2,511 accepted actions, zero rejected candidates and 65 JSON continuations, with an unchanged source fingerprint. The six-seat game reached two actual private assassination offers; both were declined. Genuine battle/Mentat focused tests independently exercise reveal, retirement, replacement and duplicate custody rejection; the natural game samples do not establish that use. Source-bound private report: /tmp/dune-moritani-assassinate-matrix-20260929/report.json, based on c961a93 plus this checkpoint's uncommitted source (fingerprint 8889d9bf25b964948913588aa3320a3f47fd2b3f1fd79edf9df12397ce687c57). Independent read-only review found no concrete profile or custody defect. The pending rule-duration and uniform-private-step UX questions remain. No complete Moritani faction, public Moritani start or deployed acceptance follows from these samples.

The focused assassination/CLI/custody union passes 56/56 cases. npm run check passes typecheck, lint and 5,767/5,767 offline cases. No app route, database schema or deployed game changed in this checkpoint.

29 September 2026 — Ecaz card variant full-game integration samples

The reusable offline runner now has --profile ecaz-treachery: two through six genuine paired Ecaz/Moritani seats, each Basic and Advanced, with the independent three-card deck, physical custody checks, all four saved AI profiles and explicit JSON continuation. Its default six historical games and seed offsets remain unchanged; incomplete snapshots can resume only under the exact saved variant/roster. Public starts remain gated.

The first same-seed matrix completed eight of ten games and caught an actual saved-view mismatch: an unlocked Bene Gesserit advisor stance was stored as {lockedTurn:undefined} by movement, Guild transport, Junction transport or Fremen Ambassador relocation, but JSON restored it as {}. The four writers now store a canonical empty stance or a numeric lock. Focused Guild, Junction, ordinary move and Fremen relocation cases preserve view parity after JSON; locked arrivals still retain their original turn. No saved room or credential was altered.

The final source-bound run at base seed 20260929 completed all ten games: 3,768 accepted actions, no rejected candidates, 95 JSON continuations and unchanged source fingerprint. The six-seat Advanced game used all three physical Ecaz card effects. Report: /tmp/dune-ecaz-treachery-matrix-final-20260929/report.json, based on 6ac5dab plus the uncommitted source changes of this checkpoint (source fingerprint 466f801d36e8dc9aa1b14d2c9215813c8b4561926cc2ba43664d38e03ebbb081). This samples playable continuation, not complete card interactions, combined-module acceptance, calibrated AI or deployed behavior.

The focused runner/advisor suites pass 101/101 cases. An independent read-only review of the four writer changes, source custody and resume gates found no concrete defect; it did not run tests or certify release readiness.

npm run check passes typecheck, lint and 5,765/5,765 offline cases; npm run build passes. No database schema or HTTP route changed. The last verified live image predates these changes.

29 September 2026 — Reinforcements in paired Ecaz/Moritani battles

The independently selected three-card Ecaz variant now allows its physical Reinforcements card in clean Basic/Advanced Ecaz/Moritani battles, as well as the prior classic-only profile. The existing battle quote pays three own reserve counters into typed Tanks, adds two to normal score without changing the physical dial, and mandates one discard after reveal. Owner-only card slots and all four minimal AI policies follow the server offer. Co-present Ecaz allied armies, Richese, Ixians/Tleilaxu and other optional modules stay guarded; prior provisional cost rulings are unchanged.

A failing-before/passing-after genuine-setup regression covers each paired faction as holder in both rules modes, private plans, physical custody and JSON recovery. A paired Advanced room also survives restart and a competing final D1 write with one cost and discard. Forty-five focused Reinforcements/Harass cases pass. A separate engine smoke settled one paired battle with 15→12 own reserves and one discard, while the co-present-ally attempt was rejected without mutation. A React-rendered owner fixture in a mobile Chromium tab showed Reinforcements selectable; it was not a live-room UI check. Independent static review found no patch-introduced defect and noted co-present Ecaz armies as a separate boundary, now guarded in the server and owner offer. No public start or complete module acceptance is claimed.

npm run check passes typecheck, lint and 5,761/5,761 offline cases; npm run build passes. No route, database schema or public start gate changed. The last verified NAS image predates this source; local results are not deployed acceptance.

29 September 2026 — Moritani and Tleilaxu Leader Skills samples

At source revision 29aedf1, all five Basic Moritani plus Leader Skills two-through-six-seat games at base seed 20260929 finished through genuine setup and saved AI actions: 2,013 accepted actions, zero rejected candidates and 53 JSON continuations. The four-seat game exercised a Bureaucrat payment decision and nine battles; the six-seat game reached twelve Terror decisions and ten turns. The source fingerprint was unchanged and no live room was used. The private report is /tmp/dune-goal-20260929-moritani-skills/report.json.

At source revision df71faf, all five Basic Tleilaxu plus Leader Skills two-through-six-seat samples at the same base seed finished with 2,723 accepted actions, zero rejected candidates and 70 JSON continuations. The six-seat game reached native early-revival requests, actual Face Dancer replacements, seventeen battle selections and eight turns. No live room was used; the source fingerprint stayed unchanged. The private report is /tmp/dune-goal-20260929-tleilaxu-skills/report.json. Neither matrix certifies every skill effect, Advanced play, combined modules or AI strength.

29 September 2026 — paired expansion game samples

At source revision b9c8b74, the reusable genuine-setup runner completed all six fixed Basic/Advanced CHOAM/Richese, Ecaz/Moritani and combined expansion samples at base seed 20260929: 4,641 accepted actions, no rejected candidates and 122 JSON continuations. The source fingerprint remained unchanged throughout. The private source-bound report is /tmp/dune-goal-20260929-expansion-pairs/report.json; no live room was used. This is sampled integration evidence, not effect-by-effect acceptance, full module coverage, AI calibration or permission to open public expansion starts.

29 September 2026 — Homeworld-sourced AI arrival preflight

A genuine five-seat Advanced combined Homeworld/Nexus/expansion game on 41fd6fe exposed two rejected Tleilaxu shipments from its own Homeworld into unsupported Ambassador/Terror entry combinations. The public AI preflight had skipped Homeworld sources. It now quotes their off-planet arrival through the same authoritative public reaction helper, without sampling private Terror faces or recreating source pricing. A failing-before/passing-after real-engine regression exercises all four AI profiles and executable fallbacks. The identical genuine game completes after the fix with 786 accepted attempts, no rejected candidates, 21 JSON continuations and a fourth-turn shared victory. Other Homeworld payment-dependent reactions and unsupported combined arrivals remain gated; no public start was opened.

The initial full check exposed an existing Guild shipment test that asserted payment before a legitimately opened Karama rate response. That test now resolves the response before checking the rounded cost. The final npm run check passes typecheck, lint and 5,757/5,757 offline cases. No HTTP contract, database schema or player-facing control changed.

29 September 2026 — Sapho finite-bid boundary and pending source questions

The existing Once Around Juice of Sapho adapter permits an unacted holder to move first after another bidder's completed bid. New engine and persisted-room regressions cover the committed bid, remaining single opportunities, exact discard, stale/duplicate rejection and private projections. The hand-panel unavailability explanation and Sapho contract now describe this bounded behavior rather than a pre-first-bid restriction. Thirty focused Sapho cases pass. A separate direct engine run after an earlier bid reported canFirst:true, one completed bidder, the holder next, unchanged standing bid 1 and one physical discard after JSON reload. A React-rendered owner-panel fixture inspected in Chromium displayed the corrected guidance; this is not a live-room UI check. npm run check passes typecheck, lint and 5,756/5,756 offline cases; the app build also passes. No engine rule or public start gate changed.

The source follow-up records that the requested publisher/designer search did not settle Tleilaxu Secret Ally revival accounting, leader eligibility or partial use; the decision index also retains the Moritani Atomics alliance-change ambiguity. Neither receives an inferred rule or an implementation unlock.

29 September 2026 — administrator action history prototype

The existing Action history draft now has a bounded source-bound checkpoint. Its read-only endpoint joins nine durable receipt families, projects only public operational settings and identifier/name fields, and returns reasons only to a live owner/operator role. Search excludes raw JSON, messages, saved games, secrets and reasons; pagination/count and role rechecks share the same database batch. Viewer and anonymous access stay restricted. No game row is read or changed by the history query.

Ten focused offline audit/D1 cases pass, including a workerd compound-query regression, malformed metadata, deleted accounts, filtered pagination and commit-time demotion/revocation. The administrator HTTP boundary passes two focused cases (54/54 in the last full local HTTP suite). An isolated non-test in-memory query returned only the two account-event envelopes, without credential contents. Browser inspection showed signed-out denial and read-only operator/viewer fixtures at desktop/mobile widths; viewer reasons stayed hidden and mobile had no horizontal overflow. Independent read-only security review found no concrete authorization or privacy defect. Typecheck, lint, 5,756/5,756 offline tests and the app build passed with this draft present. The dedicated signed-in QA operator HTTP verifier was not run: it revokes all sessions for its account and requires a separate authorized QA key. This is not deployed acceptance or complete administration; failed-attempt history, broader operations and backup/restore remain pending.

29 September 2026 — Fremen Nexus Betrayal pre-blow worm suppression

The second printed Betrayal alternative now spends the physical Fremen Nexus card at a clean phase-one boundary before the first spice blow or worm. For that turn ordinary Fremen worm rides and native Cunning remote rides do not open; worm destruction, survival/protection, spice placement and Nexus still resolve. This advance-declaration timing is a conservative product boundary, not a publisher priority ruling or a reactive post-appearance use. The existing phase-five movement-range alternative remains independent; a card recycled at the current turn's Nexus cannot activate both alternatives.

Sixteen focused Basic/Advanced, actual-worm, empty-Cunning, late-rejection, owner/rival control, all-profile bot-priority and authenticated concurrent SQLite continuation cases passed. A direct non-test third-turn worm smoke showed one spent card, a real Nexus, four surviving Fremen forces and no ride. A read-only browser preview rendered the owner-only pre-blow button with no rival or spent-card control; no room was written. Independent review found that the first movement-only checkpoint's six-field receipt would have locked saved seats on direct GET. Its original event/signature are now validated alongside new mode-bound receipts; JSON and authenticated SQL reads/actions accept genuine old records and reject tampering. The source-bound Fremen contract marks the timing and combined-mode limits. Typecheck, lint, the app build, 5,756/5,756 offline tests and 54/54 local HTTP integration cases passed. This does not open public Nexus starts or prove deployment.

29 September 2026 — bounded Moritani Atomics Aftermath

In classic-plus-Moritani tables without Guild, Ecaz or optional modules, a placed Atomics Terror token may be revealed against an eligible original entry. The existing arrival is never replayed. All physical forces in that territory enter the Tanks, the revealed token leaves play, and one public Aftermath marker permanently bars shipments there, including Fremen free reinforcements. Ordinary movement and the printed Sneak Attack exception remain available. From detonation Moritani and its ally at activation lose one Treachery hand slot; excess cards are discarded randomly through the saved fresh-discard continuation, not by identity chosen by another seat. The unresolved later-alliance penalty is conservatively gated before any Moritani alliance offer or break, while unrelated alliances remain possible.

Seventeen focused pure, Basic/Advanced gameplay, owner/rival component and authenticated SQLite CAS/restart cases pass. They cover elite counters, unallied and Harkonnen hand limits, physical card custody, privacy, Fremen shipment rejection, movement and Sneak Attack, and corrupted saved state. A direct non-test Basic reveal preserved two random discards, two lost armies, reduced projected hand limits and public Aftermath through JSON. Read-only browser inspection showed the owner-only reveal, no rival offer, public Aftermath notice and map marker; no room was written. Independent review found an impossible post-Aftermath Nexus bot alliance; the shared pre-offer guard and corresponding player controls now leave bots a legal Ready path. Typecheck, lint, the app build, 5,747/5,747 offline tests and 54/54 local HTTP integration cases passed. This is not a complete Moritani faction or release gate. See source-bound Atomics scope.

29 September 2026 — bounded Fremen Nexus Betrayal movement alternative

An unallied holder may spend the one physical Fremen Nexus card before Fremen move during Shipment and Movement in classic-only Nexus games. The native two-territory advantage stays suppressed through that turn; ordinary movement, city ornithopters and other independent movement remain available. The server-bound event and saved receipt reject duplicate or malformed plays. The holder-only control and all four AI profiles share the same private offer, with bot priority before Fremen's first move. Basic/Advanced real second-turn Nexus draws, JSON continuation, expiry, corrupted receipt rejection and a concurrent authenticated SQLite CAS/reconnect check pass seven focused cases. The actual React control rendered an owner button and no rival control in a read-only static preview; no room was written. Typecheck, lint, the app build, 5,735/5,735 offline tests and 54/54 local HTTP integration cases passed. Independent read-only review found no actionable issue in bounded timing, privacy, custody, receipt or movement. The card's separate worm-riding suppression remains unimplemented, and combined modules/public Nexus starts remain gated. See Fremen Nexus rules.

29 September 2026 — bounded Ambassador/Terror storm-order continuation

An original entry into a shared Ecaz Ambassador and Moritani Terror stronghold is now committed once, then two distinct optional owner reactions are saved in current storm order. Ecaz and Moritani can each decline or use a supported face/effect; the second owner still receives the original entrant, territory, token entitlement and turn after JSON restoration. The signed receipt remains server-only, the public notice shows current/next faction without hidden Terror identity, and physical shipment spice, counters and movement allowance never replay on continuation. This is a provisional conservative table priority chosen after a targeted source review found no publisher ruling, not a certified simultaneous-effects rule.

The first focused engine/quote/in-memory SQLite group passed 41 cases across three files. A direct non-test Basic game smoke put Moritani before Ecaz: the entrant shipped two forces for two spice once, Moritani revealed Robbery and collected nine of the remaining eighteen, then Ecaz's Emperor Ambassador collected five bank spice. JSON reloads between responses preserved owner order and the original two forces; rival views kept Robbery's face hidden before revelation. BG fighter Intrusion, Fremen/Guild Ambassador child arrivals, Atomics, optional modules and public expansion starts remain separate unfinished work. The table order and its limits are in the source-bound policy.

Follow-up regression coverage now exercises Basic/Advanced Fremen worm rides through both saved arrival stages in SQLite, Robbery hand overflow, Sabotage discard/gift, and a special-Karama summon whose Nexus precedes the queued ride. The bot owner-view quote accepts a supported ordinary overlap. The focused overlap/guide suite passed 30 cases. The obsolete prose-matching reference test was removed rather than re-pinned; full typecheck, lint, the app build and 5,735/5,735 offline tests now pass with the separate Fremen Nexus movement alternative integrated. This local coverage does not certify an expansion start or deployment.

29 September 2026 — native Guild cross/return rate response

The classic Basic/Advanced Guild rate interruption now owns a typed, persisted cross-planet/return declaration as well as ordinary reserve shipment. Guild, its reciprocal ally and paid allied Fremen southern reserves can cross-ship one exact physical group; only Guild returns an on-planet group to abstract reserves. The prepayment Karama response binds original sector/elite groups, turn, destination, quoted half-price cost and approved ally contribution. Canceled rate uses full normal destination price for that same group; a Guild return costs one spice per force under the explicit doubled-tariff interpretation. If original resources or source custody cannot support it, the declaration withdraws without payment, force transfer or consumed shipment. The spent Karama keeps a replacement at full price for this turn. Independent purchased shipping rates, Guild income and canceling transport permission remain distinct; Homeworld and optional-module combinations are not certified.

Focused engine/quote/in-memory SQLite cases cover group conservation, paid Fremen transport, exact funding and unaffordable replacement, Basic/Advanced responses, BG Worthless conversion, source corruption or depletion, private views, legal AI candidates and a concurrent CAS race. A direct non-test multi-sector smoke preserved 20 Guild spice and the source forces through JSON reloading, then canceled the rate and settled three Carthag forces for three spice with one Karama discarded. A local read-only Chromium seat-view preview displayed the public prepayment rate and owner-only Cancel with Karama button without persisting a room. These bounded cases do not certify complete Guild, public Advanced or deployed behavior; see the selected transport policy.

A second read-only Chromium seat preview selected two physical forces after an unaffordable Guild return; the replacement quoted two spice instead of the old one-spice half rate and enabled Return to reserves. It wrote no room.

Independent review found and verified a previously excluded affordable four-force/two-spice Guild Nexus Secret Ally bot cross-shipment; its independent card rate remains separate from the native rate. Existing Moritani/Terror alliance continuations also required the classic-faction roster gate rather than relying only on expansion flags. Eleven focused Guild/Nexus/Moritani files passed 123 cases; all 5,706 offline tests, the local client/server build and all 54 HTTP integration cases passed. npm run check/lint remain blocked solely by the concurrent untracked Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn field, not a transport diagnostic.

29 September 2026 — bounded Guild rate Karama before payment

In classic-faction Basic/Advanced tables without optional modules, an ordinary Guild or reciprocal ally reserve shipment priced at the Guild half-rate waits for a Karama response before any spice or forces move. Advanced Guild's separate special stop resolves first. A canceled discount reprices the exact declared force cohort at full destination tariff without enlarging the original approved ally contribution. If that split cannot fund full price, the spent Karama withdraws the uncommitted shipment; a later ordinary declaration in the same turn uses full price. This conservative withdrawal is an explicit table policy, not an identified GF9 refund ruling. Independent Karama rates and later Guild-income cancellation remain distinct; Guild cross-shipment, return and optional-module combinations remain gated.

New focused engine tests cover physical custody, exact funding, unaffordable withdrawal/replacement and turn expiry, Advanced stop priority, BG Worthless conversion, legal AI, corrupt saves and validated unstamped Advanced saves. An in-memory SQLite room test exercises authenticated private views, restart, CAS race and duplicate cancellation. A direct non-test engine smoke showed 20 Guild spice and 20 reserves held during response, then 17 spice, 17 reserves, three Arrakeen forces and exactly one discarded Karama after JSON restore/cancellation. In a local read-only Chromium QA view, the cancel button was visible before payment; after unaffordable cancellation the replacement form quoted two spice for two Arrakeen forces, selected the existing two-spice ally pledge and enabled shipment. No live room was modified. Independent review identified and verified fixes for the quote projection and older unstamped Guild-stop declarations. This is a bounded prototype, not complete Guild or deployed evidence; see the publisher distinction and selected policy.

The focused Guild rate, existing Guild income, pending shipment and BG Karama group passed 43 cases in seven files. All 5,689 offline tests, the local client/server build and all 54 HTTP integration cases passed. npm run check stops in TypeScript on a separate concurrent untracked Fremen Nexus draft referencing missing Player.fremenNexusMovementBlockedTurn; the separate lint command reports only that same draft error. No source or saved room was reset.

28 September 2026 — Moritani Extortion saved Mentat continuation

The real Terror-entry reveal now reserves five bank spice without crediting Moritani. Normal Mentat placement/relocation and any Karama response resolve first by the user's explicitly selected interpretation; bank collection then opens one saved storm-order offer for each other faction. The first three-spice payment removes the physical revealed token and ends the queue; if all decline, the return helper rotates all hidden supply identities. Insolvent and allied players retain a decline, and neither the bank award nor a payment replays after JSON reload or an SQLite compare-and-swap race. Public notice and owner-only payment controls are connected; the minimal AI declines legally.

Independent review identified three concrete follow-ups, now corrected: the current payer's affordability is private, Nullentropy Box and Richese gift continuation frames retain the exact pending payment, and an Extortion revealed by a real Guild Ambassador shipment after Mentat placement settles before the turn changes. The focused entry/engine/SQLite/alliance/placement suite passed 119 cases in eight files. A direct game-engine smoke revealed Extortion at Moritani spice 12, reached placement before collection to 17, then two AI payers declined and the revealed token returned under a different hidden ID. Separately, an offline three-seat Basic Ecaz/Moritani game completed in 110 accepted actions with two restores and no rejected bot proposals; that sample did not draw the Extortion effect.

The local rules reference displayed the selected order and late-Mentat continuation in Chromium; the production UI/room flow remains unverified. After review corrections, npm run build, all 5,677 offline tests and all 54 HTTP integration tests against the local server passed. The required TypeScript/lint umbrella check still cannot finish because a separate concurrent untracked Fremen Nexus draft references a nonexistent Player.fremenNexusMovementBlockedTurn; no Extortion diagnostic remains. Atomics/Aftermath, mixed arrival reaction priority, complete faction games and public expansion starts remain gated. See the publisher sequence and user selection.

28 September 2026 — all-expansion Homeworld/Nexus samples

The offline combined audit setup can also enable genuine Homeworld custody with Nexus Cards and all three expansion decks; public starts remain unchanged. Five- and six-seat Basic/Advanced games all completed: 2,800 accepted actions, 74 JSON/private-view restores and unchanged source fingerprints. Five-seat tables reached three Nexus Card draw/keep choices and six actual Homeworld revival-deployment decisions. Eight proposed shipments/moves into public Ecaz Ambassador and Moritani Terror overlaps were rejected without mutation; bot continuations found other legal actions. The published arrival-priority question remains unresolved. An intentionally capped ten-action Advanced save resumed to turn-five victory with 877 accepted actions and 23 more restores. The source-bound matrix and replay reports are in /tmp/dune-combined-homeworld-nexus-matrix/report.json and /tmp/dune-homeworld-nexus-resume-finish/report.json. These sample wins do not certify individual card effects, every Homeworld entitlement or combined expansion publication.

28 September 2026 — five/six-seat all-expansion Nexus integration samples

The offline-only combined-nexus audit setup selects all three physical expansions and Nexus Cards for five seats (Ixians, Tleilaxu, CHOAM, Ecaz, Moritani) or six (plus Richese). Basic and Advanced samples for each roster completed with 4,098 accepted actions, zero rejected bot actions and 109 JSON/private-view restores. The five-seat tables reached five real Nexus Card draw/keep decisions; the six-seat tables formed alliances but did not draw cards. The report at /tmp/dune-all-expansion-nexus-matrix-final/report.json records status: passed and unchanged source. A separate intentionally capped ten-action five-seat save resumed to a turn-nine win with 1,380 accepted actions, 37 more restores and zero rejected actions. The resumed random stream restarts, so its outcome need not match an uninterrupted game. No card effect happened in these samples, so they do not establish individual card correctness, complete cross-expansion behavior or permission to open public starts.

28 September 2026 — owner-only operational counts

/admin/operations now samples the build revision and live database aggregates: saved/removed/archived/paused/closed rooms, active seat credentials, syntactically invalid JSON saves, last room write, backup snapshot bytes/count and committed private exports. Its read query repeats owner authority in SQL and returns no saved state, seat token, message, backup payload or audit reason. The page is read-only and refreshes only on request; it makes no integrity, disk-capacity, repair or stalled-decision claim. Two isolated D1 tests pass for counts, live demotion/revocation and unchanged saved games. The production HTTP suite passed 54/54 with anonymous/forged-session denial, and the build includes the new route/page. A real local signed-out browser denied access; desktop and 390-pixel samples rendered correctly using mocked owner API responses only, not an authenticated production owner. Full administrator operations and deployed acceptance remain gated; no production data was changed.

28 September 2026 — owner-only room backup capture

The new /admin/backups page lets an authenticated owner capture, list and download an immutable private room snapshot. It includes the saved game and related seat/recovery, lifecycle and discussion records without changing room version or granting access. Exact operation replays, live database authorization, content/version fencing and byte quotas protect competing writes and storage. An append-only owner/room/time receipt records each successful private export before its payload is returned. These are capture-only files: there is no import, validated restore, server health display or unified action-history entry yet.

Twelve isolated in-memory D1 backup cases pass, including exact replay, revoked access, unversioned concurrent changes, highly escaped state rejection, the 32,768-record download-audit capacity boundary and duplicate snapshots. A throwaway genuine game created in an isolated store was captured, listed and downloaded once; its room version remained zero and its export receipt count was one. The signed-out local browser showed the owner gate. A separate intercepted local UI view showed an older snapshot available to download after its live room had disappeared; that view used mocked API responses, not a real room restoration. The HTTP suite passed 53/53, including a new anonymous, forged-admin and real room-host backup denial case; the build included both new backup routes and the page. The stable full offline run passed 5,662/5,662 cases with zero failures. npm run check remains blocked by the unrelated concurrent Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn type field. The 1,800,000-byte per-snapshot cap, 16 MiB per-room and 64 MiB global quotas, bounded export ledger without archival, absent chunked backups, and unavailable live NAS Apps session keep saved-game and deployed acceptance open. No production game or credential was modified.

28 September 2026 — rules-reference duplicate links

The Ecaz faction topic no longer repeats its Duke Vidal related link, and the Homeworld implementation checklist lists each Tupile intelligence and Terror entry receipt source once. The local /rules?topic=faction-ecaz#faction-ecaz page rendered its opened Ecaz guide and one Duke link after the change; its fresh browser console had no React duplicate-key errors. Before the change, the same page reported duplicate keys for all three entries. This is a reference-display correction, not new game-rule acceptance.

28 September 2026 — source-stable complete-game integration samples

tools/faction-games.ts completed five genuine Basic Tleilaxu/Leader Skills games across two through six seats: 2,435 accepted actions, 64 JSON/private-view restorations and no rejected bot candidates. Ten genuine classic-faction Homeworld + Nexus games spanned two through six seats in Basic and Advanced: 4,284 accepted actions, 110 restorations and no rejected candidates. Both source-fingerprint reports passed unchanged, with custody checks after each action. The real setup and four rotating AI profiles used no staged cards, forces, phases or statistics. Private reports: /tmp/dune-tleilaxu-skills-20260928/report.json and /tmp/dune-homeworld-nexus-matrix-20260928/report.json.

Thirty paired CHOAM/Richese, Ecaz/Moritani and Ix/Tleilaxu + Nexus games also finished, covering two through six seats in both modes. Two six-seat games with all three faction expansions finished in Basic and Advanced. Together these 32 further games accepted 14,785 actions with 385 JSON/private-view restorations, zero rejected candidates and unchanged source fingerprints. The paired-module reports are /tmp/dune-choam-nexus-matrix-20260929/report.json, /tmp/dune-ecaz-nexus-matrix-20260929/report.json and /tmp/dune-ix-nexus-matrix-20260929/report.json; the combined-expansion report is /tmp/dune-all-expansion-complete-20260929/report.json. The runner checks physical cards, force counts and typed elites after each action; its generic expansion samples do not independently census exceptional Traitor zones.

Fifteen additional Basic Leader Skills games with native Moritani, Ixians or CHOAM finished across two through six seats: 7,829 accepted actions, 206 JSON/private-view restorations, no rejected bot candidates and unchanged source fingerprints. The reports are /tmp/dune-moritani-skills-matrix-20260929/report.json, /tmp/dune-ix-skills-matrix-20260929/report.json and /tmp/dune-choam-skills-matrix-20260929/report.json. Across all nine reports, 62 games finished with 29,333 accepted actions and 765 restores.

These samples establish legal sampled continuation to a winner, not natural exercise of every rare card or payment effect. They do not certify complete Leader Skills, Tleilaxu, Homeworld, Nexus, Advanced or expansion play, browser usability, production deployment or AI strength calibration.

28 September 2026 — Basic Tleilaxu revival/Bureaucrat composition

A genuine Basic Tleilaxu/Leader Skills game now offers a living native Bureaucrat's once-per-phase redirection on another player's actual paid revival price of at least five spice. The payer's cost and revived physical leader or forces are committed once; native Tleilaxu income retains its existing Karama window, and a cancellation does not offer a player-directed payment. A separate one-spice free-revival award cannot lift a small price over the threshold and is not diverted. The decision binds the payer, trainer, payee, amount, turn and phase to the saved response; the declined opportunity remains available. Negotiated price is available to its participants and trainer but omitted from unrelated observers' pending view and the public redirection log.

The owner panel shows the original price, both possible recipient amounts and the separate free-award explanation. Four legal bot policies use the projected choice. Genuine setup, Karama allow/cancel, negotiated leader and small force revival, JSON reload, authenticated SQLite restart and competing-version CAS have focused regressions. A read-only intercepted local browser room displayed the actual seven-spice payment and both controls; no room write occurred. This is one bounded payment family, not complete Tleilaxu, Leader Skills or combined-module acceptance; the verified live image remains c9a3625.

Independent rules and privacy/recovery reviews passed after correcting a public log that initially disclosed the negotiated price. Scoped lint, the production build, all 52 local HTTP integration tests and the standalone 716-file, 5,652-case offline suite pass. The required npm run check cannot complete: concurrent independent work in game/nexus-fremen-betrayal.ts:38 reads an undeclared Player.fremenNexusMovementBlockedTurn field. This checkpoint does not alter that draft or claim a green typecheck.

28 September 2026 — Ecaz Duke revival and bounded Mirror Weapon

The user chose two explicit product interpretations after bounded publisher source review: a successfully revived Duke returns alive to the shared area, unclaimed until later acquisition; a victorious physical Mirror may be kept even when its copied attack activates Poison Tooth or Artillery. Neither is presented as an official GF9 clarification. Ecaz's separate five-spice ordinary Duke revival and Ghola now use the same physical disc, with first five-in-Tanks cohort eligibility, frozen discount/payment and Tleilaxu stop/cancellation continuation, owner controls, minimal legal AI and JSON/ isolated SQLite recovery. Repeated six-disc native cycles, exceptional shared-disc custody and Advanced Harkonnen remain guarded.

Canonical Mirror now occupies the actual weapon slot in bounded Basic/Advanced CHOAM/Richese-deck classic/CHOAM/Richese battles. Revealed opposing attacks, copy-first independently saved Tooth/Stone choices, Stone's public casualty feasibility, physical-card retention/custody, Carthag's effective-poison defense, named Voice, human controls and four-profile legal AI are connected. Combined modules, changing card roles, complete Richese starts and release acceptance remain gated. Read-only local desktop browser fixtures showed the selectable Duke at five spice with strength six/set-aside guidance and the Mirror weapon selector, copied-attack explanation and updated hand guide; no real room was written. The verified live image remains c9a3625.

Independent read-only reviews found and prompted fixes for concealed foreign- ghola death-count privacy, Mirror Voice compulsion deadlock, reordered saved copy decisions and incorrect Stone scoring of ordinary Mirror copies. The reviewed focused run passed 66/66; the frozen full offline suite passed 5,643/5,643 across 714 files, live development-server HTTP integration passed 52/52, scoped oxlint and the app build passed. Project TypeScript still reports only the unrelated in-progress Fremen Nexus draft's missing Player.fremenNexusMovementBlockedTurn; the required full npm run check cannot be claimed green until that draft is resolved. Browser proof also showed the actual copy-first revealed Tooth decision and physical Mirror/ opponent Tooth card faces. Production deployment remains blocked by the OS-locked host Apps session, not by a local reset or game migration.

27 September 2026 — Bounded Emperor Nexus bank-auction purchase

The separate Secret Ally purchase alternative lets an unallied holder with Emperor absent retain the full personally affordable winning bid on an ordinary bank-paid Treachery auction. The actual lot enters the winner's hand, the unique Emperor Nexus enters the discard, and ordinary auction follow-ups continue. A uniform winner confirmation in eligible classic-faction Nexus-only games avoids revealing hidden ownership; its timing remains a provisional product choice pending the recorded user question. Owner-only controls, all four legal AI profiles, signed event/receipt, JSON integrity and concurrent in-memory SQLite CAS/restart/replay are connected. Seller-paid/allied/expansion and non-Bidding transactions remain gated, as do the forced Emperor-payment Betrayal alternative and complete Nexus acceptance.

Independent review found and prompted repair of a stale cross-lot offer event and a bypass of normal-auction physical custody/hand-capacity preflight. The offer now binds the public auction index and final price without exposing the hidden lot face. Twenty-four focused purchase/automatic-payment cases passed; the frozen offline suite passed 5,610/5,610 across 708 files. Isolated project TypeScript excluding only the unrelated Fremen Nexus draft, scoped oxlint and the app build passed. npm run check and full lint stop at that draft's missing Player.fremenNexusMovementBlockedTurn. A read-only local browser fixture displayed the owner's purchase control, bid proof and ordinary payment choice; a rival seat saw only the uniform waiting decision and no private offer or card. No room write occurred. Production remains on the last verified c9a3625 image.

27 September 2026 — Bounded Reinforcements Battle Plan

The independent three-card runtime now permits the physical Reinforcements card in either Battle Plan slot for Basic/Advanced classic-faction games without other optional modules. A normal battle score gains two without changing the dial, support or on-board casualties; exactly three own ordinary-first reserve counters transfer to typed Tanks and count as battle losses at settlement, even for traitor/explosion outcomes. Mandatory discard, private category-None inspections, owner-only controls, four minimal legal AI profiles and JSON/SQLite saved continuation are connected. The normal-first choice, all-outcome payment and accounting are provisional product interpretations pending the recorded user/source ruling, not complete variant certification. Same-plan Harass/Stone Burner and optional modules remain gated; an opposing Harass plan is supported. Independent rules and privacy reviews found and prompted repair of a revealed-plan deadlock against opposing Harass.

Fourteen focused Reinforcements cases and 27 focused Harass cases passed, including Basic/Advanced physical custody, rival privacy, rejected-action immutability and concurrent in-memory SQLite CAS/restart. Read-only intercepted local browser views displayed the owner card in both physical selectors, cost guidance and no duplicate card after selection; the rival had no private card or cost offer. No room write occurred. Project-wide npm run check stops at the unrelated in-progress Fremen Nexus draft Player.fremenNexusMovementBlockedTurn diagnostic; isolated project TypeScript excluding only that draft and scoped lint passed. The final frozen offline suite passed 5,595/5,595 cases across 704 files; the app production build passed. Production still runs the earlier verified c9a3625 image.

27 September 2026 — Bounded native Richese Nexus Cunning pair

The Richese source contract now has one usable two-No-Field shipment in genuine Richese/CHOAM paired Nexus games without other optional modules. Two distinct nonrepeating physical tokens ship at the one-marker price; one immediately reveals into reserve-capped public normal forces and the other remains the sole concealed marker. The native Karama cancellation leaves resources, tokens and shipment allowance untouched while spending the card; Advanced Guild special prevention spends the attempted allowance without placing tokens or charging spice. Owner-only controls, four minimal legal bot paths, public value/force log and private concealed custody are connected. A read-only local browser fixture displayed the owner pair selector; the rival view had no private panel. Same-shipment lastShipped handling is a product interpretation, not a published FAQ answer.

Pure custody, Basic/Advanced engine, canceled/allowed responses, malformed intent, all AI profiles and concurrent in-memory SQLite CAS/reload/replay cases passed 60 focused tests after independent review fixed orphaned pending continuation and nullable bot-offer filtering. The final frozen full offline suite passed 5,581/5,581 cases across 700 files after the allocation-only validation refactor. Isolated project TypeScript excluding only the unrelated Fremen draft, scoped lint and app build also passed. npm run check still stops at the unrelated Player.fremenNexusMovementBlockedTurn draft error. Persistent faceup-component artwork, allied and optional-module combinations, Richese Betrayal and complete Nexus/public starts remain gated. This checkpoint is not yet in the live image.

27 September 2026 — Bounded Ecaz Nexus Secret Ally traitor inquiry

The Secret Ally prototype lets an unallied holder spend the physical Ecaz Nexus card at a quiet boundary when Ecaz is absent and ask any seated player, including themself, whether that player holds one of the holder's native leaders as an ordinary Traitor Card. The public action names the target but discloses no answer or matching identity; the holder alone can revisit the signed historical yes/no after the target's hand changes and the Nexus discard recycles. Native printed leader scope and holder-only audience are privacy-preserving product interpretations, not publisher rulings. Basic/Advanced real actions, four AI profiles, owner/rival projections, malformed and interrupted requests, JSON recovery and concurrent in-memory SQLite CAS passed six focused cases. A local read-only browser fixture showed the holder's target control and subsequent private answer, while a rival saw neither; no room write occurred. An independent rules/privacy/persistence review found no actionable defect.

The complete offline suite passed 5,571 tests across 699 files after the source tree stopped changing. Two source-bound CLI cases had reported a changed-source fingerprint during the earlier concurrent edit; all 19 CLI cases and the full suite passed on the frozen tree.

The shared clean-play predicate preserves CHOAM's existing boundary (12 focused cases). App build, scoped lint and a project TypeScript check excluding only the unrelated in-progress Nexus/Fremen draft passed. npm run check stops on that draft's missing Player.fremenNexusMovementBlockedTurn; it was not included here. Full Nexus and combined-module acceptance remain gated. This checkpoint has not been deployed.

27 September 2026 — Bounded Moritani Nexus losing-card retention

The Secret Ally prototype now opens the same after-loss choice for every Nexus loser when Moritani is absent and at least one publicly played card can be retained. Only an unallied holder may spend the physical Moritani Nexus card to keep one eligible played card; nonholders continue without disclosing custody. Mandatory discards and the other played cards follow ordinary saved battle cleanup. Native allied retention and its Karama response remain separate. Real Basic/Advanced battles, all four legal AI profiles, CHOAM winner inspection ordering, JSON restoration, rejected-action immutability and concurrent in-memory SQLite commits passed seven focused cases. An independent review found a Homeworld location-label crash; the corrected panel renders the server's public combat location name. Local browser views displayed the Arrakis decision, retained private hand and corrected Homeworld decision through read-only intercepted room responses; no room was mutated.

The complete offline suite passed 5,565 tests across 698 files, the app build and scoped lint passed, and a full project TypeScript check excluding only the unrelated in-progress Nexus/Fremen draft passed. npm run check still stops at that draft's missing Player.fremenNexusMovementBlockedTurn; this checkpoint is not yet deployed. The uniform loser prompt is a privacy-preserving product inference, not publisher timing text, and complete Nexus/module acceptance remains gated.

27 September 2026 — Bounded CHOAM Nexus after-victory inspection

The Secret Ally prototype now preserves the losing combatant's physically used-card IDs and offers every Nexus winner the same post-cleanup decision when CHOAM is absent, without revealing who holds its card. An eligible unallied holder may spend the physical CHOAM Nexus card to sample exactly one unused opposing hand card; only that seat receives the card snapshot, while the public log omits its face. Basic/Advanced real battles, all four AI profiles, signed receipt recovery, paid Nullentropy interruption, subsequent battle/turn expiry, rejected-action immutability and concurrent in-memory SQLite commits passed focused cases. A local browser with a read-only intercepted room view displayed the live table decision and private inspector; no saved room was changed. This is a product privacy interpretation, not a publisher ruling or complete Nexus certification.

The complete offline suite passed 5,558 tests across 697 files, and the app build and scoped lint passed. npm run check still stops at the unrelated in-progress Nexus/Fremen Player.fremenNexusMovementBlockedTurn type error; the CHOAM type error found on the first pass was corrected, and a second full TypeScript run reported only that unrelated diagnostic. The live image has not yet received this checkpoint.

27 September 2026 — Bounded Orgiz Processing Station Collection

The Discovery prototype now composes a sole Orgiz occupant's one-spice transfer over ordinary Collection: one uniquely collected board deposit is one observable blow, even when older blows stacked there. Separate deposits pay separately; contested Orgiz occupancy and unresolved Ecaz shared lots withhold their uncertain transfers without blocking ordinary collection. Advisor releases follow the ordinary Collection quote. This is a documented inference from the Ecaz & Moritani rulebook, not a publisher ruling. Basic/Advanced engine, JSON restoration, simultaneous in-memory SQLite CAS, conserved spice, rejected-action custody and player-visible log are covered by 20 focused Discovery cases. An actual staged engine continuation reached Collection and credited the Orgiz owner; an isolated local browser table rendered its token guidance and chronicle log without writing a room. The broader Discovery, combined-expansion and publication gates remain closed; this source is not yet the live c9a3625 image.

The complete offline suite passed 5,549 tests across 696 files, the app build passed, and scoped TypeScript/ESLint checks passed. npm run check still stops at an unrelated in-progress Nexus/Fremen draft with fremenNexusMovementBlockedTurn missing from Player; that draft was not changed or included in this checkpoint.

27 September 2026 — Bounded skilled Diplomat retreat

The standalone Leader Skills retreat interpretation now offers a surviving losing trained leader an event-bound, saved decision before ordinary loser casualties. The server quotes destination-specific undialed normal/elite counts using dial commitments, occupied strongholds, sector adjacency and the storm; accepted choices transfer those exact physical counters, while a decline or dead leader follows ordinary losses. Human controls and all four AI profiles use the same projected choices. Nine focused engine, controls and concurrent in-memory SQLite cases passed, including JSON restoration, split-sector custody, legacy-battle continuation and rejected-action immutability. An isolated browser view from a genuine revealed battle rendered the destination/count selectors and decline; POST was blocked, so no room was changed. The scoped type check and production build passed. This is a provisional strength/outcome-order interpretation, not a complete skill or combined-module ruling, and it is not yet deployed.

The complete offline regression suite passed 5,545 tests across 696 files after the retreat changes. The unrelated in-progress Nexus/Fremen draft still blocks the repository-wide type/lint check; the scoped type check covers this retreat slice. The live 4801ce0 image predates this slice.

Deployment follow-up: successful workflow 36358270534 published c9a3625ff2a9ddafdbc08e64de809eca6029db85, and a dedicated deployment agent updated only the NAS Apps dune image. The public footer title/accessibility name matched the full revision, the owner signed in, and all nine prior rooms remained (one playing room at version 54). The 0600 online SQLite backup passed PRAGMA quick_check. Live Diplomat battle gameplay and private saved-seat recovery were not exercised; the local browser fixture remains the feature-specific UI evidence.

27 September 2026 — Ixian/Tleilaxu with Nexus Cards

The paired-faction Nexus sample path now includes genuine Ixian/Tleilaxu games without opening the public expansion/module starts. At seed 20260927 all ten two-through-six-seat Basic/Advanced samples completed with 3,853 accepted actions, 100 JSON restores, five unallied card choices and no rejected actions. The three-seat Basic and Advanced traces reach Ixian auction decisions and Nexus draws; Basic reaches a Face Dancer decision, Advanced an Ixian Technology decision. A five-seat Basic trace also plays one Atreides Nexus effect, while an interrupted four-seat Advanced game resumes its own roster. The source-bound report is /tmp/dune-ix-nexus-checkpoint-20260927/report.json. This does not certify all card effects, combined module configurations or complete expansion rules.

27 September 2026 — Ecaz/Moritani with Nexus Cards

The paired-faction Nexus audit setup now includes genuine Ecaz/Moritani games, retaining the CHOAM/Richese profile and both public start gates. At seed 20260927 all ten two-through-six-seat Basic/Advanced samples completed: 3,827 accepted actions, 98 JSON restores, five unallied card choices and no rejected actions. A three-seat Basic trace reaches Ecaz Ambassador decisions, battles and Nexus drawing; an interrupted four-seat Advanced game resumes as its own Ecaz/Nexus roster. The source-bound report is /tmp/dune-ecaz-nexus-checkpoint-20260927/report.json. None of those draws activated a Nexus card effect; card-family and combined-mode completion remain gated.

27 September 2026 — CHOAM/Richese with Nexus Cards

The offline sample runner now admits genuine CHOAM/Richese setup with the physical Nexus module at two through six seats in Basic and Advanced. At seed 20260928 all ten games completed with 3,481 accepted actions, 90 periodic JSON restores, no rejected actions and one unallied Nexus Card choice. A separate seed 20260927 completed nine games with three choices, then stopped in six-seat Advanced Bidding after 1,863 accepted actions at the existing unresolved exhausted-Richese-cache normal-auction-count guard; the failed report is /tmp/dune-choam-nexus-trial-20260927/report.json. The passing source-bound checkpoint report is /tmp/dune-choam-nexus-checkpoint-20260928/report.json. No drawn card effect happened in these samples, so they do not certify the CHOAM Betrayal panel, all Nexus effects or public module starts.

27 September 2026 — Combined expansion game continuation

The original six faction samples now complete at seed 20260927, including the six-expansion-faction Basic and Advanced games. Those two combined games reached turn ten and turn nine respectively, with 4,396 accepted actions, 118 periodic JSON restores and no rejected actions. The Advanced trace includes nine explicit Ixian declines on Richese lots, ten Ecaz Ambassador decisions and fifteen Face Dancer decisions; it no longer stops at the historical movement-arrival guard for this seed. The source-bound report is /tmp/dune-combined-checkpoint-20260927-2183376/report.json. One seeded roster is not every valid combination, and the Richese Technology exchange remains unresolved; expansion/publication gates stay closed.

27 September 2026 — Ixian/Tleilaxu standalone roster samples

The expansion sample runner now exercises the Ixian/Tleilaxu pair with two through six seats under Basic and Advanced rules. At seed 20260927 all ten genuine setup/play games completed: 6,365 accepted actions, 169 JSON restores and no rejected actions. The six-seat Advanced trace reaches both Ixian Technology and Tleilaxu Face Dancer decisions, along with battle, revival and shipment paths. An interrupted four-seat Advanced run also resumes to completion. The source-bound report is /tmp/dune-ix-roster-checkpoint-20260927-final/report.json. This is bounded playable coverage, not full E1 rules certification or public expansion-start authorization.

27 September 2026 — CHOAM/Richese and Ecaz/Moritani roster samples

The sample runner now covers each expansion pair in Basic and Advanced at two through six seats, using genuine faction setup, legal AI decisions and periodic JSON restoration. The ten CHOAM/Richese games at seed 20260928 and ten Ecaz/Moritani games at seed 20260927 completed: 6,523 accepted actions, 167 restores, no rejected actions. Source-bound checkpoint reports are /tmp/dune-choam-roster-checkpoint-20260928/report.json and /tmp/dune-ecaz-roster-checkpoint-20260927/report.json. A separate CHOAM/Richese seed 20260927 completed nine games but stopped in six-seat Advanced Bidding after 1,728 accepted actions: an exhausted Richese cache reached the existing explicit unresolved normal-auction-count guard. That source question remains open, not papered over by the passing matrix. These samples do not certify full expansion rules, all rosters or public starts.

27 September 2026 — Bounded CHOAM Nexus Betrayal

The CHOAM Betrayal panel now has a playable Basic/Advanced path when CHOAM is seated. An unallied rival spends the physical CHOAM Nexus card at a clean boundary; the server samples and discards one actual held CHOAM Treachery Card without spice compensation. The holder-only control never offers a rival card choice or identities; its hand count appears only during Bidding. Bots act only when that count is public. A saved discard receipt completes once after JSON restore, including later same-turn Nexus recycling. Focused quote, controls, bot, physical inventory, rejection and interruption cases pass; the isolated browser table rendered the enabled holder control without room writes. Complete Nexus, combined-module and deployed revision acceptance remain open.

26 September 2026 — Bounded Ecaz Nexus Betrayal and build revision

The Ecaz source contract now has a narrow Betrayal path at the opening of Shipment and Movement. The unallied card holder chooses a public territory shared by Ecaz and its reciprocal ally. One physical Ecaz card is spent before a provisional Karama response; allowance returns the ally's entire typed group from all sectors to reserves, while cancellation preserves its board forces. The native shipment and movement queue is unchanged. Pure quote, real turn-two Nexus, bot ordering, privacy, rejection, JSON continuation and in-memory SQL duplicate-CAS/restart regressions exercise this bounded path. A local browser fixture rendered the owner-only shared-territory selector and rival public Karama notice; no room was written. The homepage revision was visually verified on local desktop and mobile. Broader combined-module acceptance and other Ecaz Nexus panels remain separate.

The landing lobby and active-table masthead now show the build's Git commit. Vite bakes a checkout HEAD or validated BUILD_REVISION; the container workflow passes its GitHub commit to Docker before building. A source tree with uncommitted edits still displays its committed HEAD, not those edits.

26 September 2026 — Bounded Fremen Nexus Cunning prototype

The Fremen Nexus source contract now has a native Basic/Advanced path for initially empty natural and accepted additional worm appearances, plus an Advanced Fremen special-Karama summoned appearance in classic-faction Nexus-only games. A uniform public offer does not disclose the privately held Fremen card. Accepted use spends it once, preserves the original worm and permits one source-labelled desert ride after its Nexus, moves exact normal/Fedaykin counters, and resumes native arrival children. Summons keep a separate server-issued parent event through the saved original Spice Blow. A Karama response provisionally cancels only the remote ride. JSON and in-memory SQLite continuations, duplicate-offer CAS races for natural and summoned appearances, owner-only controls, minimal legal bot participation and focused checks cover this bounded path. Independent review exposed an inherited-key force creation bug that was reproduced and fixed. Browser QA exercised natural and summoned offer/response/ride controls from genuine projected views with isolated GET interception and blocked POST; no room was mutated. Full module games, second Cunning offers during interrupted controls and Great Maker, combined modules and the absent-faction protection remain gated. A disconnected Moritani Atomics quote is not a runtime effect.

26 September 2026 — Unified administrator action history

Action history reads the nine existing durable audit sources with date/group/search filters, pagination, actor/target attribution and public recorded settings. Live owners/operators receive reasons; viewers receive none, and reasons are never searched. No saved-game or message table is read. Records remain available after target removal, with malformed metadata handled without leaking raw contents or breaking the page.

Independent review found and corrected unsafe role coercion, a rejected-field search oracle, affected-account name lookup and missing player-circle changes. Focused source/SQL regressions and genuine configuration receipts cover these boundaries. Real-runtime HTTP checking exposed workerd’s five-term compound-query limit; materialized source groups and an isolated D1 regression cover the fix. Required checks, HTTP/browser acceptance and preservation accompany the checkpoint separately. This is successful-operation history; failed attempts, full operational diagnostics and the remaining admin/game goal are unfinished.

26 September 2026 — Administrative discussion moderation prototype

Discussion controls connect human-seat mute/unmute to the admin directory and player message panel. New public/private sends are blocked at commit; history, incoming messages and exact committed retries remain usable. Settings survive seat recovery/handover without reviving old credentials. Game JSON, versions, timestamps, private custody and AI pacing remain unchanged.

Atomic live authority/membership/version fences, per-seat revisions and audit receipts protect concurrent and uncertain requests. Independent SQL/privacy and UI source review found no blocking defects. Focused regressions cover mute/send ordering, rollback, stale unmute races and exact retry privacy. Browser, HTTP, source-bound checkpoint checks and preservation evidence accompany this slice. New-revision deployed acceptance remains open; full administration and game rules/expansion completion remain unfinished.

26 September 2026 — Administrative participant AI prototype

Participant AI connects paused human-seat support to the existing authoritative controller action. It retains player access, private custody and AI deadlines; explicit resume starts normal paced continuation. Atomic authority/room/pause/seat fences, durable receipts and target-owned unused permission revocation preserve concurrent and uncertain requests. Local retry controls survive refresh and confirm old operations without reversing takeback.

Independent review corrected sector-18 and worm-ride compatibility, core continuation shape guards and changed-access handling after reconciliation. Focused regressions and twenty-two administrator HTTP groups passed; source-bound checks, browser acceptance and preservation accompany the checkpoint separately. Positive production admin testing remains pending authorized access. The complete administration panel, rules/expansion coverage and AI refinement remain unfinished.

26 September 2026 — Readable admin and saved-seat notices

First administrator and seat-control submissions show progress while the request is in flight; saved/uncertain requests retain their recovery controls. This extends the room-entry fix to admin creation, controls, lobby changes, removal, closure, archive, AI permissions and handovers. Successful recovery and handover confirmations remain above the table until Continue, including after polling or game actions. No game action waits for that acknowledgement.

Independent read-only review found no material issues. Focused notice/entry regressions and delayed/lost-response browser checks accompany the checkpoint; broad checks and deployed evidence are recorded separately. The complete admin panel and rules goal remain unfinished. See readable notices.

22 September 2026 — Administrative archive/unarchive prototype

Archive or unarchive organizes closed rooms without changing their saved state, timestamps, credentials, discussion or AI pacing. Separate directory filters compose with removal; unarchive leaves play closed, reopen rejects archives, and removal/restoration retains both flags. Live operator authority and room/archive version fences commit with durable audit receipts. Tab-scoped exact retries remain confirmable across refresh and later availability changes.

Independent read-only review found no material issues. Focused database/client checks and twenty dedicated administrator HTTP groups passed. Browser acceptance, source-bound broad checks and preservation evidence accompany the checkpoint. Authenticated production acceptance awaits authorized QA access. Full admin and rules gates remain unfinished.

22 September 2026 — Administrative close/reopen prototype

Close or reopen now separates administrative availability from the saved game's rules status and winner. It retains readable private tables and discussion, blocks new player/AI/seat/message mutations, and preserves exact prior receipts. Atomic audit/version/revision fences and independent closure metadata compose with pause, lobby configuration and recoverable removal. Reopening preserves credentials and pending choices, with existing AI pacing.

Independent review corrected recovery-claim scope, unnecessary closed-room worker scheduling and typed closure errors after write races. Focused runtime checks, dedicated HTTP acceptance and lost-response/mobile browser QA accompany the checkpoint. Source-bound broad checks and preservation evidence remain private; production acceptance must match the deployed checkpoint. Archive, permanent removal, bulk operations and the rest of the full administration panel remain unfinished; this does not certify complete rules or open publication gates.

22 September 2026 — Recoverable room removal and restoration

Added administrator removal/restoration with a typed-room confirmation, persistent operator/player notices, removed-room directory filters, live authorization and atomic version/revision audit receipts. Removed rooms deny private reads, joins, actions, AI, seat changes and discussion; restoration keeps saved state, previous pause/join flags and credential revocations. Exact retries retain proof across refresh, lost responses and temporary removal. Independent review repaired stale client removal markers without discarding recovery drafts. The dedicated HTTP flow also exposed and fixed AI lobby readiness after a human joins or changes faction. Focused, browser and required source-bound evidence accompany this checkpoint. Full administration and authenticated deployed acceptance remain unfinished.

22 September 2026 — Neutral administrator lobby configuration

Added rules/modules, AI configuration and existing-human host assignment through public administrator controls. Genuine unused-lobby admission, existing engine calculations, atomic live authorization/version fences and durable audit preserve normal start gates, physical pieces and private seats. Exact tab-scoped requests confirm without reapplying after a lost response, refresh or later game start. Independent malformed-save review, focused regressions, actual HTTP/browser checks and required source-bound checks accompany the checkpoint. Full admin scope and authenticated production acceptance remain unfinished.

22 September 2026 — Administrator room creation

Added configured lobby creation with explicit new-host ownership, initial AI factions/difficulties, supported optional rules, invitations and the ordinary voluntary host-seat transfer path. Atomic live-authorized writes and saved account-bound requests keep retries from duplicating rooms or reviving revoked private-seat access. Normal readiness and preview gates remain. Full neutral lobby administration, participant support and authenticated production acceptance remain unfinished; verification evidence accompanies the checkpoint.

22 September 2026 — Administrator room pause and joining locks

Added reversible pause/resume and joining-lock controls, availability filters and public player notices. SQL fences cover joins, player actions, automatic normalization and AI workers, including in-flight races. Saved-seat recovery, handover, discussion and AI takeback remain available. Control changes and exact receipts are audited atomically, with expected account binding protecting stale administrator tabs. Local HTTP/browser evidence includes a lost successful response, refresh, one-record replay and resume. See scope and verification. Full lifecycle, admin tools and authenticated deployed acceptance remain open.

22 September 2026 — Readable room entry and completed-action text

Normal create/join now shows concise pending text while the first request runs; the existing full recovery panel is reserved for saved or uncertain requests and remains until explicitly resolved. Automatic-action notices retain text behind a local Continue control without gating rules, server actions or AI pacing. See readable notices and action feedback. Focused regressions, delayed/lost-response browser QA and required checkpoint checks accompany the change. Deployed evidence remains separate and required.

22 September 2026 — Administrator access and room directory prototype

The first admin panel slice adds personal operator-provisioned keys, live owner/operator/viewer permissions, separate persistent eight-hour sessions, current/all-session sign-out and a privacy-preserving room directory. Additive schema/trigger changes protect the last enabled owner, invalidate disabled-account sessions and retain safe audit events. Filters, paging, public roster inspection, refresh and mobile controls are connected; no existing game state is rewritten.

Independent review found and resolved malformed-roster search failure and a revocation race at directory reads. Focused auth/SQL/privacy tests, authenticated HTTP and local browser checks precede source-bound check/build/integration and deployed acceptance. Evidence and actual final results belong to the checkpoint report. Room lifecycle, creation, participant support, backups, audit browsing and complete administration acceptance remain open; AI refinement remains gated.

22 September 2026 — Administration and deployed verification added to the goal

The user requested a complete admin panel, including adding and removing rooms and other useful operational actions. The goal now includes room lifecycle management, participant support, backups/restoration, health views and audited, authorized administration. This is a requirements checkpoint only; no admin capability or live room change is claimed. Administration is explicitly part of the non-AI completion gate; the existing Git, selective-subagent, rules coverage and saved-game preservation requirements remain unchanged. The user also requires relevant browser acceptance against the actual deployment at https://dune.procrastination.games, matching its revision and preserving human games. The verification workflow records the distinction from local checks. No new production test is claimed by this documentation checkpoint.

21 September 2026 — Selectable Advanced preview

The user-authorized Advanced preview now has room-creation and host lobby selectors, renewed readiness after mode changes, an explicit preview start and a persistent unfinished-rules notice. It uses genuine setup for two through six classic factions, with the existing Tech Token and Stronghold Card options. Saved mode integrity, fresh-piece checks, authenticated recovery and concurrent-start tests retain authority, custody and privacy. All 57 base rosters complete setup with each of four existing legal AI profiles. Full rules compliance, expansion starts and publication remain gated; final verification evidence stays in the private checkpoint report and Git message.

21 September 2026 — Harkonnen forced exchange return

Special-Karama exchanges now return automatically when the entire combined hand is owed. A private saved inspection retains the actual drawn card faces; legacy forced saves describe their held-card observation without inventing draw origin. Real choices remain interactive. Shared settlement preserves suspended responses, auction recovery and physical custody. See scope and evidence. The existing unfunded-bid ruling and Advanced/publication gates remain open.

21 September 2026 — Completed-action feedback

Core committed movement, shipping, revival, collection and battle results now feed the existing house-colored notices and optional sound. Burst summaries retain every represented action count while limiting the visible/pending queue to three notices. Hidden pages consume updates silently and clear old feedback. See coverage and verification. Rules and AI strategy are unchanged; full visual acceptance and remaining power tags stay open.

21 September 2026 — Truthtrance physical-force questions

Current force facts compare normal, elite or total physical counters in reserves, the Tanks or an exact live board location. Shared controls and validation retain typed-counter availability, exclude concealed No-Field values and reuse private compound answers, legal AI replies, history and card disposal. Restored fact questions are reparsed; current answers do not constrain later force actions. See the scope and evidence.

21 September 2026 — Basic CHOAM ordinary Leader Skill integration

The existing genuine CHOAM setup now shares ordinary skill action guards for its Basic/base roster. Full-deck, card-sale, mandatory battle cleanup and saved market/Ghola replacement choices are covered by the integration contract. Auditor, Richese and other mode/module boundaries retain their separate gates. The Sandmaster/native-HMS source audit records an unresolved eligibility question rather than assuming an extra collection power.

21 September 2026 — Basic Ixians with Leader Skills

Genuine full-deck setup connects cyborg movement per origin, Sandmaster HMS entry and exit, Suk rescue before actual Tank substitution, Rihani precedence and exact green-Special mandatory disposal. Signed aftermath choices, private controls, legal AI paths, authenticated concurrent recovery and two-through-six-player samples accompany the integration contract. Existing missing effects and mode/publication gates remain; source-bound final evidence is stored outside the checkout.

21 September 2026 — Basic Tleilaxu with Leader Skills

Genuine Basic Tleilaxu setup now uses the full skill deck, native Rihani Face Dancer exchanges and response-driven own-leader revival choices. Completed Rihani history releases live custody only when later Face Dance begins; Zoal Smuggler collection uses opposing printed disc strength. Shared guards, private controls, legal AI continuation, authenticated recovery and two-through-six player samples accompany the integration contract. Existing unfinished effects and public completion/publication gates remain.

21 September 2026 — Basic Moritani with Leader Skills

The existing private initializer now connects Basic Moritani with base opponents and the full fourteen-card skill deck. Shared public-profile guards cover the movement, shipment, payment and battle paths; Terror death/revival and ally retention compose with physical skill/card custody. Focused genuine-setup tests, authenticated concurrent recovery and a reusable two-through-six-player sample profile accompany the integration contract. Existing unfinished effects, Advanced/other roster combinations and publication gates remain explicit; private checkpoint reports record actual final evidence.

21 September 2026 — public battle component display

Revealed plans now share one table area with exact dials, played leader portraits and readable card faces. Direct inspection and navigation preserve pending decisions; both players retain access when a post-reveal choice belongs to one seat. Sealed plans and unused hands stay out of this display. Battle components records scope and evidence; focused tests and independent review accompany private check/build, browser, preservation and Git results. No game rule, saved field or AI strategy changed.

21 September 2026 — Advanced Ecaz Loyalty

Genuine Advanced Ecaz setup now randomly sets one native Traitor Card aside face up before dealing. A persisted public identity, enlarged inspector and automatic notice connect to initial setup, Tleilaxu Face Dancers and Nexus replacements. Physical census and invalid-state checks preserve its separate custody; older already-dealt games stay unchanged. Ecaz Loyalty records official sources, sequencing interpretation, focused tests and combined-module limits. Independent review accompanies private check/build/HTTP, genuine faction samples, browser and saved-preservation evidence. AI strategy and release gates remain unchanged.

21 September 2026 — public faction-sheet inspection

Every table player now has a public faction inspector and the internal guide contains a twelve-faction gallery. Basic/Advanced preview uses shared reference text without changing the game or reading private state. Richese, Ecaz and Moritani receive shared guidance from settled contracts; stale CHOAM and Ecaz availability summaries are corrected. Faction sheets records scope, source boundaries and remaining text/interaction acceptance. Focused checks and independent review accompany private browser, check/build, preservation and Git evidence. No AI strategy or release gate changed.

21 September 2026 — private-hand browsing

The private hand now supports literal name search, printed-category filtering and stable display sorting. Physical card IDs, existing inspectors/actions and saved order remain intact; required choices stay outside the filtered row. Hand browsing documents empty results, reset, live changes and local-only filter lifetime. A stale Harass allocation availability sentence is corrected. Focused tests and independent review accompany the private final browser, check/build, preservation and Git evidence. No AI strategy or gate changed.

21 September 2026 — live Treachery and Spice draw counts

The table now shows both physical draw-pile counts above the board. The public projection excludes auction pools, hands, caches and discards, while keeping private card identities and order concealed. Draw-pile counts connect existing saved responses, empty/refill guidance and internal inspection help. Setup, actual draws/refills, skipped worms, Thumper exclusion, privacy and JSON/rendering checks accompany independent review and private final evidence. No schema, game action, AI strategy or mode/publication gate changed.

21 September 2026 — public force counter inspection

Every player now has Inspect forces, with enlarged diagrams, special subsets, advisor faces, board locations and native/foreign Homeworld accounting. The reference includes all twelve factions. Force inspection excludes concealed No-Field values and temporary strength bonuses from physical counts. Focused projections, rendering, genuine setup and JSON recovery accompany independent review and private browser/preservation/Git evidence. No game action, AI strategy, schema, mode or publication gate changed; the full goal is unfinished.

21 September 2026 — live Nexus offer withdrawal

An unallied sender can now see the recipient of its outgoing Nexus offer and withdraw it through the existing action. Public history distinguishes proposals, withdrawals and alliance breaks. Nexus offer controls retain the current quote, timing, readiness, card forfeiture and version fences. Focused full-table rendering, JSON continuation, legal AI participation and production SQLite race checks accompany the private source-bound browser, preservation, independent review and Git record. No strategy, mode or publication gate changes; the broader game remains unfinished.

21 September 2026 — ordinary bribe controls

Players can now initiate the existing out-of-turn bribe action, with server-derived recipient limits, private incoming escrow and public payment history. Limits preserve reserved funds and binding Truthtrance completions; existing Bureaucrat redirection and saved version handling remain authoritative. See bribe controls. Focused rules/projection/rendering and HTTP concurrency checks accompany independent review and private source-bound browser, preservation and Git evidence. Strategic AI negotiation remains deferred. The separately reviewed Emperor gift/Bureaucrat interaction remains pending; this work does not open mode or publication gates.

21 September 2026 — durable table discussion prototype

Public table conversation and direct human-seat messages now have usable controls, plain-text rendering, durable history and exact retries. Message SQL independently fences current credentials and membership, filters private channels before paging, and leaves game JSON/version, sealed choices and bot continuation unchanged. Recovery/handover transfers access to the seat's history; old credentials stop working. Independent review found and fixed committed-write/rotation and late unmounted-response retry races, with regressions. See table discussion for the complete boundary. Final source-bound checks, browser observations, preservation and delivery records belong to the private checkpoint. AI messaging, prose-contract enforcement and full acceptance remain open; no mode gate changes.

21 September 2026 — Storm and Spice Blow practice

The interactive introduction now has thirteen lessons and eleven independent Basic examples. Storm separates sealed dials, reveal and movement, using both first-turn and later-turn ranges. Spice Blow compares accumulation, storm loss, later Shai-Hulud and first-turn worm return, with Nexus beginning after the replacement blow. Shared live calculations keep exposure and placement consistent; no rules or save-schema change. Version 6 preserves all prior lesson identities and results. Focused engine comparisons, independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Full faction, worm-ride and expansion teaching and complete game acceptance remain open.

21 September 2026 — Kwisatz Haderach component inspection

The companion inspector connects original artwork, private battle-loss tracking and availability guidance, permitted full-plan and public revealed-plan components, and static reference inspection. Existing server projection remains the privacy boundary; no rules calculation, save migration or AI tuning changes. Focused rendering/projection/JSON tests supplement the existing battle/death/revival checks. Independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Manufactured-layout verification and full Advanced acceptance remain open.

21 September 2026 — Storm Card inspection

The Storm Card inspector connects six numeric reference faces, the existing private Fremen forecast and actual public reveal receipts in the chronicle. Inspection is read-only. Saved public records retain their original face after movement or Weather Control, separately from effective storm distance. Earlier text-only history remains valid; unknown component metadata fails closed. No AI strategy or rules mode changes. Focused projection/provenance checks, independent review, browser controls and final check/build/HTTP/preservation/Git evidence belong to the private checkpoint. Complete physical face/artwork and broader component acceptance remain unfinished.

21 September 2026 — Charity and Revival practice

The introduction expands to eleven lessons and nine Basic examples. Charity teaches the top-up to two spice; Revival teaches shared free allowances, paid force returns, the ordinary cap, leader eligibility and separate leader/force limits. Existing production calculations supply the costs and choices; a legal saved action history preserves cumulative spending and custody. All previous lesson identities and outcomes migrate to version 5. No live AI strategy or rules mode changes. Focused engine comparisons, independent review, browser controls and source-bound checks/preservation/Git evidence belong to the private checkpoint. Duke revival/loans retain their existing unresolved custody boundaries; the full curriculum and game remain unfinished.

21 September 2026 — Interactive Nexus alliance practice

The introduction now connects nine lessons and seven Basic examples. A four-player Nexus teaches mutual consent, unanswered offers, withdrawal and unilateral alliance breaks. An explicit later Mentat check contrasts three shared strongholds with the ordinary four-stronghold joint victory. Shared production pairing, progress and victory quotes preserve physical force ownership. The live engine retains phase/expansion checks and card forfeiture. Version 4 practice saves preserve all prior lesson identities and committed choices. Focused engine comparisons, migration and rejection checks accompany independent review and final source-bound browser/check/build/preservation/Git evidence in the private checkpoint. Broader teaching and all mode/publication gates remain open work.

20 September 2026 — Interactive ordinary bidding practice

The introduction now connects eight lessons and six Basic examples. The new Fremen bidding position teaches raising, passing and re-entry, full hands, all-pass termination, winner-only payment and private card inspection. Shared ordinary-auction quotes also serve the live engine without changing its funding, payment or reaction layers. Version 3 practice saves migrate every prior lesson by identity and validate exact bid history through replay. Focused engine comparisons and independent review are paired with final browser, source-bound checks, preservation and Git evidence in the private checkpoint. Broader teaching, rules and mode/publication gates remain unfinished.

20 September 2026 — Configure existing lobby AI seats

Lobby AI configuration connects host-only difficulty, faction and player-circle controls to a shared strict quote and authoritative lobby action. Seat identity persists, faction rosters follow existing setup, actual changes clear human readiness, and public history explains each change. Focused engine, SQLite/restart/concurrent-start and HTTP tests cover the bounded contract. Final independent review, browser, source-bound check/build/HTTP and saved-game preservation evidence belong to the private checkpoint and Git message. Existing AI strategies and mode/publication gates remain unchanged.

20 September 2026 — One-use named-player AI permission

The AI permission prototype connects optional owner consent to a named human and fixed difficulty for one activation within 24 hours. It retains ownership and private information, uses both exact session fences, atomic versioned activation/consumption, owner takeback invalidation and saved exact retries. Additive migration 0006 preserves existing rooms and seats. Independent review, focused SQLite/client/HTTP checks, browser acceptance and final source-bound check/build/HTTP/preservation evidence belong to the private checkpoint and Git message. No AI strategy or mode/publication gate changes.

The Sites platform audit found no supported durable trigger or alarm binding. Unattended resumption remains a platform blocker; no inert scheduler was added or claimed complete.

20 September 2026 — Movement and Traitor introduction exercises

The introduction now connects seven lessons and five Basic practice positions. Movement uses shared geometry/occupancy; Traitor call, decline and mutual betrayal use the production battle quote. Version 2 browser saves explicitly migrate every old lesson and preserve its previous choices. A hot-update state mismatch found in the browser is corrected by remounting the lesson component on schema change. Focused comparisons exercise 96 actual engine moves and all offered Traitor outcomes. Independent review and final browser/check/build, preservation and Git evidence belong to the private source-bound checkpoint. Full curriculum remains unfinished; mode/publication gates stay closed.

20 September 2026 — Sandmaster worm-ride prototype

Native Fremen worm rides collect one optional destination spice after legal placement and before faction arrival reactions. Shared server, control and minimal AI paths preserve source exclusion, typed force custody and normal movement. Existing atomic room writes and saved arrival decisions prevent repeated payment after concurrent requests or restoration. Empty/ambiguous piles, unsupported combinations and legacy actions preserve ordinary riding. Ten focused engine/control/SQLite checks and independent review cover the bounded contract; final check/build/HTTP, browser/sample and preservation results belong to the source-bound private checkpoint and Git message. No release gate is opened.

20 September 2026 — Smuggler battle collection prototype

Unmodified Smuggler collection binds the reveal-time pile and pays once after leader survival, including losing or captured leaders. Shared server/control/bot admission preserves the pending modifier and combined-module boundaries; deferred settlement before Sandmaster remains an explicit timing inference. Native face-up skilled discs are excluded from AI selection. New receipts preserve private saved continuation and old unversioned battles retain their prior behavior. Independent review and focused engine/SQLite evidence are paired with source-bound final checks, browser/samples, preservation and verified Git delivery in the private checkpoint and commit message. No gate is opened.

After the reported outage the server responded and all 1,106 baseline games matched their saved rows. The prior private QA seat restored after refresh. No restart, reset or maintenance automation was needed.

20 September 2026 — Interactive introduction prototype

Five guided lessons connect shipping budgets, sealed battle plans and spice collection to shared production rule quotes, with keyboard controls, card inspection and browser-local saved progress. The fixed opponent is a teaching example, not an AI match. The wider faction, movement, bidding, Advanced and expansion curriculum remains unfinished. Focused checks cover combat outcomes and saved-choice validation; final browser/check/build, preservation and Git evidence belong to the private source-bound report and commit message. No mode or publication gate is opened.

Independent Smuggler review supports the deferred survival receipt but found no official modifier-strength ruling. That single new question remains explicit in the decision register; no pending answer was inferred to enable collection.

20 September 2026 — Sapho early battle aggressor

Early aggressor connects the held physical card, existing pre-plan opportunity, shared tie priority, controls, four AI profiles and private saved continuation. It preserves participant slots and chooser, respects Habbanya in either slot, and checks Stone finishability before commitments. Later battle intervention and its unresolved allocation/response protocol remain unfinished. Independent review found no material rules/privacy blocker after final integration. Focused engine/control/SQLite evidence is paired with final source-bound checks, browser/sample reports, preservation and verified Git delivery in the private checkpoint report and commit message. Public mode and publication gates stay closed.

The Mirror admission audit supersedes its earlier ordinary-slice recommendation: every genuine CHOAM/Richese setup includes the unresolved copy candidates. A synthetic restricted deck, hidden eligibility gate or reveal-time rejection cannot establish playable full-game support. Existing user/source rulings remain pending.

20 September 2026 — Optional table sound prototype

Table sound controls add local mute, keyboard volume and a test sample, with short synthesized cues for public phase changes and tagged automatic actions. Silent baseline consumption, coalescing and background suppression avoid replaying old updates. Preferences survive refresh and synchronize between tabs; game actions, AI timing and saved state are unchanged. Focused audio/cursor checks and browser controls cover the connected prototype. Physical output, screenshot acceptance and final event coverage remain unfinished. Required check/build, preservation and verified Git delivery belong to the source-bound private report and commit message. No mode or publication gate is opened.

The reported outage left all 1,072 baseline games unchanged. The responding server was reused and the existing isolated seat reconnected without a database reset.

14 September 2026 — Harass revealed physical allocation

Connected ordinary/elite and multi-sector choices after public plan reveal, before Traitor declarations. Unique returns remain automatic; selected counters are public but stay on board until atomic Traitor settlement. The shared quote, player controls, four AI profiles and versioned saved decision preserve exact custody and existing mode gates. Winner casualties cannot choose a smaller physical commitment after its undialed complement has returned. See the allocation contract for source timing and limits; source-bound final evidence and delivery remain in the private report/Git message.

14 September — AI ordinary arrival preflight

AI arrival checks filter known unsupported ordinary shipment/movement candidates with the existing authoritative reaction quote. All four profiles retain executable alternatives, single reactions, faction exemptions and correctly routed Guild contributions. The public-input adapter never reads concealed Terror faces or rival private resources. Special routes remain on their existing adapters; no simultaneous reaction rule is invented. Source-bound same-seed samples, focused regressions, required checks, saved-game preservation and delivery are recorded in the private report and Git message.

14 September — reusable base player-count samples

The faction sample runner now also selects genuine base Basic/Advanced games at every player count from two through six. Original expansion defaults and seed offsets remain stable. A shared inventory check includes unsold auctions, nonnegative force/spice values, exact elite totals and subsets, and post-setup base Traitor custody. Rejected-action immutability and restored private rival boundaries are checked. Failed traces and snapshots remain replayable through explicit resume. This consolidates the repeated private harness corrections; it does not certify complete player-count rules or open any mode gate.

The Moritani Secret Ally source audit also records why a holder-only retention pause would leak its hidden Nexus. The existing shared UX question remains pending; no duplicate question or new timing policy was introduced. Focused and full-run results, source identity and delivery are recorded in the private checkpoint report and Git message.

14 September 2026 — Compound shipment promises

Shipment-only AND/OR extends the existing Truthtrance shipment question with whole-expression truth, complete destination search, controls and private AI answers. Earlier separate promises remain jointly binding, and legacy flat records retain their meaning. The existing timing/module gates and unresolved material questions stay in place. Source-bound final checks, browser continuation, private preservation and verified Git delivery are recorded in the checkpoint report and commit message. The opening baseline is 1,004 rooms.

14 September 2026 — Sapho remaining battle-choice order

The Sapho battle-order prototype adds first/last remaining Battle-phase choice through the existing physical card, hand controls, legal AI and saved state. The public chooser is separate from physical attacker/defender; old battle outcomes, storm order and tie rules remain intact. Accepted priority persists through complete aftermath and later changed board eligibility. This separation and phase duration are explicit implementation interpretations.

A fresh Reinforcements cost review found no authoritative resolution of its reserve payment versus a traitor win. The question has been sent to the user; the card remains disabled while independent Sapho work proceeds. Advanced Atreides accounting and same-plan Harass ordering remain separate unresolved combinations.

The checkpoint uses a 970-room preservation baseline, a separate browser lobby, focused rules/controls/AI/SQLite checks and independent review. Final complete-game, browser, broad-check and verified Git results belong to the source-bound private report and commit message. Public mode and publication gates remain unchanged.

14 September 2026 — Harass & Withdraw battle prototype

Harass & Withdraw now connects either physical card slot, category-aware private inspections, unique typed undialed returns before battle losses, successful opponent-Traitor cancellation and mandatory disposal. Both selectors, all four AI profiles and saved continuation use the shared physical quote. Existing Planetologist inspection and literal Truthtrance slot promises remain unchanged. Richese/Stone Burner timing, ambiguous allocations and optional-module combinations remain gated; public starts stay closed.

Focused rules, controls, bot and authenticated recovery evidence is paired with independent review. Final complete-game samples, browser checks, preservation, required broad checks and Git delivery are recorded in the source-bound checkpoint report and commit message. This is a connected prototype, not full rules certification. All 936 opening games and 1,959 seats survived the reported outage unchanged; the healthy server was reused without resetting saved state or recreating automation.

14 September 2026 — Recruits independent-card preview

Recruits is connected in an explicit development preview. Genuine Basic/Advanced faction setup includes all three independent Ecaz Treachery Cards before shuffle and deal. Physical play/discard, public effective rates, shared revival quotes, exact free-use tracking, existing CHOAM/Tleilaxu response continuation, owner controls and all four AI profiles share the authoritative contract. Inactive games retain their earlier free-use arithmetic. The other two battle effects and public variant starts remain unfinished.

Source review supports the bounded clean-case contract. The independent seven-force cap after faction cancellation remains an explicit inference. Earlier-paid returns, late grants, pending repricing and same-turn recovered-card replay remain gated; the user's late-paid question is pending. Focused rules, controls, genuine local setup and authenticated recovery tests accompany the implementation. Complete-game and browser evidence, required broad checks and Git delivery are recorded with the checkpoint; this does not certify complete variant or combined-mode compliance.

All 902 opening rooms and original seat/recovery records survived the latest power failure unchanged. The healthy server was reused; integrity and foreign keys pass. No database reset, server restart or recurring automation was needed.

Final independent review's 37-case union and four SQLite recovery cases pass. Review closed normal-auction sale aliasing, malformed canonical cards, known-zero legacy ledger initialization, seat-control validation and ordinary-start bypasses. Eight genuine six-seat Basic/Advanced samples finish in 7,995 accepted actions, with zero rejected candidates and three Recruits plays. Every action preserves physical card/Traitor/force/elite custody; 212 periodic all-seat JSON restores and terminal views pass. The conserved browser exercise verifies play/discard, global rates, four free returns, explanatory chronicle, private seat and refresh. Earlier harness attempts remain preserved; JSON comparison normalizes undefined properties on both sides without dropping defined values.

14 September 2026 — Fremen/Ecaz final-turn victory and deferred shipment repair

The explicit Sietch Tabr FAQ now reaches automatic victory resolution: reciprocal Ecaz/Fremen allies with fighters there may satisfy the Fremen final-turn condition. The same public quote drives territory/blocker guidance; the chronicle explains a successful special win. Solitary/nonallied Ecaz, unrelated fighters and the unsupported Habbanya extension retain their existing exclusions. Effective advisor and concealed-marker presence, ordinary stronghold/prediction precedence, Guild fallback and existing no-Guild behavior are preserved. This adds no mandatory confirmation or schema.

Independent source/privacy review found no blocker. Seventeen focused cases pass, including Basic/Advanced outcomes, all four AI profiles, JSON/private views and authenticated SQLite restoration before and after final readiness. Concurrent last-ready requests commit once; stale/finished requests do not write. Exact cards, Traitors, forces, elites and seat records are preserved. Final-turn positions are explicitly staged after genuine setup, including the reciprocal alliance and a turn-ten Fremen prediction, rather than claimed as natural full-game outcomes. The broader existing victory regression union passes 83 cases. A fresh browser room verifies the public guide, actual Ready-to-win transition, explanatory log and pending/finished refresh. Private read-only comparison confirms unchanged spice, cards, Traitors, leaders, forces, elites and seat records.

A genuine Advanced sample also exposed the pre-existing Guild shipment deadlock: an accepted declaration could not pass an Ambassador/BG arrival overlap. Prior HEAD replay reproduced all 90 actions. Fresh ordinary/No-Field preflight and narrow, typed saved-declaration recovery now avoid the trap while preserving unresolved reaction-order gates. Independent review resolved an early No-Field window bypass and malformed special-marker handling; its 149-case union passes, including three authenticated SQLite cases.

The exact failed snapshot finishes after 842 further accepted actions, with 109 guarded candidates, on turn ten for Guild. The original Basic/Advanced seeds finish in 563/806 accepted actions with 14/81 guards, on turns seven/nine for Guild/BG. All 58 periodic JSON rounds, twelve terminal private views and physical custody checks pass against unchanged gameplay source. The Advanced runs form Ecaz/Fremen alliances, but neither uses shared Tabr or its special victory. The saved continuation uses a documented new random stream; no failed seed or snapshot was silently replaced. Simultaneous arrival integration remains open.

The latest reported outage preserved all 835 opening games and original seat records. All 869 current rooms are backed up before final verification, and the finished browser seat restores correctly. The healthy server is reused.

Browser and complete-sample evidence, types/lint/offline/build/HTTP results, source fingerprint, saved-game preservation and verified Git push are recorded with this checkpoint. The running server is reused; complete rules coverage, all combinations and publication remain gated.

14 September 2026 — Moritani Assassinate Leaders prototype and outage preservation

Assassinate Leaders connects native Advanced Moritani's qualifying battle loss to private reveal/continue controls, a different opposing-faction Traitor Card, live-target death and bank bounty, and automatic Mentat replacement with a public set-aside marker. Dead targets remain legal with zero bounty. All four AI profiles use the owner's legal choices; one use per faction and physical held/reserve/retired custody persist across saves.

The explicit local preview excludes exceptional captured/foreign leaders and combined modules. A uniform private step prevents hidden eligibility leaks but awaits the user's UX decision. Normal traitor-call duration also remains unresolved; a recorded call guards later use without declaring a publisher ruling. No ordinary start or publication gate opens. The checklist records the bounded prototype.

Independent source/privacy/persistence review and 32 focused cases pass. Separate battle obligations bind cleanup, normal-call logs wait for public revelation, and replacement custody rejects missing cards and forged same-turn consumption chains. Five SQLite cases cover authenticated pending/resolved restoration, Truthtrance interruption, competing writes, stale/duplicate actions and corrupt saved receipts.

Two genuine Advanced four-profile games finish in 296/101 accepted actions, with zero rejected candidates, ten periodic JSON rounds and all eight final seat views restored. Exact physical custody holds. Two opportunities are declined; these samples do not exercise an assassination reveal. A separate conserved, staged browser battle verifies Master Bewt's death, three-spice bounty, retained card, automatic Mentat replacement, public marker, context-correct readable inspection, and pending/resolved refresh. The QA game remains at human Terror placement.

After the reported power failure, all 801 opening games remain unchanged and the healthy server is reused. Final types/lint/offline/build/HTTP results, source fingerprint, preservation of room and seat/recovery records, and Git delivery are recorded in the verified commit and private report. The full goal remains unfinished.

14 September 2026 — Truthtrance recorded knowledge and outage preservation

Truthtrance knowledge connects stored Bene Gesserit prediction faction/turn, a respondent's active submitted storm dial and the card actually known to native Advanced Fremen. Server validation, target-only answer projection, compound controls, all four AI profiles and saved continuation share the same eligible facts. Missing knowledge stays unknown; only the aggregate answer becomes public and a definite answer consumes the physical card once. This does not implement general future commitments or AI question strategy.

Independent source/privacy review and 13 new cases pass; the focused union passes 44, including five authenticated SQLite recovery cases. Review fixed missing comparison controls, parent selector mapping and the invalid-input submission guard. Recovery covers pending questions and interrupted storm peeks, private seat views, dishonest/stale/duplicate requests, competing writes and malformed saved predicates without state or physical-custody corruption.

Two genuine-setup games using all four profiles finish with zero rejections: Basic 192 actions/five periodic JSON rounds; Advanced 518/fourteen. Exact card and force custody holds, including all eight restored final seat views. Three scripted questions use naturally held cards and cover prediction faction, prediction turn and submitted dial. Forecast coverage comes from the separate browser exercise, whose only staged acquisition relocates two physical Truthtrances. That exercise verifies invalid input, unknown/rephrasing, both compound clauses, a forecast comparison and refresh following submission and final resolution.

After the reported power failure, all 767 opening rooms and original seat/recovery records match the backup. Integrity and foreign keys pass; the healthy server is reused. A fresh snapshot protects all 768 rooms before broad checks. Final broad results, source fingerprint, post-HTTP preservation and Git delivery are recorded in the verified commit and private report. Completion/publication gates remain.

14 September 2026 — Emperor Nexus revival prototype and outage recovery

Emperor Secret Ally now connects exactly three additional free force returns in Basic/Advanced base-faction Nexus games. It preserves ordinary force/free allowances, shared Advanced Fedaykin caps and physical card custody, without a public pause or forced pass. Private legal controls, four AI profiles, JSON continuation and production SQLite recovery are connected. Independent review validates phase-wide timing and private receipts; 17 focused effect tests cover illegal/stale/competing requests and later Ghola. The separate purchase alternative remains pending its uniform payment UX question.

Two genuine-start samples finish (Basic 715 actions/19 periodic JSON rounds; Advanced 263/7), with no Emperor use. Two explicitly staged continuations finish in 18 and 17 actions with one normal-force return each. All candidates are legal; exact Treachery, force, elite and Nexus custody holds, and all 14 final seat views restore unchanged. These samples retain their setup and coverage limitations. The separate staged browser game exercises a Fedaykin return, then three ordinary revivals, unchanged spice, readable inspection and refresh recovery. The reusable local prototype writer adds genuine Nexus setup without opening public starts.

All 733 opening games and original seat/recovery records survived the reported power failure unchanged. Integrity/foreign keys pass and the healthy server is reused. A new snapshot protects all 734 rooms before final checks. The verified commit and private report record required broad checks, source fingerprint, post-HTTP preservation and Git delivery. Full module and publication gates remain.

14 September 2026 — Bureaucrat payment prototype and outage preservation

Bureaucrat now connects optional two-spice redirection for ordinary auction, Guild shipment, Richese auction and actual bribe payments in the bounded base/CHOAM Leader Skills profile. Native income cancellation resolves before the offer; the payer is charged once and the original callback resumes once. Decline leaves later opportunities available, and bribe proceeds remain unspendable until Mentat Pause. The physical-card use ledger survives ownership changes. Payment-unit guards, composition inferences and missing families remain explicit; no public mode or publication gate is opened.

Owner controls and all four AI profiles use public payment information. Independent review covers saved receipts, private projection, costs, custody and callback ordering. Review found and fixed duplicate use-event corruption and an overly broad guard on Bank-bound independent Karama shipments. Focused regressions cover those defects, auction/card delivery, real Bene Gesserit advisor continuation, bribe escrow, private SQLite restoration and competing version writes.

Four controlled-shuffle genuine-setup games complete with zero rejected actions: base Basic 718 actions/20 JSON restores, base Advanced 551/15, CHOAM Basic 681/19, and CHOAM Advanced 174/5. Full physical card, force and skill custody is checked. None reaches a Bureaucrat payment decision, so those samples establish bounded regression continuation only. A separate conserved staged browser game allows one five-spice bribe and redirects two from a second: ten is paid, eight stays in bribe escrow, and only one skill use is recorded. Both pending and resolved states restore after refresh with unchanged physical custody and private projections.

After the reported power failure, all 699 opening games and original seat/recovery records matched the private backup. The database passed integrity and foreign-key checks and the server remained healthy. No restart or reset was needed. Final broad results, source fingerprint, Git delivery and post-HTTP preservation totals are recorded in the checkpoint commit and private verification report.

13 September 2026 — Private Mentat question preview and outage recovery

Mentat has a connected private pre-plan question preview: canonical named weapons, a uniform target-owned card-show step, owner/target-only historical observations and subsequent leader concealment before faction powers. The shown card stays in hand and does not bind a plan. The private opt-in is absent from player views and cannot be enabled through actions. Ordinary Leader Skills games remain unchanged pending the user's forced-response UX exception decision; empty hands skip with an explicit unavailable receipt and no fabricated answer.

Independent review and 22 focused tests cover legality, custody, sequencing, private controls, all four AI profiles, JSON/SQLite restoration and stale/competing writes. Two complete genuine-setup samples deliberately deal Mentat through a controlled initial skill shuffle: Basic 100 actions/3 JSON restores, Advanced 507/14, each with one private observation and no rejected candidate. These are bounded preview paths, not complete skill or expansion acceptance. The separate browser QA uses a staged conserved battle and verifies private disclosure, a readable inspector, refresh recovery and the right to conceal after asking.

After another reported power failure, all 665 opening rooms and original seat, recovery and receipt rows matched the backup. A fresh backup captured 666 rooms, including the isolated preview; database integrity and foreign keys passed. The existing server responded at localhost:3000, and its lock prevented a duplicate start. The saved Mentat browser seat restored its hand, resources, observation and pending posture. No reset, recurring automation or publication was introduced. The verified Git checkpoint records final broad results and preservation counts.

13 September 2026 — Deferred movement arrival safety and reusable samples

Deferred movement fixes the combined Advanced sample's accepted CHOAM decline deadlock. The actual conflict was a qualifying Ambassador and Terror at the same destination. Fresh movement checks existing arrival guards before native prevention windows or new Ornithopter commitment. A saved explicit CHOAM decline can return an uncommitted unsupported move for another choice; its existing reserved card remains available and retires once when the replacement use finishes. Unrelated exceptions still reject atomically, and Karama cancellation still validates arrival before spending its cost. No simultaneous-arrival order is invented; that material question remains pending.

Independent review covers rules, custody and private continuation. Focused regressions exercise native Ixian/Fremen declarations, ordinary single-token arrivals, saved legacy choices and Ornithopter escrow. In-memory production-room checks cover authenticated decline, restoration, stale/duplicate ownership and concurrent version races. The final checkpoint records actual broad results.

tools/faction-games.ts replaces repeated private simulation copies with six fixed genuine-setup scenarios, all four profiles, physical custody checks and JSON restoration. It records private traces, failed snapshots, source fingerprints and explicit nonzero failure. Snapshot resume records provenance and starts a new seeded continuation stream. Full-game samples remain evidence of their particular paths; rejection counts and any later guards are retained in the checkpoint. All six fresh samples completed. Combined Advanced finished at turn six with 1,303 actions, 35 JSON restores and 46 guarded arrival candidates. The exact prior failed save separately finished after 691 additional actions, 18 restores and 39 guarded candidates. The detailed feature document records the limitation.

After the reported outage the server was healthy, all 632 opening games and their original seat/recovery records matched the private backup, and existing Ecaz and Ixian QA seats restored their private hands and pending choices in the browser. No restart or reset was needed. Public starts and publication remain gated.

13 September 2026 — Expansion faction setup and saved Ixian auction decline

The faction development profile connects all seven nonempty expansion selections to genuine Basic/Advanced setup and existing faction controls, AI and saved continuation. Ecaz now allocates six starting forces within Imperial Basin, keeping fourteen in reserve; Fremen, Advanced Bene Gesserit and Moritani placement ordering is preserved with its printed and inferred boundaries documented. The optional Ecaz Treachery variant stays separate, ordinary decks contain 33/35/47 cards, and Richese keeps its separate ten-card cache. Public starts remain gated.

Combined play exposed an existing Ixian Technology/Richese special-lot deadlock. A saved explicit per-lot decline now opens the original cache or Black Market lot without using Technology, changing its card custody or revealing a concealed card. Exact event, round, declaration and custody validation protects view, normalization and actions, including Gift/Truthtrance interruptions. Competing uses of the reserved offered card are rejected before creating responses. The actual exchange still needs its recorded replacement-custody interpretation.

Focused setup, controls, legal AI, private JSON/SQLite continuation and concurrent write checks pass, with independent review of rules, custody and persistence. Five of six genuine mixed-profile samples finish. Combined Advanced progresses past three special-lot declines to turn three, then stops on an existing CHOAM movement/Ambassador arrival guard. Guarded arrival candidates also occur in the Ecaz samples. These are explicit remaining integration limits, not full expansion acceptance. The detailed feature document retains exact sample metrics.

The browser verified genuine Ecaz traitor/force setup and refresh, then a separate Advanced development game's saved Ixian decline, unchanged offered card, legal bidding and private hand restoration. After the reported outage, all 597 opening games and original seat/recovery records matched the backup. A stale server module cache required a restart after a fresh 598-room backup; every room matched before QA resumed. Required broad checks, final preservation totals and source fingerprint are recorded in the checkpoint commit and private report. No database reset, recurring automation or publication was performed.

13 September 2026 — Diplomat base-defense copying prototype

Diplomat now optionally counts one committed Worthless as an opposing base Shield or Snooper, including to save its native trained leader. The owner chooses after public plan reveal and before traitor decisions. Exact physical plans and cards stay in place; the selected Worthless is discarded after battle even on a win. This timing and explicit-discard precedence over ordinary traitor retention are recorded implementation inferences, not additional printed rulings. Lower retreat and modified/combined defenses remain unfinished.

Player controls, all four legal AI paths, public projection and saved decisions are connected. Independent review and focused SQLite restart, concurrent copy or decline, corruption rejection, self-protection and traitor-preempted discard checks cover this boundary. Two genuine four-profile samples completed without rejected candidates: Basic used 210 actions and six JSON restores; Advanced used 223 actions and seven restores. Neither encountered an eligible Diplomat offer; targeted battle checks establish the effect. A fresh browser scenario restored the pending copy, saved native Hasimir from poison, discarded Baliset exactly once, kept Crysknife and restored the private hand/traitor plus four board forces, fifteen reserves, one Tank and eight spice. Required broad results are recorded in the checkpoint commit and private report.

After the new outage report the server responded normally, database integrity and foreign keys passed, and all 563 opening rooms plus their original seat/recovery records matched the backup. No restart, reset or automation was required. Public mode and publication gates stay closed.

13 September 2026 — Smuggler with owned Richese No-Field

The officially permitted combination now ships one separate free physical force alongside a concealed marker at its unchanged price. The private panel, shared AI quote, both cancellation/interception stages and saved continuation are connected. Revealing zero/three/five tokens preserves all physical forces; bots can reveal a zero marker accompanied by a real force before movement. Genuine CHOAM & Richese Leader Skills setup uses the sourced two-card deck addition or replacement without duplicate Ix cards. Public starts remain gated.

After the outage report, the healthy existing server was reused. All 529 opening games and their seat/recovery records matched the private backup. Focused tests, independent recovery review, browser evidence, required broad checks and final preservation/Git results are recorded in the checkpoint commit and private report. Allied No-Field and remaining combined modes are unfinished.

The first broad check exposed two deck/gate expectations and a randomized recovery test incorrectly asking an unautomated human seat for an AI action. The deck assertions now match the sourced inventory while other audit starts retain their gate. The recovery test now submits an explicit legal human choice. The failed report is retained separately from final verification.

13 September 2026 — Sandmaster movement collection prototype

Sandmaster now collects optional spice from distinct territories entered along explicit legal ground routes. Shared human/AI choices retain each source sector, path and selected pile. A Fremen movement response preserves the original declaration; cancellation collects nothing and successful completion transfers each board spice once before arrival reactions. Internal saved proofs remain outside player projections.

Independent rules and persistence review, focused legality/custody/privacy tests and SQLite continuation cover this boundary. Broad checks, browser and sample-game evidence and saved-game preservation are recorded in the checkpoint commit. Special relocation, combined modules and multiple-pile collection remain missing; no public mode or publication gate is opened.

13 September 2026 — Spice Banker battle commitment prototype

Spice Banker connects one through three sealed own spice to a selected skilled leader's surviving battle strength. Funds remain separate from force support and unavailable for other spending. A sole successful traitor caller keeps the commitment; other outcomes pay the Bank even on leader death, while death removes the bonus. Printed disc values and bounties stay fixed.

Owner/full-plan inspection and public reveal display the amount at their proper times; all four AI profiles submit funded choices. Independent source and persistence review, private SQLite restart, rejected diversion, concurrent final resolution and legacy omitted-field continuation cover this boundary. Two seeded Basic/Advanced samples finished without rejected candidates but did not use Banker spending; targeted tests establish the effect. The browser checked a three-spice commitment, pending refresh, actual +3 strength and payment, then restored one board force, fifteen reserves, four Tanks, two spice and the same private cards. Broad results and final preservation are in the checkpoint commit.

Normal income remains pending a user ruling about already-earned public spice when the trainer dies or is captured before Mentat Pause. Combined modules and complete skill acceptance remain unfinished; no mode/publication gate is opened.

13 September 2026 — Smuggler reserve shipment prototype

Smuggler shipping connects one optional free accompanying force for an empty-territory off-planet shipment. The shared quote preserves actual reserve/elite custody, Guild rounding and real recipient payments. UI controls and all four AI profiles explicitly choose the bonus; declining and legacy unstamped declarations preserve ordinary pricing.

Independent review found saved quotes could lose their required Guild decision. Read/action integrity now binds the declaration to its unique current or saved interception, rejecting missing/mismatched decisions or removed discounts. The first broad run also exposed a random Discovery fixture that searched only the undealt deck for Karama. It now relocates an existing card from its actual zone and asserts the complete physical card inventory is unchanged. SQLite restart, concurrent allowance, stale replay and old quote recovery pass. The browser exercised the price toggle, three physical arrivals for two spice and refresh with the same private hand. Two Basic/Advanced samples finished without rejected candidates but did not use Smuggler; targeted checks cover it.

The latest outage left the existing server healthy. All 427 opening rooms were unchanged and a new backup captured 428 rooms. No restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. The lower battle effect and combined routes remain missing; no rules-mode or publication gate is opened.

13 September 2026 — Leader battle effects prototype

Battle effects connects lower Mentat +2 strength, Bureaucrat occupation penalties and automatic Sandmaster board spice, plus both Rihani private inspection and committed optional exchange. Shared quotes, owner controls, all four AI profiles and saved continuation form usable prototypes. Three normal bands and Spice Banker, Diplomat and Smuggler remain missing.

Independent review found a completed Rihani receipt was not bound to current custody during battle cleanup. Decline/exchange now preserve and validate exact deck order; regressions cover corruption, replay and SQLite concurrent writes. A fresh genuine browser setup followed by a conserved staged battle exercised private inspection, separate draw, pending refresh, public return and completion. Two Basic/Advanced samples finished with no rejected candidates but did not trigger Rihani; they do not certify its integrated full-game behavior.

The server remained healthy after the outage report. An online backup preserved 393 opening rooms; no restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. No rules-mode or publication gate is opened.

13 September 2026 — Suk Graduate casualty rescue prototype

Suk Graduate connects both printed bands through shared physical casualty quotes, owner controls, all four bot profiles and durable battle continuation. A face-up trainer returns exactly one casualty to reserves; a surviving selected leader may save up to three, keeping one in its original sector and returning the others. Raw casualty choice and paid support remain unchanged. Elites retain their identity. Sole legal normal rescues are automatic.

Independent rules and implementation review found two custody defects: a stale dead face-up trainer could retain a skill, and a pending rescue was not bound to its actual skill assignment. Both now reject before mutation, with regressions. Saved receipt, missing continuation, replay, killed/returned captives, ordinary and elite rescue, JSON restore and SQLite concurrent submission are covered. The final Suk/Leader Skills focused union passed 46 tests, including the private assignment restriction, usable alternate selection and all four bots. New Advanced Atreides selection is unavailable while the existing Kwisatz Haderach loss-count question is pending; old assigned saves retain preflight protection. Seven other skill effects and combined modules remain unfinished.

Genuine module setup in fresh browser room BD33WTTV assigned Suk Graduate to Hasimir Fenring. A separately staged conserved battle then exercised the actual rescue control: three casualties saved, one kept in sector 10, two returned to reserves. Refresh preserved two board forces, seventeen reserves, one Tank, the private Crysknife/Baliset/Burseg and winner card cleanup. Two four-profile samples completed Basic/Advanced games with 92/188 actions and 3/6 JSON restorations, respectively. Neither encountered an eligible rescue; targeted tests and browser play establish that effect. These are bounded prototype samples, not calibration or full rules acceptance.

The latest reported outage left the existing server healthy. A fresh online backup captured all 360 rooms. All 359 opening rooms and their seat/recovery records remained unchanged; the new QA seat restored after refresh. No restart or reset was needed. Required broad checks and final preservation are recorded in the checkpoint commit and source-bound private report. Public Advanced, expansion, module and publication gates remain closed.

13 September 2026 — Planetologist movement and green-Special battle prototype

Planetologist now connects capped extra range, a single movement from two territories to one destination, and the surviving skilled leader's +2 green-Special battle substitution. Fremen cancellation preserves the independent skill bonus and both saved origins. Human controls, all four bot profiles and authoritative saved continuations use shared eligibility/range rules. The exact nine base Specials retain physical custody and never activate their normal effects through the battle slot. Mandatory discard includes traitor wins; that later-card-specific reading remains explicitly identified as an inference.

Independent review fixed stale saved battle plans accepting an already-dead skill leader; the original reproducer now rejects without mutation. Another integration check found appended skill moves were bypassed by ordinary candidates: they now share the existing public destination ordering. All four profiles actually choose and legally execute range and gather moves in targeted first-choice fixtures. The final focused union passed 84 tests. The first broad run stopped at lint because six new test declarations lacked the required explicit promise marker; those declarations were corrected before repeating the checkpoint check. Two four-profile sample games finished: Basic seed 20260916, 194 accepted actions and six JSON restorations (range and gather both executed); Advanced seed 20260917, 186 accepted actions and six restorations (range executed). Neither rejected a proposed action. These are bounded samples, not AI calibration or complete module/combination acceptance.

Fresh browser room TQWK5AEY used genuine Fremen/Emperor setup and selected Planetologist/Stilgar. The range-three control became available, then a real gather moved two Sietch Tabr forces and one False Wall West force to Wind Pass using one movement. Refresh restored 5/2/3 forces, the private Crysknife/Burseg and the skill. A separate targeted battle fixture in this new QA room relocated one physical Family Atomics from the deck and placed Emperor reserve forces. The actual weapon selector, plan reveal, traitor loss and mandatory discard were exercised. The Shield Wall remained intact; dead Stilgar returned the skill, and refresh preserved the remaining hand and losses. This fixture is not a naturally reached full game.

The server remained healthy after the user's outage report; no restart was needed. All 325 opening rooms were privately backed up and unchanged after browser QA; one new test room was added. Required broad checks and final preservation counts are recorded in the checkpoint commit and source-bound private report. Eight other skill effects, enemy-only mixed BG gather arrival, expansion rosters/cards and optional-module combinations remain unfinished. No public gate is opened.

13 September 2026 — Leader Skills setup, five disciplines and skilled capture

The first connected prototype adds all fourteen physical cards and readable faces, source-ordered private setup, public battle posture, five card-role strength modifiers, death return and own-leader revival through controls, all four AI profiles and saved actions. The other nine effects remain missing; combined modules and public starts remain gated.

The user's requested capture research resolved publicity through the known card's required movement with the leader. Harkonnen gets only its lower battle effect; surviving return and death retain physical custody. This is a component-based source inference. Captured replacement entitlement stays separately unresolved and explicitly guarded.

Independent review found and fixed a Voice/mandatory-leader deadlock and invalid simultaneous assignment/offer custody. Focused capture review found no remaining blocker. The focused union passed 66 tests, including genuine setup, scoring, capture and SQLite restart/concurrent setup and revival selections. Three sample games finished; their exact scope and source fingerprints are recorded separately. Browser setup, card inspection, AI assignment and refresh were exercised in new room REF6YHN7; narrow sidebar cards were made readable. All 291 opening rooms were backed up before QA. Final preservation and broad check results are recorded in the checkpoint commit and private report.

The first broad run passed types/lint and 4,410 of 4,411 offline tests. Its one failure was an existing Discovery privacy test treating treachery-32 as a substring match for hidden treachery-3. The exact physical pair now forms a deterministic scenario and assertions compare complete JSON string identities; the opponent's own card remains visible. Independent review and all six Discovery runtime tests pass. The broad run was repeated after this correction. During the follow-up, another user-reported outage stopped the server. All 292 games survived; a fresh backup and necessary server start restored the same private prototype seat and pending Storm choice.

The first broad run also exposed a pre-existing random Discovery test failure: the hidden identifier treachery-3 matched the viewer's distinct treachery-32 through a substring assertion. The regression now stages both physical cards and checks their complete identifiers; no production privacy behavior changed.

13 September 2026 — Sapho first after completed movement turns

Extends the existing clean-boundary movement contract to let Sapho's holder act first among remaining unstarted turns after earlier players fully finish. Completed shipment resources, forces, cards and counters stay intact. Advanced Guild priority remains guarded until Guild finishes. Current private controls, all four AI profiles and persisted room actions reuse the same legality check; the card is discarded once. Other Sapho modes and release gates remain pending. See runtime scope.

Four new engine tests include genuine Advanced setup and owner-only rendered controls. One independent SQLite test exercises real completed shipment, restart, concurrent claims, physical custody and replay rejection. Independent review found no blocker. Checkpoint-wide results and the final source fingerprint are recorded in the commit and private report.

The user reported a power outage during this work. The existing server was healthy, all 291 rooms were present, SQLite integrity/foreign-key checks passed, and all 218 rooms in the prior opening baseline matched. QA room 2EMYG4CY restored its same private hand, resources and pending Storm choice after refresh. All 291 rooms were backed up before further work; no reset or restart occurred.

The independent Leader Skills source contract supplies the complete fourteen-card inventory and shared lifecycle for the next batch. It records unresolved edges and establishes no runtime prototype or mode gate.

13 September 2026 — Discovery location effects prototype

Adds automatic unambiguous Jacurutu battle income, an owned Testing Station storm adjustment and physical Shrine card substitution through existing Karama and Truthtrance paths. Decisions and committed effects preserve JSON/SQLite continuation, physical custody and private information. Testing Station cannot change Weather Control; Jacurutu counts opposing physical losses, not the wheel alone. See the prototype scope and rulings.

Orgiz, contested Cistern/Testing Station and mixed-force Jacurutu remain pending. Normal module/Advanced starts and publication stay gated. Targeted browser room A5EJQ2W4 exercises station choice and refresh after real setup/reveal/entry with QA positioning. Independent review and focused regressions cover all three functions; required broad results, source fingerprint and preservation of all 187 opening rooms are recorded in the checkpoint commit and private report.

The preceding ab0ab52 entry/flight checkpoint passed 4,313 offline tests, build and 40 HTTP tests. Its outage recovery and 156-room opening baseline are historical results; the current batch keeps every game created afterward.

13 September 2026 — First connected Discovery prototype

Connects genuine base-faction Basic/Advanced audit setup to all seven sourced Spice Cards and eight opaque physical tokens. Great Maker resolves worm effects, an ordered majority vote and a free Fremen reserve ride. The six Discovery blows destroy prior forces/spice before their new blow and separate token placement. Private faction peeks and Collection inspection/reveal lead to exact stash rewards, a saved full-hand draw/discard choice, carried Ornithopter custody and five public nested locations; only Jacurutu contributes stronghold victory. Shared human/AI controls and JSON continuations accompany the actions.

This is Prototyped progress with Partial coverage. Next-turn free entry, the five special location benefits and Ornithopter spending remain missing. The normal public module start gate stays closed. Great Maker first-turn skipping, Sandtrout suppression and empty-token-supply behavior remain identified source inferences for refinement, not new confirmed rulings. See the prototype boundary and dependency queue.

Focused component, runtime, Great Maker, board/admission, private-control and SQLite recovery checks pass. Two seeded Basic/Advanced games finish while preserving components; browser 3RJBH26Y verifies genuine Fremen setup, a real Discovery blow, native private peek and enlarged card guidance. Review repaired lost encounter/arrival controls and an unfinished overflow discard. Broad verification and preservation results are recorded in the checkpoint commit and private source-bound report. No complete-module certification is claimed.

13 September 2026 — CHOAM Nexus Collection prototype and Discovery inventory

Adds the missing absent-CHOAM Secret Ally Collection trade through the engine, private physical-card selector/inspector, all four AI profiles and JSON discard continuation. Both cards are spent for exactly two bank spice; stale actions, competing SQL writes and saved replay cannot duplicate the payment. The separate battle inspection remains missing. See contract and scope. Independent review found a queued Grumman Collection lock mismatch; the server and private offer now share that automatic-continuation block.

A bounded acquisition helper resolved all Discovery component identities and card placements. No Discovery runtime is claimed. Focused trade tests pass; checkpoint-wide check/build/HTTP results are recorded in the verified commit and private source-bound report. Existing mode and publication gates remain closed. No server restart or saved-game reset is needed.

13 September 2026 — Genuine Ix expansion prototype

Connected Basic/Advanced Ix setup with both expansion factions, the complete 47-card Treachery Deck and Sandtrout through the existing game pipeline. A local prototype command backs up the named fresh lobby, starts it once with a version comparison, and preserves every seat and other room. The normal start gates remain closed. The checklist now separates Prototyped progress from Partial rules coverage. See Ix prototype.

Six new focused tests cover private setup at all four profiles, exact starting forces, Face Dancers, cards, JSON restoration, immutable rejection and the local SQLite writer. Two reproducible full games use seeds 2026091301 (Basic) and 2026091302 (Advanced), including both expansion factions and physical inventory checks. Review caught a saved JSON version mismatch, now corrected and covered. Browser room W5LE6VFB verifies genuine human Ixian setup, private refresh, Weather Control and mobile stronghold placement; owned autopilot then continues the same game. Final broad checks, later browser outcome and preservation results belong to the verified checkpoint. No complete expansion certification is claimed.

13 September 2026 — Atreides full-plan interaction verification

Replaced the full-plan suite's Basic-then-flip fixture with genuine Advanced initialization and added five tests for Truthtrance, Voice, ordinary Prescience, Ghola preparation and private full-plan inspection. Seventeen focused tests pass, including seven interruption windows and all four profiles. The tested native runtime paths needed no change. Independent source and test review found no publisher-backed defect, while preserving the unresolved special offer/deadline and target-first interpretation. See the timing audit for exact evidence and limits. Browser room AZC4HGLB verifies human special inspection, Medium AI Ghola preparation and a restricted sealed plan; desktop and phone inspection are readable. Refresh after the already-completed restart restores that private view and the earlier inventory seat. All 64 saved room versions/hashes remain unchanged. The user removed hourly restarts: restart only when warranted, preserving games and verifying restoration. Final required checks and aggregate usage belong to the verified checkpoint; no mode gate is opened and no recurring automation is installed.

13 September 2026 — Truthtrance hand size and primary-role facts

Added total physical hand counts and explicit primary-role comparisons, sharing classification with component presentation. Canonical Richese roles, Ix alternate uses, Worthless faction powers and Ecaz slot-only specials retain their distinct semantics. Current facts disclose one aggregate result and create no retention promise. The existing count controls, all four bot answer paths and production-room continuations are reused; no public mode or publication gate opens.

Eight new focused tests cover the 60-card catalog, actual engine questions, privacy, AI and JSON/custody changes. Expanded SQLite cases restore total/category and compound answers around an interrupted auction and commit competing answers once. Independent review findings were limited to two corrected wording issues. Room LC3E55GY verifies combined role counts, total size, invalid input and phone refresh. Required broad results and aggregate token endpoint belong to the verified checkpoint commit and private source-bound report. See hand inventory contract and efficiency measurements. Wider Truthtrance and Guild gaps remain explicit; preserve all post-reset games.

Typed Advanced shipment-promise checkpoint, 13 September 2026: Shipment promises now support base Advanced games without Guild or optional modules through the existing authoritative commitment, controls, private guidance, bots and recovery. Ghola preparation reuses canonical eligible normal/elite limits; pending BG conversion preserves feasible promises while retaining real responses and hiding conditional shipment pricing. Cancellation releases only when owned alternatives fail. Genuine Advanced scenarios and production SQLite races cover physical custody and saved continuations. Full validation and browser outcomes are recorded in the checkpoint commit and source-bound verification report. Ordinary Guild settlement, broader commitments, combined modules and complete mode acceptance remain unfinished; no release gate is opened.

Efficiency setup and fresh local save checkpoint, 13 September 2026: Current status and the rule decision index consolidate existing evidence without changing mode gates. Reusable verification adds private source-bound check logs, read-only saved-game snapshots/online backups and bounded HTTP seat-restoration checks. Focused regressions cover child failure/cancellation, stale source, output protection, WAL backup and seat privacy; the required full-check result is recorded in this checkpoint’s Git commit and external verification report. The user explicitly authorized clearing old local saves: a verified private backup preceded removal of 3,644 rooms and related records, preserving schema/migrations and creating a fresh empty baseline. Future games remain protected. Pilot measurements retain selective subagents, mandatory verified Git pushes and the full game scope; no gameplay or release gate is enabled. Browser setup remains feature-specific, and no live browser acceptance is claimed for this tooling change.

Guild Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_GUILD_SECRET_ALLY_RUNTIME.md records one explicitly selected Guild-priced shipment for an unallied holder with Guild absent. Reserve, physical cross/abstract-return and independently legal world-to-world routes preserve actual faction identity, typed custody, ordinary movement and bank payment. Fremen retain their free reinforcement choice; the separate paid southern route reaches beyond its range without storm privileges or off-planet triggers. Private controls and all four bot profiles share source-aware price/permission; binding shipment promises can rely on the card. Exact committed records and an independent outcome marker preserve arrival alliances and later movement without inventing native Guild responses. Final types, lint, all 4,162 offline tests, production build and 40 HTTP/session tests pass. Twenty-six new cases include real Moritani arrival alliances and production SQLite races, corruption rejection and private recovery. Review also repaired an older Cunning fixture's post-auction card-availability assumption; ten repeated runs passed 190 cases. Two three-seat browser rooms passed paid Fremen shipment/movement, mixed Emperor Homeworld shipment, desktop/phone controls and six private refreshes. The 03:46 UTC backed-up restart preserved all 3,612 opening games and restored twelve earlier private seats; final comparison preserves every opening version/hash, with two browser and thirty HTTP rooms added. Homeworld-return interpretation was asked of the user; that route, concealed transport, Betrayal and complete module/mode acceptance remain gated. Automation remains removed.

Guild Nexus Cunning checkpoint, 10 September 2026: NEXUS_GUILD_CUNNING_RUNTIME.md records a second paid native Guild shipment within the original combined turn, followed only by unused Hajr movement. Original shipment/movement history, typed Homeworld sources, cross/return routes, interception and later entry effects retain their rules. Private controls and all four bot profiles share availability; new binding shipment promises recognize the extra opportunity. Native Karama and paid BG conversion preserve the original source, and countering conversion restores it. Independent review fixed a later Moritani alliance freezing the remaining Hajr continuation; transport validation also rejects a same-territory cross-shipment. Final types, lint, all 4,136 offline tests, production build and 40 HTTP/session tests pass. Thirty-seven new cases include genuine nested interruptions, pending-frame corruption and competing production SQLite requests. Two three-seat browser rooms passed second shipment/Hajr and cancellation, desktop/phone controls and six private refreshes. A raw internal event notice found visually was corrected and verified by final rendering tests; earlier pending screenshots precede that text correction. All 3,580 opening room versions/hashes remain unchanged, with two browser and thirty HTTP rooms added. Guild Secret Ally/Betrayal, the physical Ornithopter combination, remaining native cancellation/arrival gaps and complete module/mode acceptance remain gated. Existing server reused, no restart due; automation remains removed.

Richese Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_RICHESE_RUNTIME.md records one-to-five actual reserve forces at the one-force price in the ordinary shipment pipeline. Native Guild/Fremen pricing, typed Homeworld reserves, native Ixian HMS entry, Guild prevention, BG accompaniment and real Terror entry retain their own rules. Private controls and all four bot levels share the quote; binding shipment promises recognize the affordable discounted source. Exact saved declarations and independent outcome markers protect pending and terminal history through corruption checks, competing SQL requests, Truthtrance and later turns. Review fixed the consumer's omitted native HMS destination. Types, lint, all 4,099 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases and two three-seat browser rooms cover allowance/prevention, typed Emperor sources, desktop/phone controls and six private refreshes. The 02:48 UTC backed-up restart preserved all 3,548 opening games and restored twelve earlier private sessions. Final comparison leaves all opening versions/hashes unchanged, with two browser and thirty HTTP rooms added. Native Richese Cunning, Betrayal, foreign-Homeworld tariff integration and complete module/mode acceptance remain gated. The Guild source audit prepares its distinct extra-shipment, borrowed-route and payment effects without claiming runtime completion. Automation remains removed.

Moritani Nexus Cunning checkpoint, 10 September 2026: NEXUS_MORITANI_RUNTIME.md records Basic/Advanced supply placement throughout the printed Arrakis map, including existing Terror stacks. Shared controls and all four bot profiles use the private offer; ordinary relocation stays unchanged. Native Karama cancellation preserves the token and spends the opportunity/Nexus. Independent review fixed arrival-signature downgrade, stale former-location reuse and physical-face rebinding; current placement permission and historical entry evidence remain separate. Types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests pass. Twenty-seven new cases include real later shipments, Robbery/Sabotage/Sneak Attack, Truthtrance, prior Grumman outcomes and concurrent SQLite recovery. Two three-seat browser rooms passed phone placement, allowance/cancellation, map markers and all six private refreshes. All 3,516 opening room versions/hashes remain unchanged; two browser and thirty HTTP rooms were added. Relocation/HMS/Grumman interpretations, other unfinished Terror/Nexus effects and full module acceptance remain gated. The new Ecaz source audit records its leader-scope and disclosure boundaries. Existing server reused, no restart due; automation remains removed.

CHOAM Nexus Cunning checkpoint, 10 September 2026: NEXUS_CHOAM_RUNTIME.md records five native effects using one actual Treachery Card in Basic and Advanced. Shared controls inspect the real cost independently of the selected effect; all four bots use projected legality. Karama retains the cost and spent Nexus; actual intervening cash-in fizzles and resumes the original operation. Independent review fixed saved movement, revival and storm orders accepting valid-looking replacements. Types, lint, all 4,042 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases include real paid Nullentropy, private views, physical disposal and concurrent SQLite outcomes. Two three-seat browser rooms passed phone declarations, allowance/cancellation and all six private refreshes. All 3,484 opening room versions/hashes remain unchanged; only two browser and thirty HTTP rooms were added. The printed family has six effects: Kull Wahad remains unavailable, as do unfinished Secret Ally/Betrayal and full module starts. Existing server reused, no restart due, automation remains removed.

Grumman stack cancellation checkpoint, 10 September 2026: GRUMMAN_PLACEMENT_CANCELLATION.md records the reproduced failure of printed Karama against a native Mentat placement after a legal Collection stack. Cancellation now preserves the existing stack without requiring distinct occupied locations. Independent SQL review also fixed allowance accepting unrelated duplicate physical token IDs; both outcomes validate the same inventory. Existing denial semantics remain unchanged. Types, lint, all 4,012 offline cases, production build and 40 HTTP/session cases pass. Six new cases cover Basic/Advanced, low population, unchanged income, competing cancellation/allowance, private restoration and malformed records. Browser phone declaration, desktop/phone cancellation and three-seat refresh pass. The hourly restart preserved all 3,453 opening games and restored twelve earlier private seats; final comparison leaves those same versions/hashes unchanged, with one new browser room and thirty HTTP rooms added. New Ixian replacement and Fremen Nexus audits record remaining source and privacy boundaries. No new Nexus effect or release gate was enabled; automation stays removed.

Emperor Nexus Cunning checkpoint, 10 September 2026: NEXUS_SARDAUKAR_RUNTIME.md records five ordinary counters temporarily using Sardaukar strength and support in one Advanced battle. Physical counters, starred reserves and ordinary losses remain distinct. Shared editor and bot calculations handle the Fremen exception and Salusa support. Review fixed a canceled-enhancement Prescience deadlock and retained durable winner casualty choices across competing SQLite requests. Types, lint, all 4,006 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases cover independent counter arithmetic, real Homeworld thresholds, future commitments, hidden information and recovery. Two three-seat browser rooms passed desktop/phone allowance, cancellation, reanswer, sealed planning and private refresh. All 3,421 opening room versions/hashes remain unchanged; only thirty HTTP rooms and two browser rooms were added. Fewer-than-five interpretation, Emperor Secret Ally, Betrayal and complete module acceptance remain gated. No release gate opened; no restart was due, and automation remains removed.

Bene Gesserit Nexus advisor checkpoint, 10 September 2026: NEXUS_ADVISOR_RUNTIME.md records whole-territory, multi-sector Cunning conversion during the native owner’s Advanced Shipment and Movement action. One Karama cancels the entire declared batch; source positions, counts and action allowances are preserved. Saved responses survive Truthtrance, Harkonnen exchanges and paid Nullentropy. Shared controls and all four bot profiles consume the public legality quote. Types, lint, all 3,971 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases include pending-parent corruption, physical custody and concurrent production SQLite recovery. Two three-seat browser rooms passed desktop/phone selection, allowance/cancellation and private refresh; review also fixed checkbox spacing, accessible SVG titles and stale Nexus guidance. All 3,389 opening saved rooms retain their versions/hashes; only two isolated browser rooms and thirty HTTP-test rooms were added. Fresh advisor/storm rulings, borrowed Voice, Betrayal and complete module acceptance remain gated. The Emperor source audit prepares the next family. No release gate opened; no restart was due, and automation remains removed.

Tleilaxu and Ixian Nexus Cunning checkpoint, 10 September 2026: NEXUS_CUNNING_RUNTIME.md records atomic revealed Face Dancer replacement and full-strength Suboids in every battle for the rest of the turn. Basic and Advanced retain Cyborg support costs and exact physical losses. Review fixed fresh Ixian Nexus setup, future-plan search through an unspent Cunning card and its private preparation hint; prior commitments remain binding. Types, lint, all 3,936 offline tests, production build and 40 HTTP/session tests pass. Fifty-one new cases include real Face Dance, all four bots, mixed-force support, concurrent SQLite recovery and future Truthtrance/Prescience commitments. Desktop/phone card play, private refresh and a seven-strength/two-support sealed plan passed. The hourly restart preserved all 3,359 then-existing games; final comparison preserves all 3,327 opening room versions/hashes. Tleilaxu Secret Ally, Betrayal and remaining Nexus effects stay gated pending their recorded requirements. No expansion release gate opened; automation remains removed.

Harkonnen Nexus exchange checkpoint, 10 September 2026: NEXUS_HARKONNEN_RUNTIME.md records draw-first Cunning and absent-faction Secret Ally, exact private returns, protected revealed Face Dancers, saved suspended actions and durable prior traitor declarations. Shared controls and all four bot profiles use projected identities. Independent review fixed lost preceding decisions and the paid Nullentropy action gate. Types, lint, all 3,885 offline cases, production build and 40 HTTP/session cases pass. Forty-six new cases cover rules, consumers, continuations and concurrent SQLite recovery. Two three-seat browser rooms passed draw/return, private restoration and desktop/phone inspection. All 3,295 preexisting room versions/hashes remain unchanged. Betrayal remains blocked pending the existing private response timing decision; complete Nexus and expansion games remain unfinished, and no release gate opens. The server was reused, no restart was due, and automation remains removed.

Atreides Nexus inspection checkpoint, 10 September 2026: NEXUS_ATREIDES_RUNTIME.md records Cunning's distinct second commitment and absent-faction Secret Ally, physical card disposal, No-Field distinctions, private history, all four editor locks and bot handling. Independent review fixed lost-response bypass, first-answer drift and a sealed plan contradicting its signed observation; legitimate Residual reanswers preserve the first historical disclosure. Types, lint, all 3,839 offline tests, production build and 40 HTTP/session tests pass. Forty-four new cases include concurrent SQLite recovery and four independent corruption regressions. Three-seat keyboard play, answer, protected plan submission and desktop/phone refresh passed. All 3,234 preexisting room versions/hashes survived the scheduled backup/restart and final comparison. Betrayal response timing, Residual after two answered Cunning fields, other card families and complete module games remain explicitly unfinished; no release gate opened. Automation stays removed; verified checkpoints are authorized for push without another confirmation.

Nexus ownership and complete component reference checkpoint, 10 September 2026: NEXUS_CARD_RUNTIME.md records the twelve-card physical deck, whole-phase Basic/Advanced draw opportunity, private replacement policy, all three alliance-forfeiture paths and complete inspectable 36-panel reference. Review fixed real Storm-entry initialization, edited progress/replay acceptance, one-way alliances and the private redraw prompt's public timing leak. Pre-draw preferences resolve without extra confirmations. Types, lint, all 3,795 offline tests, production build and 40 HTTP/session tests pass. Three-seat keyboard draw/redraw/refresh and all twelve normal/enlarged desktop/phone cards passed; independent review inspected 48 renders. All 3,173 preexisting room versions/hashes remain unchanged. All individual Nexus effects, Discoveries and complete expansion games remain unfinished; no release gate opened. Existing server reused, no restart due, no automation recreated.

Tupile private intelligence and occupation evidence checkpoint, 10 September 2026: HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md records current low-population contact checks, one historical spice/category answer per opposing faction, private controls and shared legal bot requests. Genuine setup binds qualification history and lifetime usage; legacy history stays unknown. Ordered battle observations retain brief sole occupation while simultaneous destruction does not invent it. Deterministic source identities make direct actions and restored continuations agree. 3,755 offline tests, types, lint, production build and 40 HTTP/session tests pass. Three-seat desktop/mobile keyboard shipment, private disclosure, later balance change and refresh passed. The hourly restart and final comparison preserved all 3,112 preexisting room versions/hashes. Occupation entitlement/expiry/income, complete module games and the full expansion goal remain unfinished; no release gate opened. The removed automation stays removed.

Grumman Collection and stacked Terror checkpoint, 10 September 2026: GRUMMAN_STACKED_TERROR_RUNTIME.md records one hidden-token addition with four bank spice, separate Mentat placement, private stacked-token selection, shared controls/AI and durable discard/alliance continuations. Review fixed selected-choice rewinds and restoration of a consumed Sabotage token during its genuine discard child. 3,712 offline cases, types, lint, production build and 40 HTTP/session cases pass. Desktop/phone keyboard Collection, shipment, token selection, Robbery payment, public stack count and three-seat private refresh passed. All 3,081 preexisting room versions/hashes remained unchanged. Removal custody, occupation, unfinished effects and complete expansion games remain unresolved; no release gate opened. The existing server was reused and the removed automation stays removed.

Caladan victory reinforcement checkpoint, 10 September 2026: HOMEWORLD_VICTORY_REINFORCEMENT_RUNTIME.md records the actual high-Caladan post-victory one-force transfer, current population and survivors, original battle location, exact native/visitor custody, owned controls and all-profile AI. Shared Ambassador arrivals preserve the original reinforcement and its nested children. Independent review reproduced and fixed arrival-to-choice rewinds and a deleted preceding cleanup choice; new revival returns also carry version-bound independent progress, while legacy completed QA saves remain readable. Final types, lint, 3,682 offline cases (89.9 seconds), production build and 40 HTTP cases pass. Eight Caladan production SQLite cases cover competing writes, reloads, private projections, nested arrivals and corruption. Two older Face Dance fixtures now explicitly decline the preceding guarded Caladan option, without choosing the unresolved placement order. Desktop and phone keyboard placement and three-seat refresh passed; final restart restoration passed for both Caladan and revival QA games. All 3,051 pre-existing room versions/hashes remain unchanged after restart and additive HTTP work. Low-Tupile public contact/once-per-faction quoting has seven cases but no playable disclosure action. Face Dancer ordering, guarded entry combinations, occupation, other missing effects and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld revival deployment checkpoint, 10 September 2026: HOMEWORLD_REVIVAL_DEPLOYMENT_RUNTIME.md records newly revived Fedaykin placement and Tleilax ordinary Free Revival deployment, exact typed groups, normal/Emperor-extra/Ghola source distinctions, owned controls and all-profile AI. Signed return, income and Ambassador completion records preserve nested arrivals and CHOAM sale restoration. Independent review found and fixed altered-offer acceptance and deleted-child premature completion. Final types, lint, 3,634 offline cases, production build and 40 HTTP cases pass; seven new production SQLite cases cover competing writes, lost responses, nested Ambassador restoration and corruption. The final suite also made an older auction test deterministic when the purchased Karama creates a second income responder. Desktop and phone keyboard placement, Ghola decline, refresh and three private seats passed without overflow or page errors. The hourly restart preserved all 3,050 saved room versions/hashes and restored the QA seats. First-reaching-high timing, partial/split groups, storm/arrival classification, occupation and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and the automation stays removed.

Homeworld collection and Terror checkpoint, 9 September 2026: HOMEWORLD_COLLECTION_RUNTIME.md records automatic high-Giedi income on actual positive desert receipts, once-per-phase recovery across Ecaz allocations, and low-Grumman original entering-force restrictions. Concealed No-Fields count as one; Ambassador choices and all four bot levels honor count-dependent arrival limits. Independent review found and verified a repair for altered saved arrival counts: original facts are now bound through live Terror, alliance cancellation and forced-discard continuations. Final types, lint, 3,575 offline cases, production build and 40 HTTP cases pass. Thirty-four new cases include seven production SQLite recovery scenarios; the older stale-entry regression now covers both signed and legacy saves. Desktop/390-pixel phone keyboard collection and three-seat refresh preserve seven collected spice plus the automatic two-spice bonus, with readable history and no overflow or browser errors. All 2,958 pre-existing room versions/hashes remain unchanged after the controlled restart and additive QA/HTTP work. Missing whole new receipts/signatures retain explicit legacy compatibility. High Grumman removal custody, occupation and low-Junction rounding questions remain pending; high Grumman operations, other faction effects and complete expansion games remain unfinished. No release gate opened, workflow optimizations remain in use, and automation stays removed.

Homeworld payment income checkpoint, 9 September 2026: HOMEWORLD_PAYMENT_INCOME_RUNTIME.md records low Kaitain and Junction reductions, original payer costs, separate ordinary-income cancellation, public split previews and private Guild contributor receipts. Final types, lint, 3,541 offline cases and production build pass; 40 HTTP cases passed before the final UI/AI funding guard. Twenty-six new cases cover actual auctions, shipment funding, native departure thresholds, Richese special/Ambassador purchases, all four profiles and five production SQLite recovery scenarios. Independent review found and verified repairs for mismatched Ambassador previews and invalid AI funding candidates. Desktop/390×844 phone keyboard allowance and three-seat refresh preserve the 5-spice purchase, 3-spice Emperor receipt and 2-spice bank remainder; screenshots were inspected without page overflow. All 2,894 baseline room versions/hashes remain unchanged. Occupation and contributor rounding questions are pending; divergent low-Junction odd/odd splits reject before declaration/payment rather than adopting an unverified rule. Legacy receipts without all new metadata retain the documented evidence limitation. Occupation, remaining card effects and full expansion games remain unfinished; no release gate opened and automation stays removed.

Kaitain and Ecaz card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records shared end-of-Bidding paid Kaitain discards and CHOAM sales/trades, current-population Ecaz poison income, private receipts and all-profile controls. Winning mandatory cards now discard after winner casualties and Ixian substitution, with reserved physical custody and independent saved battle obligations. Final types, lint, 3,515 offline cases, production build and 40 HTTP cases pass. Forty-seven new cases and updated battle/SQL regressions cover timing, privacy, corruption and races. Independent review found and verified fixes for conditional battle-role corruption, played-card diversion and deleted winner-discard queues. Desktop keyboard and 390×844 phone play completed disposal, private income, trade, sale, closing readiness and all-seat refresh; screenshots were inspected without page overflow. All 2,894 pre-existing room versions/hashes remain unchanged. Occupation, remaining Homeworld effects, complete expansion setup and full module games remain unfinished; no release gate opened. Workflow optimizations remain in use and automation stays removed.

Tupile card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records high-Tupile restrictions on both Worthless sale prices and CHOAM Ambassador payouts, private legal choices, and Ghola interruption with durable sale restoration and nested Tleilaxu income. Types, lint, 3,468 offline cases, production build and 40 HTTP cases pass. Thirty-one new regressions include all four AI profiles, five production SQLite scenarios and the repaired receipt-binding issue found by independent review. All 2,864 pre-existing room versions/hashes remain unchanged. Kaitain has source and pure-quote coverage only; its shared phase-end window, Ecaz poison-discard income, occupation and complete expansion games remain unfinished. No release gate opened. The optimized workflow remains in use; automation stays removed.

Homeworld mobility and advisor checkpoint, 9 September 2026: HOMEWORLD_MOBILITY_RUNTIME.md records low-Caladan phase-opening foresight restrictions, low-Wallach free-advisor suppression and high-Wallach two-force Polar Sink batches, low-Ix mobile-stronghold restrictions, and low-Richese token movement restrictions. Paid arrivals, physical troop movement and legitimate previously learned knowledge remain available under their separate rules. Final types, lint, 3,437 offline cases and production build pass; 40 HTTP cases passed before the final declared-advisor-count display text. Fifty-three new cases cover pure thresholds, actual actions, all-profile choices, Guild Ambassador continuations, and ten production SQLite recovery scenarios including paid Box interruption. Desktop choices, phone keyboard declaration, another human seat's allowance, saved reaction and settled refresh passed; phone screenshots were visually inspected without overflow. All 2,833 pre-existing room versions/hashes remain unchanged. Occupation-retained penalties, remaining high/occupied effects, full expansion setup and complete Homeworld games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Junction sponsored transport checkpoint, 9 September 2026: JUNCTION_TRANSPORT_RUNTIME.md records optional Guild half/full offers, replacement and expiry, exact Arrakis/Homeworld source groups, native returns, foreign departures, payment provenance, Karama immunity, arrival continuations and all-profile controls/AI. Final types, lint, 3,384 offline cases and production build pass; 40 HTTP cases passed before the final sponsor-panel identity and AI-priority guard adjustments. Forty-four new regressions include production SQLite concurrency/recovery and independent review. Actual desktop keyboard offers/replacements and phone typed shipment/refresh passed; visual inspection found readable layouts without phone overflow. Browser testing prompted preserving the sponsor panel across offer replacement. A controlled restart restored the private QA seat and preserved all 2,802 saved rooms; all 2,802 pre-existing room versions/hashes also remain unchanged after isolated QA/API tests. Occupation, remaining faces, concealed transport, unresolved generic/ordinary Karama interactions and complete module games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Guild Arrakis-to-Homeworld transport checkpoint, 9 September 2026: GUILD_HOMEWORLD_TRANSPORT_RUNTIME.md records actual Guild invasions and Junction returns from exact Arrakis sector pools, protected mobile-stronghold departures, shared interception, legacy API parity, accessible controls and all-profile AI. Final types, lint, 3,340 offline cases, production build and 40 HTTP cases pass. Thirty-six new regressions cover legality, physical custody, competing requests, interrupted recovery and private projection; independent review found no further defects. Desktop validation and keyboard declaration, phone interception, refresh and visual inspection passed in an isolated QA room. All 2,771 pre-existing room versions/hashes remain unchanged, with none missing. Junction-sponsored routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start or publication gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld invasion shipment checkpoint, 9 September 2026: HOMEWORLD_SHIPMENT_RUNTIME.md records actual world-to-world invasions, explicit native/foreign pools, mixed Emperor origins, Guild native returns, separate shipper/donor payments, Guild interception and present-force alliance restrictions. Final types, lint, 3,304 offline cases and production build pass; 40 HTTP cases passed before final UI/reference edits. Forty new regressions include actual invasion-to-battle discovery, all-profile policies, competing declarations, allowance-versus-stop races and Box-suspended recovery. Independent review fixed a public automatic-work flag that disabled genuine human Guild choices. Desktop mixed-source shipment, phone keyboard allowance and both-seat refresh preserve exact forces/payment; all 2,740 pre-existing room versions/hashes remain unchanged. Arrakis/Junction routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld battle runtime checkpoint, 9 September 2026: HOMEWORLD_BATTLE_RUNTIME.md records live Homeworld battle discovery, native strength, sealed plans, native-only Traitor calls, typed explosion losses, late Portable Snooper decisions, Ixian replacement and native Tleilaxu Face Dance. Final typecheck, lint, 3,264 offline cases and production build pass; 40 HTTP cases passed before the final saved-decision and board-selection fixes. Independent review and browser testing fixed paused-decision validation gaps and an off-planet territory-selector crash. Desktop/390×844 keyboard battle settlement and refresh preserved exact typed forces and card disposal in a conserved staged invasion. All 2,709 baseline room versions/hashes remain unchanged. Actual invasion transport, occupation, remaining face effects, unresolved return/support interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld combat foundation and Salusa checkpoint, 9 September 2026: HOMEWORLD_COMBAT_IMPLEMENTATION.md records public typed off-planet armies, pure native battle/explosion rules and connected high-Salusa free Sardaukar support. Final typecheck, lint, 3,221 offline cases and production build pass; 40 HTTP cases passed before the final Ghola guard. Independent review reproduced a population-changing Ghola deadlock after a sealed plan or prescience answer; execution, UI and AI now gate that specific unresolved interaction, with eight Salusa engine regressions covering rejection, privacy, JSON restoration and subsequent completion. All 2,648 baseline room versions/hashes are unchanged. Live Homeworld invasion/battle/occupation, remaining face effects, full module games and new browser acceptance remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld charity and revival checkpoint, 9 September 2026: HOMEWORLD_BENEFITS_IMPLEMENTATION.md records source-separated charity payments, dynamic low free-revival rates, four-free Fremen capacity, and Tleilax’s durable phase-start income condition. 3,190 offline tests, typecheck, lint, final production build, 40 HTTP tests and 144 focused Homeworld/reference cases pass. Independent review reproduced and integration fixed Box-suspended charity overpayment, invented saved free revivals and an AI/server special-Karama mismatch. Seven production SQLite recovery cases cover races, interrupted choices, privacy and rejected writes. Desktop/390×844 keyboard claims, invalid revival prevention, threshold crossing and refresh pass in an isolated QA room. All 2,648 pre-existing room versions/hashes are preserved. CHOAM opening-income and special-Karama interpretations remain pending; Homeworld battles, invasion, occupation and full module games are unfinished. No start gate opened; automation remains removed.

Homeworld native-reserve runtime checkpoint, 9 September 2026: HOMEWORLD_RUNTIME_IMPLEMENTATION.md records genuine supported-deck setup, saved typed custody, Basic strength-one special counters, exact native shipment sources, Emperor transfers and revival destinations, public controls and all-profile AI. 3,152 offline tests, typecheck, lint, production build and 40 live HTTP tests pass; the final focused Homeworld/reference run passes 106 cases. Actual transfer → shipment → Storm death → revival, Hajr, Ghola receipt integrity and competing SQLite requests are covered. Desktop/390×844 controls, card inspection, invalid-source prevention and refresh pass in a new isolated QA room. Twenty two-player Basic games complete 3,079 accepted actions without rejects/stalls or changed source fingerprints; this is a bounded regression sample. All 2,617 older saved rooms are unchanged. Invasions, Homeworld battles, occupation, card effects, remaining arrival routes and full module games are unfinished; public starts remain disabled. Workflow optimizations are preserved and the automation stays removed.

Homeworld component and custody checkpoint, 9 September 2026: HOMEWORLD_IMPLEMENTATION.md records all 13 cards and 26 verified faces, original bundled planetary art, searchable high/reverse inspectors, typed native/foreign custody and a separate population projection. 3,085 offline tests, typecheck, lint and the final production build pass. Both enlarged faces of every card were exercised on desktop and 390×844 phone; normal reverse controls, artwork loading, full-text search, keyboard activation, scrolling and refresh pass. Screenshot sampling and remaining complete visual acceptance are explicitly bounded in the feature document. The 07:53 UTC controlled restart preserved all 2,617 saved room versions/hashes and restored the authenticated QA seat. Actual Homeworld shipment, battles, occupation, card effects, AI and complete games remain unfinished; no mode gate opened. User workflow optimizations are in use and the automation remains removed.

Ecaz Ambassador alliance checkpoint, 9 September 2026: ECAZ_ALLIANCE_IMPLEMENTATION.md records the reusable token’s owner offer, entrant consent/refusal, immediate reciprocal alliance and original movement/worm continuation. Duke availability is independent; optional loans await a custody ruling. 3,058 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass. Thirty new alliance tests include public-identity quotes, all four AI levels, actual Box suspension, corrupt-save rejection and competing SQLite replies. Browser mobile keyboard proposal, AI acceptance, chronicle and refresh passed; all 2,586 older non-QA room versions/hashes are unchanged. Twenty Basic games completed 12,186 accepted actions and 545 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Full faction/mode/module completion remains gated, user workflow changes are preserved, and the automation stays removed.

Ecaz shared collection checkpoint, 9 September 2026: ECAZ_COLLECTION_IMPLEMENTATION.md records bilateral desert allocation, private proposals/counteroffers, the odd-to-ally default, automatic bank income and scoped Karama cancellation. All 3,028 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass under the new automatic test-discovery workflow. Sixty collection tests include actual engine transitions, all four AI levels, suspended Box/Karama recovery and SQLite races; review fixed orphaned collection controls. Twenty Basic games completed 10,206 accepted actions and 465 JSON round trips without rejects/stalls or changed source fingerprints. Real browser proposal/AI acceptance, phone keyboard completion and refresh passed; all 2,556 older non-QA room versions/hashes remain unchanged. Full Ecaz combat, its Fremen endgame exception, Tleilaxu Ambassador, remaining Duke interactions and complete Advanced/expansion/module acceptance stay unfinished and gated. User workflow optimizations are preserved; the automation stays removed.

Ecaz joint stronghold victory checkpoint, 7 September 2026: ECAZ_VICTORY_IMPLEMENTATION.md records the three co-occupied stronghold win, shared public server/UI/AI progress, prediction privacy and final Stronghold Card recovery. 2,758 rules/client/component +245 multiplayer tests (3,003 total) pass with TypeScript, lint and production build clean. Twenty Basic games completed 12,818 accepted actions and 568 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Actual browser Mentat victory, verbose chronicle, phone/keyboard and refresh passed; all 2,526 pre-existing non-QA room versions/hashes remain unchanged. Fremen’s Ecaz endgame exception, combined Occupy combat, shared collection, Tleilaxu Ambassador runtime and full Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Ecaz territorial occupancy checkpoint, 7 September 2026: ECAZ_OCCUPANCY_IMPLEMENTATION.md records shared server/AI entry and path checks, permanent Ecaz allied co-occupation, advisor exceptions, physical/hidden-marker conservation and the automatic turn-end notice. 2,730 rules/client/component +242 multiplayer tests (2,972 total) pass, with TypeScript, lint and production build clean. Twenty Basic games completed 11,446 accepted actions and 515 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Desktop/phone, keyboard completion, notices and refresh passed; all 2,496 older non-QA room versions/hashes are unchanged. Combined Occupy combat, shared desert collection, special victory, Tleilaxu Ambassador runtime and complete Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Tleilaxu Ambassador foundation, 7 September 2026: TLEILAXU_AMBASSADOR_RULES.md records the resolved physical return helper and outstanding interpretation boundaries. Eleven new registered tests pass for typed force custody, the fixed four-counter grant and shared Fedaykin/Sardaukar turn limit, including the Ixian exception; full TypeScript, focused lint and formatting pass. This helper has no engine integration or controls. Ordinary allowance, leader repeat-death and income interpretations remain pending; no full mode gate was opened. The automation stays removed.

Guild Ambassador checkpoint, 7 September 2026: GUILD_AMBASSADOR_IMPLEMENTATION.md records independent free typed reserve shipment, source-bound Guild prevention, BG accompaniment/Intrusion/Terror and chained Ambassador continuation, including phase-one worm riders and the Ixian HMS exception. 2,691 rules/client/component +239 multiplayer tests (2,930 total), typecheck, lint and production build pass. Twenty balanced Basic games completed 10,640 accepted actions and 482 JSON continuations with no rejects/stalls and unchanged source fingerprints. Desktop/mobile forms, keyboard submission, private refresh recovery, notices and chronicle pass; all 2,466 older non-QA room versions/hashes are unchanged. The review fixed orphaned saved shipment decisions; the 11:51 UTC controlled restart preserved all 2,497 games and restored the authenticated browser. No-Field substitution and simultaneous arrival interpretations remain unresolved; Tleilaxu Ambassador, complete Ecaz/Advanced/expansion/module acceptance and broader presentation remain unfinished. The automation stays removed.

Fremen Ambassador checkpoint, 7 September 2026: FREMEN_AMBASSADOR_IMPLEMENTATION.md records independent typed board relocation, concealed markers/HMS, advisor and separate Terror children, Baliset cancellation/re-selection, all-four-profile controls and saved-game recovery. 2,613 rules/client/component +233 multiplayer tests (2,846 total), typecheck, lint and production build pass. Twenty Basic games completed 12,252 accepted actions and 547 JSON continuations with zero rejects/stalls and unchanged source fingerprints. Desktop/phone form, keyboard submission, refresh, chronicle and automatic notice passed. The hourly restart preserved all 2,437 rooms; the subsequent QA changed only its named room, preserving all 2,436 older non-QA versions/hashes. Simultaneous Intrusion/Terror ordering awaits the user's interpretation; Guild/Tleilaxu effects, Occupy combat, full Advanced/expansion acceptance and broader mobile acceptance remain unfinished. The automation stays removed.

Richese Ambassador checkpoint, 7 September 2026: RICHESE_AMBASSADOR_IMPLEMENTATION.md records automatic three-spice purchases for all twelve possible beneficiaries, source-bound Emperor income and Harkonnen bonus, private failure handling, real BG-copy/worm continuation and all-four-profile support. 2,548 rules/client/component +228 multiplayer tests (2,776 total), typecheck, lint and production build pass. Twenty Basic games completed 12,218 accepted actions and 544 JSON continuations with zero rejected actions/stalls; only a reference evidence path changed during that run. Browser purchase, refresh and income cancellation passed, and all 2,406 older non-QA room versions/hashes remained unchanged. Fremen/Guild/Tleilaxu effects, full Ecaz/Advanced/expansion acceptance and mobile acceptance remain unfinished. The Duke revival interpretation question is pending. The automation stays removed.

Ghola lifecycle and AI checkpoint, 7 September 2026: GHOLA_LIFECYCLE_AND_AI.md records all-four-profile ordinary Ghola choices, authoritative target controls, the actual Kwisatz explosion/revival/next-territory fix, Ecaz-only shared-Duke checks and full primary card text. 2,517 rules/client/component +226 multiplayer tests (2,743 total), final typecheck, lint and build pass. Twenty Basic games completed 12,304 actions with zero rejects/stalls and 550 JSON round trips, including 18 actual Ghola plays across all four levels. Browser Ghola revival, refresh and a later sealed Carthag plan with revived Kwisatz pass. The hourly restart preserved all 2,377 saved rooms. Paid/set-aside Duke revival, full Advanced/expansion acceptance and mobile acceptance remain unfinished; the custody interpretation question is pending. The automation stays removed.

Ecaz Duke acquisition checkpoint, 7 September 2026: ECAZ_DUKE_ACQUISITION.md records direct acquisition through the reusable Ecaz Ambassador, same-disc transfer, token return, original entrant resumption, all-four-profile choices and readable controls. 2,474 rules/client/component +224 multiplayer tests (2,698 total), typecheck, lint and production build pass. Twenty Basic games completed 10,450 accepted actions with zero rejected candidates/stalls and 476 JSON round trips. Browser acquisition, refresh, inspection and subsequent battle use passed; Duke was set aside alive after use. Ambassador inventory now collapses without hiding the actual decision. Alliance/loan alternatives, Duke revival/capture, full Advanced/expansion acceptance and mobile acceptance remain unfinished. The automation stays removed.

Placement cancellation checkpoint, 7 September 2026: PLACEMENT_CANCELLATION_RECOVERY.md records source-bound Ecaz/Moritani/Duke denials and shared movement setup, phase income/refunds and victory. Duplicate movement order, absent victory allies and negative saved refunds now reject before supported cancellation costs. 2,450 rules/client/component +220 multiplayer tests (2,670 total), typecheck, lint and production build pass. Twenty Basic games complete 13,655 accepted actions without rejected candidates/stalls, with 603 JSON round trips. Browser cancellation, refresh, shipment and next-player handoff pass. All 2,286 older non-QA room versions/hashes remain unchanged. Full Advanced/expansion acceptance and exhaustive continuations remain unfinished. The automation stays removed.

CHOAM cancellation and revival checkpoint, 7 September 2026: CHOAM_WORTHLESS_CANCELLATION_RECOVERY.md records exact Worthless context restoration, shared unchanged revival checks and public storm offers. Malformed saves can no longer use these cancellation paths to produce negative Tanks, accept invalid revival prices/queues or restore a cross-phase Mentat decision. 2,386 rules/client/component +216 multiplayer tests (2,602 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,008 accepted actions without rejected candidates/stalls and with 536 JSON round trips. Browser cancellation, readiness and restart recovery passed. Controlled maintenance preserved all 2,287 saved room versions and hashes exactly. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Auction cancellation checkpoint, 7 September 2026: AUCTION_CANCELLATION_RECOVERY.md records shared Ixian draw/Technology and paid-sale, income, bonus and next-lot continuations. Independent review reproduced and fixed duplicated unsold-card custody in malformed saves. 2,312 rules/client/component +212 multiplayer tests (2,524 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 10,529 accepted actions without rejected candidates/stalls and with 475 JSON round trips. Browser cancellation, refresh and a subsequent legal bid passed. All 2,196 older non-QA saved rooms retain their exact versions/state. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Restored cancellation checkpoint, 7 September 2026: RESTORED_CANCELLATION_CONTROLS.md records exact Richese gift/purchase restoration, Moritani alliance cancellation and Ixian substitution cleanup. 2,250 rules/client/component +208 multiplayer tests (2,458 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,657 accepted actions without rejected candidates/stalls and with 522 JSON round trips. Browser gift cancellation recovered and exercised the original advisor choice. All 2,196 older non-QA saved rooms retain their exact versions/hashes. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Combat and terminal cancellation checkpoint, 7 September 2026: COMBAT_TERMINAL_CANCELLATIONS.md records shared combat queues, income/knowledge cancellation, No-Field declaration checks and canceled CHOAM sales. 2,162 rules/client/component +204 multiplayer tests (2,366 total) pass (full suites plus eight focused ownership regressions); typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,552 accepted actions without rejected candidates/stalls and with 521 JSON round trips. Browser Baliset cancellation restored the Voice controls and private hand; the banner and seat highlight now name the actual decision owner. The manual restart preserved all 2,197 saved room versions and hashes. Exhaustive continuations, durable Karama cost frames and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle aftermath checkpoint, 7 September 2026: BATTLE_AFTERMATH_PREFLIGHT.md records shared ordered cleanup, board and collection calculations, movement cancellation and owner-promise prerequisites before supported Karama costs. It fixes zero-force storm geometry and preflights the newly empty Auditor path after a cost card is spent. 2,044 rules/client/component +201 multiplayer tests (2,245 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,550 accepted actions without rejected moves/stalls and with 521 JSON round trips. Browser capture cancellation and refresh recovery passed; all 2,105 older non-QA saved rooms retain exact versions/hashes. Exhaustive suffix proof, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle, revival and disaster checkpoint, 7 September 2026: BATTLE_REVIVAL_DISASTER_PREFLIGHT.md records shared battle calculations, canceled-revival quotes and typed storm/worm prerequisites checked before Karama costs. 1,961 rules/client/component +197 multiplayer tests (2,158 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,430 actions without rejections/stalls and with 554 JSON round trips. A browser storm cancellation reconnected after the controlled restart; all 2,106 backed-up rooms retained exact versions and state hashes. Later battle aftermath, exhaustive cancellation/promise checks, Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama cancellation checkpoint, 7 September 2026: KARAMA_CANCELLATION_CONTEXTS.md records original canceled-power bindings, pure Moritani cleanup prerequisites and pure canceled-Baliset arrival checks, preserving nested conversions and summoned-worm rides. 1,850 rules/client/component +194 multiplayer tests (2,044 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,735 actions without rejections/stalls and with 567 JSON round trips. Browser cancellation and refresh recovery passed; 2,075 older non-QA rooms retain exact saved versions/state hashes. Exhaustive cancellation/promise preflight, Karama cost frames, Semuta and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama preflight and conversion checkpoint, 7 September 2026: KARAMA_PREFLIGHT_AND_CONVERSIONS.md records pending BG purchase capacity, mandatory hand-return reservations, preserved conversion opportunities across nested interruptions, and pure Richese settlement prerequisites. 1,812 rules/client/component +188 multiplayer tests (2,000 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 14,230 actions without rejections or stalls and with 627 JSON round trips. The browser restored its pending BG response after refresh and the manual restart; all 2,076 saved rooms retained exact versions and state hashes. Complete Karama cost continuations, Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ordinary card discard checkpoint, 7 September 2026: ORDINARY_CARD_DISCARD_CONTINUATIONS.md records exactly-once recovery for completed Hajr, Ghola, Harvester, Weather Control and Family Atomics effects, including preserved income and preparation promises. 1,766 rules/client/component +184 multiplayer tests (1,950 total), typecheck, lint and production build pass. Twenty Basic games completed 10,931 actions without rejections or stalls and with 495 JSON round trips; dedicated new tests provide direct ordinary-card coverage. A browser Hajr playtest verified the extra move and refresh recovery. Semuta, remaining discard producers and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Truthtrance discard checkpoint, 7 September 2026: TRUTHTRANCE_DISCARD_CONTINUATIONS.md records consumed-answer receipts, exact queued-question/parent restoration and preserved public history and promises. 1,742 rules/client/component +179 multiplayer tests (1,921 total), typecheck, lint and production build pass. Twenty current-source Basic games completed 12,616 actions with zero rejections/stalls and 559 JSON round trips; they contained no Truthtrance actions, so the 26 dedicated new tests provide direct coverage. All 1,956 saved rooms survived the manual restart unchanged; the QA table reconnected and updated internal guidance was visually checked. Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ornithopter discard checkpoint, 7 September 2026: ORNITHOPTER_DISCARD_CONTINUATIONS.md records separate completed-arrival and early-ending continuations, exact force/marker/counter recovery and preserved Guild/Sapho queues. 1,721 rules/client/component +174 multiplayer tests (1,895 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 11,522 accepted actions, zero rejections/stalls and 517 JSON round trips; dedicated tests cover the expansion card. An actual two-group browser playtest verified refresh, prevention of reusing moved forces, automatic disposal and unchanged completed state after reconnect. Semuta and complete Advanced/expansion acceptance remain unfinished; the removed automation stays removed.

Box discard checkpoint, 7 September 2026: BOX_DISCARD_CONTINUATIONS.md records a completed paid search, frozen private recovery/shuffle and exact interrupted-control restoration. An independent Auditor corruption probe prompted binding modern saved opportunities to their completed battle receipt; legacy saves remain supported. 1,703 rules/client/component +169 multiplayer tests (1,872 total), typecheck, lint and production build pass. Twenty Basic regression games completed with 12,326 accepted actions, zero rejections/stalls and 551 JSON round trips; this sample preceded the final Advanced-only Auditor guard and does not exercise Box. Browser guide/readable layout and saved QA seat restoration were checked. Semuta, remaining discard producers and full expansion acceptance remain unfinished. The removed automation stays removed.

Forced Terror discard checkpoint, 7 September 2026: TERROR_DISCARD_CONTINUATIONS.md records Sabotage and Robbery overflow saved steps, private exact card custody, preserved victim/draw and optional gift or deferred Nexus continuation. 1,685 rules/client/component +165 multiplayer tests (1,850 total), final typecheck, lint and production build pass. Twenty Basic games completed with 11,332 accepted actions, zero rejections/stalls and 509 JSON round trips; dedicated tests cover the new Terror behavior. The browser rules checklist and saved-seat restoration were verified. Semuta and full expansion acceptance remain unfinished; the removed automation stays removed.

Battle discard checkpoint, 7 September 2026: BATTLE_DISCARD_CONTINUATIONS.md records mandatory mixed-owner disposal, separate winner/Moritani cleanup, frozen effective casualty choices and exact-once post-battle recovery. Independent tests exposed and prompted a fix for corrupted Auditor ownership being accepted by private projection. 1,673 rules/client/component +161 multiplayer tests (1,834 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 12,114 legal accepted actions, zero rejections/stalls and 540 JSON round trips. All 1,806 saved rooms survived manual restart unchanged, and the QA seat reconnected. Semuta remains inactive; the full goal remains unfinished and the removed automation stays removed.

Discard continuation checkpoint, 7 September 2026: TREACHERY_DISCARD_CONTINUATIONS.md records isolated Semuta transfer rules and saved steps for Ixian/CHOAM Ambassador exchanges and Ixian purchased-card replacement. Concurrent recovery preserves exactly one replacement and each original payout. A public automatic-work signal schedules private saved frames after reconnect. Semuta activation, other discard producers, reaction timing and the full-hand question remain unfinished; no mode gate was opened and the maintenance automation remains removed. 1,653 rules/client/component +156 multiplayer tests (1,809 total), final typecheck, lint and production build pass. The existing QA table restored after browser refresh. This does not certify a playable Semuta reaction or full expansion games.

Juice of Sapho checkpoint, 7 September 2026: JUICE_OF_SAPHO_RUNTIME.md records first/last Once Around and clean combined-turn ordering, full-hand eligibility, protected last beyond Guild deferral, private controls and all-profile AI. 1,631 rules/client/component +152 multiplayer tests (1,783 total), final typecheck, lint and production build pass. Desktop/mobile staged auctions and movement, exact-once disposal, refresh and restart recovery passed. Twenty ordinary-AI Basic games completed without rejected actions or stalls; they cannot exercise Sapho because expansion starts remain gated. Battle aggressor, normal auction scope and other timing modes remain unfinished, with three material questions pending. The maintenance automation remains removed.

Shipment promise checkpoint, 7 September 2026: TRUTHTRANCE_SHIPMENT_PROMISES.md records the new structured Basic reserve-shipment commitment, complete owned preparation search, actual event enforcement, all four AI responders and private human guidance. Full regression: 1,598 rules/client/component +148 multiplayer tests (1,746 total); final focused checks, typecheck, lint and production build pass. Twenty Basic games through public production start completed with zero rejected actions or stalls and fulfilled 30 naturally sourced shipment promises. Desktop/mobile controls and refresh recovery passed in an isolated QA room. Earlier-phase, Advanced/expansion and arbitrary future promises remain unfinished; no mode gate was opened. The maintenance automation remains removed.

Truthtrance and recovery checkpoint, 7 September 2026: named-card count questions now support exact/minimum/maximum comparisons, compound facts, private verified answers and all four AI profiles. TRUTHTRANCE_CARD_COUNT.md records the implementation and desktop/mobile playtest. CHOAM_MARKET_AUTO_AUDIT.md records automatic empty-market completion only during Bidding, where counts are public; independent review caught and removed an initial non-Bidding information leak. Background recovery now schedules empty Auditor offers and unaffordable audit payments. 1,577 rules tests +143 multiplayer tests pass (1,720 total), with typecheck, lint and production build. Twenty CHOAM/base complete games had zero rejected actions or stalls, but no empty-market auto-close event; direct branch evidence comes from focused and browser tests. All 1,686 saved rooms survived the hourly restart unchanged. CHOAM_KULL_SOURCE_UPDATE.md found no new official ruling; Kull and the overall goal remain unfinished.

Auditor checkpoint, 7 September 2026: CHOAM_AUDITOR.md records the new extra leader, private inspection/payment, native lifecycle restrictions, original portrait and actual desktop/phone/recovery checks. All 1,560 rules tests +137 multiplayer tests pass, with typecheck, lint and build. A 20-game CHOAM/base-faction sample completed after fixing a reproduced Emperor AI pending-revival timing bug: 14,316 accepted actions, zero rejections, 627 JSON continuations. The two Auditor revival-cycle interpretations remain pending; Kull Wahad and broad expansion/module work remain unfinished. Prior statements that Auditor is wholly missing are historical. No full-compliance claim or start-gate change is made.

Target: classic GF9 2019 Dune + advanced game + Ixians & Tleilaxu + CHOAM & Richese + Ecaz & Moritani, including optional expansion modules. User additionally requests generated images, animations, AAA polish, a complete navigable rule reference with tooltips/guidance, and addable AI players at Easy/Medium/Hard/Brutal difficulty. The player-facing app must not link to external sites. This is an ACTIVE goal, not a completed implementation.

Current working slice

• Vinext/React/TypeScript, Cloudflare Workers + D1 via Sites.
• Lobby with faction choice, rooms and shareable eight-character invitations.
• D1 authoritative JSON state with optimistic version checks; private HttpOnly seat cookies hashed in storage; personalized projections strip hidden game information.
• Six base factions, traitor setup, Fremen allocation, prediction.
• Basic nine-phase loop: storm dials, spice blow/Nexus, charity, auctions, revival, shipping/movement, sealed battle/traitor choices, collection, victory.
• Base faction choices now include BG optional free shipments; Fremen ally worm protection, post-Nexus multi-sector worm rides and free ally revival; winner card discards; Harkonnen ally traitor support. Server enforces the designated decision owner.
• Battle preparation has guaranteed Voice → prescience → element answer → sealed-plan steps. The faction owner chooses whether to assist an ally, only the requested element is committed, and prescience values stay private to the two combatants.
• Multi-sector movement and Guild shipments, with single total rounded shipment cost. Ally funding supports private phase-specific pledges, refunds and explicit payment splits; committed bids stay funded. Ordinary spice draws preserve deck order.
• Truthtrance now overlays interrupted decisions with storm-order declaration priority, verified named-card/selected-traitor AND/OR questions, public freeform answers, unknown/retry/save flow, turn-stamped records and AI responses. Current-battle conditions now constrain plans, compose with Voice/prescience and release when impossible after an opposing effect. Arbitrary promises, feasibility through future card plays and the full timing audit remain unfinished.
• CHOAM charity, force revival, Inflation, end-phase card sales/allied exchanges, special Karama cash-in and combat funding/income now have engine, private UI and AI support. Kulon, La La La, Baliset, Jubba Cloak and Trip to Gamont Worthless effects also have engine/UI/AI support. Auditor now has its extra disc, survival-based private inspection, full cancellation payment, Karama continuation, capture/foreign-ghola exclusions, first native revival, original portrait and four-level AI controls. CHOAM tables defer victory until their final Mentat opportunity after the market. Kull Wahad, Auditor repeated/sixth-disc revival cycles and interaction audits remain unfinished; the twelve ordinary leader rosters are verified; faction starts remain disabled.
• Partial faction powers and card effects. Explicitly blocks advanced/expansion starts pending implementation, instead of claiming complete compliance.
• Interactive terrain map, hand, table log, phase rail, action forms, responsive layouts, reduced-motion support.
• Original generated artwork: two Arrakis scenes, sixty identity-mapped ordinary leader portraits across all twelve factions, and a separate Duke Prad Vidal portrait, with live text/strength and vector fallback for unsupported identities or image failures.
• Optional tech tokens for tables of three or more: initial ownership, deferred phase income, post-battle transfers, one-owner set victory bonus, public UI, internal rule topic and all four AI policies. Expansion faction starts remain gated.
• Tleilaxu now has private Face Dancer setup, post-battle replacement, three-card recycling and once-per-Mentat replacement with Karama response. Zoal copies leader strength and bounty. Revival commerce now includes private early-leader quotes, force-limit permissions, discounts, income and Karama responses. Foreign ghola acquisition, private buybacks, shared leader control and AI are also implemented. Special Karama revival prevention now has engine/UI/AI support; its timing and exception audit remains unfinished, and starts stay gated.
• Cheap Hero traitor matches either hero card, supports repeated/ally calls and KH protection, and retains public revealed identities for UI/AI use.
• Amal has an explicit public opening window for all nine phases, before automatic phase effects. The engine, UI and bots support halving available spice with upward losses and deferred phase continuation.
• Thumper has phase-opening engine/UI/AI support using a virtual worm encounter that does not alter spice-deck inventory.
• Sandtrout has persistent spice-deck/anti-alliance support with private Atreides preview and public pending status; live expansion starts remain gated.
• Ixian cyborg/suboid combat, half-strength basic dials, fixed suboid support rules and post-casualty substitution have engine/UI/AI support. Ixian movement, collection capacity and typed revival pricing also have engine/UI/AI support. Hidden Mobile Stronghold placement, relocation, sector routes, entry, protection, battles, victory and special Karama now have engine/UI/AI support; setup/bidding technology now has private decisions, Karama responses and AI support. The complete fourteen-card Ix inventory is now assembled; complete-game expansion integration and interaction audits remain unfinished.
• The complete fourteen-card Ix treachery inventory is assembled with distinct identities, including the extra ordinary weapons, defenses, Worthless card and Harvester. The combined base/Ix deck has 47 cards. Full starts remain gated pending card-face and faction/phase interaction audits.
• Current verification: 2,517 registered rules/client/component tests and 226 persisted/API tests pass, with TypeScript, lint and production build. Coverage includes the Basic game, implemented advanced/expansion slices, four AI profiles, staged setup and private authoritative recovery. Public Advanced/expansion starts remain gated; passing slice tests does not certify them.
• Earlier checkpoint: verified Truthtrance current-spice comparisons now have authoritative answers, all-profile AI responses, controls, private restoration and duplicate-answer tests. Source-ordered base setup remains integrated with private prediction, traitor selection, force placement and an automatic final Treachery deal. The new 192-game Basic calibration completed 59,380 accepted actions without rejected candidates or checked failures. The shared offline initializer passes 456 Advanced setup combinations; 456 genuine Advanced games also completed with zero rejected candidates. Difficulty calibration and full expansion/module acceptance remain unfinished.

Stronghold Cards checkpoint (2026-09-07)

All six Advanced Stronghold Cards now have authoritative local battle effects, end-Mentat public custody, event-bound mobile copying, support/payment previews, AI policies, original bundled illustrations and full readable inspectors. A sole copy choice is announced automatically. Card ownership remains fixed until turn end even after defeat. Carthag augments actual defense roles; Habbanya also resolves Stone ties; Arrakeen preserves CHOAM donor/bank accounting. Independent review found and root corrected an inaccurate Stone outcome explanation. All-level testing exposed and root fixed omitted affordable Arrakeen plans for larger armies. STRONGHOLD_CARDS.md records sources, all six identities, interpretations and integration boundaries.

1,528/1,528 rules/client/component tests and 133/133 persistence/API tests pass (1,661 total). New coverage is 12 pure module cases, nine engine cases, four all-profile AI cases, three additional combat-matrix cases and four production-room SQLite cases. Recovery covers actual seat rotation, sealed plans, duplicate/crossed copy choices, exactly-once income/support and eight malformed persisted bindings. Full logs: /tmp/dune-stronghold-full.log (64.65 seconds), /tmp/dune-stronghold-multiplayer.log (18.27 seconds). TypeScript and lint: /tmp/dune-stronghold-final2-type.log, /tmp/dune-stronghold-final2-lint.log. Production build and final ledger rebuild both pass: /tmp/dune-stronghold-build.log, /tmp/dune-stronghold-final-build.log. The initial lint complaint about an ordinary image element was resolved using the installed image component.

A separate 40/40 complete-game sample exercised the module with base factions across all counts two through six and all four homogeneous AI profiles, twice per combination. It accepted 19,665 actions with zero rejected candidates, stalls or checked failures and continued through 912 actual JSON round trips. The unchanged strict base audit initializer is followed by empty optional-module configuration before any setup action; resources/cards/forces are untouched. This does not exercise Ixian or CHOAM complete games. Runner and complete traces: /tmp/dune-stronghold-fullgames.ts and /tmp/dune-stronghold-fullgames.json; summary hash/source evidence is in the module document. Root reviewed the complete runner and every contributed test file, all six generated illustrations, both source audits and runtime review. Comparative difficulty calibration remains unfinished.

Browser inspection verified all six normal desktop faces and all six enlarged faces on desktop and 390×844 phone width. Text remains selectable and readable, images are bundled, Close controls work and the viewport override was reset. The isolated room P2PLZKVL was created through the UI with a Guild host and two Hard AI opponents and completed normal setup. Only that named QA room was then staged for a mobile battle. A reload restored its two eligible public copy choices. Choosing Arrakeen preceded plans; two support spice correctly displayed bank 2/personal 0 and was accepted at zero personal spice. Battle settlement emitted the automatic bank-support notice. The subsequent collection phase awarded the separate four-spice city income; the lost mobile battle did not prematurely transfer its retained card. The sample is a staged control test, not an entire expansion game.

Manual maintenance at 00:46 UTC backed up all 1,593 rooms to /tmp/dune-maintenance-20260907T0046/database.sqlite, then verified all saved JSON hashes and versions exactly. The private Guild transport seat reconnected with its same hand and resources. The known human room remained v14 and idle. Development server session 81510 is the current controlled launch; next maintenance is due about 01:46 UTC if active development and human play permit. The user-removed automation remains removed.

Complete Advanced faction/card timing, all expansion games, Ecaz combined-force battles and every optional-module combination remain unfinished. Public mode gates remain closed. The goal remains active.

Effective battle weapon foundation checkpoint (2026-09-07 local date)

Shared combat now distinguishes physical card identity from effective attack behavior. A pure resolver describes canonical Mirror copies, original attack roles and independent copy-first Tooth/Stone choices. Ordinary leader attacks, Artillery effects and the Lasgun explosion predicate consume these descriptors; the engine and AI use the common explosion check for their entitled inputs. Physical plans, custody, prescience, promises and retention remain unchanged. Mirror plan admission is still disabled: copied-choice persistence, effective Stone outcome, controls and settled cleanup remain necessary before activation. EFFECTIVE_BATTLE_WEAPONS.md records the complete contract and boundaries.

1,500/1,500 rules/client/component tests and 129/129 persistence/API tests pass (1,629 total). Sixteen new tests cover both copy orientations, printed defense matrices, independent Tooth answers, Artillery suppression, explosions, strict identities and blocked partial activation. Full logs: /tmp/dune-effective-weapons-full.log (67.15 seconds), /tmp/dune-effective-weapons-multiplayer.log (18.64 seconds). TypeScript, lint and production build pass: /tmp/dune-effective-weapons-type.log, /tmp/dune-effective-weapons-lint.log, /tmp/dune-effective-weapons-build.log. Independent regression comparison found zero differences across865,580 attack,216,395 explosion and3,364 single-weapon evaluations of existing canonical cards. Root reviewed the helper, both new test files, integration, comparison script and independent audits. Historical648-game calibration was not rerun.

Fresh bounded publisher retrieval did not settle the previously asked Mirror copied-Tooth/Artillery disposal question. No user answer or house rule was inferred. Current Stone and Portable foundations supersede the older Mirror audit's descriptions of missing implementations. Recovery-only follow-ups include plain evaluator errors for malformed Mirror-marked saves and missing event/source validation for existing Poison Tooth answers; no valid-action exploit was demonstrated. No live game was staged or played in this slice. The user-removed automation stays removed; server session24370 remains the last controlled launch, with maintenance next due about00:46UTC if active development and human play permit. The full goal remains active.

Pending physical shipment integrity checkpoint (2026-09-07 local date)

Ordinary physical shipments now revalidate current turn/opportunity, typed reserves, arrival stance, destination, price, funds and reciprocal allied contribution before continuation. Guild allowance and special-stop responses must match the saved public declaration. Invalid state rejects before any room write or response-card disposal. New declarations include their turn; valid older unstamped saves still resume. Concealed No-Fields retain separate contracts. No automatic save repair or cancellation settlement was introduced. See PENDING_SHIPMENT_INTEGRITY.md.

1,484/1,484 rules/client/component tests and 129/129 persistence/API tests pass (1,613 total). Ten new engine cases and three production-room SQLite cases include 24 corrupted declarations checked independently for allowance and stop, stamped/legacy restoration and duplicate CAS. Root integrated and reviewed both agents' complete files; the final runtime includes the reciprocal-donor correction caught by independent testing. Full logs: /tmp/dune-pending-shipment-full.log (61.96 seconds), /tmp/dune-pending-shipment-multiplayer.log (16.80 seconds). TypeScript, lint and production build pass: /tmp/dune-pending-shipment-final-type.log, /tmp/dune-pending-shipment-final-lint.log, /tmp/dune-pending-shipment-final-build.log. The historical 648-game calibration was not rerun for this slice.

Browser inspection confirmed that the existing Guild QA seat remains at its legitimate movement decision, with the same private hand, 20 reserves and two spice. The updated internal phase guidance is readable, searchable and reachable by its direct link after page loading. No new live state was staged. A read-only database comparison found 1,563 rooms and exact unchanged JSON/version pairs for all 1,502 rooms in the 23:45 UTC backup. The known human room remains v14; Guild QA remains v13. The removed automation stays removed. Server session24370 remains the last controlled launch; next manual maintenance is due about00:46 UTC if active work and human play permit.

The allied transit audit confirms that ordinary shipment into allied territory followed by departure is allowed by the November FAQ but remains unsupported by the table. The exceptional outcome after an opposing effect makes departure impossible remains a pending user clarification; no answer was inferred. ALLIED_TRANSIT_RULES.md records source precedence, advisor separation and the distinction from existing co-occupation. Ordinary Guild rate/permission cancellation, nonbattle Truthtrance promises and the wider Advanced/expansion scope remain incomplete. The goal remains active.

Guild contributor routing and transport controls checkpoint (2026-09-07 local date)

The Guild now receives a non-Guild ally’s shipment contribution even when Guild itself ships. Guild’s own payment still goes to the bank. The coordinating review applied November2020 FAQ’s direct-contributor rule over April’s older transfer-to-shipper wording; the source provides a general rule, not an explicit reverse-direction worked example. Both ordinary shipment and direct Guild transport use the same income calculation. Independent Karama, Guild-funded allied shipment and income cancellation retain their distinct payment destinations. Automatic chronicle entries explain collection or prevention.

Guild cross-planet, southern-reserve and return controls now display the actual selected physical-force total, rounded price, personal share and authorized ally pledge. They reject invalid counts, elite allocations, entry and funding before submission; the server remains authoritative. Combined-sector totals override the unrelated scalar control. The private preview does not expose opposing spice or implement future-action feasibility. The source/payment contract and remaining limitations are recorded in GUILD_SHIPMENT_PAYMENTS.md.

1,474/1,474 rules/client/component tests and 126/126 persisted/API tests pass (1,600 total). Nineteen new rules/quote tests and three production-room SQLite cases cover contributor direction, both settlement paths, exact counts, cancellation, duplicate CAS, privacy and restored pending income. Independent UI review compared10,320 synthetic settled-state selections without a quote/server mismatch. Root integrated and reviewed every contribution. Full logs: /tmp/dune-guild-full.log (67.75seconds), /tmp/dune-guild-multiplayer.log (17.60seconds). TypeScript, lint and production build pass: /tmp/dune-guild-final-type.log, /tmp/dune-guild-final-lint.log, /tmp/dune-guild-final-build.log. Historical648-game calibration was not rerun for this change; current full suites include the existing complete-game cases.

Root browser QA created room6XMTUD6U with Guild and two Hard AI seats, completed setup, then explicitly staged only that room atv11 for transport/payment inspection. A1+2 combined group cost2 despite scalar amount19; five-force Red Chasm transport correctly exceeded available1+2spice, while return cost3 remained enabled. Actual return consumed personal1 and pledged2, returned five forces and credited Guild the donor’s2. Finalv13 has20reserves, no Guild forces on Dune, spice2, zero incoming pledge and spent shipment; movement remains unspent. A fresh invitation restored the same private seat, spent shipment and enabled Finish control. Full-page desktop visual inspection found readable labels/counts/costs and no clipped quote controls. This is a focused staged scenario, not full-game or mobile acceptance.

The manual23:45UTC restart backed up all1,502rooms, then verified exact JSON hashes/versions, HTTP200 and private-seat restoration in PRAVNYBG. The known human room remained v14 and idle. The initial sandboxed launch failed on denied network-interface access; the authorized runtime launch succeeded, without database repair. The removed automation remains removed. Current development server session24370 started around23:46UTC; next manual maintenance is due around00:46UTC7September if development continues and human play permits. Production test runs add QA rooms; do not infer that later room-count growth changed earlier saved states.

Shared normalized pending intents, ordinary Guild rate/permission responses and current-turn Truthtrance promises remain incomplete. An additional audit found malformed/stale persisted ordinary intents can bypass revalidation; this was not a valid-action remote exploit and needs a separate exact-custody/context check without inventing cancellation recovery. Advanced and expansion starts remain gated. The overall goal is active.

Truthtrance current-spice checkpoint (2026-09-07 local date)

Truthtrance now asks whether another player currently holds exactly, at least or at most a nonnegative whole amount of personal spice. The server compares p.spice at the answer action, excluding separate pledged aid and incoming payments. It rejects dishonest/unknown answers to this knowable fact and publishes only the requested answer. AND/OR keep their three-valued semantics and reveal no additional per-clause results. The fact does not constrain later legal spending. Freeform interpretation, other facts and nonbattle promises remain incomplete.

The existing private-answer projection lets all four AI levels respond legally without new privileged information or balance fields. The UI adds a styled comparison/amount form, linked input validation and public preview, and the in-game reference adds a five-part checklist. Root reviewed all new tests and the UI; independent privacy/recovery review found no runtime defect. No engine dispatcher, public mode gate or bot strategy was changed. See TRUTHTRANCE_SPICE_FACTS.md.

1,455/1,455 rules/client/component tests and 123/123 persisted/API tests pass. Nine new rules/AI cases include105 comparator lifecycle examples, all profiles, secret-state perturbations and a later paid revival. Four new SQLite cases preserve a genuine auction/payment choice, private composite answers and one history/discard under duplicate CAS. The first broad run included eight of the nine new rules tests; the final broad run includes all nine. Logs: /tmp/dune-truth-spice-final-full.log, /tmp/dune-truth-spice-multiplayer.log. Released-source TypeScript, lint and production build pass: /tmp/dune-truth-spice-final2-type.log, /tmp/dune-truth-spice-final2-lint.log, /tmp/dune-truth-spice-final2-build.log. No additional broad game-calibration claim is inferred from the earlier648-game source checkpoint.

Browser QA in the explicitly staged private roomPRAVNYBG verified a human spice question to Hard AI, disabled invalid amounts, an AI Yes with one card discarded, the resumed first Storm, and invitation recovery. A second canonical card fixture verified the human-target private answer and pending-question restoration. Publishing it produced finalv18: two Yes records, exactly two physical Truthtrances in discard, unchanged personal balances10/7 and the same saved Emperor storm dial3. Root visually inspected both forms. No real human room or earlier completed browser game was modified. The database now contains1,502 rooms; all1,388 rooms from the22:45UTC backup retain exact versions/state hashes except the previously recorded intentional ZJUGV6XW Karama completion. The real human room remainsv14.

The broader source-defined shipment commitment requires shared legal shipment feasibility, declaration/settlement checks, prevention of voluntary evasion through spending or skipping, and honest release after opposing effects. Those requirements and the unresolved Guild cases remain in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md. Full Advanced/expansion acceptance and the overall goal remain unfinished. The removed automation stays removed; the next manual development-server maintenance remains due around23:45UTC if active work continues and human play permits.

Source-ordered setup checkpoint (2026-09-07 local date)

New base tables follow the published sequence: fixed player positions, private Bene Gesserit prediction, private traitor selection, starting spice and forces, then Treachery. The persisted setup stage exposes only the IDs of players whose choices remain. Fremen place before the Advanced starting advisor; absent factions and completed automatic steps need no acknowledgement. Harkonnen keeps four traitors automatically. No starting Treachery identity is available during placement.

Public Basic start and the strict offline initializeBaseGameForAudit share one initializer. The audit entry accepts only a fresh ready base-faction lobby without expansions or optional modules and cannot be selected through a room action. Public Advanced and expansion gates remain intact. Legacy setups without a stage finish using their existing pieces; recovery never repeats the new initializer.

The complete suites pass 1,446 rules/client/component tests and 119 persisted/API tests, including 456 Advanced setup combinations across all 57 base-faction rosters, all four profiles and both actor/physical orders. Stage-ending duplicate requests commit only once through the production SQLite compare-and-swap path. The earlier failures were fixtures assuming the old deal order; the corrected fixtures preserve their gameplay, privacy, pacing and concurrency assertions. Logs: /tmp/dune-staged-setup-full.log, /tmp/dune-staged-setup-multiplayer-final.log, /tmp/dune-staged-setup-type-final.log, /tmp/dune-staged-setup-lint-final.log, /tmp/dune-staged-setup-build-final.log.

Two frozen-source Basic studies complete 192/192 games, 59,380 accepted actions, zero rejected candidates, stalls, exceptions or checked invariant failures. AI_STAGED_SETUP_BASIC_CALIBRATION_20260907.md records exact source boundaries and the historical incorrect-order comparison. Four registered Advanced full-game bot cases now begin genuinely Advanced through the shared initializer. The separate Advanced roster study completed 456/456 games with 116,270 accepted actions, zero rejected candidates or checked failures, and 5,943 actual JSON continuation points. It covers all 57 rosters at four difficulty shifts and two seed blocks. The 20-game pilot exactly reproduces the first 20 full-study rows and is not counted as additional independent games. Medium, Hard and Brutal do not show a consistent increasing strength ladder. These complete games do not resolve the remaining rule gaps or certify full Advanced compliance.

After calibration completed, engine formatting preserved its canonical syntax tree; formatting and setup-reference/checklist changes occurred outside the measured source intervals. The final engine hash is db169e5fc959a7b26469f22f26e6957cbb39fe49aab8ed25a8714dec3c31a3c1. All 22 targeted setup/reference checks and released-source TypeScript, lint and build pass: /tmp/dune-staged-setup-final-reference.log, /tmp/dune-staged-setup-final2-type.log, /tmp/dune-staged-setup-final2-lint.log, /tmp/dune-staged-setup-final2-build.log. The five-part setup checklist now records implementation, controls, AI, documentation and verification separately.

Two fresh browser tables verified prediction before private cards, private traitor selection with empty hands/board, human and AI Fremen placement, and the automatic card deal into Storm. One then completed online atv347 with a turn5 Bene Gesserit victory under voluntary Brutal autopilot; a fresh invitation restored its finished board and private hand. No game-state staging was used. Independent source/privacy review found no substantive defect in valid base setup or legacy continuation. Complete expansion setup and optional-module ordering, broader Advanced interactions and the remaining base Guild/Truthtrance rules remain required. The next bounded Truthtrance slice is documented in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md: verified current-spice questions first, followed by source-defined shipment commitments with their full enforcement and feasibility requirements.

Fremen movement cancellation and Advanced setup checkpoint (2026-09-07 local date)

Ordinary Fremen movement now offers a Karama response only when the selected route uses its two-territory advantage. A stored turn/movement/group intent waits before any force moves. Allowance revalidates and continues the exact group through normal arrival handling. Cancellation spends one cancellation card, preserves the forces and unspent movement, and limits that particular movement use to one territory. Hajr or the second distinct Ornithopter group has a fresh range use; city and fixed-card ornithopter range remain independent. The November 2020 FAQ supersedes the April whole-phase answer; see FREMEN_MOVEMENT_KARAMA_RULES.md.

The public response explains the destination and consequence. The mover sees the current restriction, and ordinary movement and normal-range Ornithopter controls reject an unavailable replacement route before submission. All four bot profiles use the projected current restriction; Hard and Brutal can cancel an enemy movement toward their own public fighters. Advanced Bene Gesserit setup bots now wait for the public Fremen placement prerequisite while completing their own traitor/prediction choices, then consider all legal printed starting sectors.

The complete existing run passed 1,431 tests, and all five subsequently registered independent movement edge tests passed on the same engine. The 116-test persisted/API suite passed. New verification consists of four BG setup tests, nine Fremen tests, five independent continuation/typed-custody tests and three production-room SQLite recovery/concurrency tests. Full suite logs: /tmp/dune-fremen-full.log, /tmp/dune-fremen-multiplayer.log; independent integration log: /tmp/dune-fremen-review-integrated.log. The edge suite was still being edited during the first type/lint run; its released version passed the subsequent type check. Subsequent released-source TypeScript, lint and production build checks passed (/tmp/dune-fremen-type-verified2.log, /tmp/dune-fremen-lint-verified.log, /tmp/dune-fremen-build-verified.log). Browser checks and the 1,388-room restart are recorded in VISUAL_PLAYTEST.md.

Both 96-game Basic studies completed with 56,766 accepted actions and zero rejected candidates, stalls, exceptions or checked invariant failures. The source files stayed unchanged during both runs; AI_FREMEN_MOVEMENT_CALIBRATION_20260907.md preserves hashes, exact boundaries, paired changes and non-monotonic difficulty outcomes. These are four-player Basic studies. The preceding 312-game player-count checkpoint remains historical evidence, not a claim that every prior simulation was rerun on this changed engine.

Two isolated browser rooms verified the human cancellation and replacement controls, including a disabled invalid route, a completed legal replacement and a pending response restored after the 22:45UTC controlled server restart. All 1,388 saved rooms retained exact versions/state hashes through the restart. Their names explicitly mark QA; no real human room was staged. Full Advanced setup and game acceptance, the remaining Guild/Truthtrance rules and all unfinished expansion systems remain required. The removed automation stays removed.

A subsequent setup ordering audit found that this historical checkpoint dealt private cards before BG prediction and starting Treachery before normal traitor/force choices. The following staged setup implementation corrects that defect for new tables. Old saved setup rooms retain their already-known cards and continue without redealing.

AI battle legality checkpoint (2026-09-07 local date)

AI plans now require an available controlled leader or Cheap Hero, retaining the explicit no-leader and forbidden-Hero exceptions. Leaderless plans cannot carry battle cards or the Kwisatz Haderach. Voice compulsion uses each held card’s default role, while prohibition and actual usage use the selected battle slot. This preserves legal Chemistry/Weirding Way alternatives and canonical Portable Snooper behavior.

An own Prescience commitment now restricts the leader, weapon or defense candidates before scoring and slot validation. It no longer overwrites a validated plan afterward, so one physical card cannot be introduced into both slots and the final leader determines KH eligibility. Dial commitments retain typed casualty/support checks. Existing Truthtrance completion hints, Stone preflight, custody and hidden-information boundaries remain active. The authoritative engine and difficulty profiles were not changed.

AI battle selection now uses public fighter presence, storm order and an accessible same-territory path. Polar Sink, advisors, allies, earlier aggressors and storm-separated groups are excluded. The Hidden Mobile Stronghold uses its pointing sector for storm blocking. Concealed No-Field values are never consulted; public marker presence alone supports battle selection.

1,418/1,418 registered rules/client/component tests and 113/113 persisted/API tests pass, plus TypeScript, lint and production build. New coverage is three root Prescience cases, seven independently authored plan cases, nine independently authored battle-choice cases and three independent worm-ride regressions, each testing all four difficulties. Every candidate in those fixtures is applied through the authoritative engine, with private-view invariance checked separately. Final logs: /tmp/dune-battle-ai-final-full.log, /tmp/dune-battle-ai-final-multiplayer.log, /tmp/dune-battle-ai-final2-type.log, /tmp/dune-battle-ai-final-lint.log, /tmp/dune-battle-ai-final-build.log.

A broader player-count run exposed one Fremen worm ride aimed back at its origin. Ride candidates now exclude that territory and apply public destination-entry conditions before the target limit, while preserving unlimited ride distance, multiple source sectors, elite custody and the separate free-reinforcement rules. All original four-player accepted traces remain identical in the final reruns.

The original and second 96-game Basic calibration batches now complete 192/192 games with zero rejected candidates, across 58,238 accepted actions. No deadlock, action-limit, exception or checked invariant failure occurred; every accepted action was the first offered candidate. All 96 original-seed accepted traces/final states match the preceding mobility run exactly, while 92/96 second-seed traces match. The second seed is a previously observed regression set, not a new blind strategy validation. Sources stayed stable. See AI_BATTLE_CALIBRATION_20260907.md for preserved hashes, changed rows and non-monotonic difficulty outcomes.

The final separate two-through-six-player study completed 120/120 Basic games, with 24 at each player count, 51,547 accepted actions, zero rejected candidates and no checked failures. Its only earlier rejection was the now-corrected worm ride. All recorded non-timing row fields match the initial study except that one rejection’s fields. The older harness does not record complete trace/state hashes or seed UUIDs, so no byte-identical replay is claimed. See AI_PLAYER_COUNTS_20260907.md. Combined with the final four-player pair, the current frozen code completed 312 games with zero attempted-candidate rejections; these different studies are not pooled as independent strength trials.

A live Basic two-player game also completed after the human Fremen enabled Brutal autopilot against the Hard Guild. The Guild won on turn 3 with four strongholds; a fresh invitation restored the completed v112 state and exact private seat. No battle occurred in that browser game, so its evidence is online progression, completion and recovery. See VISUAL_PLAYTEST.md. The full Advanced/expansion scope and reliable difficulty ordering remain unfinished.

The independent base Advanced readiness audit separates concrete base-game gaps from unrelated expansion work. Immediate targets are the BG setup AI prerequisite, Fremen movement Karama cancellation, distinct Guild rate/transport cancellations, and unfinished Truthtrance obligations. Some special-Karama settlement policies still await authoritative resolution. Existing Advanced subsystem simulations bypass genuine Advanced setup, so authentic setup, complete games and browser recovery remain required before enabling that mode.

AI movement legality checkpoint (2026-09-07 local date)

All four profiles now filter ordinary movement using the actual selected force group, faction range, city access, Ixian cancellation, CHOAM bonus, storm geometry, occupied strongholds and advisor arrival/lock rules. Legal destinations are filtered before the ranked target limit, preserving reachable alternatives. Easy explicitly includes the minimum required cyborgs when ordinary troops cannot fill its chosen group. Allies can remain legal transit points while prohibited arrivals stay excluded; Baliset and mobile-stronghold exceptions retain their authoritative behavior.

Fremen ordinary reinforcements use static distance from the Great Flat and remain distinct from paid allied Guild transport. Advanced Fremen storm reinforcement remains available. Guild transports use the rounded total shipment cost, own available spice and explicitly pledged ally funds. Hidden opposing hand contents, unpledged spice and foreign No-Field denominations do not enter these choices. Authoritative engine rules and difficulty profiles were not changed.

The ordinary shipment control also explains and disables Fremen destinations outside that radius. Nonzero storm destinations disable ordinary movement and shipment, with the printed Advanced Fremen reserve-shipment exception retained. These are destination checks; full route previews, broader legal-action guidance and card-specific movement controls still need further acceptance. The final UI follow-up passes TypeScript, targeted lint and production build (/tmp/dune-mobility-ui-build.log).

The registered suite passes 1,396/1,396 rules/client/component tests and 113/113 persisted/API tests. New coverage comprises three transport-budget tests and eight independently authored reachability tests across all profiles; existing shipment tests now require legal Fremen radius and funded Guild transport. TypeScript, lint and production build pass. Logs are /tmp/dune-mobility-full.log, /tmp/dune-mobility-multiplayer.log, /tmp/dune-mobility-final-type.log, /tmp/dune-mobility-lint.log and /tmp/dune-mobility-build.log.

Two unchanged-harness Basic simulations completed 96/96 games each, including the original comparison seed and a held-out seed. The original seed's rejected candidates dropped 94.01% (5,508 to 330); the held-out run had 471. Neither new run produced a movement/shipment rejection, stall, action-limit, exception or checked invariant failure. Source fingerprints stayed stable. Medium/Hard/Brutal strength ordering remains unverified, and battle-candidate legality remains an active improvement target. See AI_MOBILITY_CALIBRATION_20260907.md for the complete design, categories, shared-win handling and limits.

A documentation-only CHOAM Auditor audit identifies setup, traitor, capture, revival, privacy and post-battle integration points. It corrects the overbroad historical claim that Auditor cannot use a Ghola card: foreign Tleilaxu acquisition is the specific prohibition. The audit does not implement Auditor; repeated revival cycles and some combined timing remain unresolved. Full Advanced/expansion starts remain gated, and the complete goal remains active.

Browser acceptance completed ordinary Fremen free shipment and movement, then observed the Hard Guild AI's paid shipment and move in a new unmodified two-player Basic table. Fresh invitations restored both that table and the preserved Stone battle QA seat. The corrected radius/storm warnings were inspected in the live UI. Manual restart and final comparison preserved all 1,265 pre-existing room versions and exact state hashes. New QA room JJPGBA2Q remains atv78 with a genuine turn2 movement choice. Details and limits are in VISUAL_PLAYTEST.md. No maintenance automation was recreated; live server session97328 started around21:46UTC and its next manual maintenance is due around22:46UTC during active work.

Stone Burner, complete ordinary portraits and recovery checkpoint (2026-09-06)

• Canonical Stone Burner now uses the weapon slot without changing its saved kind: special identity. It has a named Voice role, Prescience/Truth-compatible original commitments, a private precommit availability check, and an event-bound owner choice after both plans reveal. Kill mode kills both participating leader discs; ignore mode preserves other weapon attacks. Both replace ordinary strength with undialed physical-token comparison, with the aggressor winning ties. Neither adds the Kwisatz Haderach bonus or kills that companion. Normal support, bounty, traitor/explosion precedence, casualty choices and winner/loser/Moritani retention remain shared with the existing battle flow.
• Physical counting enumerates every legal casualty allocation. A winner is accepted only when every permitted pair agrees. The printed Advanced Emperor example includes three possible remaining-token totals; where all give the same winner, the winner still chooses its normal casualty allocation afterward. Where the choice could change the winner, a conservative check rejects Stone before either hidden opposing plan is inspected. Foreign No-Field values are represented by public possibilities, never read to decide availability. Compulsory Stone Voice must leave a common zero-spice completion across those public possibilities.
• Two actual interpretation questions remain unanswered: the commitment procedure when Advanced or Basic Ix physical allocations change the winner, and the priority of opposing Stone/Poison Tooth revealed choices. No policy was inferred from silence. A public Ix-configuration guard prevents accepting a Stone plan whose combined timing cannot yet finish. This is an explicit implementation boundary, not a printed prohibition. Mirror/copied weapons and unfinished modules remain uncertified. See STONE_BURNER_ENGINE_AUDIT.md.
• Player controls show both original plans, exact undialed counts or honest possible totals, the mode choice and a complete internal guide. No victim/death confirmation is added. The card stays physically reserved until standard cleanup; stale events, duplicate requests and corrupted source custody fail before resources change. All four AI profiles use public force possibilities, legal low-dial plans and revealed leader/bounty information. They preserve leader value when Artillery suppresses bounty and leave traitor/explosion precedence intact.
• 1,385/1,385 registered rules/client/component tests and 113/113 persisted/API tests pass, together with TypeScript, lint and the production build. New coverage is eight pure Stone cases, seven root engine cases, nine independent reviews, five AI cases, three persisted recovery cases and four special-art cases. Logs: /tmp/dune-stone-final-full.log (34.28 seconds), /tmp/dune-stone-final-multiplayer.log (16.22 seconds), and /tmp/dune-stone-final-{type,lint,build}.log. All original card identities and the full expansion start gates remain intact.
• Browser QA selected Stone in the normal weapon selector and reached a real revealed choice in synthetic room QPNV5XJJ. The manual hourly restart saved all 1,235 rooms and preserved every version and exact state hash, including the pending choice at v60, event 20d21df3-8e58-4039-b6be-44db4f0d661a. A fresh invitation restored the exact decision with no payment/death. After choosing kill, Harkonnen won 4–0 on undialed tokens; Feyd-Rautha and Ein Calimar each died once, the normal 11-spice bounty was paid, one dialed force was lost, and Stone was retained normally. Final v68 has four Harkonnen forces at Pasty Mesa, 19 spice, one Stone in hand and none in discard, with no battle or decision. All other 1,234 saved room hashes remain unchanged. The enlarged card/guide and corrected decision heading/counts were inspected. Backups: /tmp/dune-maintenance-20260906T1215/; snapshots: /tmp/dune-stone-browser-pending-v60.json and /tmp/dune-stone-browser-complete-v68.json. Live server session11092 started around12:15 UTC; the next manual maintenance is due around13:15 UTC if development continues. The removed automation remains removed.
• Ecaz and Moritani each gained five original portraits, completing 60/60 ordinary leaders across all twelve factions. The separate Duke Prad Vidal portrait brings special-disc coverage to one without adding him to an ordinary roster or traitor inventory. All prior assets and provenance records were preserved. Full-resolution inspection, asset tests and actual192px/80px browser review passed. Duke's actual component additionally passed custody-label, inspector, identity-fallback and real404-fallback checks in an isolated byte-identical harness. Its temporary server was stopped. See ECAZ_PORTRAITS.md, MORITANI_PORTRAITS.md and DUKE_VIDAL_PORTRAIT.md. Auditor, Kwisatz Haderach and other nonordinary component artwork remain separate unfinished work.
• Semuta Drug, Mirror Weapon and Juice of Sapho remain inactive. Source audits now identify Semuta's fresh-discard continuation requirements and Sapho's scoped ordering requirements; these are not runtime completion claims. Other unfinished faction/module systems, mobile acceptance, difficulty-strength calibration and complete Advanced/expansion games still prevent goal completion. No start gate was removed.

Balanced Basic AI calibration (2026-09-06)

A new balanced four-player study completed 96/96 Basic games with no stalls, action limits, exceptions or checked resource/hand invariant failures. Each difficulty appeared 96 times, with balanced faction, seat and physical-circle marginals. Wins were Easy 1, Medium 30, Hard 28, Brutal 37. Easy was weaker in this sample, but the two seed replicates do not establish a reliable Medium → Hard → Brutal ordering. No resource bonuses or unauthorized information were used. The run accepted 28,379 actions; 911 first candidates and 5,508 total candidates were rejected before legal fallbacks progressed, chiefly movement reachability and Fremen entry. Those candidates and 243 unaffordable Guild transports remain concrete improvement targets. Source fingerprints were stable during measurement and a four-game prefix replay reproduced all non-time results. This is Basic completion evidence, not expansion or human-strength certification. See AI_CALIBRATION_20260906.md and tools/ai-calibration-stone.ts.

Portable Snooper runtime and Richese portrait checkpoint (2026-09-06)

• Portable Snooper now supports its ordinary poison-defense slot and optional play after both plans reveal, for all twelve holders in Basic and Advanced development fixtures. Exact canonical role predicates preserve saved kind: special identities without admitting unrelated cards. Normal plan searches, Voice, Prescience, structured Truthtrance names, player selectors and AI use that same role. It stops ordinary poison and weapon Chemistry, but not Tooth, Artillery, Lasgun or the projectile half of Poison Blade.
• Late play uses the spare battle-card slot and preserves the complete original plan. A lone Worthless in either slot is allowed; a real defense, weapon-plus-Worthless or two occupied slots blocks it. Voice compulsion must be met originally when possible, and forbidden poison defense remains forbidden late. The existing own traitor-declaration opportunity is the explicit application deadline, independent of hand contents; no extra holder-only public window or acknowledgement was added.
• Battle.lateDefense records the public played card separately, with exact battle-event and physical-custody validation. The card stays reserved in its owner's hand through remaining decisions and appears in the public component inspector only after play. The effective defense feeds combat, while the original plan remains the source for inspected and structured promised slots. Winner, loser and Moritani retention cleanup all account for that one physical card. Current decisions, Truthtrance and responses retain priority; duplicate and stale requests cannot replay protection or cleanup.
• Source review corrected an earlier retention assumption: the official November 2020 FAQ permits winning battle-card retention even without a keep footer, while explicitly naming Tooth/Artillery exceptions. Portable therefore uses ordinary winner retention. Mirror's ordinary retention follows the same source; inheritance of a copied Tooth/Artillery discard exception remains a separately pending user ruling. PORTABLE_SNOOPER_ENGINE_AUDIT.md and MIRROR_WEAPON_ENGINE_AUDIT.md record provenance and boundaries. Mirror itself remains inactive.
• 1,352/1,352 rules/client/component tests and 110/110 persisted/API tests pass, plus TypeScript, lint and production build. This adds five pure, five root engine, seven independent review and six all-profile AI cases, plus three persisted recovery cases. The recovery race forces both first-commit orderings between late defense and own traitor declaration. Logs: /tmp/dune-portable-final-full.log (35.29 seconds), /tmp/dune-portable-final-multiplayer.log (17.89 seconds), /tmp/dune-portable-final-type.log, /tmp/dune-portable-final-lint.log, /tmp/dune-portable-final-build.log.
• Browser QA verified the ordinary defense selector, sealed an empty original defense, played Portable against revealed Chaumas, and inspected the separate public late card. A fresh invitation preserved the exact pending v46 state and event before resolution. Feyd-Rautha survived, Harkonnen won 8–6, and the normal keep/discard choice retained Portable. Final v51 has three forces at Pasty Mesa, eight spice, Maula Pistol plus exactly one Portable, no Portable in discard, no battle or decision, and a living Feyd-Rautha used in that territory. The enlarged guide was visually inspected. Snapshots: /tmp/dune-portable-browser-pending-v46.json and /tmp/dune-portable-browser-complete-v51.json. All other 1,174 saved room hashes still match the last maintenance backup. This is a focused battle/reconnect check, not complete expansion-game acceptance.
• Final integrated review fixed a late-defense AI omission for Cheap Hero accompanied by the Kwisatz Haderach. All four profiles now preserve the +2 when protection changes defeat into victory; an ordinary zero-strength hero still does not consume the card. The real Advanced Atreides regression follows actual power preparation, legal spice support and both traitor decisions. Portable’s enlarged inspector now opens its specific timing/interaction guide, and its summary explicitly offers both normal and late use. The final 18 guide/reference tests also pass.
• Five original Richese portraits bring ordinary coverage to 50/60, completing both factions in each of the first two expansions as well as the six base factions. All forty-five prior files and manifest entries are unchanged. Full-resolution inspection, four existing asset tests and actual 192px inspector / 80px circular browser review pass. The exact temporary review server was stopped. See RICHESE_PORTRAITS.md. Ten Ecaz/Moritani ordinary portraits and separate special-disc artwork remain unfinished.
• Four Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon and Juice of Sapho. Complete faction/module interactions, mobile acceptance and full Advanced/expansion games remain unfinished. No start gate was removed. The live development server remains the verified session started during the preceding maintenance; the removed automation stays removed and the full goal stays active.

Residual Poison runtime and CHOAM portrait checkpoint (2026-09-06)

• Canonical Residual Poison now has engine, private controls and all four AI policies. Before either combatant commits a leader, it uniformly selects one living, currently controlled opposing leader available in the battle territory, sends that physical disc to the Tanks and discards once. Same-territory reuse remains eligible; dead or elsewhere-used leaders, Cheap Heroes and the Kwisatz Haderach are excluded. There is no payment, bounty, force loss or automatic battle victory.
• A hand-independent shared preparation step gives both combatants an actual opportunity before leader commitment in Richese tables. Both choose readiness; no nonholder is silently passed. This is a disclosed application timing procedure, not a claimed publisher ordering rule. Active interactions retain priority. Exact saved battle events bind both actions and retries. No additional confirmation is added to the random death.
• Foreign ghola revival custody and Duke Vidal's physical disc/death history are preserved. Involuntary death reconciles impossible battle promises and reopens an impossible non-leader Prescience answer without redrawing the victim. All candidate death transitions and prospective hand commitments are validated before randomness. The still-secret Harkonnen captive disclosure ruling remains unresolved: Advanced Harkonnen tables guard the card based on their public configuration, never based on hidden captivity. See RICHESE_RESIDUAL_POISON_ENGINE_AUDIT.md.
• The full registered suites pass 1,329/1,329 rules/client/component tests and 107/107 persisted/API tests, with TypeScript, lint and production build passing. New focused coverage comprises seven pure, six root engine, seven independent review and four AI cases, plus three SQLite/CAS recovery cases. Logs: /tmp/dune-residual-final-full.log (34.00 seconds), /tmp/dune-residual-final-multiplayer.log (16.26 seconds), /tmp/dune-residual-final-type.log, /tmp/dune-residual-final-lint.log, /tmp/dune-residual-final-build.log. Existing No-Field tests now perform the genuine readiness actions; independent-battle privacy comparisons normalize only the new random public event IDs.
• The manual maintenance restart preserved all 1,175 saved room versions and exact state hashes, including a real browser-created open preparation step in synthetic QA room QPNV5XJJ v29. Backup: /tmp/dune-maintenance-20260906T1117/database.sqlite. The known human room remained idle and unchanged. A fresh invitation restored the exact event and opponent readiness. Browser play then killed Flinto Kinnis once, left spice and forces unchanged, removed the card from hand and placed exactly one in discard. Ready resumed normal planning; the AI sealed a valid plan. Refresh retained v34, the same event, one death and one discard. All other 1,174 saved room hashes remained unchanged. No automation was recreated. Snapshots: /tmp/dune-residual-browser-complete-v31.json and /tmp/dune-residual-browser-planning-v34.json.
• Five original CHOAM portraits bring ordinary coverage to 45/60, completing the six base factions plus Ixians, Tleilaxu and CHOAM. All forty earlier files and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and actual 192px inspector / 80px circular browser review pass. The temporary contact-sheet server was stopped. See CHOAM_PORTRAITS.md. Fifteen ordinary portraits and separate special-disc artwork remain unfinished.
• Five Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon, Portable Snooper and Juice of Sapho. Other incomplete faction/module systems and unresolved interactions remain tracked. No full Advanced or expansion game was certified and no start gate was removed. The full goal remains active.

Ornithopter runtime and Tleilaxu portrait checkpoint (2026-09-06)

• Canonical Ornithopter now supports both printed movement choices in the engine, player controls and all four AI profiles: one group moves up to three territories, or two different groups move with normal movement range. The played physical card leaves the hand for public played-card custody until the effect finishes, then enters discard exactly once. It grants no additional reserve shipment.
• Two-group movement records the original remaining ordinary and elite forces separately. Later arrivals from the first move cannot replenish those quotas, and the second group must also fit current physical custody. Exact No-Field token/event identity is tracked; an eligible marker revealed during the effect contributes its actual revealed forces to the remaining group, without permitting a moved marker or moved forces to be reused. Event and custody checks survive saved reactions, stale submissions and recovery.
• The movement controls expose both modes, active progress and remaining eligible groups; a source containing only already-moved forces is disabled. All four AI policies use the authorized movement projection and handle the continuation. Prior movement/Hajr composition and the fixed-three-territory interaction with Kulon remain explicit interpretation guards. Six other Richese card effects and broader combined interactions remain unfinished; no Advanced or expansion start gate was removed.
• Focused coverage adds 28 pure/engine/review/AI cases (eight pure, eight root engine, six independent review and six AI), plus four persisted/CAS cases. The full registered suite passes 1,305/1,305 rules/client/component tests and 104/104 persisted/API tests, in /tmp/dune-ornithopter-final-full.log (36.51 seconds) and /tmp/dune-ornithopter-final-multiplayer.log (17.40 seconds). Final UI TypeScript, lint and production build all exited successfully; the initial lint findings were fixed before the successful rerun. Logs: /tmp/dune-ornithopter-ui-final-type.log, /tmp/dune-ornithopter-ui-final-lint.log, /tmp/dune-ornithopter-final-build.log.
• Real browser QA in the synthetic room moved two forces from Red Chasm sector 7 to Pasty Mesa sector 5 (v23→24). Reusing that moved group was disabled. A fresh invitation restored the exact v24 state and three-force remaining quota. The second browser move advanced to v25: five total forces in pasty_mesa:5, two completed moves, eight spice, fifteen reserves, only Maula Pistol retained, exactly one Ornithopter in discard and no pending played card. Snapshot: /tmp/dune-ornithopter-browser-complete-v25.json. All other 1,114 room hashes remained unchanged against the controlled-maintenance backup. This is focused movement/recovery evidence, not a complete expansion-game claim.
• Five original Tleilaxu portraits bring coverage to 40/60 ordinary leaders, completing all six base factions plus Ixians and Tleilaxu. All thirty-five prior assets and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and coordinating-agent browser inspection at actual 192px square and 80px circular sizes pass. The temporary review server was stopped after inspection. See TLEILAXU_PORTRAITS.md for exact names, prompts, local paths and hashes. Twenty ordinary portraits and separate special-disc artwork remain unfinished.

Nullentropy Box runtime and Ixian portrait checkpoint (2026-09-06)

• Canonical Nullentropy Box now charges two uncommitted own spice to the bank before granting a private discard search. The paid search is persisted, owner-only and bound to an exact event, player, turn, phase and discard signature. Selecting a non-Box card transfers that physical card, commits one shuffled remainder order and places the used Box on top. No Emperor income, purchase bonus, recipient acknowledgement or Karama cancellation window is introduced.
• The private search layout now uses available container width, keeping candidate cards readable in the narrow decision sidebar. Final reference/presentation/art checks pass all 22 cases, including two new reference cases. Final reference/layout type checking and targeted lint pass.
• The Box remains reserved in hand while the real discard pile is locked. Existing response, decision, pending Karama and phase opening are saved and restored exactly. Early Truthtrance, CHOAM, gift and Distrans mutations, discard recycling and automatic continuation cannot alter the search. Seat recovery and voluntary autopilot takeback remain available. One eligible card completes automatically after payment; multiple eligible cards require the genuine private choice. A refresh or duplicate request neither pays again nor rerolls a committed result.
• Full-hand activation, empty/only-Box searches and the existing provisional Guild shipping-Karama refund conflict remain explicit guards. Active Truthtrance keeps answer-first priority; payment cannot break a binding battle promise. Semuta's future discard reaction, remaining Richese card effects, broader timing disputes and full combined-game acceptance remain unfinished. No Advanced or expansion start gate was removed.
• Owner controls and all four AI profiles use the authorized paid-search projection. Before payment, the projection contains no discard faces; after settlement the search entitlement expires. The current original portrait registry also reaches 35/60 ordinary leaders, adding the complete five-leader Ixian roster. Twenty-five ordinary expansion portraits and separate special-disc artwork remain. The Ixian sources were visually inspected and four existing asset tests pass; actual 192px inspector and 80px circular browser inspection now passes in the root-reviewed contact sheet. See IXIAN_PORTRAITS.md.
• Focused Box verification passes 17 new rules/AI cases (six root engine, six independent review, five AI) and four persisted recovery cases. The seven pure Box cases were already registered at the previous checkpoint. Review coverage includes paid privacy, exact parent restoration, real Truthtrance fee constraints, gift reservations, central locks, corruption before RNG, automatic singleton completion and duplicate begin/selection CAS. TypeScript and targeted lint pass for the independent review checkpoint.
• Combined test verification passes: 1,275/1,275 registered rules/client/component tests and 100/100 persisted/API tests. Logs: /tmp/dune-box-final-full.log (31.97 seconds) and /tmp/dune-box-final-multiplayer.log. Current aggregate TypeScript, lint and production build pass. After adding two reference cases and extending the existing portrait roster assertion, all 22 targeted reference/presentation/art tests pass (/tmp/dune-box-final-reference-art.log). Root browser review passed the five Ixian portraits at actual 192px and 80px sizes. A real paid Box search survived a controlled server restart with all 1,115 room state hashes unchanged; browser selection of Maula Pistol then advanced v21→22 with the same eight spice, one Box on top of discard and the exact earlier Richese gift restored. The other 1,114 rooms remained unchanged after that deliberate QA action. No automation was recreated. The current development server restarted successfully at approximately10:12UTC; the next manual maintenance check is due around11:12UTC if active development continues and human play permits.

Distrans engine, controls and recovery checkpoint (2026-09-06)

• Activated canonical Distrans for any faction holder: select another player and a different card from the owner hand, transfer it intact, then discard Distrans once. No fee, purchase bonus, recipient acknowledgement or new Karama response is added. Donor/recipient cards stay private, and the public history identifies only the played Distrans and transfer participants.
• Shared transfer validation checks both outgoing cards against exact gift, plan, prescience, retention, Black Market and accepted Ix replacement commitments, including saved parent responses. Prospective completion preserves binding Truthtrance answers, compulsory Ambassador discards, the Harkonnen returner's required card count and the target's reserved incoming slots. It improves those same saved-context protections for existing Richese gifts.
• The synchronous action preserves a pending response, decision or phase-opening window. Tests show a recipient can free space for a pending gift, or another legal Distrans transfer can fill that space and make gift settlement abort cleanly. Active Truthtrance has priority. Unpaid open lots and self-transfer remain named guards pending the existing questions; a completed purchase income/bonus response is distinct from an unresolved bid. Semuta reactions and the remaining eight Richese effects remain unfinished.
• The hand panel has recipient/card selectors, both inspectors, unavailable reasons and an explicit give-and-discard action. All four AI profiles use entitled choices to give Worthless cards to suitable allies or share duplicate ordinary weapons/defenses/Karamas from a full hand. They do not inspect other hands and respect existing decision priority. Full expansion starts remain gated.
• Integrated verification passes 1,247/1,247 registered rules/client tests and 96/96 persisted/API tests, TypeScript, lint and production build. Distrans coverage comprises six pure custody, six root engine, six independent review, five AI and three persisted cases. The root matrix spans all twelve donor factions, nine phases and both modes. Logs: /tmp/dune-distrans-full.log, /tmp/dune-distrans-multiplayer.log, /tmp/dune-distrans-type.log, /tmp/dune-distrans-lint.log, /tmp/dune-distrans-build.log; card/reference checks pass22/22 in /tmp/dune-distrans-reference.log.
• Real browser QA used only the synthetic roomQPNV5XJJ: a staged Harkonnen hand held Distrans and Shield while its incoming Richese gift awaited an observer's Karama response (v18). Clicking the explicit transfer button gave Shield to Richese, discarded Distrans once and preserved the exact pending gift event (v19). A fresh invitation tab restored the empty donor hand and same pending gift, without replay. Root visually inspected the selectors and result. Fixtures: /tmp/dune-distrans-browser-before-v17.json, /tmp/dune-distrans-stage.ts, /tmp/dune-distrans-browser-complete-v19.json. No human table changed.
• Four original Bene Gesserit portraits complete all six base-faction portrait rosters, bringing ordinary leader coverage to30/60. Root inspected all four final full-resolution images; the agent also checked192px inspector and80px circular presentation. Exact names, prompts, corrections and hashes are in docs/BENE_GESSERIT_PORTRAITS.md. All prior26 manifest records and Irulan remain unchanged. The existing four asset tests are now registered in npm test, and their roster assertion covers all six base factions.
• Nullentropy Box now has a source/insertion-risk audit (docs/NULLENTROPY_BOX_ENGINE_AUDIT.md) and pure custody helper (game/nullentropy-box.ts) with seven passing registered cases. Payment, private search, event-bound selection, automatic one-choice completion, discard locking, parent restoration and AI/UI remain the next runtime work. The existing full-hand question remains pending; provisional Guild discard-refund custody also requires an explicit guard or resolution before search can compose with that case.
• Final combined verification:1,258/1,258 registered rules/client/component tests,96/96 persisted/API tests, TypeScript, lint and production build pass. Final combined logs are /tmp/dune-distrans-final-full.log, /tmp/dune-distrans-final-type.log, /tmp/dune-distrans-final-lint.log, /tmp/dune-distrans-final-build.log; the unchanged runtime's96-case multiplayer evidence remains /tmp/dune-distrans-multiplayer.log. No test files are left unregistered. Full expansion compliance remains unproven.
• No automation was recreated. Manual maintenance remains due around10:10UTC, subject to active human play. Nullentropy Box's private paid search and the remaining portrait inventory are the next independent slices; no broad compliance claim is made.

Richese gift integration checkpoint (2026-09-06)

• Integrated the Basic Richese alliance gift for exact canonical cards already held by the donor. A transfer creates no spice payment, auction income, bonus draw or replacement. The gift can suspend ordinary decisions, responses and phase opening; resolving it restores their exact ownership, passes and pending Karama. Active Truthtrance still has priority.
• The card stays reserved in the donor hand until its separate Karama opportunity resolves. Only donor and recipient see its pending identity. Declaration and settlement revalidate custody, mutual alliance, capacity and commitments, including auction slots, battle promises and accepted exchanges. Random Harkonnen extraction is rejected before RNG when it would disturb a reserved gift. A Harkonnen bonus rechecks actual capacity before drawing.
• Independent review found a stale-alliance defect that could overwrite the old recipient hand using the new ally hand. Settlement now validates the full original owner/recipient/card intent before assigning either hand. Engine and real SQLite CAS regressions confirm all hands remain unchanged on stale-alliance abort.
• A further real Harkonnen special-Karama regression verifies mandatory return capacity: gifts cannot fill slots needed by the return, but remain legal when the recipient still has room afterward. Both restored exchanges complete without lost or duplicated cards.
• Owner controls provide inspectable card selection and unavailable reasons; both allies can privately inspect pending gifts. All four AI profiles gift the functional canonical Karama to free a full bidding hand when public ally counts support it. Other nine Richese effects and broader gift strategy remain unfinished. Same-card retry after cancellation during the same phase explicitly awaits a ruling; no complete mode gate was removed.
• 1,230/1,230 registered rules/client and 93/93 persisted/API tests pass, along with TypeScript, lint and production build. Gift coverage comprises six pure custody, five root engine, eight independent review, four AI and three persisted cases. The root matrix exercises all ten identities in both rule modes across nine phases. Logs: /tmp/dune-gift-final-full.log, /tmp/dune-gift-final-multiplayer.log, /tmp/dune-gift-final-type.log, /tmp/dune-gift-final-lint.log, /tmp/dune-gift-final-build.log.
• Real browser controls in synthetic QA room QPNV5XJJ gave Karama to the ally automatically when no one could cancel (v13→14). The exact completed state is /tmp/dune-gift-browser-complete-v14.json. A second staged case retained an observer Karama, declared the gift through the UI (v15→16), and restored that exact pending response/card in a fresh invitation tab. /tmp/dune-gift-browser-pending-owner-v16.json preserves the original pending owner fixture. Only synthetic role IDs were then swapped (v17); the recipient browser showed the exact pending card, an empty private hand and no spurious acceptance button. Both donor and recipient presentation were visually checked with the existing authenticated QA seat. No human table was modified, and this is not real seat-switch coverage.
• The next Distrans slice has a source/insertion audit in docs/RICHESE_DISTRANS_ENGINE_AUDIT.md and an immutable pure helper in game/distrans.ts. Six registered pure tests pass across all twelve structural donor factions, ordinary and Richese targets, custody, capacity and replay. The card is not activated in engine/UI/AI. Open-bid timing and self-transfer were asked once and remain unanswered; next work is synchronous action integration after Truthtrance priority with both-card reservations and the new mandatory incoming-capacity guard.
• No automation was recreated. The server remains the one started at 09:10 UTC; next manual hourly restart is due around 10:10 UTC if development continues and human activity permits. This bounded checkpoint does not certify complete Richese or combined expansion games.

Allied No-Field shipment and recovery checkpoint (2026-09-06)

• Added a persisted Richese offer-or-pass opportunity before the ally’s normal shipment. This preserves a human supplier’s decision when the active ally uses AI, regardless of seating order. The supplier privately selects a different token, destination and payment; the recipient accepts and selects its physical ordinary/elite mix or declines without cost. Denomination, typed offer details and recipient finances remain private to their entitled viewers.
• Successful shipment first reveals an existing supplier marker, immediately materializes the allied token from the recipient’s available reserves, updates shared no-repeat history and uses the recipient’s shipment slot. Prices are one spice in a stronghold or two elsewhere. Either ally can pay the full cost, or both can explicitly pay one for a two-spice shipment. Guild income and Heighliner accrual use the appropriate recipient/payment identities.
• Exact consent and token events fence stale/replayed actions. Richese cancellation and Guild prevention preserve token/fund custody; stale post-response allocation aborts safely. Arrival preflight catches unsupported simultaneous reactions before consent becomes committed, leaving decline available. AI tries legal acceptance and retains decline as a fallback after authoritative rejection.
• Fremen’s ordinary reserves are on-planet, so they do not satisfy this off-planet-only shipment method. Guild-recipient/active-Karama price and routing conflicts have been asked explicitly and remain guarded. HMS/Homeworld and combined arrival work, mixed No-Field battle arithmetic, whole-plan prescience and other expansion systems remain unfinished. No incomplete mode gate was removed.
• Final verification: 1,207/1,207 registered rules/client tests, 90/90 persisted/API tests, TypeScript, lint and production build pass. The new allied tests comprise eleven engine, seven independent review, seven AI and three persisted cases. Six additional pure Richese-gift tests pass, but gift engine/control/AI integration is not yet implemented. Final logs: /tmp/dune-allied-final-full.log, /tmp/dune-allied-final-multiplayer.log, /tmp/dune-allied-final-type.log, /tmp/dune-allied-final-lint.log, /tmp/dune-allied-final-build.log.
• Browser roomQPNV5XJJ made a real private No-Field3 proposal (v10), then recovered that exact pending decision in a fresh invitation tab after the 09:10 UTC server restart. For recipient-control QA only, the two synthetic player-role IDs were swapped in a saved fixture (v11), preserving the authenticated QA seat; this was not a claim of switching real user seats. Clicking Accept then created three Harkonnen forces in Arrakeen, reduced its reserves20→17, charged Richese one spice, and used only the recipient’s shipment (v12). Root visually inspected the recipient terms and buttons. The original proposal fixture is saved in /tmp/dune-allied-browser-owner-v10.json.
• Controlled hourly maintenance backed up995 tables to /tmp/dune-maintenance-20260906T0910/. Every table’s exact state hash and version matched after stop, restart and browser reconnect, before subsequent deliberate QA actions. The known human table remained v14, idle203minutes at restart. Health returnedHTTP200. No recurring automation was recreated. Next manual maintenance is due around10:10UTC if active development continues and human play permits.

No-Field engine, controls and recovery checkpoint (2026-09-06)

• Integrated own concealed shipment at the one-force rate, selected allied funding, separate Karama/Guild responses, immutable token custody, stale-event fencing, marker-only and mixed physical movement, voluntary reveal, effective occupancy/control/collection, exposed storm and unprotected worm losses. Physical force arrays contain actual units only; the marker never fabricates a reserve or Tank token.
• Marker-only battles support all three secret values, scarce reserves, joint plan revelation, zero-token leader/card resolution and ordinary Atreides dial restrictions. Mixed ordinary/No-Field battle dialing and entire-plan special prescience remain guarded pending source resolution. Allied token shipment, protected-worm/Truthtrance/other optional combinations remain unfinished; Richese and other incomplete mode gates remain intact.
• Trip to Gamont reveals a marker in the selected sector, including when ordinary forces share it, then returns one actual force if present. A zero-result play still uses the card. Karama cancellation preserves concealment; a changed restored marker event aborts the pending effect without consuming the card.
• Owner controls show private inventory, payment, last-use restrictions, marker movement and reveal. Opponent board markup is identical across secret values. All four AI profiles use their entitled views for own shipments, marker moves/reveals and marker-only Basic/Advanced battle fixtures.
• 1,176/1,176 registered rules/client tests and 87/87 persisted/API tests pass. TypeScript, lint and production build pass. Logs: /tmp/dune-no-field-full.log, /tmp/dune-no-field-multiplayer.log, /tmp/dune-no-field-final-type.log, /tmp/dune-no-field-final-lint.log, /tmp/dune-no-field-build.log. New tests include eight presence, ten engine, eight independent review, nine AI and four persisted recovery scenarios. Full game acceptance for Richese remains outstanding.
• Browser QA room QPNV5XJJ advanced through real token-5 shipment (one spice, reserves unchanged), marker-only Arrakeen→Imperial Basin sector10 movement, invitation reopening in a fresh tab, and voluntary reveal exactly once. Final v8 has nine spice, fifteen reserves, five actual forces in Imperial Basin and token5 faceup as last used. Root visually inspected the board and private inventory. Initial QA fixture staging was backed up to /tmp/dune-no-field-browser-before.json; no human table was modified. Battle/Gamont/mobile browser acceptance remains outstanding.
• No recurring automation was recreated. The development server from the 08:10 UTC controlled restart is still running; the next hourly maintenance is due around09:10 UTC if human activity permits. This checkpoint advances the active goal and does not certify full rules compliance.

Richese acquisition, No-Field model and Guild art checkpoint (2026-09-06, 08:19 UTC)

• Richese special Karama now validates and buys one secretly selected canonical cache card for three uncommitted own spice, discards the activating Karama and consumes its once-per-game Advanced power atomically. Full-hand timing and consuming the final cache card remain explicit unresolved guards; the user was asked about full-hand timing. Offered auction cards remain reserved.
• Emperor receives the purchase payment through a separate cancellable income response. Cancellation never reverses the uncancelable special purchase. The persisted continuation preserves the original response, decision and pending Bene Gesserit conversion, then restores them once. Direct cache purchase creates no Harkonnen bonus or Ixian allied replacement.
• Private hand controls provide both selectors, card inspectors, price, payment recipient and authoritative availability explanations. All four AI profiles can conservatively buy the currently usable canonical Karama; nine other Richese card effects remain unfinished. A browser-discovered generic Karama purchase button outside an ordinary auction is now disabled with a visible reason.
• No-Field has an isolated immutable three-token model, single concealed deployment, shared own/allied consecutive-shipment history, capped materialization and private projection. Independent review fixed sparse inventory validation. Root review fixed Polar Sink’s sector-zero address. Thirteen focused model tests pass; shipment, board, battle, casualty, victory, AI and multiplayer adapters are still outstanding.
• Four original Guild portraits complete its five ordinary leaders. Original art now covers26/60 identities. Root visually reviewed the complete Guild row and all four new enlarged portraits in the browser.
• Final verification: 1,141/1,141 rules/client tests, 83/83 persisted/API tests, TypeScript, lint and production build pass. Logs: /tmp/dune-acquisition-final-full.log, /tmp/dune-acquisition-multiplayer.log, /tmp/dune-acquisition-final-type.log, /tmp/dune-acquisition-final-lint.log, /tmp/dune-acquisition-final-build.log. Focused acquisition tests include eight engine, nine independent review and four all-profile AI scenarios; two new persisted race/restart scenarios extend the Richese recovery suite to nine.
• Browser roomQPNV5XJJ purchased a cache Karama via real controls, restored its private seat and pending Emperor income through the invitation in a fresh tab after the controlled restart, and paid income exactly once. Finalv4 has Richese7 spice, Emperor13 spice, one acquired Karama, nine cache cards and a consumed special power. The final ordinary purchase button guard and both internal reference topics/links were checked in the browser.
• Hourly maintenance saved905 rooms under /tmp/dune-maintenance-20260906T0809/. All original states matched after stopping; after restart and verification only the deliberately advanced QA room changed. The known potentially human table remained v14, idle142minutes at restart. Local server was restored; no recurring automation was created. Gifts, Distrans, Box, No-Field integration, other faction/modules, full Advanced/expansion games and mobile/component audits remain unfinished. No mode gate was removed and the overall goal remains active.

Richese bidding and component checkpoint (2026-09-06)

• Added all ten separate Richese cache identities and the missing five CHOAM/five Richese ordinary leaders. There are now60 ordinary leaders and22 original portrait matches; Auditor remains a separate unfinished advanced component. Ten Richese guides have printed categories and enlarged inspectors; ordinary card-effect integration remains incomplete, with Karama inheriting the existing generic handler in development fixtures.
• The engine wraps ordinary bidding with a first/last cache auction and optional advanced Black Market prelude. Cache supports Once Around/Silent; Black Market supports all three methods for other buyers. Exact card custody, selected own/allied payment, private sealed submissions, storm-order ties, zero outcomes, seller income, Atreides inspection, Harkonnen bonus and source-specific Ixian ally replacement are integrated. No fake normal auction object is used for a special sale.
• Independent review fixed concealed physical-ID leakage, a reserved Truthtrance queue deadlock, and malformed funding-error probes of private allied bids. Full-hand participants automatically pass or submit zero; a full-hand owner automatically removes an unbid cache card. Losing bids release reservations, and a normal pool is not drawn and lost when all hands fill. Automatic room recovery uses the existing CAS fence; legitimate waiting states produce no writes.
• Controls and all four AI profiles handle the supported auction paths. AI currently declines an optional Black Market offer, while responding legally to its three offered methods. Browser acceptance covers cache declaration, Once Around purchase, Silent private bid restoration and all ten enlarged card guides; it found and fixed rule-link expansion and unsupported hand-action presentation defects.
• Explicit unresolved guards remain for cache-auction cancellation count, exhausted-cache arithmetic, positive Black Market seller bids and Advanced Ixian Technology on special lots. No-fields, the special cache purchase/gift, nine card effects and other full faction/module interactions remain unfinished. These guards are implementation limitations, not assertions that the official rules prohibit the interactions. Live Advanced/expansion starts remain disabled.
• Final verification:1106 rules/client tests,81 persisted/API tests, TypeScript, lint and production build pass. The120-game Basic regression study completed with unchanged per-game outcomes and no stalls; it does not certify an expansion mode. See RICHESE_AUCTION_RULES.md, RICHESE_COMPONENTS.md, CHOAM_RICHESE_LEADERS.md, AI_CALIBRATION.md and VISUAL_PLAYTEST.md for scoped evidence.
• The07:06UTC controlled restart preserved all843 then-existing room states and versions. No recurring automation was recreated.

Shipment funding controls and Atreides artwork (2026-09-06)

• Ordinary reserve shipment now displays its selected price, normal price when discounted, available own/pledged funds and selected payment split. Invalid force/elite counts, invalid explicit shares and insufficient selected funding disable the submit button with accessible reasons. An obsolete explicit share is ignored when the player has no ally, so a hidden old field cannot block a later shipment. The server remains responsible for geometry and all final action validation.
• The pure presentation component consumes only caller-provided values. The parent uses the same ordinary reserve price helper as server/AI and the same default-own-first contribution calculation as the engine. Independent review found no new pricing or privacy defect. This does not implement Guild rate cancellation.
• Four additional original portraits complete the five Atreides native leaders: Lady Jessica, Gurney Halleck, Duncan Idaho and Dr. Yueh join Thufir. Ten of the 50 currently cataloged ordinary leaders now have artwork. Each new asset is inspected, 1254px square, with its exact prompt preserved and exact identity mapping. All required twelve-faction art/component work remains incomplete.
• Desktop QA restored S85SLVRR, used an isolated version40 fixture with two Guild spice, showed three forces costing two and five costing three, and disabled the unaffordable action. Submitting three forces reached version41 with exactly two spice paid and three placed. EN4L8NTV retained version83 while its complete Atreides roster and expanded Lady Jessica were inspected. TypeScript, lint and production build pass. No engine/bot behavior changed in this slice; the prior 951-rule/45-persisted test checkpoint remains the latest full regression run.
• GUILD_RATE_KARAMA_RULES.md now records publisher support for separately canceling discounts, transport permission and income, with the later November FAQ overriding the older April transport answer. The user was asked how to handle a declaration made unaffordable by cancellation. That answer remains pending, so the new cancellation engine is not activated.

Portraits, shipment proposals and Extortion accounting checkpoint (2026-09-06)

• Six original leader portraits now appear in authorized roster and expanded identity views: Thufir Hawat, Feyd-Rautha, Hasimir Fenring, Stilgar, Staban Tuek and Princess Irulan. Exact ID/name matching prevents inferred identities; unknown identities and failed assets retain existing vector components. Names and current strengths remain interface text. Six of the 50 currently cataloged ordinary leaders have portraits; this is not the complete twelve-faction component inventory.
• Ordinary reserve shipment pricing is shared between authoritative payment and AI budget filtering. Bots preserve existing destination, amount and candidate order, removing only unaffordable proposals using their own balance plus projected pledged aid. Seven tests cover all difficulties, Guild rounding/alliance, Karama beneficiary, free Fremen, aid and hidden balances. Existing Guild transport and movement candidate filtering are unchanged.
• A paired 120-game Basic run at seed20260907 completed without deadlocks or checked invariant failures before and after filtering. Every recorded per-game field other than elapsed time and rejected-candidate diagnostics matched, including assignments, winners, finishing turn and accepted-action count. Rejections fell26,146→9,081 (65.27%); 16,735 insufficient-spice proposals and330 proposals rejected earlier for occupancy disappeared. All other rejection-reason counts match. See AI_CALIBRATION.md; the four-level strength ranking remains unproven.
• Extortion now has an isolated, immutable accounting helper and nine tests for the reserved five spice, Mentat collection, storm-order three-spice payment, affordability and recovery outcome. It has no engine, UI or AI activation. The official rules do not resolve collection/recovery versus the same Mentat's Terror placement order; the user's interpretation is pending. Do not count this helper as a working Extortion effect.
• Independent review confirmed a preexisting missing Guild rule: ordinary Guild or ally half-rate shipment can be canceled once with Karama under November2020 FAQ p7. Current pricing preserves existing rates and does not implement that cancellation window. This remains on the full-rules completion backlog.
• Validation:951 rules/client tests and45 persisted multiplayer tests pass; TypeScript, lint and production build pass. The hourly manual restart at04:52UTC restored exact hashes and versions of all four selected QA saves; HTTP health and the Atreides saved browser seat recovered. The removed automation remains removed.

Moritani allied card retention checkpoint (2026-09-06)

• A defeated Moritani ally may choose one eligible card from its revealed Battle Plan when the battle has a winner, or decline. The same mandatory-discard predicate serves winner cleanup and ally eligibility, including hero, Tooth, Artillery and traitor-preempted effects. Moritani itself and mutual-loss outcomes do not gain this benefit.
• The engine reserves the exact played cards as soon as combat settles. Winner casualty/card cleanup continues first, then ally retention, then the existing CHOAM income, technology, capture and Face Dancer continuation. Selecting a card declares the ordinary faction-power use with Moritani as Karama owner; cancellation discards all played cards, otherwise only the chosen card remains. No combat outcome, payment or RNG step is repeated.
• Controls use single-choice radios, full existing card rules and inspectors, an explicit decline and a visible declared-card inspector during the response. Reserved Bene Gesserit cards cannot be converted to Karama; reserved CHOAM cards cannot be cashed in. Public projection exposes only the previously revealed played cards and declaration, not the rest of the hand. All four AI profiles handle the choice and response.
• Twenty-three focused engine/AI tests cover actual combat, exact custody, no-eligible-card paths, owner/target rejection, JSON recovery, cancellation and nested Worthless conversion, hidden hand boundaries and continuation into income/capture/Face Dance. Full validation reached 935 passing rules tests and 45 passing persisted multiplayer tests; TypeScript, lint and production build pass. The targeted 18-case engine file was also rerun after replacing a redundant predicate test with an actual no-retainable-card battle.
• Browser QA S85SLVRR versions37–39 inspected Crysknife, selected it, refreshed during the response, allowed the ability and continued to Spice Collection with Crysknife/Baliset retained and exactly Snooper discarded. This is an isolated scenario, not a complete expansion game.
• This ordinary alliance ability is integrated, but full Moritani remains gated. The November 2020 official FAQ explicitly allows cancellation of alliance abilities; the exact serialized postbattle ordering remains a documented composition without a dedicated publisher ruling. See MORITANI_ALLY_RETENTION_RULES.md. Terror Atomics/Aftermath, Extortion, advanced assassination and other expansion interactions remain unfinished.

Native leader revival consistency checkpoint (2026-09-06)

• The server now projects owner-specific native leader eligibility, normal/discounted prices, early-revival status and affordability through one pure helper used by action validation. Reading a table does not advance revival cycles. Kwisatz revival uses the same projection boundary.
• The Revival selector uses those options and rejects empty, stale or unaffordable selections in the interface. A spent leader slot is explained. All four bot profiles continue an opened ordinary revival cycle even while an earlier returned leader is alive; unavailable leaders and unaffordable revivals no longer enter their ordinary action candidates. Bots avoid unnecessary new early-service requests when ordinary revival is available while preserving existing quotes and foreign-ghola buybacks.
• Sixteen added tests cover actual server actions, capture/ghola boundaries, face-down repeat deaths, phase/slot/prevention, discounts, JSON restoration, owner projections and all four AI profiles. Full validation: 912 unit tests and 45 persisted multiplayer tests pass. This does not certify complete expansion rules.
• Browser QA in isolated room S85SLVRR showed four remaining eligible Atreides leaders after an earlier return, a disabled empty selection, Lady Jessica revived for five spice, and the consumed slot surviving refresh. See VISUAL_PLAYTEST.md.
• Ecaz's special five-dead threshold and shared Duke revival remain unfinished. ECAZ_REVIVAL_RULES.md records the verified price/threshold, unresolved post-revival custody and repeated six-disc cohort handling. Shared Duke has not been appended to native rosters or silently made revivable by this change. MORITANI_ALLY_RETENTION_RULES.md records the next battle-cleanup implementation contract; that ability is not implemented yet.

Latest card and recovery checkpoint (2026-09-06)

• Shared pure availability rules now drive Weather Control, Family Atomics, Hajr and Harvester server checks and hand controls. Invalid timing shows an explanation linked to the disabled action; inspection remains available. Eight focused tests cover timing, ownership, pending-decision precedence, card disposal, advisor-only forces, repeated Harvesters, input immutability and hidden-information independence.
• Public spice-pile top cards and the authorized private Atreides preview have separate read-only inspectors. The component receives only its projected card, displays base amount/sector or worm/Sandtrout identity, and separates original guidance from card values. Desktop Cielago North and mobile Rock Outcroppings inspection passed; mobile Close restored focus. Gated advanced double-pile and private-preview browser journeys remain outstanding.
• Current validation: 797 unit tests, 34 persisted multiplayer tests, TypeScript, lint and production build passed. Tests do not certify full Advanced or expansion modes.
• Controlled local restart at approximately 01:49 UTC preserved EN4L8NTV version76 and ZUUFRHF6 version8 byte-for-byte state hashes; both browser seats restored their pending decisions. Consistent backup: /tmp/dune-maintenance-20260906T0148/database.sqlite. No maintenance automation was recreated.
• Primary component evidence now verifies the three Ecaz treachery faces and quantities; see ECAZ_TREACHERY_RULES.md. Battle timing and late-Recruits accounting questions remain explicit; this source evidence does not enable an expansion.

Revival correctness and Ecaz component checkpoint

• Fremen normal revival shares one server/view/UI/AI allowance calculation. Correction: official November2020FAQp5 permits paid Fremen revivals when Tleilaxu is seated, subject to the current three-force or granted five-force limit. Without Tleilaxu, the free-only restriction remains; an Ix module flag alone does not grant the exception. La La La blocks free returns but leaves legal paid returns with Tleilaxu. Nine focused tests cover the correction, payment settlement, cancellation, JSON recovery and all AI profiles. FREMEN_REVIVAL_AUDIT.md explicitly retracts the earlier contrary interpretation.
• Player.freeForcesRevived records actual settled free normal returns, separately from total normal revival. Pending/canceled requests and special/leader returns do not consume it. Missing legacy usage remains unknown after prior revivals and resets at the next Revival phase. Five focused settlement, conservation, private-view and JSON/lifecycle tests pass; existing prices do not change.
• game/recruits.ts supplies isolated turn-scoped arithmetic from explicitly resolved current rates, limits and usage. Eleven tests cover ordinary caps, unlimited physical rosters, typed pricing and prevention. The helper is not yet called by the engine: late-paid accounting and pending-transaction policy await the user clarification recorded in RECRUITS_RULES.md.
• game/ecaz-cards.ts supplies exactly one each of the three verified cards, immutable source/coverage metadata and original gameplay paragraphs. Canonical authorized cards receive full expanded text in the existing inspector; metadata remains developer-only. Eight tests cover the 50-card manual inventory composition, no implicit activation, exact identities and existing presentation regression. The live deck factory still rejects the unfinished variant.
• Live turn-four playtesting caught a storm draft shared with battle dials. Separate storm state now renders and submits the legal first/later-turn range; the later-turn browser submission revealed3+3. The test game continues and is not a completed visual acceptance run.
• Final runtime checkpoint:797 unit tests,34 persisted multiplayer tests,TypeScript,lint and production build passed. A subsequent text-only reference correction received its focused reference check. Full Advanced and all expansion starts remain gated.

Voluntary seat control checkpoint

• A human can opt their own setup/playing seat into Easy, Medium, Hard or Brutal AI, then take back control. autopilot remains distinct from a permanent bot, preserving credentials and recovery. Control changes preserve pending/sealed game state; the server rejects ordinary human actions while delegated and rejects foreign targets. Public control labels and responsive explicit controls are integrated.
• AI uses the same private projection for both kinds of seat. Server background batches re-read saved control and CAS-fence every update; competing takeover and continuation tests pass. Existing botsPending recovery is retained. Durable unattended scheduling after server interruption remains missing; see AUTOPILOT.md for the full boundary and traceable ledger.
• Seven engine/control tests, five SQLite continuation tests and six HTTP recovery/completion tests were added. Current complete suites:797 unit and45 persisted/API tests pass, along with TypeScript,lint and production build.
• Browser room2SG3ZS3E verified opt-in, refresh, same-seat takeback, mobile Hard control and a completed Basic game (Harkonnen,turn7). A separate three-human HTTP game completed through server continuation after all opted intoAI, with no later gameplay POSTs. These do not establish relative difficulty strength or complete expansion support.
• New primary Moritani audit records all six Terror effects, hidden token lifecycle, official FAQ/Karama anchors and legible printed leader values. MORITANI_TERROR_RULES.md distinguishes implementation-ready rules from remaining reaction-order and exceptional-custody questions. Faction starts remain gated.

Verified Ecaz/Moritani ordinary leader inventory

The publisher-authored page3 illustration was independently inspected by two agents. All five Moritani and all five Ecaz native names/strengths now have stable component instances in game/cards.ts, with seven roster/traitor/regression tests. Duke Prad Vidal6 stays separate and has no traitor; his special custody lifecycle remains unimplemented. The total available ordinary leader definitions is50; CHOAM and Richese remain missing. Faction starts stay gated. After these additions the full797-unit suite, TypeScript, lint and production build passed; the45-test persisted/API suite passed after the seat-control integration.

Required remaining work

1. Complete base rules: leader/captured-leader edge cases, auction deadlines, temporary allied-territory entry, remaining Karama powers, Truthtrance and explicit timing windows. Audit interactions among card play and committed battle elements, plus supported cancellation windows.
2. Printed-board audit: geometry adapted from MIT Truthsayer, approximate generated connectivity must be compared to printed GF9 map; verify terrain categories, spice sectors, starting positions. SVG sectors now oriented 1=SW, 2=S, increasing counterclockwise.
3. Advanced game: finish BG advisor timing/forced-flip cancellation audit, Worthless auction edge-case verification, remaining cancellation timing and expansion special Karamas; summoned-worm/card sequencing, Atreides full-plan timing and Guild canceled-shipment settlement clarification. KH, captured leaders and increased stronghold spice income now have engine/UI support, with repeated-revival and expansion-interaction audits remaining. Double spice blow, Fremen storm forecasts/half losses/additional worms and out-of-order Guild movement now have engine/UI support; full advanced-game integration and scenario audits remain. Elite accounting, spice combat and deferred casualty choices now have engine/UI foundations and focused tests; complete-game advanced support is still blocked.
4. All six expansion faction engines, cards and remaining optional modules: skills, stronghold cards, homeworlds, Nexus cards, discoveries. Tech-token support exists for 3+ players; two-player allocation and unfinished-faction/module interactions remain.
5. More complete phase scenarios, property/conservation tests, six-seat integration, security request checks, runtime build and UI validation where authorized.
6. AAA presentation refinement: readable tactical overlays, cards and leader portraits, reveal/event animations, responsive/control polish. Original art is integrated; Browser playtests and screenshots are explicitly authorized. Initial lobby, setup and storm checks have been performed; the remaining critical journeys and responsive layouts still need visual validation.
7. Register WebMCP read tool implemented; supported-context validation remains unperformed. Add task-completing mutation tools after game journeys stabilize.
8. AI players: legal action selection through private projections, host-controlled bot seats, distinct Easy/Medium/Hard/Brutal policies, and automated turn progression. Basic-game implementation now exists and passes complete-game simulation and multiplayer tests. Relative playing strength needs calibration; advanced/expansion policies remain.
9. Complete the rules reference: current searchable /rules has action guides, phase topics, card coverage, faction/module placeholders, examples and related links. Tooltip infrastructure and inline phase guidance exist. Base faction rules and six advanced faction rule topics are written; full advanced/expansion content and interaction examples still need completion alongside implementation.
10. Publish complete validated site with Sites hosting, not this incomplete slice. Registered project exists; never create again.

Moritani setup and hidden placement checkpoint

Implemented the isolated setup/placement slice, with expansion starts still gated. Moritani deploys six forces last into an unoccupied printed territory, retaining fourteen reserves and twelve spice. Advisors count as occupation. Six shuffled, opaque physical Terror IDs keep private faces separate from public placement. Mentat opens one optional placement or relocation before the existing victory check; decline and Karama cancellation consume the opportunity for that turn. The pending private intent survives JSON reload, commits only after responses and never leaks through the public response or log. Cancellation leaves custody unchanged.

Rule family	Runtime	Controls	AI	Verification
Setup last, six deployed/fourteen reserves	Implemented	Board/sector selection	All four profiles	Completion order, occupied/advisor targets, invalid sectors, conservation
Hidden supply and placed token privacy	Implemented	Six original token illustrations and readable inspectors; public hidden map marker	Owner projection only	Seven pure model tests and equivalent public views for different secret declarations
One Mentat placement or relocation; storm permitted	Implemented	Private token/destination selectors; explicit declare/pass	All four profiles	Later-turn relocation, no duplicate custody, decline, stale rejection
Placement Karama	Implemented	Standard response window	Pass/legal response support	Allowed/reloaded settlement, canceled relocation, preserved source and consumed turn
Mentat continuation	Implemented for this slice	Pending decision ownership	Legal progression	Deferred victory and CHOAM market/final-opportunity continuity
Terror entry/revelation and six effects	Unimplemented	Rules/inspection only	Unimplemented	Source audit only; no expansion full-game claim

Files: game/moritani-terror.ts, game/engine.ts, game/bots.ts, components/moritani-terror.tsx, components/game-table.tsx, game/reference.ts. Added 17 named tests in tests/moritani-terror.test.ts and tests/moritani-placement.test.ts. Full814-unit and45-persisted/API suites, TypeScript, lint and build pass. Browser QA used a separately named local fixture, not an enabled expansion start: mobile inspector, restored focus, private declaration, refresh during response and final placement/map marker passed. See VISUAL_PLAYTEST.md for limits.

Next: explicit persistent entry continuations with committed force-cohort accounting, all six effects, Enemy of My Enemy, Aftermath, Extortion and advanced powers. Do not restore pre-Atomics Fremen storm casualty counts against forces already destroyed. Previously revealed Extortion must receive a fresh opaque public ID before hidden redeployment. The full expansion remains unavailable. The final owner-only pending-declaration reminder passed24focused tests, TypeScript, lint and build after the full814/45check. Controlled02:49UTCmaintenance preserved exact versions/state hashes for four saved QArooms and restored both the Basic Nexus and placed Terror token in the browser.

Terror entry, Robbery and Sabotage checkpoint

Persistent entry records now capture the entrant, location, committed force/elite counts, cause, turn/phase, effect stage and worm-ride continuation. Hooks cover ordinary shipment, cross-territory movement, Guild transport, spiritual-advisor arrival and worm rides. No-Field and Face Dancer modules remain outside this implementation. Self/allied entry and moving within the same territory do not open Terror. Existing occupation alone does not trigger it.

The Moritani owner may leave a token hidden or reveal an implemented effect. Robbery transfers half the entrant’s available spice rounded up, or draws before enforcing a chosen hand discard. Sabotage randomly discards once, then offers an optional own-card gift. Only authorized hands are projected; unrevealed identities and random discarded cards do not enter public logs. Reload preserves the stage and never replays shipment payment or the original force transfer. Truthtrance completion reconciles an already-cleared Robbery overflow. Fremen’s summoned-worm interruption now opens its owed Nexus before remaining rides after Terror completes.

Work	Controls/AI	Evidence	Remaining boundary
Entry opportunities and optional decline	Human controls; all four AI profiles	18entry tests across five arrival paths, hidden-face invariance and JSON recovery	Arrivals with another pending response/decision reject atomically; timing question awaits user clarification
Robbery and Sabotage	Reveal, choices, own-card discard/gift; legal AI choices	Full-hand draw, spice rounding, random discard exactly once, gift/decline, Truthtrance	Exceptional Sabotage gift overflow remains explicitly unsupported; no full-faction certification
Worm/Nexus interruptions	Existing Karama/Truth/Nexus controls continue	3new overlay regressions include actual alliance decisions and no extra draw/force transfer	Destructive Terror effects and their cohort reconciliation remain unfinished
Revealed/returned token custody	Reveal integrated; return helper ready	11pure custody tests	Return helper is not yet wired to Enemy of My Enemy or Extortion; it rotates all available supply IDs and shuffles positions before hidden redeployment
Assassination, Atomics, Extortion, Sneak Attack and advanced powers	Rule inspection only	Primary-source audit	Unimplemented

Full843-unit suite passes with TypeScript, lint and production build. All45persisted/API tests also pass. Browser QA completed the Robbery draw/forced-discard journey through refresh in the isolated S85SLVRRfixture. The table banner now prioritizes an interrupted decision’s owner over the original active mover. Combined arrival timing and later-ally Aftermath semantics remain unresolved in MORITANI_ENTRY_TIMING.md. Full Advanced and expansion starts remain gated.

Local operation

• npm run dev -- --host 0.0.0.0 (port 3000).
• npm run db:local applies Drizzle migrations to .wrangler/state (local only).
• npm test; npm run test:multiplayer.
• npm run typecheck; npm run build.
• Current app preview http://localhost:3000/ was opened via open_in_codex (tool returned queued; no tab ID available).

Sources and evidence

• GF9 base: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf
• Text mirror: https://www.rulespal.com/dune/rulebook
• Base PDF mirror: https://cdn.1j1ju.com/medias/37/57/71-dune-rulebook.pdf
• Ix: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf
• Ix mirror: https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf
• CHOAM: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf
• Ecaz: https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf
• Ecaz mirror: https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf
• Designer source hub: https://futurepastimes.com/dune-launch
• Reference aid (secondary): https://www.orderofgamers.com/downloads/Dune2019_v2.pdf
• https://www.landsraad-vegas.com/rules mixes GF9 and tournament house rules: do NOT silently adopt house rules.
• GF9 downloads currently give 403/non-PDF responses. tools/fetch_rules.py records original URLs, saved files only to /tmp/dune-rules.
• Board reference: https://github.com/marekyggdrasil/truthsayer ; THIRD_PARTY_NOTICES.md retains MIT license. tools/import_board.py consumes /tmp/dune-config.json; generated JSON already checked into workspace.

Sites

Project ID persisted in .openai/hosting.json. Private unpublished registration only. No source push, save version, or deployment yet. Workspace .git is read-only/empty; hosting will need a writable source staging Git repository or approved repository initialization when complete. Source credentials expired; obtain fresh credential for existing project when ready. Never store credentials in source or print them.

Current reaction and funding design

• Game.decision is a single server-gated decision union: advisor / wormProtection / wormRide / battleCards. spiceResolution persists resumable worm draws; wormRides resolves after all Nexus choices. Existing JSON rooms normalize missing fields on the next action.

• Game.aid holds spice earmarked by a donor for its ally in phase 3 or 5. A bid records its exact ally contribution. Unspent funding can be revoked unless committed to the current high bid; remaining funds return at phase end. Projections show only the player’s own pledge and ally credit.

• Harkonnen is an additional traitor voter when allied to a combatant, regardless of whether it holds a relevant card, preserving secret hand information. Resolution waits for its affirmative reveal or decline.

• Printed base PDF is downloaded at /tmp/dune-rules/base.pdf, extracted with layout at /tmp/dune-rules/base.txt. Reviewed pages 9–12, 16–19 confirm group movement, ally funding, optional discards and faction choices.

• Battle.preparation owns Voice/prescience steps. prescience.value commits a single element only after an existential legal-plan check, so Voice cannot force an impossible answer. components/battle-preparation.tsx owns these action forms. Karama cancellation now covers Voice and prescience. Add Truthtrance on top of these explicit windows.

Official FAQ priority

The November 2020 official FAQ is indexed at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf although direct fetch is still 403. Use targeted web searches to read its indexed sections. It supersedes the older base PDF mirror where they differ. Implemented: Weather Control and Family Atomics may be played after the dial distance is known but before actual movement. Remaining corrections: bribery is intended as advanced; Karama auction acquisition wording updated; audit simultaneous expansion stronghold victories. Storm-contested occupation is now excluded from victory counts. Truthtrance may ask any game-related yes/no question including current-turn commitments; unknown answers allow another question or later play. Full enforcement will need explicit structured commitments plus handling for freeform questions; do not silently limit its semantics and call it complete.

Latest windows and cards

• Game.stormPending reveals the total before movement; all players confirm and card changes reset confirmations. Weather Control can replace revealed dials.

• Game.spiceWindow keeps each base spice blow open for Harvester before Nexus/charity. Harvester doubles new spice only; the old incorrect collection multiplier was removed.

• Game.response suspends normal play for a public power use. Every seat may allow; another faction may spend Karama to cancel. Supported: Voice, prescience (before answer), spiritual advisor, Emperor auction income, Harkonnen bonus card. More response kinds remain.

• Auction winner now receives an auctionPayment decision: pay bid or use Karama. Holding Karama allows overspice bids; an eligible player may take the current card directly. Full-hand limits still apply. Payment, income and bonus-card resolution are separated.

• Exact official Karama list was retrieved via targeted search site:gf9games.com/dune/wp-content/uploads/2020/11 "unlimited"; indexed page 7 gives rules, superseding the April FAQ. Shipment with Karama costs Guild rates paid to the bank (not free); implemented with a benefit for the active recipient, who chooses their own shipment. Remaining base cancellations include Guild rates/transport, Fremen movement. Guild income and Harkonnen ally traitor support now have cancellation windows.

• Rule UI: /rules is searchable reference; /rules/coverage retains implementation ledger. Data in game/reference.ts; client in components/rules-reference.tsx; reusable HelpTip and TooltipProvider integrated in layout.

• AI: game/bots.ts accepts personalized views for candidate selection; authoritative rules filter candidates. runBots copies input state and advances up to 96 actions per transaction, with botsPending allowing authenticated continuation. Host-only lobby actions manage seats; no player cookie is issued for bots. game/bot-profiles.ts supplies UI descriptions without importing the engine into the client.

• Player-facing external hyperlinks have been removed from lobby and rule pages. Research provenance remains in developer documentation. Rule topic deep links open their target details.

• Fremen setup accepts sector-specific allocations and retains compatibility with earlier territory-level setup actions.

• Emperor alliance actions: immediately spendable spice gifts, and up to three extra allied force revivals at two spice each. Both have cancellation windows; canceled uses cost no spice or quota. Extra revivals are tracked separately from normal revival. Gift amounts are projected only to Emperor and recipient.

• Full base-faction reference topics now describe printed starting conditions, powers, allies and special victories. Six advanced-faction reference topics document their powers while clearly marking execution support as planned.

Advanced combat checkpoint

• game/combat.ts enumerates casualty combinations matching both dial strength and spice support. Exhaustive independent small-army assignments verify the solver, including the printed Sardaukar example.
• Optional Player.elites tracks subsets of the existing total forces in reserves, tanks and individual sectors. Shipment, cross-shipment, multi-sector movement, worm rides, kills, revival and Ghola preserve elite counts. UI has explicit elite selection inputs.
• Advanced plans accept half-strength increments, seal support privately and reserve its spice against gifts/bribes. Prescience checks whether any legal support commitment permits the chosen dial without revealing that support.
• Battle resolution pays support (except a traitor winner), then gives the normal winner a battleLosses decision before card discards. Casualty options preserve the player's choice of token types; traitor/explosion losses include all elite tokens.
• Elite revival quota resets at the next turn, not when Revival starts. Ordinary revival, Ghola and Emperor extra revivals share it. November FAQ page 2 explicitly confirms no Ghola/Emperor/Tleilaxu exception.
• Advanced bot battle policies now evaluate feasible spice support and preserve valuable elites in casualty choices. Complete advanced AI games remain unverified because the remaining advanced rules are not implemented.
• Guild alliance transport now includes half-price off-planet shipment, on-planet cross-shipping, and Fremen paid cross-shipment from southern reserves. Only Guild may ship back to reserves. Allied cross-shipping pays the Guild, except the Guild-funded share, which pays the bank. Guild funding of its ally's ordinary shipment goes to the bank; only the recipient's paid share becomes Guild income.
• New primary evidence: November FAQ page 2 allows temporary allied-territory entry during shipping/movement provided the entrant moves out. Current allowedEntry still rejects allied destinations; must implement the complete movement obligation without creating unresolvable turns or inventing a voluntary-loss rule. Passing through an ally's territory is already possible.
• Latest full checkpoint: 141 unit/reference/combat/advanced tests + 3 persisted multiplayer tests, lint, typecheck and production build all pass. No deployment yet.

Advanced storm/spice and foresight checkpoint

• Each advanced blow has its own discard pile and completes its Harvester/Nexus/ride sequence before the next blow. First-turn worms return after both blows. Additional worm placement is optional; its Karama cancellation blocks further placements for the current turn only.
• Fremen worm survival and optional allied protection have separate response windows before devouring. Only a surviving Fremen group can ride after the Nexus. Cancellation of one protection does not silently cancel the other.
• Advanced Fremen privately forecasts a randomly selected 1–6 storm card after movement. The next turn reveals that card instead of dialing; Weather Control can override it. Foresight cancellation hides the card without changing the distance. Without Fremen, normal dials remain.
• stormResolution resumes sector traversal around elite casualty decisions. Half losses round up per exposed group, and repeated laps recalculate against survivors. Legal Fremen reserve shipments into storm damage the arriving group only. Storm-protection responses cover the current storm movement or that individual shipment.
• Atreides auction and movement spice peeks now pause before private revelation. Each auction card gets a fresh response; a full Atreides hand does not suppress its peek. Movement shows one card even with double blow. An empty spice deck refills before foresight, preserving the revealed top card.
• Corrected allied Guild cross-shipment payments using the current GF9 base rulebook FAQ, page 23: all allied shipments pay Guild. The Guild's own contribution still pays the bank (November 2020 FAQ page 2). This supersedes the earlier implementation note saying cross-shipments pay the bank.
• End-of-game fallback is now implemented from base FAQ page 23: Fremen when Guild is absent; highest individual stronghold counts including ties when both are absent. Expansion victory interactions and optional extra-turn ties remain to implement.
• Advanced starts and all expansion starts remain disabled. These tests verify individual rules in advanced fixtures; they do not establish full advanced compliance.

Guild timing and integrated checks

• movementRemaining tracks uncompleted turns independently of fixed storm order. Advanced Guild gets a now/wait choice at each boundary, may take its whole turn first/last/between others, and cannot interrupt an active player. Once Guild completes its turn it is removed from the queue permanently for that phase.
• The first attempt to take an early turn or delay the normal slot has a guildTiming Karama response. Cancellation locks normal order for that phase. Allowing a delayed turn grants the timing use; Guild can decide at subsequent boundaries without declaring its eventual position in advance. Flags reset at the next movement phase.
• Allied co-occupation resolution uses actual completed movement turns, which matters when Guild changes order. Temporary allied entry still needs implementation; the current entry check remains restrictive.
• Fixed a pre-existing recursive phase-transition bug: skipping an empty battle phase could invoke spice collection twice. The transition now returns after advancing; a regression test checks the exact per-force collection cap.
• Bot elite revival choices respect the shared one-per-turn limit, and stronger policies deliberately deploy elite reserves. Hard/Brutal scenarios combine the currently implemented advanced storm/spice/combat/timing systems and finish without stalling or violating elite conservation. This is not a claim of complete advanced play.
• Verified current checkpoint: 141 unit/AI/reference tests + 3 persisted multiplayer tests; typecheck, lint and production build pass. No deployment yet.
• Next advanced implementation: advisors and remaining cancellation/special Karama powers, followed by full timing audits. Then all expansion mechanics and full integration.
• Primary base page 13 explicitly resolves blow A and its Nexus before revealing blow B. Its combat example and increased spice-flow rule were retrieved directly from the indexed official GF9 PDF.

KH and advanced economy checkpoint

• Advanced Collection adds 2 spice for Arrakeen, 2 for Carthag and 1 for Tuek's Sietch, stacking separately from ground-spice collection. Empty-battle transitions still pay collection only once.

• Plan.kwisatz is a privately sealed optional bonus. Validation requires advanced Atreides, seven accumulated battle losses, a living KH, a leader/Cheap Hero, matching per-turn territory and no cancellation. Loss counter/activation/used territory are projected only to Atreides. The battle's response window is identical whether KH is active or not.

• A surviving accompanying leader/hero adds +2; a killed one adds nothing. KH blocks traitor calls, including allied Harkonnen support through the shared voter path. A lasgun/shield explosion kills KH only if actually played and the explosion resolves; traitor victory overrides it. KH never increases normal leader bounty. Seventh-loss activation is immediate for another battle that turn; territorial use resets at the next turn.

• Normal KH revival costs 2 and shares the phase's one-leader revival quota. Eligibility tracks the required Atreides revival cycle independently; KH never participates in the five-leader cycle calculation. After revival, a subsequent KH death requires the next cycle. Ghola can return it early/free without using normal quota. The repeated/late-cycle interpretation still needs broader source and expansion-interaction audit before advanced mode is enabled.

• AI plans account for KH strength and traitor protection and can revive a dead KH. Advanced simulation fixtures remain partial rules integration, not full advanced-game certification.

• components/revealed-battle.tsx renders complete public plans for combatants and spectators, including card names, support and KH. The server supplies labels for played cards only after both plans reveal; unrelated hands remain hidden. Ghola now has an explicit force/leader/KH target selector.

• Primary evidence: GF9 base page 13 (stronghold income/combat), page 17 (KH/captures), November FAQ pages 3 and 7 (immediate activation and Karama), page 6 (Tleilaxu can offer KH revival). Official indexed GF9 source URLs remain above.

• Remaining timing audit: the guaranteed KH cancellation window currently precedes Voice/prescience. Broader legal card timing, including intervention after other preparation choices, still requires verification before full advanced compliance is claimed.

• Final verification for this checkpoint: 141 unit/AI/reference tests pass, plus the three persisted multiplayer journeys. TypeScript, lint and the production build pass. Advanced/expansion starts remain disabled; the full goal remains active.

Harkonnen capture checkpoint

• Leader records remain with their original faction. capturedBy determines temporary control, and controlledLeaders is the common server source for battle validation, prescience feasibility and resolution. This avoids duplicating leaders or losing their death/revival history.

• A winning advanced Harkonnen battle queues capture after casualty and card choices. Harkonnen can decline; acceptance opens a Karama response before any random draw. Only surviving eligible leaders enter the draw, including the just-used leader in the same territory. Then Harkonnen privately chooses retention or execution.

• A concealed snapshot preserves outsiders' pre-capture knowledge without exposing the captive's identity through the original owner's leader roster. Captor and owner see actual state; Tleilaxu additionally sees concealed executions, not living captives. Revealed use or revival clears concealment. Turn resets clear obsolete territory markers from both current and concealed records.

• Execution pays 2 spice and places the leader face down, with at least two deaths. Live captives return after one battle; dead captives enter their original owner's tanks. Losing every native Harkonnen leader immediately returns unused captives. Captured leaders can turn traitor and retain their territory restrictions.

• Original-owner revival now treats capture as unavailability when opening a leader revival cycle. Executed face-down leaders remain restricted until their later cycle, with Ghola able to revive them early. KH cycle initialization avoids non-finite values when all native leaders are captured.

• Captive UI, ownership-aware leader selectors, AI capture/use/return policies and a searchable internal capture reference are implemented. Basic/advanced test suites include twelve capture scenarios and JSON round-trip privacy checks.

• Primary sources: GF9 base page 17, November 2020 FAQ pages 5–7, Ix Karama table. CHOAM FAQ page 12 says captured leaders provide only battle-use skill effects; leader skills and further expansion interactions remain to be implemented.

• Verified capture checkpoint: 141 unit/AI/reference tests and 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment; advanced and expansion starts remain disabled while required rules are incomplete. The goal remains active.

Combat cancellation and endgame checkpoint

• Advanced battle preparation now queues separate public response windows for elite strength and Fremen free spice support, alongside KH. Emperor gets no redundant elite-strength response against Fremen, where Sardaukar is already ordinary. No elite response is offered without elite forces in the battle.
• Canceling doubled strength changes combat arithmetic for that battle only; the physical elite token identity remains intact through casualties, reserves and revival. Canceling Fremen support requires spice for full strength, permits unsupported half strength, and retains the traitor-winner payment exemption. AI plans and player support forms use the same flags. Both cancellation notices are visible with the battle.
• Eight focused combat tests cover independent cancellations/card consumption, support, casualty identity, ownership, secrecy, atomic rejection, fresh-battle reset and basic-mode isolation. Full legal intervention timing after other preparation and before reveal remains a required audit: these guaranteed windows currently precede Voice/prescience. Advanced starts remain disabled.
• Victory counts exclude strongholds with opposing occupants, as specified by November FAQ page 1. Sole occupation under storm still counts. Final-turn fallback now awards Fremen when Guild is absent, or the highest individual qualifying stronghold count (all ties) when neither is present. Normal wins retain priority over special/fallback outcomes, and BG prediction cannot replace Guild/Fremen special wins.
• Six new endgame tests cover contested/sole occupation, missing factions, priority, ties including zero, earlier turns and prediction. The shared test setup now predicts a different seat when Bene Gesserit is the first player. The internal victory topic and Mentat guidance describe these cases without external links.
• Primary evidence: GF9 base rulebook pages 18 and 23; November 2020 FAQ pages 1 and 7; Ix expansion Karama table. Expansion extra-stronghold/tech ties, advisor occupation and the complete expansion victory system remain unimplemented.
• Verified checkpoint: all 155 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The full goal remains active and advanced/expansion starts stay disabled. No deployment yet.

Bene Gesserit advisor checkpoint

• Player.advisors records one stance per territory, with optional arrival-turn locks; existing force totals and sector counts stay canonical. game/advisors.ts distinguishes physical force counts from fighter counts, plans arrival stance and removes obsolete advisor records. Lone advisors promote automatically.
• Advisor presence no longer contributes to battles, normal/fallback stronghold victory, Fremen special-condition blocking, stronghold entry limits, ornithopters, collection/stronghold income or Atomics eligibility. Area destruction still includes advisors. Wrapping action results settles stance after a whole action, avoiding mid-explosion promotion. Collection, victory and battle enumeration settle before calculating their result.
• Initial placement follows Fremen setup. Direct shipments, including allied Guild cross-shipment, enter as fighters unless joining existing advisors. Normal movement can preserve advisors, match existing fighters/advisors, or request an optional fighter flip after arrival. Arrival locks are carried when moving/joining advisors. Advanced starts remain disabled, so setup is exercised in controlled fixtures.
• Intrusion choices interrupt ordinary shipments, movement and worm rides, including repeated entry. The optional whole-territory flip has a Karama response. Free accompaniment follows intrusion, and a worm ride resumes its spice/Nexus sequence only after the reaction resolves.
• Advanced free accompaniment offers valid sectors in the shipment territory as well as the Polar Sink. Successful advisor accompaniment locks that territory’s group for the turn. Before the first shipment, eligible advisor territories receive individual prepare-for-battle choices/responses; allies and storm-inaccessible battles are excluded.
• November FAQ page 4 supersedes April’s conflicting same-type/arrival text. Primary sources: base page 18 and November FAQ pages 4 and 7. Remaining audits include the full declaration timing range between Nexus and first shipment, mandatory/matching flips under Karama, precise scope of carried arrival locks, and all expansion interactions. Advanced charity and Worthless-as-Karama are still pending. Do not claim complete BG advanced compliance.
• Advisor setup, stance decisions and movement options are available in the existing table UI. Dashed map rings and territory labels identify advisors. AI handles intrusion/declarations/accompaniment and uses fighter counts for enemy control/strength estimates. The internal advisor reference now documents these behaviors as Partial.
• The advisor storm test exposed a pre-existing graph bug: distance(from, from, blocked) returned zero before checking the blocked sector. Checking blockage first now prevents battles under storm even when both armies occupy the same location.
• Seventeen focused scenarios cover occupancy, economy, Atomics, movement/type matching, intrusion sequencing, setup, arrival locks, worm rides, storm/worm/explosion casualties, sector choices and JSON round-trip state. Verified checkpoint: all 172 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Bene Gesserit charity and Worthless Karama checkpoint

• charityTurn enforces one charity claim per turn for all factions, closing repeated claims after bribing proceeds away. Advanced BG receives +2 even from one spice and on turn one. At two or more spice the claim has a bgCharity response; cancellation consumes the claim without paying. The private view exposes claim availability only to the owner.
• game/karama.ts is the shared eligibility predicate used by engine, AI and player forms. Advanced BG can select Worthless cards for all currently implemented Karama uses, and holding one enables overspice bidding. Full-hand acquisition checks run before discarding. Sealed battle cards and prescience-committed cards cannot be spent again.
• pendingKarama stores a structured continuation for cancel/shipment/purchase/auctionPayment. A Worthless card is discarded before its worthlessKarama response. Allowed conversion completes the original use; canceled conversion grants no benefit and never returns the Worthless card. A canceled attempted cancellation restores the suspended response and its previous passes. The stored continuation is not projected, preventing private Emperor-gift amounts from leaking. Real Karama has no additional conversion window.
• Auction payment UI now selects the exact card. AI can claim advanced charity and use Worthless payment/cancellation. Internal searchable guidance covers the implemented behavior and remaining limitations.
• IMPORTANT unresolved source edge: the primary GF9 November FAQ confirms discarded Worthless cards on cancellation but does not specify an unfunded winning bid afterward. Current provisional recovery offers another funded payment or available Karama; otherwise it resets bidding for the same unseen card, original opener and unchanged ally funds. Do not treat the passing recovery test as proof of printed-rule compliance. Research surfaced similar restart rules in nonofficial compilations, which are NOT accepted as authoritative default rules. Confirm or replace this branch before enabling advanced mode.
• Primary sources: base rulebook page 18; November FAQ pages 7 and 9; Ix expansion Karama table. Advanced starts remain disabled. Twelve new focused scenarios cover charity thresholds/quota/cancellation, conversion timing, privacy and resumability, hand limits, bids/payments, commitment protection and private-view AI. All 184 unit/AI/reference tests and 3 persisted multiplayer journeys pass; typecheck, lint and production build pass. A final public-intent display check follows the same privacy test. The goal remains active, with no deployment.

Emperor and Harkonnen special Karama checkpoint

• specialKaramaUsed persists once-per-game usage publicly per faction. The special card action validates advanced mode, phase, actual Karama ownership and unused power before applying effects. Ordinary Karama uses remain available afterward.
• Emperor’s Revival-phase power returns up to three own forces or one own dead leader for free, independently of normal quotas/cycle. The shared one-elite-per-turn limit applies and token totals are conserved. Living/captured/foreign leaders, combined force-plus-leader targets, wrong phases and ally-force targets are rejected atomically. Expansion revival/income and full timing audits remain.
• Harkonnen’s Bidding-phase power draws 1–4 unseen random cards from another hand, temporarily exceeding the hand limit if necessary. Its owner then returns exactly that many distinct cards from the combined hand, including any newly acquired ones. The card is discarded and game usage is consumed before the draw.
• pendingExchange privately suspends an existing auction decision/response. During the exchange all ordinary actions are gated. Completion restores the exact response including its passes and private amount, or resumes the pending payment. The continuation is never projected. Card IDs are absent from public exchange logs/decisions; each owner sees only their own current hand.
• Losing the only Karama backing a winning bid now uses the existing provisional unfunded-payment recovery. Auction finalization checks funding as well, so taking the backing card before the final pass cannot stall the game. This recovery remains a source-verification gap; tests prove conservation/resumability, not official printed-rule compliance.
• Player forms provide blind-draw amount/target, private return checkboxes, Emperor force/leader targets and help tips. Internal faction and special-Karama topics describe the two implemented powers and identify the remaining powers. AI selects targets from public hand counts and return cards from its own hand; Emperor can invoke special revival then continue normal revival.
• Twelve focused tests cover conservation, transient hand limits, privacy/JSON projection, suspension/resumption, atomic rejections, once-per-game usage, revival quotas and private-view AI. The AI invariant permits excess cards only for the active Harkonnen exchange, within its declared count.
• Primary evidence: GF9 base page 14; November FAQ page 3 (phase restrictions/once per game), page 6 (blind draw, inspect, equal return and temporary hand limits), page 2/base page 19 (one elite per turn). No tournament compilation was adopted as a primary rule source.
• All 196 unit/AI/reference tests and 3 persisted multiplayer journeys passed, along with typecheck, lint and production build. Final guidance-only validation follows. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Guild special shipment-stop checkpoint

• Ordinary off-planet shipments now validate destination, availability, elites, cost and private ally contribution before opening a Guild decision. The decision appears regardless of the Guild’s hidden hand until its once-per-game power is spent. Fremen southern reinforcements and on-planet cross/return transport are excluded; Guild’s own off-planet shipment can also be allowed/stopped under the rulebook’s “any one player” wording.

• pendingShipment stores the validated shipment privately. No payment, troop/elite placement, Guild income, intrusion or accompanying advisor happens during the pause. Only the Guild can allow it or spend its actual Karama to stop it. The special power resolves directly and cannot open a normal Karama counter-response. Mutation stays atomic and private projections never include pending funding.

• Allowing invokes the shared shipment commit once and resumes Guild income, then intrusion/advisor choices. Stopping spends Guild’s card and once-per-game power, consumes the shipper’s shipment opportunity, keeps troops/spice/allied credit untouched and leaves ordinary movement available. Any shipment-rate card is tracked privately and returned to its original owner on stop; allowed shipment consumes it normally. Converted Worthless benefits are tested as well.

• Unverified settlement details: GF9 base page 14 confirms one off-planet shipment of any one player; November FAQ page 3 supplies phase/once-per-game scope and page 7 establishes Fremen’s reserve immunity. Those retrieved primary passages do not settle retaining/returning rate cards, consuming the canceled shipment opportunity, stopping a separate spiritual advisor, or special-power counter timing. Current settlement is provisional engineering behavior, not a full-compliance claim. Historical/Avalon Hill/tournament and unofficial compilation text must not silently supersede GF9. Audit this before enabling advanced starts and extend it for homeworld/expansion interactions.

• UI provides declared target/count/sector, an allow button and a special-stop button only for actual cards in the Guild’s own hand, plus internal tooltips and rule links. AI at every difficulty resolves the decision from its private projection; higher difficulties protect occupied territories or contest substantial stronghold shipments and preserve allied shipments.

• Fourteen focused tests cover deferred effects, canceled and allowed payment accounting, elite conservation, allied contributions, gifted/converted rate cards, private projection, invalid/bypass attempts, once-per-game scope, movement after stop, basic/Fremen/cross-shipment exclusions, all AI difficulties and JSON-persisted intrusion continuation. Existing rate-benefit shape assertions now include the tracked card internally, while the public view preserves its prior shape.

• Primary sources: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf (p14); https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (p3/p7). Product references remain internal only.

• Verified checkpoint: all 210 engine/AI/reference tests and all 3 persisted multiplayer tests pass, as do TypeScript, lint and production build. Advanced/expansion starts remain disabled. No deployment; the full goal remains active.

Atreides full battle-plan inspection checkpoint

• Advanced Atreides now receives a special-Karama offer after Voice and ordinary prescience are resolved or declined. The offer occurs independently of its hidden hand and is available even in an unrelated battle. Declining preserves its card and game-wide usage; the offer cannot be reopened after sealing has begun.

• Spending an actual Karama consumes the once-per-game power and chooses either combatant. Battle.fullPlan records observer and target; the target must submit a fully validated plan first. Dial, leader, weapon, defense, spice support and KH are committed using the ordinary battle plan store, so existing support reservations and sealed-card protections apply. Invalid actions are atomic.

• Full-plan inspection now persists privately until public reveal without an acknowledgement decision. Its entitled Atreides owner can be an external ally; the assisted ally does not receive the private projection. Legacy saved fullPlanRead normalizes through authoritative recovery. Target-first sealing and the normal reveal/traitor sequence remain intact.

• A canceled ordinary prescience request still leads to the special offer. An answered element and the Voice remain binding during the full-plan submission. The special resolves without a normal cancellation window. Its game-wide usage persists across later battles/turns.

• Added a private plan panel and request/acknowledgement guidance. Existing battle form handles target commitment; other players see the specific wait. Internal faction, card, special-Karama and coverage topics include this behavior and identify incomplete timing coverage.

• AI can initiate, answer, decline and acknowledge the inspection at all four difficulties. When Atreides has inspected its own opponent, its battle scoring uses actual enemy dial/leader/weapon/defense, survivor strength and explosion risk. Unseen hand contents and traitors cannot alter the chosen candidates. Broader difficulty calibration still remains.

• Twelve dedicated scenarios cover Voice/prescience ordering, targeted commitment, selected-card privacy, acknowledgement ownership, unrelated battles/allies, hidden-hand-independent offers, ordinary cancellation, invalid input atomicity, once-per-game scope, sealed Worthless protection, all four AI difficulties, actual-information tactics and KH visibility. Existing advanced combat/KH/advisor fixtures now explicitly decline the new offer before testing their original mechanics; their original assertions are retained.

• Primary evidence: GF9 base rulebook p14 (once-per-game Karama; inspect any one player’s entire Battle Plan), November 2020 FAQ p3/p9 (advanced power scope/once-per-game). The exact post-prescience commitment/acknowledgement order is an engineering timing choice pending the remaining pre-reveal card audit. Re-answer/replanning rules after other card effects, interaction with cancellations already committed, and all expansion plan components must still be audited. Historical/unofficial compilations were not adopted as proof of GF9 compliance.

• Advanced and expansion table starts remain disabled; no deployment. The full goal remains active.

• Verified checkpoint: all 222 engine/AI/reference tests and all 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. The full goal remains active, with advanced/expansion starts still gated.

Fremen summoned sandworm checkpoint

• Added once-per-game Fremen Karama during Spice Blow and Nexus, restricted to sand. The call does not draw/discard a spice card or mutate the existing discard-pile order. Destruction, optional ally protection, ordinary Karama cancellation of protection, elite conservation and worm rides reuse the existing worm engine.

• summonedWorm.resume privately suspends the interrupted response/decision, Worthless conversion, fresh-blow window and spice sequence until protection/destruction finishes. Only the called territory is projected. Resumption preserves response passes and private payloads; devoured fresh spice is marked unavailable to Harvester.

• Timing corrected to primary evidence: November 2020 FAQ p3 explicitly places the called worm’s Nexus at the end of the spice-blow phase, not immediately before remaining draws. The initial local interruption prototype was replaced before release. A pre-draw call now defers its Nexus while preserving its ride queue; normal draw completion opens negotiations. In advanced play this follows the current pass’s ordinary Nexus point before proceeding to the other pile. Calling during an open Nexus adds the new ride and resets confirmations. A call during an unmade ride requeues it and opens negotiations; a completed ride’s pending BG intrusion/flip resolves before the new Nexus.

• UI adds a sand-territory picker and summon control to Fremen’s actual Karama card, with internal tooltip/reference guidance. AI uses public sand-territory threats and its own available card. All four difficulty policies can initiate the call; existing response/Nexus/ride policies perform the continuation.

• Fourteen focused tests cover deferred Nexus ordering, unaltered deck/pile state, troop/elite/spice effects, protection cancellation, merged Nexus rides, JSON suspension, interrupted additional-worm choice, Harvester prevention, invalid/repeated actions, first-turn token versus drawn-card behavior, private-view AI, pending rides, BG intrusion and suspended Worthless conversions.

• Rule precedence: https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf p3 supplies summon timing, destruction/protection, rides and second-Karama survival cancellation. It supersedes the older contradictory “no Nexus” answer still printed in the current base PDF p22. Base p14 supplies sand placement/one-use scope. Remaining audit: simultaneous/late card timing, whether a called worm changes subsequent additional-worm counting, first-turn token interactions and expansion discovery/Homeworld/Nexus mechanics. Advanced starts remain gated pending the complete audit.

• Verified checkpoint: 236 engine/AI/reference tests and all 3 persisted multiplayer tests pass. Final TypeScript, lint and production build pass after the UI handler and test declaration corrections. Advanced/expansion starts remain gated; no deployment; the full goal remains active.

Tech-token module checkpoint

• Added game/tech-tokens.ts with the three printed tokens, designated initial owners, per-phase triggers, public escrow and a one-owner stronghold-set helper. Host-controlled lobby selection is independent of expansion factions and resets human readiness. Three or more players are currently required.
• Initial Fremen/Ixian/Tleilaxu assignments occur at setup. After the first storm, shuffled missing tokens go to factions without tokens in storm order. The printed-map/seat-order audit remains separately outstanding.
• Charity, free revival and off-planet arrivals trigger their matching token once per phase, excluding BG-only charity, Tleilaxu-only revival and Guild-only shipping. Income is based on the owner's full token count and paid at the phase boundary. Actual BG advisor arrivals can trigger Heighliners; Fremen reinforcements, cross-planet/return transport and stopped Guild-special shipments do not. Ghola and Emperor special free revival use the Axlotl hook only in Revival. These card-revival and free-arrival readings follow the printed trigger wording; expansion interactions still need a comprehensive audit.
• Battle outcomes preserve pending token transfer through advanced casualty and winner-card decisions, then resolve one automatic token or an owner-only choice before Harkonnen capture. No token changes in mutual destruction; single traitor victory takes a token even when it overrides lasgun/shield. Surviving winning forces are not required.
• Victory includes one extra stronghold only when a single player owns all three tokens, including in alliances. Collect all normal qualifying winners before BG prediction, so a token-assisted win can tie another normal win. Tokens also participate in the existing final-turn fallback count.
• Added public holdings/income to player panels, capture-choice controls, lobby tooltip, searchable internal tech-token topic and updated coverage. AI considers enemy token holdings, complete-set victory pressure and legal token selection without access to other hands.
• Evidence: GF9 Ixians & Tleilaxu rulebook pages 4–5 (https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf; same primary document at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf); November 2020 FAQ page 9 confirms the tech-token normal-victory tie. Ecaz & Moritani rulebook page 15 reiterates that allies cannot combine token holdings and says homeworld shipments trigger Heighliners (homeworld engine still unimplemented).
• Verification: full 251-test suite passed before the final focused battle-outcome addition; all 15 focused tech tests then passed, bringing total tested cases to 252. All four persisted multiplayer journeys pass, including a complete six-seat human/AI game with tech tokens and reconnect checks. TypeScript, lint and production build passed. No browser visual QA or deployment performed. The full goal remains active.

Ix combined/alternate battle-card checkpoint

• Added four typed card identities via ixBattleCards() and shared game/battle-cards.ts logic. Poison Blade requires both projectile and poison protection; Shield Snooper supplies both and remains a shield for lasgun explosions. Weirding Way defaults to projectile weapon and can fill the defense slot with another weapon; Chemistry defaults to poison defense and can fill the weapon slot with another defense. Each occupies exactly one slot.

• Authoritative plan validation, combat casualties, feasible prescience answers, Voice prohibitions/compulsions, UI selectors and AI now use the same card roles. Voice can name each special card directly; generic prohibitions follow the played role, and compulsion considers default roles so it does not force an alternate use. Prescience reveals only the actual selected slot and preserves the other card's privacy.

• AI evaluates full-plan inspection with the shared lethality/explosion functions. Ordinary prescience now identifies the explicitly revealed card through the catalog instead of guessing from its label; Hard/Brutal select Shield Snooper against revealed Poison Blade. No opponent hand or deck data enters those decisions.

• Added internal searchable rules, readable Voice labels and descriptions on the new hand cards. Complete expansion deck assembly is not enabled: this is tested subsystem support, not a claim that Ixians/Tleilaxu are playable.

• Primary evidence: GF9 November 2020 FAQ pages 3–5 for effective-slot prescience, generic/named Voice and default-role compulsion; page 9 for Weirding Way versus lasgun and Shield Snooper. Ixians & Tleilaxu rulebook page 11 confirms ordinary Shield does not stop Poison Blade while Shield Snooper does. CHOAM & Richese rulebook page 4 says revised Poison Tooth and Artillery Strike replace their Ix versions; implement those revised effects next, not the superseded text. URLs are retained in the earlier source sections and the tech-token checkpoint; no external links were added to player-facing pages.

• Still audit printed card edge cases involving Worthless as the complementary slot and Chemistry/Weirding Way together (current representation permits both assignments when both slots are occupied). Complete Ix card inventory, card text revisions, Cheap Hero traitor, Sandtrout, Amal, and faction integrations remain. A base-deck name audit is also needed: Basilia Weapon appears in the current base list, while sources suggest it belongs to the Ix expansion and the base card should be Ellaca Drug; verify against printed primary components before changing the catalog.

• Verification: all 265 unit/engine/AI/reference cases and four persisted multiplayer journeys pass; TypeScript and lint pass. The new 13-test file includes a 36-pair lethality matrix, authoritative leader death/explosion outcomes, failed-plan immutability, generic/named/default-role Voice, JSON/private prescience, legal AI choices at all levels, and targeted Hard/Brutal defense selection. No browser visual QA or deployment. Full goal remains active.

• Production build completed successfully for this checkpoint; final subsequent UI edits only replace the card-type label with its readable label and update the coverage text.

Poison Tooth and Artillery Strike checkpoint

• Added poisonTooth and artillery card identities to the implemented Ix battle-card catalog. Full room decks still use the gated base setup; no partial expansion deck is offered.
• Battle revelation now opens an owner-only Poison Tooth activation decision before traitor choices. This is separate from the sealed plan and ordinary prescience commitments. Activation is public, serialized and immutable once submitted. No leaders, forces or spice are changed until battle resolution. The queue can handle multiple tooth-bearing plans in storm order for future card-copy effects; complete Mirror Weapon semantics remain unimplemented.
• Shared battleCardEffects handles attacks on both leaders. A tooth can be declined, or activated against each side's defense; Chemistry as defense protects while Snooper/Shield Snooper do not. Unused winning tooth is optionally retained; used tooth is discarded. Artillery attacks each side's shield, suppresses surviving leader/KH strength and all leader bounty, and is discarded after use. Other weapons still apply, and advanced spice support/casualty accounting is preserved.
• Traitor victories bypass these effects and preserve the winning faction's otherwise single-use weapon; explosions take precedence. This follows the base rule that the successful traitor caller loses nothing. Opposing leaders/forces/cards follow normal traitor losses.
• AI models both leaders' exposure and artillery suppression during planning. At the revealed tooth decision it compares public totals with/without activation, preferring a win and preserving its leader and unused card when possible. Easy retains variation; Medium/Hard/Brutal choose based on these outcomes. The UI shows revealed plans to the tooth owner, activation/decline controls and the submitted result; internal card topics describe effects, timing and current coverage.
• Evidence: GF9 November 2020 FAQ p8 explicitly covers Chemistry versus tooth, Snooper exceptions, used/unused tooth discard and Shield Snooper explosions; p9 confirms Shield Snooper versus Artillery and the Weirding Way exception. Pages 4–5 govern named versus generic Voice. CHOAM & Richese rulebook p4 directs replacement of the original tooth/artillery cards. Direct retrieval of the replacement printed card faces remains incomplete, so do not claim that printing audit is finished; the implementation currently follows the FAQ-backed behavior and known card text. Do not use the separately found Dune movie-game rulebook as classic-game evidence. Stone Burner, leader skills, Mirror Weapon and other later card interactions still need implementation/audit; specifically confirm artillery/KH suppression against later clarifications.
• Verification: all 277 unit/engine/AI/reference tests and all four persisted multiplayer journeys pass. The 12 new tests cover ownership, invalid-action immutability, JSON/private revelation, activation, retained/discarded tooth, defenses on both sides, self-exposure, suppressed bounty, traitor/explosion precedence, Voice, four AI levels and advanced force/spice/KH outcomes. TypeScript, final lint and production build pass. Final coverage text was updated after build. No visual browser QA or deployment; full goal remains active.

Sandtrout spice-deck checkpoint

• Added a Sandtrout spice-card variant and optional 22-card Ix deck construction. Start chooses that deck when the Ix expansion is selected, but the existing expansion-start gate still applies. The 21-card base deck remains unchanged.
• Drawing Sandtrout breaks alliances, clears offers and returns any outstanding ally credit to its donor. It is represented as a public set-aside card while waiting, so it cannot re-enter a reshuffle before consumption. Normal territory draws do not consume it, including between advanced piles and across turns.
• A subsequent active drawn Shai-Hulud consumes Sandtrout without destruction, protection responses, Fremen rides or its own Nexus. Only an immediate territory replacement receives double spice. A second worm resolves normally against the preceding effective card and cancels the bonus. Suppressed discard entries carry metadata so they do not count as normal worms for Fremen extra placement; reshuffling strips that metadata.
• Harvester doubles the enhanced amount; storm still prevents it. First-turn ignored worms currently do not consume a waiting Sandtrout. A Fremen summoned worm is not a drawn card and does not consume it. A prior already-triggered Nexus is preserved when Sandtrout appears later in that draw sequence.
• Added a public pending-status notice, an internal searchable Sandtrout topic, and the previously missing table display for Atreides' private spice foresight (territory, Shai-Hulud or Sandtrout). The existing server projection controls who can see the next card. Status notices sit outside the play grid so they do not displace its columns.
• Primary evidence: GF9 Ixians & Tleilaxu rulebook p4 (add one Sandtrout) and p11 (immediate alliance cancellation, next Shai-Hulud suppression, immediate land doubling or second-worm normal Nexus), at https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf. First-turn ordering, the exact suppressed-card discard layout, prior-worm Nexus and special-summon interpretations remain audit items; later discovery and other expansion spice interactions are not implemented. Live expansion starts stay gated pending full integration and that audit.
• Verification: all 292 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 14 Sandtrout scenarios cover deck inventory, alliance/escrow cleanup, pending-state JSON, suppression versus normal worms, both advanced piles, Fremen protection/placement, Harvester/storm, reshuffle metadata and private foresight. An additional full-game AI test runs Hard/Brutal with Sandtrout and checks exactly one card across deck/discards/set-aside state plus force conservation. Final TypeScript, lint and production build all pass. No browser QA or deployment; full goal remains active.

Thumper checkpoint

• Added the implemented Thumper entry to ixSpecialCards(). The full expansion treachery deck is not yet assembled/enabled; Amal, generic expansion duplicates and Cheap Hero traitor setup remain.
• Playing Thumper before the first Spice Blow draw discards it once and passes a virtual Shai-Hulud into the shared spice resolver. It targets the prior effective card in pile A, pauses for normal Fremen/allied protection before drawing any real card, opens the ordinary Nexus/rides, and counts toward advanced extra-worm placement. Pile B continues separately.
• Virtual worm markers retain their identity in serialized discard history and are removed on refill rather than becoming extra Shai-Hulud cards. Sandtrout suppression preserves the virtual marker and doubles only an immediate land replacement. First-turn ignored Thumper is never returned to the spice deck. Pending ordinary/summoned worm continuation remains unchanged.
• Added public beforeSpiceDraw timing to the view, a disabled-until-legal card button and hand guidance, plus an internal Thumper rule topic. AI uses only the public prior territory and force counts to prefer hitting enemies while preserving the card when Sandtrout would suppress it; Easy retains variation.
• Source status: the GF9 Ix rulebook establishes the expansion inventory and shared worm/Sandtrout framework. The Thumper card's opening-phase/instead-of-reveal wording was located in transcribed card references (https://www.scribd.com/document/745862168/DUNE-Factions-TreacheryCards-EXP1-3-v2 and the classic-card section of https://www.landsraad-vegas.com/rules/gencon). These are secondary and the latter includes tournament/house amendments; do not treat the whole source as the target rules. Direct primary card-face verification of first-turn allowance, exact opening timing and Sandtrout handling remains required before enabling expansion starts. The implementation currently permits first-turn use but ignores its worm effect, and limits play to the phase opening before pile A.
• Verification: all 302 unit/engine/AI/reference tests and four persisted multiplayer journeys pass; final TypeScript, lint and production build pass. Ten focused Thumper tests cover treachery consumption, deck order/conservation, JSON-paused protection, ally responses, Nexus/rides, extra worms, second pile, Sandtrout, first-turn handling, refill and timing rejection/AI policy. No browser QA or deployment. Full goal remains active.

Cheap Hero traitor checkpoint

• Added game/traitors.ts: one expansion traitor identity maps both Cheap Hero treachery cards without inventing a faction leader disc. The deck builder includes it only for the Ix expansion; full expansion starts remain gated.
• Setup, authoritative traitor calls and private-view AI share this identity. Normal traitor losses apply, with zero hero bounty and no fake leader in the tanks. The holder retains the card for subsequent opponents. Harkonnen ally calls use their existing Karama response; KH protects an accompanying hero.
• Resolved traitor calls now retain public identity history in revealedTraitors; uncalled selections remain private. Player panels display the history. Medium/Hard/Brutal plan scoring avoids publicly exposed leaders held by an opponent or its Harkonnen ally, unless KH protects the plan. Setup scoring handles the hero identity and all four AI levels can call it.
• Added a searchable internal rule entry with related links. No player-facing external navigation added.
• Primary evidence from the previously indexed GF9 Ixians & Tleilaxu rulebook p11: Cheap Hero traitor may be revealed against any opponent playing a hero, can be used repeatedly, and is known after its first revelation. Base rules p17 protect KH-accompanied heroes and permit Harkonnen ally support. Sources: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf and https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf. Direct retrieval of the Ix PDF remains intermittently forbidden. Later Face Dancer/Tleilaxu and other expansion interactions remain unimplemented. Public identity becomes visible at simultaneous call resolution; canceled Harkonnen support does not publish it, pending the broader timing audit.
• Verification: all 314 engine/AI/reference tests and all four persisted multiplayer journeys pass, as do TypeScript, lint and production build. Twelve new tests cover inventory, private setup, both heroes, repeated use, no leader/bounty fabrication, invalid-action immutability, KH, Harkonnen cancellation, mutual traitors, all difficulty levels and public-knowledge-only AI planning. No browser QA or deployment; full goal remains active.

Amal and phase-opening checkpoint

• Added Amal to the implemented Ix special-card catalog. On play each player's available spice becomes its floor-half; the card is discarded once. Unpaid bribes and deferred token income are separate balances. Full expansion deck assembly and starts are still gated.
• Refactored phase entry into openPhase and beginPhase. Ix-enabled tables receive the same public window at every phase opening, regardless of who holds Amal. Everyone plays or passes; an Amal play resets passes. After all passes, the saved initializer runs once. This includes the initial Storm and the post-storm Spice Blow entry, serializes through JSON, and preserves the Fremen storm-forecast response.
• Automatic auctions, movement preparation/prescience, empty battle skipping, collection, Mentat bribe payout/victory and new-turn resets wait for the opening. Previous-phase tech income and unused alliance credit settle before it. The window blocks normal phase actions and special Karama play; advanceBots remains a harmless polling continuation. More beginning-of-phase powers and universally timed cards will need explicit integration here.
• UI supplies an opening panel, pass count and owner-only Amal control with its exact personal spice loss. Hand controls disable Amal outside the opening. The public view does not reveal hidden card holdings, rival spice or internal continuation details. A searchable internal rule topic describes the timing and current limits.
• All four AI policies can pass openings; the Amal policy uses only its own low spice balance (and Easy variation), without inspecting rival wealth. Hard and Brutal complete games with all phase windows and exactly one Amal conserved across deck/hand/discard.
• Source status: transcribed printed-card wording specifies beginning of any phase, half of spice behind shields rounded up, then discard. References are the previously recorded classic-card transcription and https://www.scribd.com/document/851223590/ (Chinese card reference). Official Ix PDF confirms the expansion framework but direct primary card-face retrieval is still incomplete. The earlier PDF search results remain indexed despite direct 403 responses. Do not claim the printed-face or simultaneous beginning-of-phase audit is complete. CHOAM inflation, homeworld reserves, Richese auctions and other unreleased economy interactions remain unimplemented. Current pass commitment/reopening semantics are the digital timing protocol and require the complete card-window audit.
• Verification: 328 engine/AI/reference tests and all four persisted multiplayer journeys pass. Fourteen new Amal tests cover exact rounding, bribe/collection ordering, deck draws, prior income/credit settlement, charity, setup/turn boundaries, empty phases, hidden information, ownership/timing/immutability, all difficulty levels, full games and Fremen forecast/Thumper continuation. Final TypeScript, lint and production build all pass. No browser QA or deployment; the full goal remains active.

Tleilaxu Face Dancers and Zoal checkpoint

• Obtained a readable mirror of the publisher's 12-page Ix rulebook at https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf. Stored genuine PDF/text as /tmp/dune-rules/ix-official-mirror.pdf and .txt; the older /tmp/dune-rules/ix.pdf remains invalid HTML. Rendered and inspected printed p3 to verify all ten Ix/Tleilaxu leader names and strengths; catalog includes both sets. The printed rulebook's older ghola-buyback answer is superseded by November 2020 FAQ p6 (a foreign ghola cannot be sold back while alive).

• Tleilaxu are excluded from ordinary traitor dealing/selection. After others select, the unused deck is reconstructed from valid faction cards minus held traitors, shuffled and dealt as three private Face Dancers. The reserve is stored authoritatively and never projected. Staged fixture setup covers conservation and secrecy; live expansion-start gates remain in place.

• Every other faction's battle victory opens an optional Tleilaxu decision independently of its hidden holdings, after winner losses/card choices/tech transfers/Harkonnen capture. A matching unrevealed Face Dancer returns the winner's surviving forces to reserves, preserving elite subsets, and allows replacement from Tleilaxu reserves and any board locations up to that count. Killing a living winning leader adds no bounty and does not repeat an earlier death. Cheap Hero identity survives its treachery discard for matching; KH cannot prevent Face Dancing. Karama cannot cancel it. Winner rewards remain unchanged.

• Replacement currently removes the winning faction's forces, preserves peaceful BG bystanders, permits zero replacement forces, and lets Tleilaxu choose a sector in the battle territory. These sector/zero/bystander readings and later mobile-stronghold/homeworld/terror/ambassador interactions remain explicit cross-module audit items. Captive release is rechecked when a Face Dancer kills Harkonnen's last native leader.

• Revealed Face Dancers are public and unavailable for reuse. Revealing the third shuffles all three into the reserve and deals three new cards. During Mentat, Tleilaxu may replace one unrevealed card with a cancelable response. The selected identity is hidden from other players in the response projection; cancellation preserves the cards and uses the turn's replacement opportunity. Full simultaneous timing and Mentat/victory ordering still require the global audit.

• battleLeaderStrength copies the opposing disc for Zoal, excluding KH, and uses zero against a hero. Ordinary totals, poison/weapon bounty and traitor bounty share the helper. Zoal retains a separate effective ordinary revival value of three through his catalog strength; battle selectors display X. AI sealed-plan estimation and Poison Tooth evaluation use dynamic leader strength.

• Added an owner-only Face Dancer control component with sources, sector and counts; private hand and public revealed-card panels; Mentat replacement buttons; searchable rule/faction entries. AI at all four levels can reveal/decline using its own private identities, preserves one force in source strongholds, and replaces dead-leader Face Dancers during Mentat. Tleilaxu revival strategy is not yet implemented.

• Closed a start-validation gap: an expansion faction supplied with an empty expansion selection is rejected, so direct API construction cannot silently start an unfinished faction. All expansion starts remain gated pending actual completion.

• Primary evidence: Ix printed p3, p6–7, p10–12; November 2020 FAQ p6 and p8 at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf. The FAQ confirms unlimited Tleilaxu force/own-leader revival, their own free-revival income, Zoal revival value three/no copied KH bonus, Emperor extra-revival payments to Tleilaxu and the separate Karama effects. Revival income/discounts/negotiation, foreign gholas, special Karama and their UI/AI are the next major Tleilaxu work, not completed here.

• Nineteen focused scenarios pass: private setup/deck conservation, reward ordering, force/elite conservation, invalid-action immutability, declined/unmatched reveals, Cheap Hero, KH, dead leaders, third-card recycling, private/canceled Mentat replacement, Zoal totals/bounty, all AI difficulties, unfinished-faction gating, BG bystanders and Harkonnen captive release. The fixture's Guild-to-Tleilaxu substitution now remaps dealt identities before setup; an earlier randomized fixture failure was corrected. Final regression/build results are recorded below.

• Setup finalization is shared by all successful setup actions and bot continuations. This prevents the Harkonnen–Tleilaxu two-faction combination from waiting indefinitely when neither faction has an ordinary traitor-selection prompt. A nineteenth scenario covers automatic completion and deck conservation for that pairing.

• Final verification: all 347 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and production build pass after the setup-finalization and UI/reference edits. No browser visual QA or deployment. The original goal remains active and incomplete; the next required Tleilaxu work is revival economy/negotiation, foreign gholas and special Karama.

Tleilaxu revival commerce checkpoint

• Added shared revival quoting and transactions in game/revival.ts and the authoritative engine. Tleilaxu can revive their own forces without the ordinary three-force limit, revive multiple own leaders before all five are dead, and pay half normal prices rounded up. Other factions retain their native revival-cycle and one-leader restrictions. Elite revival remains limited to one per turn across ordinary, Ghola and Emperor-funded revivals.
• Tleilaxu can grant another faction up to five normal force revivals and grant their current ally half-price ordinary revival. The recipient pays; no implicit Tleilaxu funding is created. Dedicated Karama responses occur when the extra limit or paid discount is used. A canceled limit aborts the transaction without partial revival; a canceled discount restores the normal price and aborts if the payer cannot afford it.
• Other factions privately request an early dead leader or KH, and Tleilaxu quotes or declines. Acceptance revalidates eligibility, funds and the one-leader allowance before its Karama response. A zero-spice agreement is allowed. When all native leaders are unavailable, including capture, ordinary revival rules apply instead of the early negotiation path. Early-revival cancellation blocks that selected leader for the phase without revealing a concealed identity to outsiders.
• Paid revivals now route to Tleilaxu through a separate income response. Normal free revival rewards one spice once per faction per turn, including Tleilaxu themselves; split free-force actions and canceled income cannot repeat that reward. A Ghola treachery play has its separate one-spice reward, including outside the Revival phase. Income cancellation preserves the completed revival. Emperor-funded extra allied forces also pay Tleilaxu, and their separate three-force quota can combine with a granted normal five for eight forces.
• Pending transactions serialize safely and remain internal. Quote records are visible only to Tleilaxu and the requester; payment amounts only to Tleilaxu and the payer. Target IDs are validated against actual players before indexing request records, including rejection of prototype-property targets. No hidden rival spice enters AI quotation or revival choices.
• Added components/revival-commerce.tsx, private quote/accept/decline/withdraw controls, Tleilaxu permission controls, remaining-limit/free-revival/price guidance, response labels and an internal searchable revival rule entry. All four AI levels can quote, grant permissions, request/accept eligible early returns, use discounts and complete the phase through response windows.
• Primary evidence: printed Ix rulebook p7 and November 2020 FAQ p6 and p8. The FAQ confirms unlimited own leaders, one leader for other factions, half-price rounding, KH negotiations, captured-leader unavailability, ally self-payment and Emperor extra-force income. Sources are the genuine publisher-rulebook mirror and official November FAQ recorded above. Foreign gholas, special Karama, Ix cyborg pricing and later expansion economy remain unimplemented. Exact cancellation duration/scope, combined paid/free-income cancellation, ally-permission timing, Emperor special free-revival income and full card-window integration remain audit items; tournament-wide free-income cancellation rules have not been silently adopted.
• Verification: all 368 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 21 focused revival scenarios cover private quotes, rejection/immutability, zero-price and KH revival, captured/concealed leaders, repeated free-income prevention, canceled discounts/limits/payments, Zoal rounding, elite/tech-token accounting, Emperor funding and complete AI phase progression. Final TypeScript, lint and production build pass. No browser visual QA or deployment. The original goal remains active; expansion starts stay gated until their full rules and interactions are complete.

Foreign ghola checkpoint

• Added game/leader-control.ts and persistent Leader.gholaBy. Every leader remains a single record under its original faction, preserving traitor identity and death history; ghola control overrides native use, and temporary Harkonnen capture overrides ghola control. The engine, battle preparation, battle selectors and AI share the controller predicate. Public ghola pools are projected without copying authoritative identities.
• Advanced Tleilaxu can acquire dead foreign leaders during Revival at their discounted bank price while their active controlled pool has fewer than five leaders. Multiple acquisitions are allowed up to that pool limit. Face-down executed leaders remain eligible and retain death counts. KH and the Auditor are excluded. The full-price discount cancellation still reprices before any payment or transfer.
• Acquisition has a dedicated Karama response. Cancellation aborts it without spice or leader mutation and blocks that particular foreign leader for the current turn; another eligible leader can be chosen. Selected pending identities and canceled-identity history remain private to Tleilaxu. The turn key persists independently of Revival-phase initialization.
• Foreign gholas remain associated with Tleilaxu after death. A living ghola cannot be sold back. The native faction may request a private dead-ghola buyback through the existing quote/decline/accept controls even when all its native leaders are unavailable. Acceptance restores native control and uses the one-leader revival allowance. Stale quotes are revalidated. Ordinary paid revival and Emperor special revival cannot bypass ghola ownership; the Ghola treachery card can revive an existing leader in the acting faction's controlled pool.
• A foreign ghola is unavailable to its native faction for ordinary cycle eligibility. It can fight for Tleilaxu, turn traitor under its original identity, die again and retain the death history. Capture of a foreign ghola now reveals the captured identity to its current controller and Harkonnen; the original faction is an outsider to that capture. Capture logs identify the losing controller. After one Harkonnen use, capture clears and Tleilaxu control resumes.
• Added foreign-ghola revival controls, price/limit checks, pool status, dead-ghola buyback labels and a searchable internal tleilaxu-gholas rule topic. All four AI difficulties select affordable gholas from their personalized projection, recognize combat control and request eligible buybacks when their native leaders are unavailable. No player-facing external links were added.
• Primary evidence: publisher Ix rulebook p7 (acquisition and five-active-leader pool), p10 (buyback permission) and p12 (Karama table); November 2020 official FAQ p6 supersedes the older living-ghola buyback wording, confirms multiple foreign revivals and face-down leader history. CHOAM rulebook p8 excludes the Auditor. Original sources and the genuine PDF mirror remain recorded above. Remaining audits include exact buyback pricing/normal-revival and card exceptions, captured-leader pool counting, returning own leaders above five total active leaders, Harkonnen native-ghola/captive-release edges, cancellation timing and all leader-skill/homeworld/Ecaz interactions. Tleilaxu special Karama remains unimplemented; expansion starts remain gated.
• Sixteen focused scenarios cover acquisition/payment/identity conservation, JSON/public pools, five-leader cap, authority/timing/funds, specific cancellation and privacy, discount cancellation, face-down leaders, living/stale/declined buybacks, original-owner cycles, Ghola card ownership, traitors, illegal native battle use, capture and return, all AI difficulties and complete AI revival progression. Final full verification passes all 384 engine/AI/reference tests, including the additional AI buyback-selection regression. All four persisted multiplayer journeys also pass. TypeScript, lint and the production build pass. No browser visual QA or deployment. The full goal remains active and incomplete.

Tleilaxu special Karama checkpoint

• Added an authoritative revivalStop decision before another faction's advanced normal revival commits. The window appears independently of Tleilaxu's hidden card holdings while their once-per-game power is unused. Only Tleilaxu may allow or spend a real Karama. The decision exposes the recipient and force/leader category, not the pending identity, price or private continuation. A successful stop consumes the card once, marks the special power spent permanently and cancels the pending transaction without spice, force, leader, elite or ordinary-revival quota mutation.

• Current implementation prevents the selected faction's remaining normal force and leader revivals for that turn's Revival phase. It covers ordinary revivals, negotiated leaders, buybacks, KH and Emperor-funded allied extra forces. Requests for the stopped faction are cleared; later requests/revivals reject, while other factions and the next turn remain eligible. Already completed revivals are not undone. Ghola treachery and Emperor special Karama currently remain separate. No ordinary cancellation response is created for the special use itself.

• Emperor allied extra revivals now use the shared pending revival transaction after their ordinary Emperor-power response. The Emperor remains the payer; the ally receives forces and the separate extra quota; Tleilaxu receives paid-revival income only after completion. A stopped extra revival consumes neither the Emperor's spice nor the ally's force/elite/extra quota. Shared transactions carry explicit payer/source fields and serialize through JSON.

• Added a player decision panel, matching tooltip, public prevention status, blocked-revival guidance and updated internal faction/special-power/coverage references. All four AI difficulties allow without a Karama, protect allies and use public tank/leader threats to choose when to spend it. Blocked bots pass normal Revival and continue the game; the policy does not inspect rival spice or concealed leader identities.

• Primary source: printed publisher Ix rulebook p6 and indexed official PDF describe preventing a player's revival, forces and/or leader. This wording is brief and does not independently settle every duration or exception. November FAQ p7–8 clarifies ordinary Karama effects, which must not be confused with this special power. WBC 2022's explicitly amended tournament reference describes full-turn normal-revival prevention and a Ghola-card exception, but is not itself proof of target GF9 rules. The current full-turn scope, guaranteed declaration window, Ghola/Emperor-special exceptions, interactions with prior partial revival and later CHOAM/card-prevention effects remain explicitly provisional audit items. Expansion starts remain disabled; do not label the full Tleilaxu rules certified.

• Eleven focused special-power tests cover private/public windows independent of holdings, ownership and card validation, immutable rejected actions, permanent one-use tracking, stopped force/leader/KH/elite transactions, private negotiated requests, continuation into ordinary response chains, Emperor-funded payment/quota accounting, card exceptions, public-knowledge AI policies and complete blocked-phase progression. Existing revival and foreign-ghola test helpers now explicitly allow the new decision where those tests exercise a completed revival. Final verification: all 395 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass after a test-only const correction. No browser visual QA or deployment; the original goal remains active.

• Next concrete expansion work: Ixian cyborg/suboid force model and casualty substitution, then setup/auction technology and Hidden Mobile Stronghold. Printed Ix p8–9 establishes 7 cyborgs/13 suboids, initial 3+3 in the mobile stronghold, cyborg strength 2/movement 2/collection 3/revival 3, suboid strength one-half and post-loss substitution. The current combat model assumes normal strength one (or unsupported one-half); it must be generalized before Ix is enabled.

Ixian combat and suboid substitution checkpoint

• Generalized CombatForces with a fixed-half-strength normal-force mode. Ixian suboids always contribute one-half in basic and advanced play and cannot consume spice support. Basic cyborgs contribute two; advanced cyborgs contribute one unsupported or two for one spice. Other factions preserve their existing basic/advanced arithmetic. validatePlan, casualty resolution and AI now accept the Ixian half-strength basic dial range, with matching human/prescience input controls.
• Ixian leader/force identity stays within the existing physical-force model: seven cyborgs are tracked as a subset of twenty total forces, with thirteen suboids as the remainder. The lobby initializes seven cyborgs; changing factions clears or restores that subset appropriately. Base-game start also clears stale force-type metadata. Mobile stronghold setup remains gated and unimplemented.
• Basic Ixian double-strength cancellation now enters the pre-plan Karama queue. The November FAQ specifically limits this cancellation to basic cyborg strength; advanced cyborg and suboid strength do not receive that response. Suboid substitution has its own separate cancellation window when the owner chooses the exchange.
• Winning Ixians choose matching physical casualties in both game modes. The engine records cyborg losses by sector. If surviving suboids remain, ixSubstitution allows a partial/full exchange or decline. Selected surviving suboids go to the tanks and an equal number of cyborgs lost in that battle return to their original casualty sectors. Total physical casualties and the seven-cyborg inventory are preserved; unrelated prior cyborg deaths cannot be recovered. The loss and recovery transaction serializes, rejects invalid sources/counts immutably and resumes winner card choices/tech transfers/capture/Face Dancers after its response.
• Added components/ix-substitution.tsx with sector/count controls, distinct suboid/cyborg casualty labels, dial guidance/tooltips, internal faction rules and a searchable ix-forces topic with the printed example. All four AI policies generate legal basic/advanced plans using the shared solver and can make legal substitutions. Relative strength and opponent force-type estimation still require calibration.
• Primary evidence: publisher Ix rulebook p9 (force strengths, fixed suboid support, movement/collection/revival, substitution) and p10 (two cyborgs plus six suboids dialing six, then sacrificing the two surviving suboids to retain both lost cyborgs); November 2020 official FAQ p7 (basic-only cyborg-strength cancellation, substitution cancellation, no suboid-strength effect). The genuine local PDF/text remains /tmp/dune-rules/ix-official-mirror.pdf and .txt. Exact multi-sector loss selection/substitution restoration, later mobile-stronghold sectors, additional card timing and expansion interactions remain audit items.
• Fifteen focused tests cover the printed example in both modes, independent exhaustive token assignments, unsupported/supported cyborgs, unboostable suboids, half-strength basic plans, physical/typed conservation, optional/partial/canceled substitution, ownership and input validation, multi-sector restoration, traitor destruction, all AI difficulties and lobby force-type cleanup. Final verification: all 410 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass, including the final basic-Ixian 20.5-strength input-range correction. No browser visual QA or deployment; the original goal remains active and expansion starts remain gated.
• Next required Ixian work: cyborg movement and collection capacity, per-type revival pricing and free-revival selection/limits, complete Hidden Mobile Stronghold setup/occupancy/movement/protection/income, auction/setup technology and its ally/special Karama interactions. Combat support does not establish complete Ixian play.

Ixian movement, collection and revival checkpoint

• Cyborgs in the selected group now allow two-territory movement, carrying accompanying suboids. Cyborgs left behind do not grant speed. Ornithopters still grant three to either type. A move needing cyborg speed stores the validated group/sector/type choices in pendingIxMove, opens a Karama response before removal, and resumes through shared completeMove if allowed. Cancellation preserves the army and movement opportunity but restricts cyborg speed for that movement index; a shorter move remains legal. Exact cancellation duration across Hajr and broader simultaneous movement windows remain audit items.
• Normal spice collection now counts cyborg capacity as three per token while suboids retain the normal two/three ornithopter rate. Collection remains sector-specific and excludes storm/advisors. This is ordinary ground collection; mobile-stronghold travel income is still unimplemented.
• forceRevivalPrice and paidForceRevivalCost share typed prices between engine, UI and AI. Each paid cyborg costs three spice and suboid two. The free allowance may be assigned to either type via an explicit free-cyborg count; the UI offers cyborg-first or suboid-first selection. Default allocation uses free cyborgs first. Mixed Tleilaxu discounts halve the paid total and round up; discount cancellation restores the original typed total before payment. This aggregate mixed-price rounding remains part of the complete cross-faction economy audit.
• eliteRevivalRemaining distinguishes the one-per-turn Sardaukar/Fedaykin restriction from cyborg inventory. Cyborgs may fill their ordinary force-revival allowance with multiple cyborgs, and Ghola can return several more without consuming the ordinary allowance. All paths retain physical and typed counts. The official November FAQ p2 names Sardaukar/Fedaykin explicitly; it does not impose their limit on cyborgs.
• Emperor-funded extra returns now validate and pay each selected force's actual type price, with no free allowance. The Emperor is still the payer and the ally's extra quota remains separate. Cyborgs therefore cost three each in the current implementation; the printed Emperor ability pays revival costs without a cyborg-specific exception. That expansion interaction remains an explicit primary-source audit item alongside later homeworld/CHOAM effects.
• Added seven-cyborg-capacity force selectors, movement/cost guidance, free-type selection, correct mixed price previews and typed selectors for Ghola cards and Emperor allied extras. The Emperor's own elite choice and its ally's extra-revival choice are separate UI state. AI revival candidates now enumerate affordable amounts/type mixes using the same prices and proper special-force allowance; existing movement candidates can use the newly legal speed and complete response windows. Stronger economic/movement cancellation strategy still needs calibration.
• Thirteen focused scenarios cover mixed/selected-only/multi-sector movement, saved continuation, canceled retry and shorter move, ornithopters, collection capacity, explicit free-type pricing, multiple cyborg returns/Ghola and base elite limits, Tleilaxu discounts/cancellation, Emperor funding/funds rejection, shipment count/type conservation and all AI difficulties. All 423 engine/AI/reference tests and all four persisted multiplayer journeys pass. Final TypeScript, lint and production build pass, including the explicit Ghola/Emperor ally selectors and a test-only const correction. No browser visual QA or deployment. The goal remains active and incomplete.
• Primary sources: printed publisher Ix p8–9 and November 2020 FAQ p2/p7. Remaining Ixian work: complete Hidden Mobile Stronghold setup/occupancy/entry/movement/protection/income, setup and auction technology, allied card replacement, special Karama and full interaction audit. Live expansion starts remain gated.

Hidden Mobile Stronghold checkpoint

• Added room-local mobile-stronghold state and an explicit virtual territory at hidden_mobile_stronghold:0. gameTerritories includes it only after placement; gameDistance connects it through its pointing sector with a one-territory entry/exit cost. Shared printed board metadata and other rooms remain unchanged. Normal movement, battle enumeration, stronghold victory and allied co-occupation checks now enumerate room territories. Expansion starts remain gated.
• The future Ix setup branch assigns three cyborgs and three suboids inside, with four cyborgs and ten suboids in reserves. The initial placement decision occurs after first-storm destruction and before the Spice Blow opening/advanced Fremen forecast. It accepts canonical sectors in non-stronghold territories, including Polar Sink. Advanced BG setup cannot use an unplaced mobile stronghold.
• Later Storm initialization offers an occupied Ixian stronghold relocation before dials or the advanced storm-card reveal. Declining resumes that initialization once. A route consists of adjacent printed sector locations, charges one per territory transition, forbids duplicate locations and ends in a non-stronghold territory within three steps. The normalized declaration survives JSON persistence. A public Karama response precedes movement/income; cancellation preserves pieces, location and spice, consumes that opportunity and resumes storm initialization.
• Relocation keeps every occupant inside. Current collection interpretation takes up to two spice per Ixian force from each visited spice sector, including departure and arrival, optionally declined for the whole route. It does not grant cyborg/ornithopter collection bonuses inside. This per-pile capacity and the no-repeat/within-territory sector-route interpretation are explicitly provisional pending further primary clarification, not certified full compliance. Storm-sector traversal is corrected in the later checkpoint below using the explicit printed p11 answer: relocation into, out of or through storm is forbidden. Passage through printed strongholds and the relationship between entry cost and separate movement opportunities remain audit items.
• Ixians may ship directly inside at ordinary stronghold rates, regardless of controller, subject to normal capacity/alliance restrictions. Other factions, including Guild cross-shippers, cannot. Advanced BG accompaniment is supported. Ordinary forces enter/exit only through the pointing sector; a storm there blocks transit. Inside forces remain separate from outside territory worms/storms and battles. Captured control counts toward the controller's win but never grants relocation authority. Contested/advisor-only occupation does not grant a winning hold.
• Advanced Ix special Karama relocates at most two territories on its own Shipment and Movement turn, requires occupying Ixian forces, spends a real card once, and leaves normal shipment/movement counters intact. It uses the same provisional route/collection interpretation. Later special-power cancellation and expansion interactions remain audit items.
• Added an original SVG stronghold marker, dotted attachment line, destination/force overlays, a keyboard-native sector-route editor with undo/collection preview, public pending-route display, special-Karama route controls, tooltip and searchable partial rules topic. No player-facing external navigation was added. No browser visual QA was performed or authorized.
• All four AI levels can place and relocate via private projections, use profitable special relocation, and move armies into/out of the virtual territory. Fixed movement-candidate filtering so unreachable high-scoring destinations cannot crowd out all reachable options before the 24-candidate limit. Relative strength and strategic placement remain uncalibrated.
• Twenty new scenarios cover room isolation, serialized timing/cancellation, invalid placement/routes and rollback, direct/Guild/BG shipping, movement cost/storm obstruction, capacity, inside/outside worms/battles, controller/contested/advisor victory, captured/empty movement restrictions, advanced reveal ordering, special Karama, all AI levels and BG setup validation. 443 unit/AI/reference tests and 4 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment. Goal remains active and incomplete.
• Primary evidence: publisher Ix rulebook p8–10 (initial forces, mobile stronghold, BG accompaniment), p6 (special Karama) and November 2020 FAQ p7 (movement/collection cancellation), using the genuine publisher PDF mirror already recorded above. The currently indexed publisher copy at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf confirms p9 wording. Do not adopt tournament/house amendments to fill the provisional items silently.
• Next concrete work: Ixian setup/auction technology and allied purchased-card replacement, including their Karama/timing/private-information handling; then complete Ix deck assembly and the remaining advanced/expansion audits. CHOAM/Richese and Ecaz/Moritani engines and optional modules, full rules compliance, art/presentation polish and final validated deployment are still required.

Ixian setup and auction technology checkpoint

• Wired the future gated Ixian start path to draw one starting card per faction into a private choice. Selecting one shuffles and privately deals the remainder; Harkonnen then draws its extra card from the deck. Pending choice prevents setup completion, is owned by Ixians, and survives JSON serialization. The decision/dealing path is exercised in setup fixtures; public expansion starts still reject unfinished rules and are not claimed end-to-end complete.
• Beginning an Ixian bidding round offers a public Karama window before any cards are drawn or inspected. Allowing draws the eligible-bidder count plus one, then offers a private card/top-or-bottom choice. The remaining cards are shuffled for bidding. Canceling draws only the ordinary count, with no Ixian inspection. A full Ixian hand does not disable this faction advantage; zero eligible bidders skip it. The chosen deck end is publicly logged, while card identity remains private.
• The private projection records an unordered inspected pool. It never exposes the actual next card to Ixians or the pool to other factions. The record includes cards already auctioned and deduplicates an earlier purchase returned through technology; it is not an inferred view of remaining hidden hands. UI labels make this distinction explicit.
• Advanced technology is offered before each card's bidding and before Atreides' independent inspection response. Ixians commit a hand card without seeing the incoming card; a separate Karama window precedes the swap. Declining preserves the option for another card. Declaring uses the round's attempt even if canceled. Successful exchange preserves hand count and makes the replacement the card Atreides can inspect. Canceling pool inspection does not also cancel advanced substitution.
• After an ally purchases a card, the buyer may keep it or request replacement before Emperor income and Harkonnen's separate bonus draw. The replacement response belongs to Ixians and names the buyer publicly; only the buyer sees the purchased identity. Success discards that exact purchase and draws the top deck card privately. Spice payment remains settled exactly once, canceled/declined replacements preserve the purchase, and Karama-paid purchases qualify without Emperor income. Bonus cards do not recursively receive this purchased-card privilege.
• Existing Harkonnen special exchanges can interrupt these windows. A pending offered card that no longer belongs to Ixians skips the stale swap and resumes Atreides inspection; a stale purchased-card decision exposes no replacement and can be declined to settle the sale. These recovery paths preserve card ownership and progress. The exact legality/order of such interruptions remains a primary timing audit rather than certification of every interaction. Bene Gesserit Worthless conversion cancellation restores the suspended private Ixian response correctly.
• Added the IxTechnology decision component, setup-aware decision routing, inspected-pool details, tooltip, searchable partial technology rules, updated faction guidance/coverage page, and all four AI policies. AI chooses starting cards, prepares pools, evaluates offered cards against known pool values and replaces weak allied purchases; complete advanced bidding phases terminate through legal private projections at every level. Strategic strength remains uncalibrated.
• Twenty-one new technology tests cover pre-draw cancellation/privacy, eligible/full-hand counts, top/bottom placement, invalid/unauthorized choices, order-independent pool projection, pre-Atreides swaps, one-attempt timing, setup/Harkonnen conservation, paid/free/allied/Harkonnen purchase sequencing, Worthless reactions, stale-card recovery, empty/short decks and every AI level. Short-deck fallback permits a lone available card to auction without removing it; multi-card insufficient-pool behavior remains an explicit rules audit, alongside Richese/other auction modes and exact Amal phase-opening order.
• Primary evidence: publisher Ixians & Tleilaxu p8 (initial and bidding preparation), p9 (advanced substitution and alliance), p11 (explicit Harkonnen extra setup draw), and November 2020 FAQ p7 (three distinct cancelable advantages). Publisher URLs and the genuine mirror remain in the source ledger. No tournament amendments were adopted.

Mobile stronghold storm correction

• The same printed Ix rulebook p11 explicitly answers No to relocation into, out of or through a storm. This contradicts the earlier provisional allowance. validateMobileMove now rejects storm departure, arrival and transit before any special card or resources are spent. AI route generation and the sector-route control share the restriction; an occupied stronghold whose pointer is currently in storm can remain in place until the storm clears.
• Ordinary stronghold storm obstruction also applies to battles inside: the battle check uses the pointing sector, not the virtual internal sector zero. Storm/worm casualty immunity remains. A contested stronghold covered by storm grants no winning control; uncontested control still counts like a printed stronghold. This follows the general stronghold obstruction clarification in the November 2020 FAQ p1; no separate HMS battle exception was found.
• Two added scenarios reject ordinary/special storm routes without mutation and ensure AI routes avoid storm, including blocked origins. The existing internal-battle test now verifies storm obstruction and resumed battle after the pointer clears. Updated tooltips, searchable rules and the earlier provisional ledger note.
• 466 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The focused 21-test technology suite also passes after the final public deck-end log refinement. No browser visual QA or deployment. Goal remains active and incomplete.
• Next concrete work: audit and assemble the complete fourteen-card Ix expansion inventory, resolve remaining card/auction/mobile-stronghold interpretation gaps and integrate the advanced/base systems. CHOAM/Richese, Ecaz/Moritani, optional modules, full rules compliance, presentation/art refinement and final validated deployment remain required.

Complete Ix treachery inventory checkpoint

• Added the six remaining ordinary-type cards: Hunter Seeker, Basilia Weapon, Shield, Snooper, Harvester and Kull Wahad. ixDeck() composes these with the six special battle cards, Thumper and Amal; treacheryDeck(['ix']) returns 47 distinct cards. Existing base and Ix IDs remain stable; factories return fresh instances. Repeating the Ix option does not duplicate the set. Requests for unimplemented CHOAM/Ecaz/unknown decks fail explicitly. The future gated start path now uses this deck assembler; public expansion starts remain disabled.
• Corrected the base poison at treachery-7 from Basilia Weapon to Ellaca Drug. Projections and action processing normalize that exact legacy ID/name in hands, deck, discard, auction and private Ix pools after cloning state. Expansion Basilia retains its own name and identity; original input states and historical logs are untouched.
• AI prescience recognition now looks up the complete implemented card catalog, including the additional ordinary weapons and defenses. Ordinary rule kinds preserve matching defense, Voice, lasgun/Shield and advanced BG Worthless conversion behavior without special duplicate-name dispatch.
• The second Harvester exposed the old one-use-per-blow assumption. Current behavior allows each physical copy to double the open fresh blow again, leaves pre-existing spice unchanged, resets table acceptance, and tracks the number of plays. Storm still prevents placement. Worm destruction explicitly closes the Harvester window, so adding another copy cannot resurrect spice. A shared availability helper drives engine, AI and guidance. Ambiguous legacy harvested windows stay closed; old live base rooms have only one Harvester.
• Multiple-Harvester timing and multiplier interpretation remain provisional pending primary card-face verification. The card names/count are corroborated secondary inventory facts, with the publisher independently establishing the fourteen-card total. This step improves the implementation without claiming that every card interaction is certified. Full provenance and unresolved limits are in docs/CARD_INVENTORY.md.
• Added a searchable internal Ix deck topic, corrected stale faction/coverage descriptions and updated fresh-blow guidance. No external navigation or copied publisher art was added to the app. Harvester coverage is now honestly marked partial for the multi-copy audit.
• Nine new tests verify exact card names/counts/identities, independent factories, rule types/Voice/Karama, duplicate Harvester conservation and timing, worm/storm restrictions, authoritative Shield explosions and poison leader kills, immutable legacy-name normalization, all AI Harvester choices, and complete six-base-faction Hard/Brutal games with all 47 cards conserved. These full-deck games are engine simulations; the four persisted multiplayer journeys still cover the currently enabled base/tech-token modes.
• 475 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. No browser visual QA or deployment. Goal remains active and incomplete.
• Source evidence: publisher Ix p4; unamended inventory portions of the Landsraad compilation corroborated by Ludopedia component-sheet listings; primary designer video page identifying the fourteen-card overview. Designer captions/transcript and the located retailer card photo could not be retrieved, so no card-by-card primary inspection is claimed from them. The source audit explicitly avoids importing tournament changes or the compilation's incorrect Ellaca defense description.
• Next substantive work: close base Truthtrance and binding-choice support, then continue the remaining base/advanced timing and expansion engines/modules. Card-face audits, mobile-stronghold collection/entry interpretations, CHOAM/Richese, Ecaz/Moritani, skills/strongholds/homeworlds/Nexus/discovery, complete internal guidance, generated card/leader art and presentation polish, and final validated deployment all remain required.

Truthtrance question-flow checkpoint

• Added game/truthtrance.ts with a persistent overlay (priority → ask → answer, plus unknown for retry/save). The original response, decision, auction, phase opening, storm/spice state and sealed battle remain in place, so completing a question does not reconstruct or replay their effects. The engine rejects unrelated actions while the overlay is active. Setup completion also waits for the overlay to finish.
• Competing declarations are collected before any question is asked, then sorted by storm order. A holder can declare either or both physical copies. Each definite answer discards exactly its own card; an unknown answer leaves that card available for a different question or later play. The original input state remains immutable, and JSON round-trips preserve pending questions.
• Structured facts cover exact named cards currently held and selected traitor identities, including Cheap Hero. AND/OR combinations expose only the combined Yes/No answer. The server rejects dishonest fact answers, forged targets/card identities, invalid answers and malformed or excessive predicate trees. Only the target's personalized projection includes the expected fact answer before publication; no hand, traitor list or matching disjunct is revealed to other seats.
• Freeform game-related questions accept public Yes/No/unknown responses. An explicit current-turn scope records promises for the table; the engine does not yet enforce the meaning of freeform questions or arbitrary promises. The app/reference state this limitation. Future-turn scope is rejected by the structured payload; natural-language meaning still relies on human players. Facts and promises are recorded with turn/phase and retained in authoritative history.
• The dedicated React action panel remains available above suspended phase/faction controls. Hand cards can declare Truthtrance during those windows. It offers named-card/traitor clauses, AND/OR, a freeform question field, public answer controls, retry/save and current-turn history. Existing internal rule navigation is used; no external links or copied publisher assets were added.
• All four AI levels pass priority, answer server-verified facts through their private view, ask a structured question when resolving their own declaration and save an unanswerable question. AI freeform interpretation and proactive strategic use of Truthtrance remain unfinished. Bots return unknown instead of inventing a freeform answer.
• Twelve focused tests cover storm-order races, separate two-copy disposal, privacy, dishonest/malformed actions, immutable interruption of five window types, sealed plans, JSON reconnects, unknown/retry/save, current-turn records, incomplete setup and all four AI levels. The existing persisted multiplayer journeys cover the unchanged authoritative action/version/private-seat boundary; a dedicated persisted Truthtrance journey is still required.
• Source: GF9 November 2020 FAQ p8, https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (indexed primary text). It establishes any-time play, game-related yes/no questions, current-turn commitments and impossibility, AND/OR, storm order, and unknown/retry/save. The base rulebook p23 supports Truthtrance during Voice/prescience interactions. Exact printed card-face/immediate-pause wording and a general simultaneous-action timing audit still need primary verification; secondary tournament amendments were not adopted as certification.
• Remaining Truthtrance work: binding current-battle plans and current-turn shipment/other decisions with feasibility escape; arbitrary human commitments and disputes; AI interpretation, question selection and use of learned facts; guaranteed interrupt opportunities between currently atomic game effects; priority/timing audit and complete persisted multiplayer scenarios. Full base/advanced/expansion compliance remains incomplete, with advanced and expansion starts still gated.
• Verified checkpoint: 487 unit/AI/reference tests + 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. New form styling includes consistent dark controls, keyboard focus, grouped fact fields and wrapping for long questions. No browser visual QA or deployment was performed. The active full-game goal is not complete or blocked.

Binding battle Truthtrance checkpoint

• Added game/battle-promises.ts: validated conditions for dial equality/ranges, spice support, named weapon/defense slots (including empty slots and duplicate physical cards), exact leader/Cheap Hero identity, Kwisatz use, and bounded AND/OR combinations. Definite current-battle answers create public constraints attached to that battle; the recorded question receives the actual territory from the server. Arbitrary freeform/current-turn promises remain available and explicitly unenforced.
• The engine searches full legal completions for an answer, including previous active Truthtrance conditions, Voice, prescience, card-role pairings, controlled leaders, support, elite strength and Ixian half-strength suboids. It only offers answers with a currently legal completion; a sealed plan fixes its answer without exposing its other elements or acquiring new mutable commitments. The search consults the questioned player's private choices and public opponent properties, never the opponent's hidden plan or hand.
• Battle-plan validation enforces all active answers while leaving unrelated elements free. AND/OR conditions preserve alternative completions instead of secretly selecting and locking a witness. Contradictory later answers and prescience values are rejected. The prescience existence check now uses full-plan search when Truthtrance restricts an unshown element, removing the old assumption that all other numeric values can be zero.
• Integration exposed and fixed an existing basic Ixian prescience bug: the API now accepts legal half-point dials for Ixians, matching the existing UI and battle validator. A test specifically reveals 2.5 under a bound Ixian dial.
• A pending Voice response resolves before impossibility releases are considered, so a canceled Voice retains the original answer. After an opposing effect completes, promises are evaluated in their declaration order; an impossible one is publicly released while feasible earlier obligations remain. Canceling Fremen free support and elite strength participates in this search. Voluntary card spending, bribes and aid pledges that would make the actor's still-feasible battle promise impossible are rejected atomically.
• Personalized views expose answer options only to the target, and a legal example plan only to its owner. The React interface adds battle condition fields, public bindings/release status, and a private preview that can populate the editable battle form without sealing it. Tooltips and the internal rules explain the feature and its limits. All four bot levels can choose a feasible answer, filter their candidate plans against existing commitments, and use an authoritative private completion when their heuristic candidate set lacks a required exact dial/support/Kwisatz choice.
• Seventeen new tests cover immutable/public-versus-private state, overlapping Yes/No answers, OR alternatives, dual-role Ix pairs, sealed plans, prescience, pending/canceled/completed Voice, voluntary spice/card evasion, optional Kwisatz flags, duplicate cards and Cheap Heroes, basic Ix half dials, malformed payloads, all four AI levels, Fremen/elite cancellations, and comparison of offered answers against an exhaustive authoritative basic-plan oracle. The full Truthtrance-focused group is 29 tests.
• Still partial: feasibility explores currently available plans, not multi-action futures such as reviving a currently dead leader before committing, additional Karama/card sequences, or acquiring a new choice later. Released answers currently stay released; exact revalidation behavior, cancellation timing, self-caused impossibility and multi-promise ordering need a primary-source interaction audit. Guaranteed interrupt opportunities between atomic engine actions also remain unfinished. Do not call this full Truthtrance compliance.
• Source basis remains the official GF9 November 2020 FAQ p8 (current-turn obligations, impossibility, AND/OR, storm order) and base rulebook p23 (Truthtrance during Voice/prescience and freedom to alter unaffected plan components). Tournament amendments requiring reactivation of previously invalid answers are not silently treated as the printed publisher rule.
• Next work: current-turn shipment and broader binding decisions, future-action feasibility/card-sequence audit and persisted Truthtrance game scenarios; complete remaining base/advanced interactions and all expansion faction/module engines. CHOAM/Richese, Ecaz/Moritani, optional skills/strongholds/homeworlds/Nexus/discovery, AI calibration, complete guidance, generated art/AAA polish and final validated deployment remain part of the active goal. Advanced/expansion starts remain gated.
• Verified checkpoint: 504 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. No browser visual QA or deployment. The full-game goal remains active and incomplete.

Reachable Ghola battle preparation checkpoint

• Expanded battle-answer feasibility from currently legal plans to plans reachable through actual Ghola cards in the questioned player's hand. A bounded-by-card-consumption search explores eligible controlled dead leaders, Atreides' dead Kwisatz, and valid force/elite revival choices. Each physical card is consumed in its simulated branch, so one Ghola cannot revive both a leader and KH. Revived forces remain in reserves and never inflate the current battle's army.
• Extracted applyGholaEffect from the existing card dispatcher so real play and lookahead share revival/control/quota/income logic. The search uses independent state clones and never spends a real card, changes a real leader or leaks rival hands/plans. Selected preparations are suggestions, not locks: other legal ways to satisfy an OR condition remain available. Diverting the last needed Ghola to an incompatible revival is rejected atomically by existing promise enforcement.
• A pending Tleilaxu revival-income response is modeled as a possible future receipt, not currently spendable spice. This includes the original income response suspended beneath a BG Worthless Karama conversion. Promise feasibility waits for the outcome; allowing income enables the supported plan, while successful cancellation releases an otherwise impossible answer without undoing the actual revival. Another faction's income and deferred tech-token income cannot fund the questioned player's current battle.
• Prescience also recognizes Ghola-reachable leaders, including when there is no preceding Truthtrance. A player's personalized battle view exposes compliantPreparation (needed card actions, possible plan, income-wait flag) separately from compliantPlan, which remains immediately legal. The React guide offers a real Ghola play, disables it during other pending windows, and leaves final plan review/sealing separate. All four AI levels execute a required preparation before committing or answering a prescience element.
• Twelve tests cover untouched authoritative state and private projections, pending JSON reconnects, Ghola-to-leader completion, prescience with/without a prior promise, physical-card limits, KH/hero dependencies, native/captured/foreign-ghola control, incompatible diversions and OR alternatives, Tleilaxu income and real/Worthless Karama outcomes, unavailable third-party funding, reserve-force conservation, all four AI levels and sealed-plan immutability. The full Truthtrance-related focused group now contains 41 tests.
• Primary evidence: official base rulebook FAQ p22, https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf, explicitly permits a leader revived by Ghola during Battle to fight in that Battle Phase. The November 2020 FAQ p8 supplies the Truthtrance current-turn obligation/impossibility principle. KH and foreign-ghola treatment reuse the existing engine's revival rules; their outstanding broader source audit is not claimed complete by this step. Older PBEM/tournament restrictions forbidding same-phase Ghola use were not adopted.
• Still required: other future card/power sequences, precise interruption and reactivation rules, current-turn shipment/other obligations and freeform commitment enforcement, dedicated persisted Truthtrance journeys, remaining base/advanced rules and every expansion/module. This addition does not enable advanced/expansion starts or establish full rules compliance. No browser visual QA or deployment was performed.
• Verified checkpoint: 516 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; the 41-test Truthtrance group also passes after expanding AI prescience scenarios. TypeScript, lint and the final production build pass. The full-game goal remains active and incomplete.

CHOAM charity and hand-limit checkpoint

• Publisher CHOAM & Richese rulebook pp. 7–8 and p. 12 cancellation table, verified through the indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . CHOAM takes two spice for each faction, including itself, before other claims. Other factions take their charity from CHOAM. Karama cancels the income and sends charity to the bank, with ordinary charity still available to eligible CHOAM. Printed hand limit is five.

• Added game/charity.ts for shared entitlement and payer selection. beginPhase opens a public CHOAM-income response after any Ix/Amal phase opening. Settlement persists the turn and cancellation state. Ordinary and advanced Bene Gesserit claims transfer actual spice from CHOAM; wealthy Bene Gesserit still has its own cancellation window before any transfer. Cancellation restores bank payments for this turn only. Claimed charity continues to trigger existing Spice Production rules.

• Private projection exposes only the current player's entitlement and the public payer/status. Other players' spice and claim flags remain private. Shared hand limit now supports CHOAM's fifth purchase, and the hand tab displays current count/capacity. UI names the income response and payer; internal rules include a linked, explicitly partial CHOAM economy topic. All four bot levels resolve the response and claim eligible charity; Brutal may spend Karama on enemy income and preserves allied income.

• Fifteen focused scenarios in tests/choam-charity.test.ts cover income timing, ordinary/advanced payout conservation, both cancellation layers, next-turn reset, Amal order and JSON roundtrip, six-player funding, private views, deferred tech income, fifth-card purchase/full-hand Karama exclusion, AI and retained start gates. Existing Bene Gesserit and reference suites pass alongside them (29 focused tests).

• Deliberate unresolved boundary: the publisher text does not explain insolvency if CHOAM spends away its funds before a claim. The engine rejects an unfunded payout atomically rather than inventing a bank subsidy or negative spice. This is not certified full compliance. Inflation, whether CHOAM's automatic income itself triggers Spice Production, self-claims after spending income, and all later module interactions need source audits. CHOAM remains gated.

• Additional primary findings for upcoming work: start two spice/twenty reserves/free revival zero; paid force revival one spice and unlimited. Karama limits it to three (five with Tleilaxu permission) at two spice each. Mentat Inflation places a Double/Cancel token for the following turn, flips at the next Mentat, then is removed from the game at the subsequent Mentat. Karama prevents initial placement, never the mandatory flip. Double face in play prohibits bribes. Exact doubled ordinary charity entitlement, combined Tleilaxu revival discounts and insolvency remain to verify.

• Remaining CHOAM powers: end-phase duplicate sales, Worthless sales/six special effects, once-per-turn two-way allied card trade, allied battle support, advanced Auditor and battle-support income, special Karama, printed leader data and full setup. Auditor checks two random unused opposing hand cards if alive, one if killed (not win/loss); opponent may pay one spice per card to cancel the audit. It cannot be acquired as a foreign ghola by Tleilaxu, be captured or gain a leader skill; CHOAM’s own Ghola card revival is not prohibited (corrected by the 2026-09-07 Auditor audit). The p. 12 cancellation table also covers card sales/Worthless effects, single-battle force income and the audit.

• Validation for this checkpoint: all 531 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM force revival checkpoint

• Primary rulebook p. 7: no native free revivals, no quantity limit for paid forces, one spice per force. Primary p. 12 Karama table: restore three-force limit (five if Tleilaxu permits) and two-spice price. Indexed official PDF verified again: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Genuine Ix rulebook mirror text /tmp/dune-rules/ix-official-mirror.txt p. 6 states allied force/leader revival at half price rounded up.

• RevivalRules.choamBlocked tracks this combined CHOAM cancellation separately from Tleilaxu quantity/discount cancellation and resets on entering Revival. Shared forceRevivalPrice accepts the cancellation status; CHOAM's native cost precedes any separate Tleilaxu discount. forceRevivalLimit preserves native CHOAM unlimited revival when Tleilaxu permissions are canceled.

• choamRevival response belongs to CHOAM and precedes spending/movement. If canceled, a request beyond the newly applicable total allowance aborts without partial payment or revival. A valid request is repriced; insufficient funds abort without changes. Prior revivals remain completed and count against the new total allowance. Applicable Tleilaxu five-force/discount response windows follow. Canceling only Tleilaxu's discount retains active CHOAM native price. This avoids treating the two independent abilities as a single generic half-price flag.

• Free Fremen allowance remains free and is tracked across requests; a completely free request within the normal three-force allowance does not invoke CHOAM's paid/quantity advantage. Emperor extras retain their existing two-spice price and separate allowance. Tleilaxu income receives actual payment, and advanced Tleilaxu special prevention occurs before the CHOAM response. No leader revival prices changed.

• Private views expose the cancellation flag for the player's force quote; UI displays native pricing and the separate allied discount. All four AI levels use the shared quote before spending. Internal CHOAM reference now links to its force-revival topic; remaining powers and faction start gates are retained.

• Seventeen scenarios in tests/choam-revival.test.ts verify quantities through twenty, cancellation/repricing/affordability, independent powers, actual Tleilaxu income, free and Emperor extras, next-phase reset, earlier completed revival, Tleilaxu prevention, JSON reconnect and private projections, AI budgeting and force/spice conservation. All 53 focused CHOAM/Tleilaxu/Ix economy/reference tests pass.

• Interpretations still needing final combined-expansion audit: applying Tleilaxu half-price to CHOAM's native one-spice rate, aggregate rounding per declared transaction, cancellation recovery by repricing versus a fresh player confirmation, and exceptions introduced by Recruits/homeworlds/leader skills. These tests verify the implementation, not publication certification of unresolved interactions. Full CHOAM starts remain disabled. Printed CHOAM leader data, Auditor, Inflation, Worthless powers/sales, ally trades/support and special Karama remain required.

• Validation: all 548 unit/AI/reference tests and four persisted multiplayer journeys pass. TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM Inflation checkpoint

• Verified primary CHOAM rulebook p. 8 Inflation and p. 12 cancellation table at https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Place either side during Mentat; the following turn doubles/cancels all charity including CHOAM income and advanced Bene Gesserit; next Mentat flips; subsequent Mentat removes from the game. Double face in play prohibits bribes. Only initial placement can be canceled by Karama.

• Newly located primary FAQ p. 10 resolves an earlier open question: CHOAM income alone does NOT trigger Spice Production, and Inflation does NOT affect the tech-token payment. Existing separation is retained and directly tested. Same page also confirms Auditor payment is bounded by cards actually available and cannot be partial, and duplicate-card sales require identical cards (Shield Snooper/Portable Snooper do not match Snooper). Record these for subsequent CHOAM work.

• Added persistent Inflation with side, placement turn, update turn and flip flag; inflationUsed prevents reuse after removal; inflationAttemptTurn prevents retry in a canceled placement phase. choamInflation action is available to CHOAM during Mentat, clears table readiness and opens a public Karama response. Successful placement spends the token; cancellation preserves it for a later Mentat.

• Shared charityMultiplier modifies all ordinary and advanced BG claims and CHOAM per-faction income beginning the turn after placement. Cancel records charity initialization without creating a zero-income response; all claim amounts are zero, including wealthy advanced BG. Karama cancellation of CHOAM income retains Inflation and pays doubled ordinary charity from the bank. BG cancellation still resolves before any charge to CHOAM.

• beginPhase flips/removes the token during Mentat after the existing Ix/Amal opening, without a cancelable response. updatedTurn prevents duplicate advancement. Existing bribes still settle; all new bribe actions are rejected while Double is active, including before the first affected Charity phase. Optional placement occurs during normal Mentat controls after existing automatic victory settlement; a finished game needs no subsequent-turn token placement.

• UI shows the public side, affected turn, next lifecycle event and Double bribe prohibition, plus CHOAM placement buttons/save-by-ready guidance and response explanations. Private entitlement and projected income reflect the multiplier. AI levels choose an initial side using their own wealth/forces (Easy varies); Brutal may cancel enemy Double placement. Bots skip suppressed charity and finish their normal phase actions.

• Fourteen scenarios in tests/choam-inflation.test.ts cover both sequences, once-per-game removal, phase/owner/side validation, canceled placement/retry, ordinary/advanced payouts, both cancellation layers, no repeated flips, bribes and deferred payments, unchanged tech income, Amal ordering, persistence, private/public status and all four AI policies. All 43 focused Inflation/charity/BG/reference tests pass.

• Explicit interpretation still under audit: ordinary charity eligibility remains zero or one spice, and Double multiplies the received amount (four from zero, two from one), rather than changing the threshold or automatically raising wealth to four. Primary wording says charity is doubled but the one-spice example was not located. Canceled placement's later-turn retry and full interactions with homeworlds, leader skills, end-phase sales/trades and other unimplemented modules also require final combined-expansion audit. Complete CHOAM faction starts remain gated.

• Validation for Inflation: all 562 unit/AI/reference tests, all four persisted multiplayer tests, TypeScript, lint and production build pass. Check processes exited successfully; logs are /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM end-phase sales and allied exchange checkpoint

• Verified publisher rulebook p. 7 Treachery and p. 8 Alliance: exact duplicates may be revealed and surplus cards discarded for three spice each at phase end; Worthless cards may be discarded for two spice. One two-way allied card exchange per game turn, at the end of any phase. Primary p. 10 FAQ rejects Shield Snooper/Portable Snooper as duplicates of Snooper. Primary p. 12 cancellation table says prevent discarding a card for spice. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . No tournament changes adopted.

• Game.choamMarket provides an always-present closing decision when CHOAM is in a playing table, independent of hidden hand contents. Normal nextPhase now opens this window; advancePhase performs the original continuation only when CHOAM finishes. Storm's separate continuation is handled by resume: storm and advanceAfterStorm, preserving the existing forecast/opening sequence. Automatically skipped phases still receive their closing opportunity.

• game/choam-market.ts builds private sale choices and validates exact-name witnesses. Any distinct matching copy may be retained. CHOAM declares one physical sale at a time; its card (and duplicate name where applicable) is publicly revealed, then a choamSale Karama response precedes discard and payment. Cancellation leaves the card in hand and blocks that physical card from another sale in this closing window. Other cards may still be sold.

• choamTradeReply lets the ally choose a return card or decline; choamTradeConfirm gives CHOAM final approval or decline. Successful exchange atomically swaps the two cards, preserves hand sizes and spends choamTradeTurn. Declines do not consume the turn's successful trade. The market tracks an attempted offer only to avoid AI repeat loops; the human may renegotiate. Trade cards and sale choices appear only in authorized private projections; public decisions contain no card identities.

• Transactions revalidate card custody at settlement. An interrupted sale with a missing card/witness pays nothing; an impossible trade moves neither card. Truthtrance remains available as an overlay and is tested consuming a pending sale card. Other special powers are currently held until the closing decision completes; bots suppress those competing special-card choices while the market exists.

• components/choam-market.tsx provides sale, offer, reply, confirm/decline and phase-finish controls. UI names all new windows. AI sells eligible surplus/Worthless cards, offers a private exchange, handles empty hands/declines, and finishes the phase; higher levels compare the offered/returned values. Internal reference adds the linked CHOAM market topic. Existing CHOAM test helpers now explicitly finish closing decisions rather than assuming an immediate phase transition.

• Twenty-two focused scenarios verify ownership/timing, invariant public windows, delayed sale payment, exact duplicates and arbitrary retained witness, failed/forged sales, Karama/card preservation, private two-way consent, declines/empty hands, custody changes, tech income and auction escrow settlement, storm/automatic battle/auction continuations, persistence, Truthtrance interruption, AI progress and once-per-turn trade across boundaries. All 66 market/CHOAM/reference focused tests pass.

• Remaining audit boundaries: multi-card simultaneous sales versus serial declarations, whether Karama blocks only the selected sale card or the whole sale power for that phase, required ordering among concurrent end-phase income/refund/sale/trade effects, and other anytime card/special-power interactions in the closing window. The current implementation prioritizes the market before deferred tech income and escrow refunds. Full CHOAM starts remain gated. Worthless special effects, allied battle support, Auditor, printed leaders, special Karama and other expansion modules remain required.

• Validation: all 580 unit/AI/reference tests, four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM special Karama cash-in checkpoint

• Publisher CHOAM & Richese rulebook p. 4 permits the special Karama to discard hand Treachery Cards, including Worthless cards, for three spice apiece at any time. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Implementation applies the existing advanced-game, real-Karama and once-per-game special-power restrictions. The activation Karama is discarded separately and earns no income; a second Karama may be among the selected cash-in cards. The activation-card interpretation and exact interruption boundaries still require final source audit.

• New shared game/choam-karama.ts filters available cards against the player's sealed battle plan and exact prescience commitments. The authoritative action requires distinct owned physical IDs, at least one selected card and a separate activation card; invalid requests are atomic. It preserves a winning auction's funding using available spice plus the auction's actually committed allied payment, or another retained real Karama. Uncommitted ally pledges never count as already committed funding.

• CHOAM may cash in across all nine playing phases, phase-opening decisions, responses, pending revival and market/trade decisions, preserving the interrupted continuation. An active Truthtrance question still resolves first. A pending sale or trade whose offered card was cashed in is revalidated and aborts without duplicate income or partial exchange. Private projections expose only the acting player's eligible cards; public logs reveal counts and income rather than discarded identities.

• components/choam-cash-in.tsx provides activation selection, eligible-card checkboxes and a live gain preview above the private hand. It excludes stale/committed selections and prevents submission during an active Truthtrance question. Internal faction/reference topics explain the implemented power and its outstanding audit boundaries without external player-facing links.

• Battle-plan reachability now explores actual cash-in preparations alongside Ghola through shared authoritative effects on independent clones. Each branch consumes physical cards and the once-per-game power; retained promised weapons/defenses and leaders remain necessary for the resulting legal plan. The existing battle guide shows the required cash-in and lets the player execute the next preparation. All four AI levels can follow a binding promise that needs the proceeds, then seal a compliant plan. Outside battles, bots sell low-value Worthless cards when short of spice while preserving committed auction funding.

• Fourteen tests cover all nine phases, pricing and once-only use, ordinary disposal of an extra Karama, atomic malformed/forged selections, advanced-game restrictions, response/opening preservation, actual Amal order, funding an interrupted revival, invalidated sales/trades, winning-bid funding, sealed/prescience reservations, private JSON projections, all four AI policies and a binding battle promise requiring both cash-in-funded support and a retained defense. The focused cash-in/Ghola/market suite has 44 passing tests.

• Remaining work includes other future battle preparation sequences, special-power timing and activation-card source clarification, CHOAM Worthless effects, allied battle support/income, Auditor and printed leaders, plus remaining factions/modules and full interaction audits. This step does not enable expansion starts or establish complete rules compliance.

• Validation: all 594 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

CHOAM combat funding and force-payment income checkpoint

• Primary CHOAM & Richese rulebook p. 8 verified through the publisher's indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Its alliance rule permits paying some or all of an ally's forces in battle. Advanced Forces pays CHOAM half of other players' force payments, rounded down; its own payments go to the bank, and any revealed traitor prevents the income. Primary p. 12 permits Karama to cancel force-payment collection for one battle. The base November 2020 FAQ p. 7 permits cancellation of alliance powers. Direct publisher PDF fetches remain 403; no local genuine CHOAM PDF was obtained.

• Extended existing authoritative allied escrow to advanced CHOAM during Battle. A new choamBattleFunding decision gives CHOAM a guaranteed chance to set its pledge before ordinary battle preparation begins. Ordinary phase controls can adjust the unspent pledge. A mutual alliance is required; other factions cannot pledge combat funds. A choamBattleAid response precedes sealing and can block the alliance benefit for that battle without consuming the escrow. Later battles get fresh funding/response opportunities.

• Plan.allyPayment records the sealed CHOAM share separately from total support; it is not a prescience-selectable field. The default split spends the combatant's own spice first, then covers its shortfall from eligible escrow. Explicit shares may use more CHOAM funding. Validation bounds total support by actual available resources, rejects foreign/oversized shares, and prevents withdrawal of a committed contribution. Bribes reserve only the combatant's own committed share. Final payment uses the same atomic allied-payment helper as bidding/shipment.

• Unused combat escrow returns after the Battle closing market, alongside the existing phase-end settlement. Pledges remain private to donor/recipient views; an ally does not gain access to the other's spice or sealed plan. Private legal-plan search, prescience feasibility and binding Truthtrance completion now include actual eligible CHOAM funds. Pledged spice cannot bypass a canceled alliance benefit or become a general-purpose transfer.

• Battle resolution records pending CHOAM income from each non-CHOAM combatant's own payment, rounded down separately. CHOAM's own support and the amounts it pays for its ally are excluded. A sole traitor winner spends neither own nor allied support; mutual traitors still pay both commitments. Any traitor suppresses all CHOAM income. An explosion without a traitor still produces normal paid support and income. After casualty/winner-card choices, choamBattleIncome opens a response before technology/capture/Face Dancer continuations. Allowing pays once; canceling sends the amount to the bank without refunding combatants.

• Added private funding controls, payment-split inputs, response explanations, revealed/compliant-plan payment details, linked internal combat reference and tooltip. All four AI levels allocate CHOAM support before allied battles and use it in legal plan generation, including binding support promises. Hard/Brutal may counter an enemy alliance benefit; Brutal may cancel enemy force income. No player-facing external links were added.

• Twenty new scenarios cover funding ownership/timing, mutual alliances, affordability and malformed requests, locked payment shares, explicit splits, per-payer rounding, once-only income, real and BG Worthless Karama responses, canceled funding across two battles, phase refunds, one/two traitors, CHOAM's own payments, Fremen free support, basic-game exclusion, explosions, private projections and JSON reconnects, preserved Atreides full-plan offers, and all four AI levels including a five-spice binding promise with zero own spice. The focused combat/CHOAM Karama/full-plan group has 54 passing tests.

• Remaining audit boundaries: per-player versus combined rounding when both pay odd amounts, exclusion of CHOAM-funded allied contributions under the own-payment clause, exact timing of the alliance cancellation and income versus simultaneous post-battle powers, and later module interactions. The implementation follows the literal payment interpretation, but these edge cases lack explicit publisher examples. Worthless special effects, Auditor/printed leaders, other factions/modules and full-game interaction work remain. Advanced/expansion starts stay gated.

• Validation: all 614 unit/AI/reference tests and all four persisted multiplayer journeys pass; TypeScript, lint and final production build pass. The first full run found only an existing case-sensitive error-message assertion, corrected by restoring compatible wording; the entire suite then passed. All check processes exited successfully. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed. The goal remains active and incomplete.

CHOAM Kulon and La La La checkpoint

• Verified publisher CHOAM & Richese rulebook p. 7 and cancellation table p. 12 through indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Kulon adds one territory on CHOAM's Shipment and Movement turn. La La La prevents a player's Free Revival during Revival. Karama prevents discarding a Worthless card in that phase for its special effect. Both are basic faction advantages and also work in advanced play.

• Added a shared CHOAM Worthless declaration/settlement path with pendingChoamWorthless and the choamWorthless Karama response. The physical owned card and declared target are validated before announcing. Discard occurs only on successful settlement. Cancellation retains the card and tracks its physical ID as blocked for that phase. Card custody is rechecked: if special Karama cash-in consumes the pending card, no special effect occurs and an interrupted revival continues.

• Kulon requires CHOAM's active movement turn and an available move. Its turn-stamped bonus adds to normal range and ornithopters; it does not grant extra actions or bypass storm, occupancy or allied-entry validation. The current interpretation applies the bonus to both available Hajr movements. A later turn ignores the old bonus. Private views now include the actual number of allowed movement actions for controls/AI.

• Added freeRevivalRemaining shared by authoritative revival quotes and the private projection; UI and bots use that projected entitlement. RevivalRules.freeBlocked denies ordinary free forces for the rest of Revival, including a Fremen allied allowance granted before or after the denial. Normal paid revival and separate Ghola card returns remain possible. Earlier force returns and quota consumption stay unchanged; the next Revival initialization clears denial.

• Every CHOAM table opens a choamFreeRevival decision when another faction declares a normal force revival with a free portion, independently of CHOAM's private hand. CHOAM may allow the request or declare La La La. Success stops the entire pending request without payment, force movement or quota use; the requester can explicitly select a paid revival afterward. Cancellation/missing card resumes the original quote through the existing Tleilaxu special-prevention window and later revival responses. This ordering avoids automatic spending at a newly increased price.

• New components/choam-worthless.tsx supplies private phase/reaction controls, target selection and allow/pass. Phase UI shows extra movement range and free-revival denial, and a linked internal topic/tooltip explains the two implemented cards. All AI levels use Kulon when movement is available. Easy saves La La La; higher levels may deny an enemy's free request while preserving allied requests. AI revival budgets use the denied entitlement rather than faction defaults.

• Sixteen new scenarios cover basic/advanced range, ornithopters, storm/alliance restrictions, Hajr action counts and next-turn expiry, ownership/phase/timing rejection, Karama retention/retry, earlier free returns, hand-independent public decisions, mixed request aborts, cancellation resumption, cash-in interruption, later Fremen grants, Ghola exception, Tleilaxu continuation, next-phase reset, private JSON reconnects, AI policies/budgets and unsupported/forged effects. The focused Worthless/CHOAM revival group has 33 passing tests. One preexisting revival scenario now explicitly allows CHOAM's new free-revival decision before testing Tleilaxu cancellation.

• Still required: Baliset, Jubba Cloak, Kull Wahad and Trip to Gamont effects; Auditor/printed leaders; remaining factions/modules and combined-expansion audits. Outstanding interpretations include physical-card versus whole-power Karama scope, Kulon with Hajr/ornithopters, reactive La La La request cancellation versus repricing, ordering with other prevention effects and later free-revival exceptions. Full CHOAM/advanced starts remain gated.

• Unit validation: all 630 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript and lint pass; lint caught an obsolete faction import after centralizing AI revival entitlement, which was removed. The final production build passes; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

Trip to Gamont and deferred CHOAM Mentat victory checkpoint

• Primary CHOAM & Richese p. 7 permits returning any one force belonging to another player to its reserves during Mentat Pause; p. 12 supplies the Worthless-effect Karama cancellation. Official indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Primary base p. 11 checks occupied strongholds during Mentat; November 2020 FAQ p. 1 excludes unresolved opponent co-occupation and discusses ties with extra strongholds/tech. The ordering below ensures a legal Mentat return can affect the board used for victory; the detailed schedule is an implementation interpretation requiring later interaction audit.

• Extended the CHOAM Worthless declaration with Trip to Gamont, target player, board sector and ordinary/elite choice. Rejects self, absent player/force, reserves, invalid sector, unavailable force type and quantities other than one. The public response includes the selected recipient, sector and force type. Settlement rechecks both card and typed force, then moves exactly one token to that player's reserves. Elite totals/type are preserved; no tanks, battle-loss count, revival allowance, spice or transport income changes.

• The return can select forces in storm, Bene Gesserit advisors or occupants of the Hidden Mobile Stronghold. Returning a stronghold occupant does not relocate the stronghold. Existing advisor stance settlement runs after the return so removal of the last opposing force is reflected in control. A missing card/force aborts without an extra discard or reserve token. Karama keeps the selected force and card, blocking that physical card's effect for the phase.

• At tables containing CHOAM, beginPhase(8) still settles bribes and Inflation once but defers victory. Ordinary Mentat actions and readiness lead to the existing closing market. advancePhase then opens a hand-independent choamMentat decision; a newly exchanged Trip card remains usable before victory. After each Trip response, this final decision reopens. CHOAM's explicit completion calls victory on the resulting board and only advances the turn if play continues. Other tables retain the existing entry-time victory behavior. completePhase isolates that continuation without repeating settlement or the market.

• New components/choam-gamont.tsx offers owner/sector/type choices and final victory confirmation. Public Mentat guidance explains the delay; internal faction, phase and Worthless topics now link to a detailed Trip to Gamont topic. All four AI levels can select and return an enemy force and finish the window. Higher levels prioritize single stronghold occupants and elite forces. Bots preserve a usable Mentat Trip from proactive cash-in, market sale and their own trade offer so the final chance is not accidentally lost.

• Nineteen new tests cover deferred/unchanged winning boards, ordinary/advanced returns, public empty/full-hand windows, readiness, Karama, ordinary/elite conservation, invalid actions, storm/advisors, automatic advisor stance, mobile stronghold occupants, closing allied acquisition, interrupted card/force custody, JSON reconnects, final-turn Guild fallback/BG prediction, once-only bribes/Inflation, tech-token victory and all four AI policies. The focused Gamont/market/Inflation/reference suite passes 53 tests. The shared Worthless reconnect case now covers both La La La and Kulon; the first full run caught optional response fields serialized differently, fixed by emitting force/recipient fields only when applicable. One existing exchange-limit test now completes the additional Mentat decision before asserting the next turn.

• Remaining timing audit: exact ordering of sales/trades and Trip versus other simultaneous Mentat abilities, opportunities to revisit an already closed market after a canceled Trip, future force-type/stronghold/module exceptions, and the existing advisor-force cancellation rules. Baliset, Jubba Cloak and Kull Wahad remain unfinished, alongside Auditor/printed leaders, all other remaining factions/modules and complete-game audits. Advanced and expansion starts remain gated.

• Validation: all 649 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and final production build pass; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active and incomplete.

Baliset and development reliability checkpoint

• CHOAM’s Baliset has proactive player/territory controls and a public response decision before another player enters a CHOAM-occupied territory by movement. The response is offered independently of the private hand. The declared force group remains server-private; public intent includes mover, destination, sector and count.
• Allowing or canceling resumes the original typed force group after rechecking custody, entry, movement availability and route. Successful Baliset leaves forces in place and the movement unspent. Shipment and movement between sectors inside the same territory remain possible. Restriction enforcement checks the current turn/phase, chosen player/territory and current CHOAM occupation.
• All four AI levels handle the response. Movement candidates respect active restrictions without removing shipment candidates; Hajr second movements and Kulon plus ornithopter range are considered. Cash-poor CHOAM preserves a reactive Baliset. The internal Worthless reference and tooltip describe these flows.
• Twenty-two focused scenarios cover basic/advanced blocking, cancelation, typed forces, empty-hand privacy, JSON decision restoration, shipments, expiry, stale custody/routes, lost occupation, cash-in, Ix transport ordering, same-territory moves and AI behavior. All 671 unit/rules/AI/reference tests and four persisted multiplayer tests pass. TypeScript, lint and production build passed at integration; final presentation-only checks are recorded below.
• Interpretation audit remains: exact Baliset duration and destination/transit scope, consumption of a prevented movement, simultaneous prevention ordering, and later module exceptions. These are implementation choices under audit, not certification of complete expansion compliance; full faction starts remain disabled.
• Found repeated Vite page reloads from Wrangler registry heartbeats and database state updates in the running server log. server.watch.ignored now excludes .wrangler; the restarted server no longer logs these reloads. Saved data was preserved.
• The hourly automation was created, then the app reported it removed. The user explicitly requested leaving it removed. Do not recreate it. During active development, follow the objective’s controlled-restart requirements: preserve data, warn before active human play and defer until safe, verify health/reconnection/restoration. Do not use restarts as a substitute for fixing root causes.
• Revised objective read from /home/quintine/.codex/attachments/b71d2b8c-373e-499e-801d-5bdce7d72e33/goal-objective.md. It preserves the full twelve-faction scope, official source precedence, complete-game acceptance gates, original internal guidance, all four AI levels, and explicitly authorizes browser screenshots/playtesting.
• Current local development server: exec session 97563, log /tmp/dune-dev-server.log. Sandbox network-interface restrictions required approved escalation to launch it. Tests use approved escalation because tsx requires local IPC pipes.

Parallel review, card inspection and browser acceptance

• Latest controlling objective: /home/quintine/.codex/attachments/70120c7b-5b79-41a3-b429-edac4afcf059/goal-objective.md. It additionally authorizes proactive parallel agents and requires authentic, inspectable physical components and a verified complete component inventory. No recurring automation: the user explicitly requested leaving it removed.
• Independent read-only Baliset review found no confirmed crash, deadlock, duplicate-force or hidden-hand leak. Its observer-context suggestion is implemented: non-CHOAM seats see the public pending mover/destination/sector/count. Additional passing tests cover BG Worthless Karama, countering that conversion, multisector elite custody and advisor arrival locks. Exact timing interpretations still require authoritative resolution before full starts.
• Integrated CardRules and CardInspector from the card-presentation agent into the authorized private hand. Both receive only a visible card; they do not read game/deck state. Enlarged cards include crisp original gameplay guidance and internal explanations, accessible dialogs, focus return, keyboard dismissal and reduced-motion handling. Normal cards are wider for readable text. These are current gameplay guides, NOT verified complete printed card text; all-card inventory/text acceptance remains open.
• Reviewed and integrated docs/COMPONENT_INVENTORY.md from the inventory agent. It distinguishes factory counts from official verification, records replacement-card versus additive-deck distinctions and separate caches, and traces inventory/text/engine/UI/AI/test gaps. Its UI matrix describes the pre-inspector baseline; this checkpoint records the newly verified subset without implying every component was inspected.
• Browser playtest room EN4L8NTV, Atreides human test seat + Medium Harkonnen AI: created room, added AI, ready/start, private traitor selection, sealed storm choice/confirmation, spice reveal/acceptance, charity readiness, auction powers, bid/counterbid/pass, payment and private card receipt, revival readiness, shipment and map-selected movement all worked. Atreides shipped one force to Arrakeen and moved one to Imperial Basin sector 9. Refresh restored 1 spice, 9 reserves, 10 forces at Arrakeen, 1 at Imperial Basin and the Kulon/Snooper hand; the spent movement stayed spent.
• Browser-discovered control fixes: auction bids now default to at least the current minimum, reset for a new auction card and disable unaffordable raises; spent movement disables Move forces and explains that the turn can be finished. The server remains authoritative for all legal-action checks.
• Visually inspected enlarged Kulon at normal desktop and 390×844 mobile viewport. Dialog fits mobile width, its body scrolls to expanded rules, Close remains reachable, Escape closes and focus returns to Inspect Kulon. Temporary viewport override was reset. Full forty-seven-card normal/enlarged review, unseen component families, mobile whole-game flow, sound and combat visual QA remain open.
• Initial refresh briefly renders the landing page before restoring the room. Restoration works, but a dedicated restoration/loading state would avoid this misleading flash; this is a remaining UX refinement.
• No recurring .wrangler hot reloads appeared in the new dev-server log after exclusion. Browser test room is paused at its test human’s completed movement turn; no unattended progression is required. Current browser tab 4 may be kept for later authorized QA.

Jubba Cloak and bounded client recovery checkpoint

• Latest objective read: /home/quintine/.codex/attachments/3c2d7613-9ed4-4489-a95a-5502776c4a29/goal-objective.md. It preserves complete classic/advanced/all-expansion scope, parallel development, complete component text/inventory and browser acceptance. The user explicitly left the hourly automation removed; no replacement automation was created.
• Jubba Cloak now opens a hand-independent CHOAM decision before storm traversal when CHOAM has exposed forces. The owner can declare an available physical Jubba for one threatened territory or continue. Successful settlement discards the card and protects only CHOAM's forces in that territory for this storm movement; spice and opponents remain exposed. Multiple sectors of the chosen territory share protection. Further threatened territories are offered again before continuing into Fremen protection and normal casualties.
• The shared Karama response retains a canceled card and prevents its special reuse in that phase. Missing/cashed-in custody aborts the effect and restores storm continuation. Private projections include the owner's exact pending Worthless card so AI cash-in cannot consume its own declared card, including while BG conversion is nested. Human cash-in remains possible and correctly aborts the pending effect.
• Added components/choam-storm.tsx, public waiting context, internal linked Jubba guidance and all four AI policies. Independent source/code review found and reproduced the poor-CHOAM pending-card cash-in bug; the integrated fix passes direct and nested regression tests. No additional confirmed defect was found in that review. Exact multi-sector scope and simultaneous priority remain interpretations under audit; CHOAM starts remain gated.
• Twenty new Jubba tests verify basic/advanced scope, multi-sector and separate territories, conservation, Karama/counter behavior, custody interruption, privacy/JSON restoration, sheltered terrain/HMS, zero movement, destroyed Shield Wall, Weather Control/Atomics, first storm and sector wrap, expiry, Fremen continuation and all AI levels.
• Integrated bounded request helper and client recovery: 15-second fetch plus body deadline, abort, no automatic replay of an uncertain POST, GET-only reconciliation, completion-scheduled/coalesced polling, monotonic versions and recovery epochs, immediate duplicate-click guard, explicit reconnect/AI resume, and initial restoration placeholder. Ten focused helper tests pass. Independent review is checking initial-invite failure recovery; browser timeout/reconnect acceptance is still outstanding. Initial create/join receipts and lost-cookie seat recovery remain separate missing server capabilities.
• Click/tap help now uses an accessible popover with hover support; the browser confirmed visible spice help and Escape dismissal. Enlarged private-card inspection and mobile checks are described above. The browser game has reached turn two from Mentat Pause without lost state; this is not yet a complete visual game.
• Integrated validation: 701/701 unit tests and 7/7 persisted multiplayer tests pass, along with TypeScript and lint; all four commands exited zero. The multiplayer command now includes the three recovery regressions. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log. Final client follow-up and production build remain to be checked after the initial-invite recovery review.
• Remaining CHOAM implementation includes Kull Wahad and Auditor/verified printed leaders, plus timing audits. Richese, Ecaz, Moritani, leader skills, stronghold cards, homeworlds, Nexus, discoveries and full combination/AI/component acceptance remain required. No full-compliance or release claim is made.

Owner-proved seat recovery, visual combat and AI calibration

• Added authenticated recovery-key setup and private-proof recovery at POST /api/rooms/:code/control. Recovery preserves player identity, game state and sealed plans, increments the room version, revokes older seat credentials and installs the new token. Storage keeps cryptographic hashes; private keys and tokens do not enter GameView or public history. An exact operation receipt can reissue the current cookie without rotating twice; changed credentials/proof, later rotations and replaced keys invalidate older receipts.

• SeatAuth now contains player ID and token hash. Every authoritative game write checks that exact active credential in the same conditional SQL statement as the room version. Private reads join the live credential with the room. This fences requests authenticated before revocation as well as later reads. Additive Drizzle migrations 0001_fancy_king_cobra.sql and 0002_famous_piledriver.sql are applied locally; apply them before dependent code in other environments.

• Integrated SeatRecoverySetup below the table and SeatRecoveryClaim in the join area. The owner saves the complete generated private kit before enabling it; the setup retains that kit through uncertain and confirmed results. Recovery validates the saved kit and retains the exact operation ID/new session token for explicit retries. No automatic retry or localStorage secret storage. Normal game actions and management share the pending guard. Restored-seat integration isolates owner identity and discards stale epoch/version results, including WebMCP reads from an exited/recovered context.

• Initial invite failures now show a GET-only retry screen for transient errors and a usable join form for missing/auth-rejected seats. HTTP 408/5xx mutation errors are treated as uncertain. Independent client review confirmed both fixes and identified stale read return values; obsolete reads now reject instead of escaping through the WebMCP return value. Additional settlement guards verify seat/epoch as well as room.

• Seven new backend tests pass, covering owner setup/rotation, private state preservation, lost-response receipt replay, altered/stale receipts, same-key/key replacement invalidation, simultaneous claims, actual SQL fencing of an already-authenticated old writer and byte-identical sealed-battle JSON. Existing seven multiplayer tests also pass after the authentication change. Five recovery-kit helper tests and twelve request tests pass within the aggregate 708/708 unit suite. TypeScript/lint/build pass at integration; final presentation/context-guard checks follow separately.

• Browser test completed a Carthag battle: weapon prescience, sealed plans, public reveal, traitor decline, victory, chosen card discard and refresh restoration all worked. It exposed an enabled Reveal traitor button without a matching card; controls now use only entitled traitors and revealed plans to disable with a reason, including hero and Kwisatz cases. The disabled state was visually verified. Detailed evidence and remaining visual limits are in docs/VISUAL_PLAYTEST.md.

• Reproducible calibration completed 120 basic base games across 2–6 players with balanced difficulty/faction/seat rotations: no deadlocks, unhandled exceptions, action-limit failures or checked invariant failures. Win counts across 120 appearances per level: Easy 1, Medium 41, Hard 37, Brutal 41. This separates Easy in the measured sample but does not demonstrate an increasing strength ladder among upper levels. The run recorded 31,388 rejected candidate proposals; first-choice rejection frequency was not measured. Methodology, correlated-sample limits, seeds and deterministic replay are in docs/AI_CALIBRATION.md; source files were unchanged during measurement.

• Lost initial create/join response receipts, intentional seat transfer and prior-consent AI delegation remain missing. Owner recovery requires a previously saved kit; it does not make a completely abandoned unprepared seat replaceable. No advanced/expansion starts or release gates were lifted. Independent backend review is still underway.

• Controlled maintenance at approximately 10:04 Australia/ACT, 2026-09-06: consistent SQLite backup in /tmp/dune-maintenance-20260906T0003, prior server97563 stopped cleanly, new server73638 started with approved network permission. Recent active rooms were test fixtures, and the browser game was paused at its collection decision. Complete saved JSON hash and version47 matched after restart; browser reload restored the same state. No recurring automation was created. New server log remains /tmp/dune-dev-server.log.

• Independent backend review found no confirmed custody/privacy defect. Actual room-module SQLite reproductions verified transaction rollback, key replacement between proof and commit, rotation/key replacement during receipt reads, stale version batches and old credential fencing. Six deterministic rollback/interleaving cases are now permanent tests, including a barrier-controlled race between distinct recovery claims. The prior14-test suite passed after restart; the expanded20-test suite is running. The13-test seat-recovery file includes7 original scenarios and6 new cases.

• Read-only mobile recovery-panel inspection at390×844 confirmed wrapping, reachable controls and no horizontal overflow; no recovery key was enabled for the browser test seat. Detailed record is in docs/VISUAL_PLAYTEST.md. Latest production build, lint and TypeScript checks completed successfully after the context-guard fixes.

• Expanded persisted/database validation completed: 20/20 pass, terminal exit0, including all six newly permanent interleaving/rollback cases. Aggregate unit checkpoint remains708/708. No application source changed during the final multiplayer run.

Battle-wheel presentation checkpoint

• Integrated the independently authored original SVG battle wheel with native range and numeric controls. The parent preserves the existing numeric label as a sibling, supplies the same dial limits/step/commitment as before and disables while sending. The graphic is decorative for assistive technology; native controls remain keyboard/tap usable, with no animation or external assets.

• Added a basic battle-wheel practice example to the internal battle topic and expanded internal recovery guidance. The practice is local UI state and cannot change a live game. Its ten-force dial is clamped to0–10. Tick labels were adjusted to selectable step values after the ten-force example exposed fractional printed labels on an integer-only wheel.

• Browser desktop/mobile checks verified exact-number, arrow-key and range synchronization, explanatory totals, practice bounds and readable mobile controls. Found and fixed pre-existing horizontal overflow of the mobile rules reference caused by its grid’s automatic minimum width. Screenshots and limitations are in docs/VISUAL_PLAYTEST.md; viewport reset and temporary tab closed.

• Reviewed the Richese source/architecture plan in docs/RICHESE_IMPLEMENTATION_PLAN.md. No Richese implementation or mode enabling occurred. The immediate architecture work is a bidding schedule separate from ordinary auction state, with explicit sale provenance and sealed bid handling; No-Field requires a separate concealed board object. Printed cache faces and leader roster/strengths still need verified primary components.

• Final checks for this presentation slice: reference-link validation1/1, TypeScript, repository lint and production build all exited0. The most recent aggregate checkpoints are708/708 unit tests and20/20 persisted/database recovery tests. The running server73638 returns200 for the saved playtest; browser tab4 remains available at turn2 collection. No deployment or full-compliance declaration occurred. All three agents' contributions from this checkpoint were reviewed and integrated or retained as explicitly scoped developer plans.

Initial room-entry recovery checkpoint

• Create and join now optionally accept a private operation receipt. The server hashes its operation, exact normalized request identity and session token, atomically stores the room/seat/receipt, and returns the current original private view on an exact retry. Duplicate operations converge without additional rooms, seats or state versions. A mismatched request, revoked credential or cross-room operation cannot claim the receipt. Migration 0003_magical_hawkeye.sql was applied locally before dependent runtime changes.

• The browser saves an immutable, versioned, tab-scoped request before sending. Refresh restores an explicit retry screen; no POST retries automatically, and a cookie-only GET cannot erase the proof. Only a matching receipt or a confirmed fresh already-seated join acknowledges success. A clearly rejected first request returns the form for correction; uncertain and replayed attempts retain their proof. Failed storage writes prevent sending; failed deletion keeps the record visible. Invalid/future records are preserved for deliberate handling.

• Saved-kit recovery and entry attempts cannot silently discard each other's unresolved operation. Uncertain recovery blocks conflicting entry/navigation and retains its exact payload. A deliberate acknowledged abandonment provides an exit when another recovery invalidates that receipt; it does not undo any completed recovery. The original saved kit remains necessary for future recovery.

• Independent backend audit found a concurrent token-reuse classification issue; the fixed path rolls back and returns ENTRY_TOKEN_USED instead of a generic server error. Thirteen permanent entry cases cover accepted response loss, duplicate create/join, normalized/mismatched inputs, cookie precedence, started-game private projection, revocation, competing faction claims, failed receipt inserts and deterministic operation/token collision barriers. An independent eight-case isolated audit found no remaining confirmed custody/privacy defect.

• Ten client entry tests cover frozen payloads, strict parsing, fresh versus uncertain response acknowledgment, storage failures, retained proof through refresh and first-request rejection policy. Aggregate verification: 718/718 unit tests and 33/33 persisted/database tests pass. TypeScript, repository lint and production build pass. Browser creation, refresh, same-seat rejoin, explicit retained-request retry, deliberate abandonment and corrected-invitation flows passed; mobile layout was inspected and improved. See VISUAL_PLAYTEST.md for precise scope.

• Richese source checks are recorded in RICHESE_BLACK_MARKET_RULES.md and RICHESE_LEADER_AUDIT.md. Black Market custody/payment/continuation need separate engine state; self-purchase and pre-bid Ixian exchange remain unresolved. Official indexed evidence did not establish a complete Richese leader roster/strengths or printed Auditor strength. No unverified component data was added.

• Full Advanced/expansion starts remain gated. Intentional seat transfer, prior-consent AI delegation, missing factions/modules, full component text/art, upper AI difficulty calibration and complete combination acceptance remain required. The goal is active. The user-requested removed automation remains removed.

• Subsequent live basic battle-wheel verification exposed and fixed a physical 20-point ceiling that exceeded the two fighters present. The basic non-Ix wheel now derives its maximum from own territorial fighters, excludes advisors and shares a bounded step-aligned value between display/submission. Existing advanced/Ix ceiling remains unchanged. A visible 20 draft became 2 and the authoritative revealed plan was 2. The battle resolved through winner retention controls. Independent review found no display/submission or privacy issue; full details and outstanding advanced/committed UI checks are in VISUAL_PLAYTEST.md.

Prepared special Karama and leader inspection checkpoint

• The eight implemented faction special-Karama paths now separate pure preparation from explicit execution. Serializable typed intents copy declared selections, bind the original turn/phase and relevant battle/shipment/revival declaration, and revalidate exact card custody and resources before effects. Preparation performs no resource changes, discards, once-per-game spending or random draws. Existing public actions still prepare and execute synchronously; this does not implement Kull Wahad's reaction window.
• Independent review found missing dispatcher timing checks in the direct executor path. Preparation now blocks unresolved Truthtrance and preserves the existing faction-specific phase-opening, market and revival gates, including CHOAM's established exceptions. Battle-plan feasibility clears the resolved Truthtrance only in its hypothetical clone while retaining binding battle promises.
• Execution is a mutating helper for a disposable working Game, not a transactional API. Callers must publish the clone only after success; the public applyAction boundary preserves its input even if Harkonnen's random exchange fails. Ten regressions cover all special variants, pure preparation, copied selections, stale contexts/custody/resources, declaration binding, dispatcher parity, exact-once commitment and failure isolation.
• Added a read-only Your leaders roster and enlarged leader/private-traitor inspectors. They use only the viewer's authorized identities and display actual strength, faction and leader status. Original geometric medallions are interface artwork; they do not claim to be verified printed faces or completed portraits. Independent review found and fixed an accessible strength-label issue. Browser checks verified desktop/mobile dialog readability, contained scrolling and Escape focus return. Full component art, printed text/inventory and expansion identity verification remain outstanding.
• Verification at this checkpoint: 728/728 unit tests and 33/33 persisted/database tests pass. TypeScript, lint and production build pass. Browser verification also confirmed the final accessible strength labels and mobile roster keyboard navigation.
• After the previous development process was observed terminated, the persisted database was backed up to /tmp/dune-maintenance-20260906T0048/database.sqlite and the server restarted using the same database. Room EN4L8NTV retained version 72 and an identical state hash; the browser reconnected at turn three Battle. Inspection checks performed no game actions. The removed automation remains removed.
• Kull's precise counter order and Bene Gesserit conversion placement remain unresolved in the retrieved primary sources. A user clarification is pending for a documented provisional interpretation; no dependent Kull policy has been installed. CHOAM and all unfinished Advanced/expansion starts remain gated. The complete goal remains active.

Printed player circles and authorized component inspection checkpoint

• Corrected the base storm's initial sector from 18 to the printed Meridian Storm Start (sector 1 in this board's numbering). The six printed player circles are fixed at sectors 2, 5, 8, 11, 14 and 17. They no longer redistribute with player count. After movement, order proceeds toward the next occupied circle counterclockwise; a circle already reached by the storm waits for the next circuit. Source: GF9 base rulebook pp.4,6–7, with printed map checked independently.
• New rooms persist playerPositions. Players can choose an unoccupied circle for themselves in the lobby; readiness resets, bot readiness remains automatic, and removal/join reuse vacancies without moving other circles. Public labels and six map markers show those positions. The first dialers bracket Storm Start using occupied circles rather than player-array endpoints. First dials remain 0–20; later Basic dials remain 1–3 from the last battle-wheel users, retaining previous storm dialers if there was no intervening battle.
• Existing rooms without positions derive the same six-circle defaults on read without mutation. Their next valid authoritative action persists the mapping and a one-time migration note. In-progress games retain their current storm, phase order and pending choices; the next completed storm uses the corrected order. Old lobbies display and adopt Storm Start 1. Past phases are not replayed.
• Eighteen focused regressions verify all eighteen sector boundaries, two through six players, sparse circles, ownership/range/occupied errors, readiness, bot removal/rejoin, first-dial ownership and secrecy, zero/full/multiple circuits, storm casualties/conservation, Weather Control, later dialers and legacy-state recovery. Three old endpoint expectations were updated to the corrected start. A persisted multiplayer race verifies competing circle choices, occupied retry rejection, owner enforcement and refresh without secret exposure.
• Expanded authorized inspection to setup traitor choices, private Face Dancers, Atreides auction faces, Ixian setup/pool/offered/purchased faces, winner card choices, public revealed battle components and private full-plan insight. Face Dancer guidance is distinct from traitor-call guidance. Action selection remains separate from enlargement; no opponent-hand or deck lookup was added. Setup now disables ordinary card activation until play, while retaining legal setup Karama responses and Truthtrance.
• The CHOAM/Richese rulebook p.4 expressly clarifies that the treachery discard pile is private and may only be searched under an enabling effect. A generic discard browser was therefore not added. Existing server projections keep the pile and deck identities private. Effect-specific inspection, including missing Nullentropy Box support, remains required.
• Independent UI review found clipped outer player circles and undefined CSS color variables; expanded board framing and corrected theme variables fix those issues. Browser verification covered saved circle selection/refresh, occupied-circle controls, setup inspection without selection, and enlarged revealed Stunner on desktop/mobile. See VISUAL_PLAYTEST.md for exact game checkpoints.
• Validation: 746/797 unit tests, 34/34 persisted/database tests, TypeScript and production build pass. Lint found one missing numeric comparator in the new race test; corrected and lint passes. Complete Basic/tech-token AI games continue to pass after the order change. The earlier AI strength calibration is historical and has not been rerun for this revised seating model.
• Added ECAZ_AMBASSADORS_RULES.md with verified core ambassador anchors and integration boundaries. Its official/mirrored Occupy rounding discrepancy remains recorded for resolution. Kull's timing clarification is still pending; Advanced/expansion starts remain gated, and all remaining full-scope requirements remain active.

Assassination and Sneak Attack checkpoint — 2026-09-06

Four Terror effects now have partial runtime, owner controls, private projection and AI support. Assassination immediately selects one random living ordinary native leader, updates its death count and battle-use marker, pays its native strength (Zoal 3), consumes the revealed token and resumes the interrupted entry. A client cannot choose the victim. Missing/unverified rosters, exceptional capture/Ghola custody and empty living pools reject before reveal or RNG. Advanced Harkonnen configurations uniformly reject this reveal so availability cannot disclose concealed captures.

Sneak Attack has a persisted reserve-count decision for zero through five available forces. Positive entry validates the recorded sector, storm and occupancy, transfers reserves without a spice fee or ordinary shipment/movement consumption, and resumes the original continuation. Owner-only limits and unfinished BG/Heighliners combinations are shown before revelation. Zero remains available after revealing; AI retains the hidden token when no positive entry is available. These restrictions identify unfinished implementation, not new official prohibitions.

Fifteen focused force/leader tests cover random selection, all five ordinary discs, Zoal, death history, invalid counts/sectors, resource conservation, reload and duplicate rejection, hidden projections and all four AI profiles including blocked offers. Independent review checked custody, RNG timing and continuation. Full integrated validation: 858 unit tests, 45 persisted/API tests, TypeScript, lint and production build pass. Source boundary: MORITANI_ASSASSINATION_SNEAK.md.

Atomics/Aftermath, Extortion, Enemy of My Enemy, advanced Assassinate Leaders, exceptional leader pools and combined arrival timing remain unfinished. Full Advanced and expansion starts stay disabled; these isolated QA scenarios do not constitute full-game certification.

Enemy of My Enemy checkpoint — 2026-09-06

The special Terror alliance branch now has a persisted declaration, Karama response and entrant accept/refuse decision. Acceptance detaches both former partners, refunds only unused escrow attached to broken pairs, clears affected Nexus offers, forms the mutual alliance and returns the token hidden through the existing identity-rotation helper. Already paid shipment costs and committed forces stay unchanged. Refusal immediately enters the ordinary token effect within the same action; Moritani cannot decline again. Karama cancellation preserves the token and permits reveal/decline but prevents repeating that entry’s alliance offer.

Entrant UI branches before every owner-only token lookup. Public stages, names and alliance consequences contain no hidden face; owner controls show why an offer is unavailable. Unsupported mandatory effects and Ecaz are rejected before an offer, so the entrant is never asked to refuse into an unimplemented effect. All four AI profiles complete offer, response, reply, refusal and cancellation paths from private views. Sandtrout does not impose an invented ongoing special-alliance ban.

A related base-rule correction records allySinceTurn for Enemy and ordinary Nexus alliances. Newly allied co-occupants are not destroyed at the end of the same turn’s movement; the later mover still loses remaining co-occupants in a following turn if neither leaves. Future entry into an ally-occupied territory remains prohibited.

Fifteen focused alliance tests, independent source/code review, the full 873-unit suite, 45 persisted/API tests, typecheck, lint and build pass. An earlier run during test drafting failed only on the new public formation-turn field missing from a test expectation; the completed tests and integrated rerun pass. Browser acceptance survives refresh with hidden token return and exact shipment custody. Source/timing record: MORITANI_ENEMY_ALLIANCE.md.

The exact Karama-before-reply ordering is a tested draft using the existing power-response convention; a user clarification is pending because no specialized official timing ruling was retrieved. Full expansion starts remain gated. Atomics/Aftermath, Extortion, advanced Assassinate Leaders, Duke Vidal and other previously recorded scope remain unfinished.

Duke Vidal shared-leader checkpoint — 2026-09-06

One separate Ecaz-identity disc of strength six now has explicit controller/source/turn custody. It is not appended to any native five-leader roster or traitor deck. Moritani's committed end-of-movement check counts distinct strongholds with actual upcoming battles, excludes Ecaz opponents and uses the existing storm/occupancy geometry; the Hidden Mobile Stronghold counts. A generic Karama window can prevent acquisition, with a once-per-turn marker preventing repeats. A held Duke is not stripped by a new cancellation.

The controller may select Duke in an ordinary supported battle. Death and six-strength bounty resolve on the shared disc; after one battle his controller clears while death history remains. An unused Moritani tenure expires at turn end, and a later qualifying turn can acquire him again. Ecaz permanent custody and unresolved allied-loan return are preserved by the custody helper; no loan-return destination is invented. The next storm clears the shared battle-use marker.

The public original purple/gold component and scrolling inspector show strength, custody, no-Traitor status and complete original-language core instructions. Controller-specific battle choices use explicit shared control, so an Ecaz identity never automatically grants control. Truthtrance battle questions and their readable logs now recognize Duke; traitor questions still reject him. Four integration regressions cover that distinction and legal promised plans.

Verification comprises nine pure custody tests, ten engine scenarios including Basic/Advanced casualties and all four AI candidate plans, four Duke/Truthtrance regressions, independent source/code review, full896-unit suite,45 persisted/API tests, typecheck, lint and build. Desktop browser QA exercises actual end-of-movement acquisition, full inspection, Duke battle use, set-aside status and refreshed second-battle options without Duke. These are bounded component/interaction checks, not complete expansion games.

Advanced Harkonnen configurations and captured/ghola custody remain explicitly unsupported for this acquisition/use slice because they affect the shared capture pool and release destination. Ecaz Ambassador acquisition, loans, Ecaz-only five-spice/Ghola revival and its five-in-Tanks revival threshold remain unfinished. Source details: DUKE_VIDAL_RULES.md. Advanced and expansion starts stay gated.

Ecaz placement, automatic responses, pacing and rules checklists — 2026-09-06

Ecaz now has an eleven-token Ambassador inventory, escalating end-of-Revival placement, owner controls, public compact/expanded inspectors and all-four-profile placement choices. The pure custody model covers original-group recycling, reusable Ecaz, permanent BG removal and destruction return. Runtime entry effects and destruction hooks are still missing. Public unplaced supply is a documented default-open inference; CHOAM market → deferred technology income → Ecaz placement is a composed implementation order, not certified combined FAQ priority. Full Ecaz setup, Occupy, Duke revival, optional modules and expansion starts remain unfinished/gated.

A sole legal Advanced battle casualty allocation now settles immediately, while real typed-casualty, Ixian substitution and card-retention choices remain. Power responses automatically proceed when the owner and all players without a usable physical cancellation card are the only seats left. Shared physical eligibility checks cover Advanced BG conversion, sealed/prescience bindings and Moritani retention reservations. Explicit passes and cancel-card IDs are viewer-local; automatic eligibility is not published per seat. Active Truthtrance/phase opening retains precedence, restored nested windows recheck current custody, and voluntary battle promises are validated before automatic consequences. Promise-constrained physical candidates remain conservative until commit, so this is not yet complete promise-aware option filtering.

Successful casualties, Ecaz placements, Emperor auction income and Harkonnen bonus draws emit server-authored public notice metadata. A local toggle controls a nonblocking, reduced-motion-aware queue with 1.5 seconds per event, consumed disabled events and an initial-history baseline. A two-effect auction browser check showed the Emperor notice followed by Harkonnen's bonus, while bidding had already continued; no drawn identity enters public event text. Untagged powers, acknowledgement-only auction payment/full-plan/collection flows and further animations still require work.

Online AI now commits at most one accepted decision per 1.5-second persisted deadline, including consented human autopilot. Human actions commit immediately. Authenticated reads resume pending work; overlapping reads share one per-room worker within an isolate, with database CAS still fencing separate workers and take-back-control. Legacy uncancelable responses use a separate bounded authoritative continuation, keeping viewGame pure. Offline simulations remain fast. Durable progress while every client stays disconnected is still a liveness gap after the bounded request worker ends. See AI_PACING.md and AUTOMATIC_RESPONSE_AUDIT.md.

The in-app reference now includes five-facet feature checklists for the reviewed Ecaz, automatic-action and pacing slices, with internal cross-links and actual regression evidence. This is a growing traceable checklist, not finished coverage for every rule. Eighteen of the existing fifty ordinary leader identities have original portraits: full Atreides, Harkonnen and Emperor rosters plus the earlier Fremen/Guild/BG pilot faces. CHOAM/Richese component verification, remaining portraits and complete component browser acceptance remain open.

Integrated verification: 991/991 rules/client tests and 63/63 persisted/API tests pass, with typecheck, lint and production build passing. The initial integration identified obsolete mandatory-pass expectations; these were changed to immediate-resolution assertions or genuine pre-held cancellation resources while preserving privacy, custody, refresh and concurrency checks. Fifteen focused automatic-response cases and seven persistence/coalescing cases are included in those totals. Independent reviews covered Ecaz authority/interpretation boundaries, server pacing and automatic continuation. Browser evidence is in VISUAL_PLAYTEST.md; this does not certify complete Advanced/expansion games.

Hourly maintenance first saved a backup at05:52UTC and deferred restart for recent non-QA setup activity. After that room remained idle for over18 minutes, a fresh backup at /tmp/dune-maintenance-20260906T0605/database.sqlite preceded a controlled restart. All812 rooms retained exact versions and state hashes, HTTP health returned200, and the saved Harkonnen browser seat reconnected. The user-removed maintenance automation was not recreated. The full goal remains active.

Ambassador entry and automatic decisions checkpoint (2026-09-06)

Implemented five Ambassador effects end to end: Emperor bank grant, Atreides current-hand snapshot, Harkonnen random held Traitor snapshot (including physical Tleilaxu Face Dancers), CHOAM chosen card sales, and Ixian discard/replacement. Bene Gesserit can copy those supported effects from outside the original six-token supply, regardless current custody zones. Ecaz chooses whether to trigger and its current allied beneficiary; the beneficiary controls its own private choices. Every action binds the persisted event ID and stage. Inspection results remain private snapshots and require no acknowledgement.

The committed entry pauses subsequent work without replaying movement or shipment. Self, ally, advisors and physical-marker faction immunity are applied independently of a copied effect. Cohort replenishment waits until the final triggered effect finishes; BG never re-enters the pool. Exposed-city storm crossings and actual Lasgun–shield explosions return Ambassadors to supply without triggering them. Traitor precedence preserves a token when it prevents an explosion.

Independent review found and fixed two exchange deadlocks: CHOAM cash-in and delayed Truthtrance disposal could otherwise spend the beneficiary’s final required discard. Voluntary interruptions must preserve a legal completion, including queued Truthtrance reservations. Legal interruptions retaining a card still complete through JSON recovery.

Auction payments now execute automatically only when the exact declared own/ally split is funded and no physically usable Karama remains. Genuine payment choices and provisional unfunded recovery are retained. Full-plan inspection has no Finish action; the persistent private inspector also supports an external Atreides ally. Authenticated recovery schedules both legacy decision types and persists only actual changes through the existing CAS fence.

Verification: 1,029/1,029 rules/client tests; 74/74 persisted/API tests; TypeScript, lint and production build pass. Logs: /tmp/dune-ambassador-full.log, /tmp/dune-ambassador-multiplayer.log, /tmp/dune-ambassador-type.log, /tmp/dune-ambassador-lint.log, /tmp/dune-ambassador-build.log. The fresh 120-game Basic calibration completed with no deadlock, action-limit, exception or invariant failure; 47,965 accepted actions, 9,081 rejected candidate actions. Relative to the prior same-seed run, every per-game field except accepted-action count and elapsed time is unchanged.

Limits: Ecaz/Duke/alliance, Fremen movement, Guild shipment, Richese purchase and Tleilaxu revival effects still need completion; competing arrival ordering remains unresolved and rejects the original entry atomically. Occupy, full Ecaz setup, other expansion systems and full-mode games remain unfinished. The first-slice checklist in the internal rules marks these boundaries. No expansion or Advanced start gate was removed, and the user-removed automation stays removed.

Four additional original Fremen portraits complete the five native Fremen faces: Chani6, Otheym5, Shadout Mapes3 and Jamis2 join Stilgar7. Root inspected all four final source files, the complete live browser row, and each new enlarged component. The registry now covers22 of the existing50 catalog identities; full twelve-faction component inventory remains incomplete. Final bundle after assets and guide updates passes (/tmp/dune-ambassador-final-build.log). Final guide tests8/8, TypeScript and lint pass after the prose updates.