Dune/docs/IMPLEMENTATION_STATUS.md

Dune implementation status

21 September 2026 — public battle component display

Revealed plans now share one table area with exact dials, played leader portraits and readable card faces. Direct inspection and navigation preserve pending decisions; both players retain access when a post-reveal choice belongs to one seat. Sealed plans and unused hands stay out of this display. Battle components records scope and evidence; focused tests and independent review accompany private check/build, browser, preservation and Git results. No game rule, saved field or AI strategy changed.

21 September 2026 — Advanced Ecaz Loyalty

Genuine Advanced Ecaz setup now randomly sets one native Traitor Card aside face up before dealing. A persisted public identity, enlarged inspector and automatic notice connect to initial setup, Tleilaxu Face Dancers and Nexus replacements. Physical census and invalid-state checks preserve its separate custody; older already-dealt games stay unchanged. Ecaz Loyalty records official sources, sequencing interpretation, focused tests and combined-module limits. Independent review accompanies private check/build/HTTP, genuine faction samples, browser and saved-preservation evidence. AI strategy and release gates remain unchanged.

21 September 2026 — public faction-sheet inspection

Every table player now has a public faction inspector and the internal guide contains a twelve-faction gallery. Basic/Advanced preview uses shared reference text without changing the game or reading private state. Richese, Ecaz and Moritani receive shared guidance from settled contracts; stale CHOAM and Ecaz availability summaries are corrected. Faction sheets records scope, source boundaries and remaining text/interaction acceptance. Focused checks and independent review accompany private browser, check/build, preservation and Git evidence. No AI strategy or release gate changed.

21 September 2026 — private-hand browsing

The private hand now supports literal name search, printed-category filtering and stable display sorting. Physical card IDs, existing inspectors/actions and saved order remain intact; required choices stay outside the filtered row. Hand browsing documents empty results, reset, live changes and local-only filter lifetime. A stale Harass allocation availability sentence is corrected. Focused tests and independent review accompany the private final browser, check/build, preservation and Git evidence. No AI strategy or gate changed.

21 September 2026 — live Treachery and Spice draw counts

The table now shows both physical draw-pile counts above the board. The public projection excludes auction pools, hands, caches and discards, while keeping private card identities and order concealed. Draw-pile counts connect existing saved responses, empty/refill guidance and internal inspection help. Setup, actual draws/refills, skipped worms, Thumper exclusion, privacy and JSON/rendering checks accompany independent review and private final evidence. No schema, game action, AI strategy or mode/publication gate changed.

21 September 2026 — public force counter inspection

Every player now has Inspect forces, with enlarged diagrams, special subsets, advisor faces, board locations and native/foreign Homeworld accounting. The reference includes all twelve factions. Force inspection excludes concealed No-Field values and temporary strength bonuses from physical counts. Focused projections, rendering, genuine setup and JSON recovery accompany independent review and private browser/preservation/Git evidence. No game action, AI strategy, schema, mode or publication gate changed; the full goal is unfinished.

21 September 2026 — live Nexus offer withdrawal

An unallied sender can now see the recipient of its outgoing Nexus offer and withdraw it through the existing action. Public history distinguishes proposals, withdrawals and alliance breaks. Nexus offer controls retain the current quote, timing, readiness, card forfeiture and version fences. Focused full-table rendering, JSON continuation, legal AI participation and production SQLite race checks accompany the private source-bound browser, preservation, independent review and Git record. No strategy, mode or publication gate changes; the broader game remains unfinished.

21 September 2026 — ordinary bribe controls

Players can now initiate the existing out-of-turn bribe action, with server-derived recipient limits, private incoming escrow and public payment history. Limits preserve reserved funds and binding Truthtrance completions; existing Bureaucrat redirection and saved version handling remain authoritative. See bribe controls. Focused rules/projection/rendering and HTTP concurrency checks accompany independent review and private source-bound browser, preservation and Git evidence. Strategic AI negotiation remains deferred. The separately reviewed Emperor gift/Bureaucrat interaction remains pending; this work does not open mode or publication gates.

21 September 2026 — durable table discussion prototype

Public table conversation and direct human-seat messages now have usable controls, plain-text rendering, durable history and exact retries. Message SQL independently fences current credentials and membership, filters private channels before paging, and leaves game JSON/version, sealed choices and bot continuation unchanged. Recovery/handover transfers access to the seat's history; old credentials stop working. Independent review found and fixed committed-write/rotation and late unmounted-response retry races, with regressions. See table discussion for the complete boundary. Final source-bound checks, browser observations, preservation and delivery records belong to the private checkpoint. AI messaging, prose-contract enforcement and full acceptance remain open; no mode gate changes.

21 September 2026 — Storm and Spice Blow practice

The interactive introduction now has thirteen lessons and eleven independent Basic examples. Storm separates sealed dials, reveal and movement, using both first-turn and later-turn ranges. Spice Blow compares accumulation, storm loss, later Shai-Hulud and first-turn worm return, with Nexus beginning after the replacement blow. Shared live calculations keep exposure and placement consistent; no rules or save-schema change. Version 6 preserves all prior lesson identities and results. Focused engine comparisons, independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Full faction, worm-ride and expansion teaching and complete game acceptance remain open.

21 September 2026 — Kwisatz Haderach component inspection

The companion inspector connects original artwork, private battle-loss tracking and availability guidance, permitted full-plan and public revealed-plan components, and static reference inspection. Existing server projection remains the privacy boundary; no rules calculation, save migration or AI tuning changes. Focused rendering/projection/JSON tests supplement the existing battle/death/revival checks. Independent review and source-bound check/build/browser/preservation/Git evidence belong to the private checkpoint. Manufactured-layout verification and full Advanced acceptance remain open.

21 September 2026 — Storm Card inspection

The Storm Card inspector connects six numeric reference faces, the existing private Fremen forecast and actual public reveal receipts in the chronicle. Inspection is read-only. Saved public records retain their original face after movement or Weather Control, separately from effective storm distance. Earlier text-only history remains valid; unknown component metadata fails closed. No AI strategy or rules mode changes. Focused projection/provenance checks, independent review, browser controls and final check/build/HTTP/preservation/Git evidence belong to the private checkpoint. Complete physical face/artwork and broader component acceptance remain unfinished.

21 September 2026 — Charity and Revival practice

The introduction expands to eleven lessons and nine Basic examples. Charity teaches the top-up to two spice; Revival teaches shared free allowances, paid force returns, the ordinary cap, leader eligibility and separate leader/force limits. Existing production calculations supply the costs and choices; a legal saved action history preserves cumulative spending and custody. All previous lesson identities and outcomes migrate to version 5. No live AI strategy or rules mode changes. Focused engine comparisons, independent review, browser controls and source-bound checks/preservation/Git evidence belong to the private checkpoint. Duke revival/loans retain their existing unresolved custody boundaries; the full curriculum and game remain unfinished.

21 September 2026 — Interactive Nexus alliance practice

The introduction now connects nine lessons and seven Basic examples. A four-player Nexus teaches mutual consent, unanswered offers, withdrawal and unilateral alliance breaks. An explicit later Mentat check contrasts three shared strongholds with the ordinary four-stronghold joint victory. Shared production pairing, progress and victory quotes preserve physical force ownership. The live engine retains phase/expansion checks and card forfeiture. Version 4 practice saves preserve all prior lesson identities and committed choices. Focused engine comparisons, migration and rejection checks accompany independent review and final source-bound browser/check/build/preservation/Git evidence in the private checkpoint. Broader teaching and all mode/publication gates remain open work.

20 September 2026 — Interactive ordinary bidding practice

The introduction now connects eight lessons and six Basic examples. The new Fremen bidding position teaches raising, passing and re-entry, full hands, all-pass termination, winner-only payment and private card inspection. Shared ordinary-auction quotes also serve the live engine without changing its funding, payment or reaction layers. Version 3 practice saves migrate every prior lesson by identity and validate exact bid history through replay. Focused engine comparisons and independent review are paired with final browser, source-bound checks, preservation and Git evidence in the private checkpoint. Broader teaching, rules and mode/publication gates remain unfinished.

20 September 2026 — Configure existing lobby AI seats

Lobby AI configuration connects host-only difficulty, faction and player-circle controls to a shared strict quote and authoritative lobby action. Seat identity persists, faction rosters follow existing setup, actual changes clear human readiness, and public history explains each change. Focused engine, SQLite/restart/concurrent-start and HTTP tests cover the bounded contract. Final independent review, browser, source-bound check/build/HTTP and saved-game preservation evidence belong to the private checkpoint and Git message. Existing AI strategies and mode/publication gates remain unchanged.

20 September 2026 — One-use named-player AI permission

The AI permission prototype connects optional owner consent to a named human and fixed difficulty for one activation within 24 hours. It retains ownership and private information, uses both exact session fences, atomic versioned activation/consumption, owner takeback invalidation and saved exact retries. Additive migration 0006 preserves existing rooms and seats. Independent review, focused SQLite/client/HTTP checks, browser acceptance and final source-bound check/build/HTTP/preservation evidence belong to the private checkpoint and Git message. No AI strategy or mode/publication gate changes.

The Sites platform audit found no supported durable trigger or alarm binding. Unattended resumption remains a platform blocker; no inert scheduler was added or claimed complete.

20 September 2026 — Movement and Traitor introduction exercises

The introduction now connects seven lessons and five Basic practice positions. Movement uses shared geometry/occupancy; Traitor call, decline and mutual betrayal use the production battle quote. Version 2 browser saves explicitly migrate every old lesson and preserve its previous choices. A hot-update state mismatch found in the browser is corrected by remounting the lesson component on schema change. Focused comparisons exercise 96 actual engine moves and all offered Traitor outcomes. Independent review and final browser/check/build, preservation and Git evidence belong to the private source-bound checkpoint. Full curriculum remains unfinished; mode/publication gates stay closed.

20 September 2026 — Sandmaster worm-ride prototype

Native Fremen worm rides collect one optional destination spice after legal placement and before faction arrival reactions. Shared server, control and minimal AI paths preserve source exclusion, typed force custody and normal movement. Existing atomic room writes and saved arrival decisions prevent repeated payment after concurrent requests or restoration. Empty/ambiguous piles, unsupported combinations and legacy actions preserve ordinary riding. Ten focused engine/control/SQLite checks and independent review cover the bounded contract; final check/build/HTTP, browser/sample and preservation results belong to the source-bound private checkpoint and Git message. No release gate is opened.

20 September 2026 — Smuggler battle collection prototype

Unmodified Smuggler collection binds the reveal-time pile and pays once after leader survival, including losing or captured leaders. Shared server/control/bot admission preserves the pending modifier and combined-module boundaries; deferred settlement before Sandmaster remains an explicit timing inference. Native face-up skilled discs are excluded from AI selection. New receipts preserve private saved continuation and old unversioned battles retain their prior behavior. Independent review and focused engine/SQLite evidence are paired with source-bound final checks, browser/samples, preservation and verified Git delivery in the private checkpoint and commit message. No gate is opened.

After the reported outage the server responded and all 1,106 baseline games matched their saved rows. The prior private QA seat restored after refresh. No restart, reset or maintenance automation was needed.

20 September 2026 — Interactive introduction prototype

Five guided lessons connect shipping budgets, sealed battle plans and spice collection to shared production rule quotes, with keyboard controls, card inspection and browser-local saved progress. The fixed opponent is a teaching example, not an AI match. The wider faction, movement, bidding, Advanced and expansion curriculum remains unfinished. Focused checks cover combat outcomes and saved-choice validation; final browser/check/build, preservation and Git evidence belong to the private source-bound report and commit message. No mode or publication gate is opened.

Independent Smuggler review supports the deferred survival receipt but found no official modifier-strength ruling. That single new question remains explicit in the decision register; no pending answer was inferred to enable collection.

20 September 2026 — Sapho early battle aggressor

Early aggressor connects the held physical card, existing pre-plan opportunity, shared tie priority, controls, four AI profiles and private saved continuation. It preserves participant slots and chooser, respects Habbanya in either slot, and checks Stone finishability before commitments. Later battle intervention and its unresolved allocation/response protocol remain unfinished. Independent review found no material rules/privacy blocker after final integration. Focused engine/control/SQLite evidence is paired with final source-bound checks, browser/sample reports, preservation and verified Git delivery in the private checkpoint report and commit message. Public mode and publication gates stay closed.

The Mirror admission audit supersedes its earlier ordinary-slice recommendation: every genuine CHOAM/Richese setup includes the unresolved copy candidates. A synthetic restricted deck, hidden eligibility gate or reveal-time rejection cannot establish playable full-game support. Existing user/source rulings remain pending.

20 September 2026 — Optional table sound prototype

Table sound controls add local mute, keyboard volume and a test sample, with short synthesized cues for public phase changes and tagged automatic actions. Silent baseline consumption, coalescing and background suppression avoid replaying old updates. Preferences survive refresh and synchronize between tabs; game actions, AI timing and saved state are unchanged. Focused audio/cursor checks and browser controls cover the connected prototype. Physical output, screenshot acceptance and final event coverage remain unfinished. Required check/build, preservation and verified Git delivery belong to the source-bound private report and commit message. No mode or publication gate is opened.

The reported outage left all 1,072 baseline games unchanged. The responding server was reused and the existing isolated seat reconnected without a database reset.

14 September 2026 — Harass revealed physical allocation

Connected ordinary/elite and multi-sector choices after public plan reveal, before Traitor declarations. Unique returns remain automatic; selected counters are public but stay on board until atomic Traitor settlement. The shared quote, player controls, four AI profiles and versioned saved decision preserve exact custody and existing mode gates. Winner casualties cannot choose a smaller physical commitment after its undialed complement has returned. See the allocation contract for source timing and limits; source-bound final evidence and delivery remain in the private report/Git message.

14 September — AI ordinary arrival preflight

AI arrival checks filter known unsupported ordinary shipment/movement candidates with the existing authoritative reaction quote. All four profiles retain executable alternatives, single reactions, faction exemptions and correctly routed Guild contributions. The public-input adapter never reads concealed Terror faces or rival private resources. Special routes remain on their existing adapters; no simultaneous reaction rule is invented. Source-bound same-seed samples, focused regressions, required checks, saved-game preservation and delivery are recorded in the private report and Git message.

14 September — reusable base player-count samples

The faction sample runner now also selects genuine base Basic/Advanced games at every player count from two through six. Original expansion defaults and seed offsets remain stable. A shared inventory check includes unsold auctions, nonnegative force/spice values, exact elite totals and subsets, and post-setup base Traitor custody. Rejected-action immutability and restored private rival boundaries are checked. Failed traces and snapshots remain replayable through explicit resume. This consolidates the repeated private harness corrections; it does not certify complete player-count rules or open any mode gate.

The Moritani Secret Ally source audit also records why a holder-only retention pause would leak its hidden Nexus. The existing shared UX question remains pending; no duplicate question or new timing policy was introduced. Focused and full-run results, source identity and delivery are recorded in the private checkpoint report and Git message.

14 September 2026 — Compound shipment promises

Shipment-only AND/OR extends the existing Truthtrance shipment question with whole-expression truth, complete destination search, controls and private AI answers. Earlier separate promises remain jointly binding, and legacy flat records retain their meaning. The existing timing/module gates and unresolved material questions stay in place. Source-bound final checks, browser continuation, private preservation and verified Git delivery are recorded in the checkpoint report and commit message. The opening baseline is 1,004 rooms.

14 September 2026 — Sapho remaining battle-choice order

The Sapho battle-order prototype adds first/last remaining Battle-phase choice through the existing physical card, hand controls, legal AI and saved state. The public chooser is separate from physical attacker/defender; old battle outcomes, storm order and tie rules remain intact. Accepted priority persists through complete aftermath and later changed board eligibility. This separation and phase duration are explicit implementation interpretations.

A fresh Reinforcements cost review found no authoritative resolution of its reserve payment versus a traitor win. The question has been sent to the user; the card remains disabled while independent Sapho work proceeds. Advanced Atreides accounting and same-plan Harass ordering remain separate unresolved combinations.

The checkpoint uses a 970-room preservation baseline, a separate browser lobby, focused rules/controls/AI/SQLite checks and independent review. Final complete-game, browser, broad-check and verified Git results belong to the source-bound private report and commit message. Public mode and publication gates remain unchanged.

14 September 2026 — Harass & Withdraw battle prototype

Harass & Withdraw now connects either physical card slot, category-aware private inspections, unique typed undialed returns before battle losses, successful opponent-Traitor cancellation and mandatory disposal. Both selectors, all four AI profiles and saved continuation use the shared physical quote. Existing Planetologist inspection and literal Truthtrance slot promises remain unchanged. Richese/Stone Burner timing, ambiguous allocations and optional-module combinations remain gated; public starts stay closed.

Focused rules, controls, bot and authenticated recovery evidence is paired with independent review. Final complete-game samples, browser checks, preservation, required broad checks and Git delivery are recorded in the source-bound checkpoint report and commit message. This is a connected prototype, not full rules certification. All 936 opening games and 1,959 seats survived the reported outage unchanged; the healthy server was reused without resetting saved state or recreating automation.

14 September 2026 — Recruits independent-card preview

Recruits is connected in an explicit development preview. Genuine Basic/Advanced faction setup includes all three independent Ecaz Treachery Cards before shuffle and deal. Physical play/discard, public effective rates, shared revival quotes, exact free-use tracking, existing CHOAM/Tleilaxu response continuation, owner controls and all four AI profiles share the authoritative contract. Inactive games retain their earlier free-use arithmetic. The other two battle effects and public variant starts remain unfinished.

Source review supports the bounded clean-case contract. The independent seven-force cap after faction cancellation remains an explicit inference. Earlier-paid returns, late grants, pending repricing and same-turn recovered-card replay remain gated; the user's late-paid question is pending. Focused rules, controls, genuine local setup and authenticated recovery tests accompany the implementation. Complete-game and browser evidence, required broad checks and Git delivery are recorded with the checkpoint; this does not certify complete variant or combined-mode compliance.

All 902 opening rooms and original seat/recovery records survived the latest power failure unchanged. The healthy server was reused; integrity and foreign keys pass. No database reset, server restart or recurring automation was needed.

Final independent review's 37-case union and four SQLite recovery cases pass. Review closed normal-auction sale aliasing, malformed canonical cards, known-zero legacy ledger initialization, seat-control validation and ordinary-start bypasses. Eight genuine six-seat Basic/Advanced samples finish in 7,995 accepted actions, with zero rejected candidates and three Recruits plays. Every action preserves physical card/Traitor/force/elite custody; 212 periodic all-seat JSON restores and terminal views pass. The conserved browser exercise verifies play/discard, global rates, four free returns, explanatory chronicle, private seat and refresh. Earlier harness attempts remain preserved; JSON comparison normalizes undefined properties on both sides without dropping defined values.

14 September 2026 — Fremen/Ecaz final-turn victory and deferred shipment repair

The explicit Sietch Tabr FAQ now reaches automatic victory resolution: reciprocal Ecaz/Fremen allies with fighters there may satisfy the Fremen final-turn condition. The same public quote drives territory/blocker guidance; the chronicle explains a successful special win. Solitary/nonallied Ecaz, unrelated fighters and the unsupported Habbanya extension retain their existing exclusions. Effective advisor and concealed-marker presence, ordinary stronghold/prediction precedence, Guild fallback and existing no-Guild behavior are preserved. This adds no mandatory confirmation or schema.

Independent source/privacy review found no blocker. Seventeen focused cases pass, including Basic/Advanced outcomes, all four AI profiles, JSON/private views and authenticated SQLite restoration before and after final readiness. Concurrent last-ready requests commit once; stale/finished requests do not write. Exact cards, Traitors, forces, elites and seat records are preserved. Final-turn positions are explicitly staged after genuine setup, including the reciprocal alliance and a turn-ten Fremen prediction, rather than claimed as natural full-game outcomes. The broader existing victory regression union passes 83 cases. A fresh browser room verifies the public guide, actual Ready-to-win transition, explanatory log and pending/finished refresh. Private read-only comparison confirms unchanged spice, cards, Traitors, leaders, forces, elites and seat records.

A genuine Advanced sample also exposed the pre-existing Guild shipment deadlock: an accepted declaration could not pass an Ambassador/BG arrival overlap. Prior HEAD replay reproduced all 90 actions. Fresh ordinary/No-Field preflight and narrow, typed saved-declaration recovery now avoid the trap while preserving unresolved reaction-order gates. Independent review resolved an early No-Field window bypass and malformed special-marker handling; its 149-case union passes, including three authenticated SQLite cases.

The exact failed snapshot finishes after 842 further accepted actions, with 109 guarded candidates, on turn ten for Guild. The original Basic/Advanced seeds finish in 563/806 accepted actions with 14/81 guards, on turns seven/nine for Guild/BG. All 58 periodic JSON rounds, twelve terminal private views and physical custody checks pass against unchanged gameplay source. The Advanced runs form Ecaz/Fremen alliances, but neither uses shared Tabr or its special victory. The saved continuation uses a documented new random stream; no failed seed or snapshot was silently replaced. Simultaneous arrival integration remains open.

The latest reported outage preserved all 835 opening games and original seat records. All 869 current rooms are backed up before final verification, and the finished browser seat restores correctly. The healthy server is reused.

Browser and complete-sample evidence, types/lint/offline/build/HTTP results, source fingerprint, saved-game preservation and verified Git push are recorded with this checkpoint. The running server is reused; complete rules coverage, all combinations and publication remain gated.

14 September 2026 — Moritani Assassinate Leaders prototype and outage preservation

Assassinate Leaders connects native Advanced Moritani's qualifying battle loss to private reveal/continue controls, a different opposing-faction Traitor Card, live-target death and bank bounty, and automatic Mentat replacement with a public set-aside marker. Dead targets remain legal with zero bounty. All four AI profiles use the owner's legal choices; one use per faction and physical held/reserve/retired custody persist across saves.

The explicit local preview excludes exceptional captured/foreign leaders and combined modules. A uniform private step prevents hidden eligibility leaks but awaits the user's UX decision. Normal traitor-call duration also remains unresolved; a recorded call guards later use without declaring a publisher ruling. No ordinary start or publication gate opens. The checklist records the bounded prototype.

Independent source/privacy/persistence review and 32 focused cases pass. Separate battle obligations bind cleanup, normal-call logs wait for public revelation, and replacement custody rejects missing cards and forged same-turn consumption chains. Five SQLite cases cover authenticated pending/resolved restoration, Truthtrance interruption, competing writes, stale/duplicate actions and corrupt saved receipts.

Two genuine Advanced four-profile games finish in 296/101 accepted actions, with zero rejected candidates, ten periodic JSON rounds and all eight final seat views restored. Exact physical custody holds. Two opportunities are declined; these samples do not exercise an assassination reveal. A separate conserved, staged browser battle verifies Master Bewt's death, three-spice bounty, retained card, automatic Mentat replacement, public marker, context-correct readable inspection, and pending/resolved refresh. The QA game remains at human Terror placement.

After the reported power failure, all 801 opening games remain unchanged and the healthy server is reused. Final types/lint/offline/build/HTTP results, source fingerprint, preservation of room and seat/recovery records, and Git delivery are recorded in the verified commit and private report. The full goal remains unfinished.

14 September 2026 — Truthtrance recorded knowledge and outage preservation

Truthtrance knowledge connects stored Bene Gesserit prediction faction/turn, a respondent's active submitted storm dial and the card actually known to native Advanced Fremen. Server validation, target-only answer projection, compound controls, all four AI profiles and saved continuation share the same eligible facts. Missing knowledge stays unknown; only the aggregate answer becomes public and a definite answer consumes the physical card once. This does not implement general future commitments or AI question strategy.

Independent source/privacy review and 13 new cases pass; the focused union passes 44, including five authenticated SQLite recovery cases. Review fixed missing comparison controls, parent selector mapping and the invalid-input submission guard. Recovery covers pending questions and interrupted storm peeks, private seat views, dishonest/stale/duplicate requests, competing writes and malformed saved predicates without state or physical-custody corruption.

Two genuine-setup games using all four profiles finish with zero rejections: Basic 192 actions/five periodic JSON rounds; Advanced 518/fourteen. Exact card and force custody holds, including all eight restored final seat views. Three scripted questions use naturally held cards and cover prediction faction, prediction turn and submitted dial. Forecast coverage comes from the separate browser exercise, whose only staged acquisition relocates two physical Truthtrances. That exercise verifies invalid input, unknown/rephrasing, both compound clauses, a forecast comparison and refresh following submission and final resolution.

After the reported power failure, all 767 opening rooms and original seat/recovery records match the backup. Integrity and foreign keys pass; the healthy server is reused. A fresh snapshot protects all 768 rooms before broad checks. Final broad results, source fingerprint, post-HTTP preservation and Git delivery are recorded in the verified commit and private report. Completion/publication gates remain.

14 September 2026 — Emperor Nexus revival prototype and outage recovery

Emperor Secret Ally now connects exactly three additional free force returns in Basic/Advanced base-faction Nexus games. It preserves ordinary force/free allowances, shared Advanced Fedaykin caps and physical card custody, without a public pause or forced pass. Private legal controls, four AI profiles, JSON continuation and production SQLite recovery are connected. Independent review validates phase-wide timing and private receipts; 17 focused effect tests cover illegal/stale/competing requests and later Ghola. The separate purchase alternative remains pending its uniform payment UX question.

Two genuine-start samples finish (Basic 715 actions/19 periodic JSON rounds; Advanced 263/7), with no Emperor use. Two explicitly staged continuations finish in 18 and 17 actions with one normal-force return each. All candidates are legal; exact Treachery, force, elite and Nexus custody holds, and all 14 final seat views restore unchanged. These samples retain their setup and coverage limitations. The separate staged browser game exercises a Fedaykin return, then three ordinary revivals, unchanged spice, readable inspection and refresh recovery. The reusable local prototype writer adds genuine Nexus setup without opening public starts.

All 733 opening games and original seat/recovery records survived the reported power failure unchanged. Integrity/foreign keys pass and the healthy server is reused. A new snapshot protects all 734 rooms before final checks. The verified commit and private report record required broad checks, source fingerprint, post-HTTP preservation and Git delivery. Full module and publication gates remain.

14 September 2026 — Bureaucrat payment prototype and outage preservation

Bureaucrat now connects optional two-spice redirection for ordinary auction, Guild shipment, Richese auction and actual bribe payments in the bounded base/CHOAM Leader Skills profile. Native income cancellation resolves before the offer; the payer is charged once and the original callback resumes once. Decline leaves later opportunities available, and bribe proceeds remain unspendable until Mentat Pause. The physical-card use ledger survives ownership changes. Payment-unit guards, composition inferences and missing families remain explicit; no public mode or publication gate is opened.

Owner controls and all four AI profiles use public payment information. Independent review covers saved receipts, private projection, costs, custody and callback ordering. Review found and fixed duplicate use-event corruption and an overly broad guard on Bank-bound independent Karama shipments. Focused regressions cover those defects, auction/card delivery, real Bene Gesserit advisor continuation, bribe escrow, private SQLite restoration and competing version writes.

Four controlled-shuffle genuine-setup games complete with zero rejected actions: base Basic 718 actions/20 JSON restores, base Advanced 551/15, CHOAM Basic 681/19, and CHOAM Advanced 174/5. Full physical card, force and skill custody is checked. None reaches a Bureaucrat payment decision, so those samples establish bounded regression continuation only. A separate conserved staged browser game allows one five-spice bribe and redirects two from a second: ten is paid, eight stays in bribe escrow, and only one skill use is recorded. Both pending and resolved states restore after refresh with unchanged physical custody and private projections.

After the reported power failure, all 699 opening games and original seat/recovery records matched the private backup. The database passed integrity and foreign-key checks and the server remained healthy. No restart or reset was needed. Final broad results, source fingerprint, Git delivery and post-HTTP preservation totals are recorded in the checkpoint commit and private verification report.

13 September 2026 — Private Mentat question preview and outage recovery

Mentat has a connected private pre-plan question preview: canonical named weapons, a uniform target-owned card-show step, owner/target-only historical observations and subsequent leader concealment before faction powers. The shown card stays in hand and does not bind a plan. The private opt-in is absent from player views and cannot be enabled through actions. Ordinary Leader Skills games remain unchanged pending the user's forced-response UX exception decision; empty hands skip with an explicit unavailable receipt and no fabricated answer.

Independent review and 22 focused tests cover legality, custody, sequencing, private controls, all four AI profiles, JSON/SQLite restoration and stale/competing writes. Two complete genuine-setup samples deliberately deal Mentat through a controlled initial skill shuffle: Basic 100 actions/3 JSON restores, Advanced 507/14, each with one private observation and no rejected candidate. These are bounded preview paths, not complete skill or expansion acceptance. The separate browser QA uses a staged conserved battle and verifies private disclosure, a readable inspector, refresh recovery and the right to conceal after asking.

After another reported power failure, all 665 opening rooms and original seat, recovery and receipt rows matched the backup. A fresh backup captured 666 rooms, including the isolated preview; database integrity and foreign keys passed. The existing server responded at localhost:3000, and its lock prevented a duplicate start. The saved Mentat browser seat restored its hand, resources, observation and pending posture. No reset, recurring automation or publication was introduced. The verified Git checkpoint records final broad results and preservation counts.

13 September 2026 — Deferred movement arrival safety and reusable samples

Deferred movement fixes the combined Advanced sample's accepted CHOAM decline deadlock. The actual conflict was a qualifying Ambassador and Terror at the same destination. Fresh movement checks existing arrival guards before native prevention windows or new Ornithopter commitment. A saved explicit CHOAM decline can return an uncommitted unsupported move for another choice; its existing reserved card remains available and retires once when the replacement use finishes. Unrelated exceptions still reject atomically, and Karama cancellation still validates arrival before spending its cost. No simultaneous-arrival order is invented; that material question remains pending.

Independent review covers rules, custody and private continuation. Focused regressions exercise native Ixian/Fremen declarations, ordinary single-token arrivals, saved legacy choices and Ornithopter escrow. In-memory production-room checks cover authenticated decline, restoration, stale/duplicate ownership and concurrent version races. The final checkpoint records actual broad results.

tools/faction-games.ts replaces repeated private simulation copies with six fixed genuine-setup scenarios, all four profiles, physical custody checks and JSON restoration. It records private traces, failed snapshots, source fingerprints and explicit nonzero failure. Snapshot resume records provenance and starts a new seeded continuation stream. Full-game samples remain evidence of their particular paths; rejection counts and any later guards are retained in the checkpoint. All six fresh samples completed. Combined Advanced finished at turn six with 1,303 actions, 35 JSON restores and 46 guarded arrival candidates. The exact prior failed save separately finished after 691 additional actions, 18 restores and 39 guarded candidates. The detailed feature document records the limitation.

After the reported outage the server was healthy, all 632 opening games and their original seat/recovery records matched the private backup, and existing Ecaz and Ixian QA seats restored their private hands and pending choices in the browser. No restart or reset was needed. Public starts and publication remain gated.

13 September 2026 — Expansion faction setup and saved Ixian auction decline

The faction development profile connects all seven nonempty expansion selections to genuine Basic/Advanced setup and existing faction controls, AI and saved continuation. Ecaz now allocates six starting forces within Imperial Basin, keeping fourteen in reserve; Fremen, Advanced Bene Gesserit and Moritani placement ordering is preserved with its printed and inferred boundaries documented. The optional Ecaz Treachery variant stays separate, ordinary decks contain 33/35/47 cards, and Richese keeps its separate ten-card cache. Public starts remain gated.

Combined play exposed an existing Ixian Technology/Richese special-lot deadlock. A saved explicit per-lot decline now opens the original cache or Black Market lot without using Technology, changing its card custody or revealing a concealed card. Exact event, round, declaration and custody validation protects view, normalization and actions, including Gift/Truthtrance interruptions. Competing uses of the reserved offered card are rejected before creating responses. The actual exchange still needs its recorded replacement-custody interpretation.

Focused setup, controls, legal AI, private JSON/SQLite continuation and concurrent write checks pass, with independent review of rules, custody and persistence. Five of six genuine mixed-profile samples finish. Combined Advanced progresses past three special-lot declines to turn three, then stops on an existing CHOAM movement/Ambassador arrival guard. Guarded arrival candidates also occur in the Ecaz samples. These are explicit remaining integration limits, not full expansion acceptance. The detailed feature document retains exact sample metrics.

The browser verified genuine Ecaz traitor/force setup and refresh, then a separate Advanced development game's saved Ixian decline, unchanged offered card, legal bidding and private hand restoration. After the reported outage, all 597 opening games and original seat/recovery records matched the backup. A stale server module cache required a restart after a fresh 598-room backup; every room matched before QA resumed. Required broad checks, final preservation totals and source fingerprint are recorded in the checkpoint commit and private report. No database reset, recurring automation or publication was performed.

13 September 2026 — Diplomat base-defense copying prototype

Diplomat now optionally counts one committed Worthless as an opposing base Shield or Snooper, including to save its native trained leader. The owner chooses after public plan reveal and before traitor decisions. Exact physical plans and cards stay in place; the selected Worthless is discarded after battle even on a win. This timing and explicit-discard precedence over ordinary traitor retention are recorded implementation inferences, not additional printed rulings. Lower retreat and modified/combined defenses remain unfinished.

Player controls, all four legal AI paths, public projection and saved decisions are connected. Independent review and focused SQLite restart, concurrent copy or decline, corruption rejection, self-protection and traitor-preempted discard checks cover this boundary. Two genuine four-profile samples completed without rejected candidates: Basic used 210 actions and six JSON restores; Advanced used 223 actions and seven restores. Neither encountered an eligible Diplomat offer; targeted battle checks establish the effect. A fresh browser scenario restored the pending copy, saved native Hasimir from poison, discarded Baliset exactly once, kept Crysknife and restored the private hand/traitor plus four board forces, fifteen reserves, one Tank and eight spice. Required broad results are recorded in the checkpoint commit and private report.

After the new outage report the server responded normally, database integrity and foreign keys passed, and all 563 opening rooms plus their original seat/recovery records matched the backup. No restart, reset or automation was required. Public mode and publication gates stay closed.

13 September 2026 — Smuggler with owned Richese No-Field

The officially permitted combination now ships one separate free physical force alongside a concealed marker at its unchanged price. The private panel, shared AI quote, both cancellation/interception stages and saved continuation are connected. Revealing zero/three/five tokens preserves all physical forces; bots can reveal a zero marker accompanied by a real force before movement. Genuine CHOAM & Richese Leader Skills setup uses the sourced two-card deck addition or replacement without duplicate Ix cards. Public starts remain gated.

After the outage report, the healthy existing server was reused. All 529 opening games and their seat/recovery records matched the private backup. Focused tests, independent recovery review, browser evidence, required broad checks and final preservation/Git results are recorded in the checkpoint commit and private report. Allied No-Field and remaining combined modes are unfinished.

The first broad check exposed two deck/gate expectations and a randomized recovery test incorrectly asking an unautomated human seat for an AI action. The deck assertions now match the sourced inventory while other audit starts retain their gate. The recovery test now submits an explicit legal human choice. The failed report is retained separately from final verification.

13 September 2026 — Sandmaster movement collection prototype

Sandmaster now collects optional spice from distinct territories entered along explicit legal ground routes. Shared human/AI choices retain each source sector, path and selected pile. A Fremen movement response preserves the original declaration; cancellation collects nothing and successful completion transfers each board spice once before arrival reactions. Internal saved proofs remain outside player projections.

Independent rules and persistence review, focused legality/custody/privacy tests and SQLite continuation cover this boundary. Broad checks, browser and sample-game evidence and saved-game preservation are recorded in the checkpoint commit. Special relocation, combined modules and multiple-pile collection remain missing; no public mode or publication gate is opened.

13 September 2026 — Spice Banker battle commitment prototype

Spice Banker connects one through three sealed own spice to a selected skilled leader's surviving battle strength. Funds remain separate from force support and unavailable for other spending. A sole successful traitor caller keeps the commitment; other outcomes pay the Bank even on leader death, while death removes the bonus. Printed disc values and bounties stay fixed.

Owner/full-plan inspection and public reveal display the amount at their proper times; all four AI profiles submit funded choices. Independent source and persistence review, private SQLite restart, rejected diversion, concurrent final resolution and legacy omitted-field continuation cover this boundary. Two seeded Basic/Advanced samples finished without rejected candidates but did not use Banker spending; targeted tests establish the effect. The browser checked a three-spice commitment, pending refresh, actual +3 strength and payment, then restored one board force, fifteen reserves, four Tanks, two spice and the same private cards. Broad results and final preservation are in the checkpoint commit.

Normal income remains pending a user ruling about already-earned public spice when the trainer dies or is captured before Mentat Pause. Combined modules and complete skill acceptance remain unfinished; no mode/publication gate is opened.

13 September 2026 — Smuggler reserve shipment prototype

Smuggler shipping connects one optional free accompanying force for an empty-territory off-planet shipment. The shared quote preserves actual reserve/elite custody, Guild rounding and real recipient payments. UI controls and all four AI profiles explicitly choose the bonus; declining and legacy unstamped declarations preserve ordinary pricing.

Independent review found saved quotes could lose their required Guild decision. Read/action integrity now binds the declaration to its unique current or saved interception, rejecting missing/mismatched decisions or removed discounts. The first broad run also exposed a random Discovery fixture that searched only the undealt deck for Karama. It now relocates an existing card from its actual zone and asserts the complete physical card inventory is unchanged. SQLite restart, concurrent allowance, stale replay and old quote recovery pass. The browser exercised the price toggle, three physical arrivals for two spice and refresh with the same private hand. Two Basic/Advanced samples finished without rejected candidates but did not use Smuggler; targeted checks cover it.

The latest outage left the existing server healthy. All 427 opening rooms were unchanged and a new backup captured 428 rooms. No restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. The lower battle effect and combined routes remain missing; no rules-mode or publication gate is opened.

13 September 2026 — Leader battle effects prototype

Battle effects connects lower Mentat +2 strength, Bureaucrat occupation penalties and automatic Sandmaster board spice, plus both Rihani private inspection and committed optional exchange. Shared quotes, owner controls, all four AI profiles and saved continuation form usable prototypes. Three normal bands and Spice Banker, Diplomat and Smuggler remain missing.

Independent review found a completed Rihani receipt was not bound to current custody during battle cleanup. Decline/exchange now preserve and validate exact deck order; regressions cover corruption, replay and SQLite concurrent writes. A fresh genuine browser setup followed by a conserved staged battle exercised private inspection, separate draw, pending refresh, public return and completion. Two Basic/Advanced samples finished with no rejected candidates but did not trigger Rihani; they do not certify its integrated full-game behavior.

The server remained healthy after the outage report. An online backup preserved 393 opening rooms; no restart or reset was needed. Broad results and final preservation are in the checkpoint commit and private source-bound report. No rules-mode or publication gate is opened.

13 September 2026 — Suk Graduate casualty rescue prototype

Suk Graduate connects both printed bands through shared physical casualty quotes, owner controls, all four bot profiles and durable battle continuation. A face-up trainer returns exactly one casualty to reserves; a surviving selected leader may save up to three, keeping one in its original sector and returning the others. Raw casualty choice and paid support remain unchanged. Elites retain their identity. Sole legal normal rescues are automatic.

Independent rules and implementation review found two custody defects: a stale dead face-up trainer could retain a skill, and a pending rescue was not bound to its actual skill assignment. Both now reject before mutation, with regressions. Saved receipt, missing continuation, replay, killed/returned captives, ordinary and elite rescue, JSON restore and SQLite concurrent submission are covered. The final Suk/Leader Skills focused union passed 46 tests, including the private assignment restriction, usable alternate selection and all four bots. New Advanced Atreides selection is unavailable while the existing Kwisatz Haderach loss-count question is pending; old assigned saves retain preflight protection. Seven other skill effects and combined modules remain unfinished.

Genuine module setup in fresh browser room BD33WTTV assigned Suk Graduate to Hasimir Fenring. A separately staged conserved battle then exercised the actual rescue control: three casualties saved, one kept in sector 10, two returned to reserves. Refresh preserved two board forces, seventeen reserves, one Tank, the private Crysknife/Baliset/Burseg and winner card cleanup. Two four-profile samples completed Basic/Advanced games with 92/188 actions and 3/6 JSON restorations, respectively. Neither encountered an eligible rescue; targeted tests and browser play establish that effect. These are bounded prototype samples, not calibration or full rules acceptance.

The latest reported outage left the existing server healthy. A fresh online backup captured all 360 rooms. All 359 opening rooms and their seat/recovery records remained unchanged; the new QA seat restored after refresh. No restart or reset was needed. Required broad checks and final preservation are recorded in the checkpoint commit and source-bound private report. Public Advanced, expansion, module and publication gates remain closed.

13 September 2026 — Planetologist movement and green-Special battle prototype

Planetologist now connects capped extra range, a single movement from two territories to one destination, and the surviving skilled leader's +2 green-Special battle substitution. Fremen cancellation preserves the independent skill bonus and both saved origins. Human controls, all four bot profiles and authoritative saved continuations use shared eligibility/range rules. The exact nine base Specials retain physical custody and never activate their normal effects through the battle slot. Mandatory discard includes traitor wins; that later-card-specific reading remains explicitly identified as an inference.

Independent review fixed stale saved battle plans accepting an already-dead skill leader; the original reproducer now rejects without mutation. Another integration check found appended skill moves were bypassed by ordinary candidates: they now share the existing public destination ordering. All four profiles actually choose and legally execute range and gather moves in targeted first-choice fixtures. The final focused union passed 84 tests. The first broad run stopped at lint because six new test declarations lacked the required explicit promise marker; those declarations were corrected before repeating the checkpoint check. Two four-profile sample games finished: Basic seed 20260916, 194 accepted actions and six JSON restorations (range and gather both executed); Advanced seed 20260917, 186 accepted actions and six restorations (range executed). Neither rejected a proposed action. These are bounded samples, not AI calibration or complete module/combination acceptance.

Fresh browser room TQWK5AEY used genuine Fremen/Emperor setup and selected Planetologist/Stilgar. The range-three control became available, then a real gather moved two Sietch Tabr forces and one False Wall West force to Wind Pass using one movement. Refresh restored 5/2/3 forces, the private Crysknife/Burseg and the skill. A separate targeted battle fixture in this new QA room relocated one physical Family Atomics from the deck and placed Emperor reserve forces. The actual weapon selector, plan reveal, traitor loss and mandatory discard were exercised. The Shield Wall remained intact; dead Stilgar returned the skill, and refresh preserved the remaining hand and losses. This fixture is not a naturally reached full game.

The server remained healthy after the user's outage report; no restart was needed. All 325 opening rooms were privately backed up and unchanged after browser QA; one new test room was added. Required broad checks and final preservation counts are recorded in the checkpoint commit and source-bound private report. Eight other skill effects, enemy-only mixed BG gather arrival, expansion rosters/cards and optional-module combinations remain unfinished. No public gate is opened.

13 September 2026 — Leader Skills setup, five disciplines and skilled capture

The first connected prototype adds all fourteen physical cards and readable faces, source-ordered private setup, public battle posture, five card-role strength modifiers, death return and own-leader revival through controls, all four AI profiles and saved actions. The other nine effects remain missing; combined modules and public starts remain gated.

The user's requested capture research resolved publicity through the known card's required movement with the leader. Harkonnen gets only its lower battle effect; surviving return and death retain physical custody. This is a component-based source inference. Captured replacement entitlement stays separately unresolved and explicitly guarded.

Independent review found and fixed a Voice/mandatory-leader deadlock and invalid simultaneous assignment/offer custody. Focused capture review found no remaining blocker. The focused union passed 66 tests, including genuine setup, scoring, capture and SQLite restart/concurrent setup and revival selections. Three sample games finished; their exact scope and source fingerprints are recorded separately. Browser setup, card inspection, AI assignment and refresh were exercised in new room REF6YHN7; narrow sidebar cards were made readable. All 291 opening rooms were backed up before QA. Final preservation and broad check results are recorded in the checkpoint commit and private report.

The first broad run passed types/lint and 4,410 of 4,411 offline tests. Its one failure was an existing Discovery privacy test treating treachery-32 as a substring match for hidden treachery-3. The exact physical pair now forms a deterministic scenario and assertions compare complete JSON string identities; the opponent's own card remains visible. Independent review and all six Discovery runtime tests pass. The broad run was repeated after this correction. During the follow-up, another user-reported outage stopped the server. All 292 games survived; a fresh backup and necessary server start restored the same private prototype seat and pending Storm choice.

The first broad run also exposed a pre-existing random Discovery test failure: the hidden identifier treachery-3 matched the viewer's distinct treachery-32 through a substring assertion. The regression now stages both physical cards and checks their complete identifiers; no production privacy behavior changed.

13 September 2026 — Sapho first after completed movement turns

Extends the existing clean-boundary movement contract to let Sapho's holder act first among remaining unstarted turns after earlier players fully finish. Completed shipment resources, forces, cards and counters stay intact. Advanced Guild priority remains guarded until Guild finishes. Current private controls, all four AI profiles and persisted room actions reuse the same legality check; the card is discarded once. Other Sapho modes and release gates remain pending. See runtime scope.

Four new engine tests include genuine Advanced setup and owner-only rendered controls. One independent SQLite test exercises real completed shipment, restart, concurrent claims, physical custody and replay rejection. Independent review found no blocker. Checkpoint-wide results and the final source fingerprint are recorded in the commit and private report.

The user reported a power outage during this work. The existing server was healthy, all 291 rooms were present, SQLite integrity/foreign-key checks passed, and all 218 rooms in the prior opening baseline matched. QA room 2EMYG4CY restored its same private hand, resources and pending Storm choice after refresh. All 291 rooms were backed up before further work; no reset or restart occurred.

The independent Leader Skills source contract supplies the complete fourteen-card inventory and shared lifecycle for the next batch. It records unresolved edges and establishes no runtime prototype or mode gate.

13 September 2026 — Discovery location effects prototype

Adds automatic unambiguous Jacurutu battle income, an owned Testing Station storm adjustment and physical Shrine card substitution through existing Karama and Truthtrance paths. Decisions and committed effects preserve JSON/SQLite continuation, physical custody and private information. Testing Station cannot change Weather Control; Jacurutu counts opposing physical losses, not the wheel alone. See the prototype scope and rulings.

Orgiz, contested Cistern/Testing Station and mixed-force Jacurutu remain pending. Normal module/Advanced starts and publication stay gated. Targeted browser room A5EJQ2W4 exercises station choice and refresh after real setup/reveal/entry with QA positioning. Independent review and focused regressions cover all three functions; required broad results, source fingerprint and preservation of all 187 opening rooms are recorded in the checkpoint commit and private report.

The preceding ab0ab52 entry/flight checkpoint passed 4,313 offline tests, build and 40 HTTP tests. Its outage recovery and 156-room opening baseline are historical results; the current batch keeps every game created afterward.

13 September 2026 — First connected Discovery prototype

Connects genuine base-faction Basic/Advanced audit setup to all seven sourced Spice Cards and eight opaque physical tokens. Great Maker resolves worm effects, an ordered majority vote and a free Fremen reserve ride. The six Discovery blows destroy prior forces/spice before their new blow and separate token placement. Private faction peeks and Collection inspection/reveal lead to exact stash rewards, a saved full-hand draw/discard choice, carried Ornithopter custody and five public nested locations; only Jacurutu contributes stronghold victory. Shared human/AI controls and JSON continuations accompany the actions.

This is Prototyped progress with Partial coverage. Next-turn free entry, the five special location benefits and Ornithopter spending remain missing. The normal public module start gate stays closed. Great Maker first-turn skipping, Sandtrout suppression and empty-token-supply behavior remain identified source inferences for refinement, not new confirmed rulings. See the prototype boundary and dependency queue.

Focused component, runtime, Great Maker, board/admission, private-control and SQLite recovery checks pass. Two seeded Basic/Advanced games finish while preserving components; browser 3RJBH26Y verifies genuine Fremen setup, a real Discovery blow, native private peek and enlarged card guidance. Review repaired lost encounter/arrival controls and an unfinished overflow discard. Broad verification and preservation results are recorded in the checkpoint commit and private source-bound report. No complete-module certification is claimed.

13 September 2026 — CHOAM Nexus Collection prototype and Discovery inventory

Adds the missing absent-CHOAM Secret Ally Collection trade through the engine, private physical-card selector/inspector, all four AI profiles and JSON discard continuation. Both cards are spent for exactly two bank spice; stale actions, competing SQL writes and saved replay cannot duplicate the payment. The separate battle inspection remains missing. See contract and scope. Independent review found a queued Grumman Collection lock mismatch; the server and private offer now share that automatic-continuation block.

A bounded acquisition helper resolved all Discovery component identities and card placements. No Discovery runtime is claimed. Focused trade tests pass; checkpoint-wide check/build/HTTP results are recorded in the verified commit and private source-bound report. Existing mode and publication gates remain closed. No server restart or saved-game reset is needed.

13 September 2026 — Genuine Ix expansion prototype

Connected Basic/Advanced Ix setup with both expansion factions, the complete 47-card Treachery Deck and Sandtrout through the existing game pipeline. A local prototype command backs up the named fresh lobby, starts it once with a version comparison, and preserves every seat and other room. The normal start gates remain closed. The checklist now separates Prototyped progress from Partial rules coverage. See Ix prototype.

Six new focused tests cover private setup at all four profiles, exact starting forces, Face Dancers, cards, JSON restoration, immutable rejection and the local SQLite writer. Two reproducible full games use seeds 2026091301 (Basic) and 2026091302 (Advanced), including both expansion factions and physical inventory checks. Review caught a saved JSON version mismatch, now corrected and covered. Browser room W5LE6VFB verifies genuine human Ixian setup, private refresh, Weather Control and mobile stronghold placement; owned autopilot then continues the same game. Final broad checks, later browser outcome and preservation results belong to the verified checkpoint. No complete expansion certification is claimed.

13 September 2026 — Atreides full-plan interaction verification

Replaced the full-plan suite's Basic-then-flip fixture with genuine Advanced initialization and added five tests for Truthtrance, Voice, ordinary Prescience, Ghola preparation and private full-plan inspection. Seventeen focused tests pass, including seven interruption windows and all four profiles. The tested native runtime paths needed no change. Independent source and test review found no publisher-backed defect, while preserving the unresolved special offer/deadline and target-first interpretation. See the timing audit for exact evidence and limits. Browser room AZC4HGLB verifies human special inspection, Medium AI Ghola preparation and a restricted sealed plan; desktop and phone inspection are readable. Refresh after the already-completed restart restores that private view and the earlier inventory seat. All 64 saved room versions/hashes remain unchanged. The user removed hourly restarts: restart only when warranted, preserving games and verifying restoration. Final required checks and aggregate usage belong to the verified checkpoint; no mode gate is opened and no recurring automation is installed.

13 September 2026 — Truthtrance hand size and primary-role facts

Added total physical hand counts and explicit primary-role comparisons, sharing classification with component presentation. Canonical Richese roles, Ix alternate uses, Worthless faction powers and Ecaz slot-only specials retain their distinct semantics. Current facts disclose one aggregate result and create no retention promise. The existing count controls, all four bot answer paths and production-room continuations are reused; no public mode or publication gate opens.

Eight new focused tests cover the 60-card catalog, actual engine questions, privacy, AI and JSON/custody changes. Expanded SQLite cases restore total/category and compound answers around an interrupted auction and commit competing answers once. Independent review findings were limited to two corrected wording issues. Room LC3E55GY verifies combined role counts, total size, invalid input and phone refresh. Required broad results and aggregate token endpoint belong to the verified checkpoint commit and private source-bound report. See hand inventory contract and efficiency measurements. Wider Truthtrance and Guild gaps remain explicit; preserve all post-reset games.

Typed Advanced shipment-promise checkpoint, 13 September 2026: Shipment promises now support base Advanced games without Guild or optional modules through the existing authoritative commitment, controls, private guidance, bots and recovery. Ghola preparation reuses canonical eligible normal/elite limits; pending BG conversion preserves feasible promises while retaining real responses and hiding conditional shipment pricing. Cancellation releases only when owned alternatives fail. Genuine Advanced scenarios and production SQLite races cover physical custody and saved continuations. Full validation and browser outcomes are recorded in the checkpoint commit and source-bound verification report. Ordinary Guild settlement, broader commitments, combined modules and complete mode acceptance remain unfinished; no release gate is opened.

Efficiency setup and fresh local save checkpoint, 13 September 2026: Current status and the rule decision index consolidate existing evidence without changing mode gates. Reusable verification adds private source-bound check logs, read-only saved-game snapshots/online backups and bounded HTTP seat-restoration checks. Focused regressions cover child failure/cancellation, stale source, output protection, WAL backup and seat privacy; the required full-check result is recorded in this checkpoint’s Git commit and external verification report. The user explicitly authorized clearing old local saves: a verified private backup preceded removal of 3,644 rooms and related records, preserving schema/migrations and creating a fresh empty baseline. Future games remain protected. Pilot measurements retain selective subagents, mandatory verified Git pushes and the full game scope; no gameplay or release gate is enabled. Browser setup remains feature-specific, and no live browser acceptance is claimed for this tooling change.

Guild Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_GUILD_SECRET_ALLY_RUNTIME.md records one explicitly selected Guild-priced shipment for an unallied holder with Guild absent. Reserve, physical cross/abstract-return and independently legal world-to-world routes preserve actual faction identity, typed custody, ordinary movement and bank payment. Fremen retain their free reinforcement choice; the separate paid southern route reaches beyond its range without storm privileges or off-planet triggers. Private controls and all four bot profiles share source-aware price/permission; binding shipment promises can rely on the card. Exact committed records and an independent outcome marker preserve arrival alliances and later movement without inventing native Guild responses. Final types, lint, all 4,162 offline tests, production build and 40 HTTP/session tests pass. Twenty-six new cases include real Moritani arrival alliances and production SQLite races, corruption rejection and private recovery. Review also repaired an older Cunning fixture's post-auction card-availability assumption; ten repeated runs passed 190 cases. Two three-seat browser rooms passed paid Fremen shipment/movement, mixed Emperor Homeworld shipment, desktop/phone controls and six private refreshes. The 03:46 UTC backed-up restart preserved all 3,612 opening games and restored twelve earlier private seats; final comparison preserves every opening version/hash, with two browser and thirty HTTP rooms added. Homeworld-return interpretation was asked of the user; that route, concealed transport, Betrayal and complete module/mode acceptance remain gated. Automation remains removed.

Guild Nexus Cunning checkpoint, 10 September 2026: NEXUS_GUILD_CUNNING_RUNTIME.md records a second paid native Guild shipment within the original combined turn, followed only by unused Hajr movement. Original shipment/movement history, typed Homeworld sources, cross/return routes, interception and later entry effects retain their rules. Private controls and all four bot profiles share availability; new binding shipment promises recognize the extra opportunity. Native Karama and paid BG conversion preserve the original source, and countering conversion restores it. Independent review fixed a later Moritani alliance freezing the remaining Hajr continuation; transport validation also rejects a same-territory cross-shipment. Final types, lint, all 4,136 offline tests, production build and 40 HTTP/session tests pass. Thirty-seven new cases include genuine nested interruptions, pending-frame corruption and competing production SQLite requests. Two three-seat browser rooms passed second shipment/Hajr and cancellation, desktop/phone controls and six private refreshes. A raw internal event notice found visually was corrected and verified by final rendering tests; earlier pending screenshots precede that text correction. All 3,580 opening room versions/hashes remain unchanged, with two browser and thirty HTTP rooms added. Guild Secret Ally/Betrayal, the physical Ornithopter combination, remaining native cancellation/arrival gaps and complete module/mode acceptance remain gated. Existing server reused, no restart due; automation remains removed.

Richese Nexus Secret Ally checkpoint, 10 September 2026: NEXUS_RICHESE_RUNTIME.md records one-to-five actual reserve forces at the one-force price in the ordinary shipment pipeline. Native Guild/Fremen pricing, typed Homeworld reserves, native Ixian HMS entry, Guild prevention, BG accompaniment and real Terror entry retain their own rules. Private controls and all four bot levels share the quote; binding shipment promises recognize the affordable discounted source. Exact saved declarations and independent outcome markers protect pending and terminal history through corruption checks, competing SQL requests, Truthtrance and later turns. Review fixed the consumer's omitted native HMS destination. Types, lint, all 4,099 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases and two three-seat browser rooms cover allowance/prevention, typed Emperor sources, desktop/phone controls and six private refreshes. The 02:48 UTC backed-up restart preserved all 3,548 opening games and restored twelve earlier private sessions. Final comparison leaves all opening versions/hashes unchanged, with two browser and thirty HTTP rooms added. Native Richese Cunning, Betrayal, foreign-Homeworld tariff integration and complete module/mode acceptance remain gated. The Guild source audit prepares its distinct extra-shipment, borrowed-route and payment effects without claiming runtime completion. Automation remains removed.

Moritani Nexus Cunning checkpoint, 10 September 2026: NEXUS_MORITANI_RUNTIME.md records Basic/Advanced supply placement throughout the printed Arrakis map, including existing Terror stacks. Shared controls and all four bot profiles use the private offer; ordinary relocation stays unchanged. Native Karama cancellation preserves the token and spends the opportunity/Nexus. Independent review fixed arrival-signature downgrade, stale former-location reuse and physical-face rebinding; current placement permission and historical entry evidence remain separate. Types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests pass. Twenty-seven new cases include real later shipments, Robbery/Sabotage/Sneak Attack, Truthtrance, prior Grumman outcomes and concurrent SQLite recovery. Two three-seat browser rooms passed phone placement, allowance/cancellation, map markers and all six private refreshes. All 3,516 opening room versions/hashes remain unchanged; two browser and thirty HTTP rooms were added. Relocation/HMS/Grumman interpretations, other unfinished Terror/Nexus effects and full module acceptance remain gated. The new Ecaz source audit records its leader-scope and disclosure boundaries. Existing server reused, no restart due; automation remains removed.

CHOAM Nexus Cunning checkpoint, 10 September 2026: NEXUS_CHOAM_RUNTIME.md records five native effects using one actual Treachery Card in Basic and Advanced. Shared controls inspect the real cost independently of the selected effect; all four bots use projected legality. Karama retains the cost and spent Nexus; actual intervening cash-in fizzles and resumes the original operation. Independent review fixed saved movement, revival and storm orders accepting valid-looking replacements. Types, lint, all 4,042 offline tests, production build and 40 HTTP/session tests pass. Thirty new cases include real paid Nullentropy, private views, physical disposal and concurrent SQLite outcomes. Two three-seat browser rooms passed phone declarations, allowance/cancellation and all six private refreshes. All 3,484 opening room versions/hashes remain unchanged; only two browser and thirty HTTP rooms were added. The printed family has six effects: Kull Wahad remains unavailable, as do unfinished Secret Ally/Betrayal and full module starts. Existing server reused, no restart due, automation remains removed.

Grumman stack cancellation checkpoint, 10 September 2026: GRUMMAN_PLACEMENT_CANCELLATION.md records the reproduced failure of printed Karama against a native Mentat placement after a legal Collection stack. Cancellation now preserves the existing stack without requiring distinct occupied locations. Independent SQL review also fixed allowance accepting unrelated duplicate physical token IDs; both outcomes validate the same inventory. Existing denial semantics remain unchanged. Types, lint, all 4,012 offline cases, production build and 40 HTTP/session cases pass. Six new cases cover Basic/Advanced, low population, unchanged income, competing cancellation/allowance, private restoration and malformed records. Browser phone declaration, desktop/phone cancellation and three-seat refresh pass. The hourly restart preserved all 3,453 opening games and restored twelve earlier private seats; final comparison leaves those same versions/hashes unchanged, with one new browser room and thirty HTTP rooms added. New Ixian replacement and Fremen Nexus audits record remaining source and privacy boundaries. No new Nexus effect or release gate was enabled; automation stays removed.

Emperor Nexus Cunning checkpoint, 10 September 2026: NEXUS_SARDAUKAR_RUNTIME.md records five ordinary counters temporarily using Sardaukar strength and support in one Advanced battle. Physical counters, starred reserves and ordinary losses remain distinct. Shared editor and bot calculations handle the Fremen exception and Salusa support. Review fixed a canceled-enhancement Prescience deadlock and retained durable winner casualty choices across competing SQLite requests. Types, lint, all 4,006 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases cover independent counter arithmetic, real Homeworld thresholds, future commitments, hidden information and recovery. Two three-seat browser rooms passed desktop/phone allowance, cancellation, reanswer, sealed planning and private refresh. All 3,421 opening room versions/hashes remain unchanged; only thirty HTTP rooms and two browser rooms were added. Fewer-than-five interpretation, Emperor Secret Ally, Betrayal and complete module acceptance remain gated. No release gate opened; no restart was due, and automation remains removed.

Bene Gesserit Nexus advisor checkpoint, 10 September 2026: NEXUS_ADVISOR_RUNTIME.md records whole-territory, multi-sector Cunning conversion during the native owner’s Advanced Shipment and Movement action. One Karama cancels the entire declared batch; source positions, counts and action allowances are preserved. Saved responses survive Truthtrance, Harkonnen exchanges and paid Nullentropy. Shared controls and all four bot profiles consume the public legality quote. Types, lint, all 3,971 offline tests, production build and 40 HTTP/session tests pass. Thirty-five new cases include pending-parent corruption, physical custody and concurrent production SQLite recovery. Two three-seat browser rooms passed desktop/phone selection, allowance/cancellation and private refresh; review also fixed checkbox spacing, accessible SVG titles and stale Nexus guidance. All 3,389 opening saved rooms retain their versions/hashes; only two isolated browser rooms and thirty HTTP-test rooms were added. Fresh advisor/storm rulings, borrowed Voice, Betrayal and complete module acceptance remain gated. The Emperor source audit prepares the next family. No release gate opened; no restart was due, and automation remains removed.

Tleilaxu and Ixian Nexus Cunning checkpoint, 10 September 2026: NEXUS_CUNNING_RUNTIME.md records atomic revealed Face Dancer replacement and full-strength Suboids in every battle for the rest of the turn. Basic and Advanced retain Cyborg support costs and exact physical losses. Review fixed fresh Ixian Nexus setup, future-plan search through an unspent Cunning card and its private preparation hint; prior commitments remain binding. Types, lint, all 3,936 offline tests, production build and 40 HTTP/session tests pass. Fifty-one new cases include real Face Dance, all four bots, mixed-force support, concurrent SQLite recovery and future Truthtrance/Prescience commitments. Desktop/phone card play, private refresh and a seven-strength/two-support sealed plan passed. The hourly restart preserved all 3,359 then-existing games; final comparison preserves all 3,327 opening room versions/hashes. Tleilaxu Secret Ally, Betrayal and remaining Nexus effects stay gated pending their recorded requirements. No expansion release gate opened; automation remains removed.

Harkonnen Nexus exchange checkpoint, 10 September 2026: NEXUS_HARKONNEN_RUNTIME.md records draw-first Cunning and absent-faction Secret Ally, exact private returns, protected revealed Face Dancers, saved suspended actions and durable prior traitor declarations. Shared controls and all four bot profiles use projected identities. Independent review fixed lost preceding decisions and the paid Nullentropy action gate. Types, lint, all 3,885 offline cases, production build and 40 HTTP/session cases pass. Forty-six new cases cover rules, consumers, continuations and concurrent SQLite recovery. Two three-seat browser rooms passed draw/return, private restoration and desktop/phone inspection. All 3,295 preexisting room versions/hashes remain unchanged. Betrayal remains blocked pending the existing private response timing decision; complete Nexus and expansion games remain unfinished, and no release gate opens. The server was reused, no restart was due, and automation remains removed.

Atreides Nexus inspection checkpoint, 10 September 2026: NEXUS_ATREIDES_RUNTIME.md records Cunning's distinct second commitment and absent-faction Secret Ally, physical card disposal, No-Field distinctions, private history, all four editor locks and bot handling. Independent review fixed lost-response bypass, first-answer drift and a sealed plan contradicting its signed observation; legitimate Residual reanswers preserve the first historical disclosure. Types, lint, all 3,839 offline tests, production build and 40 HTTP/session tests pass. Forty-four new cases include concurrent SQLite recovery and four independent corruption regressions. Three-seat keyboard play, answer, protected plan submission and desktop/phone refresh passed. All 3,234 preexisting room versions/hashes survived the scheduled backup/restart and final comparison. Betrayal response timing, Residual after two answered Cunning fields, other card families and complete module games remain explicitly unfinished; no release gate opened. Automation stays removed; verified checkpoints are authorized for push without another confirmation.

Nexus ownership and complete component reference checkpoint, 10 September 2026: NEXUS_CARD_RUNTIME.md records the twelve-card physical deck, whole-phase Basic/Advanced draw opportunity, private replacement policy, all three alliance-forfeiture paths and complete inspectable 36-panel reference. Review fixed real Storm-entry initialization, edited progress/replay acceptance, one-way alliances and the private redraw prompt's public timing leak. Pre-draw preferences resolve without extra confirmations. Types, lint, all 3,795 offline tests, production build and 40 HTTP/session tests pass. Three-seat keyboard draw/redraw/refresh and all twelve normal/enlarged desktop/phone cards passed; independent review inspected 48 renders. All 3,173 preexisting room versions/hashes remain unchanged. All individual Nexus effects, Discoveries and complete expansion games remain unfinished; no release gate opened. Existing server reused, no restart due, no automation recreated.

Tupile private intelligence and occupation evidence checkpoint, 10 September 2026: HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md records current low-population contact checks, one historical spice/category answer per opposing faction, private controls and shared legal bot requests. Genuine setup binds qualification history and lifetime usage; legacy history stays unknown. Ordered battle observations retain brief sole occupation while simultaneous destruction does not invent it. Deterministic source identities make direct actions and restored continuations agree. 3,755 offline tests, types, lint, production build and 40 HTTP/session tests pass. Three-seat desktop/mobile keyboard shipment, private disclosure, later balance change and refresh passed. The hourly restart and final comparison preserved all 3,112 preexisting room versions/hashes. Occupation entitlement/expiry/income, complete module games and the full expansion goal remain unfinished; no release gate opened. The removed automation stays removed.

Grumman Collection and stacked Terror checkpoint, 10 September 2026: GRUMMAN_STACKED_TERROR_RUNTIME.md records one hidden-token addition with four bank spice, separate Mentat placement, private stacked-token selection, shared controls/AI and durable discard/alliance continuations. Review fixed selected-choice rewinds and restoration of a consumed Sabotage token during its genuine discard child. 3,712 offline cases, types, lint, production build and 40 HTTP/session cases pass. Desktop/phone keyboard Collection, shipment, token selection, Robbery payment, public stack count and three-seat private refresh passed. All 3,081 preexisting room versions/hashes remained unchanged. Removal custody, occupation, unfinished effects and complete expansion games remain unresolved; no release gate opened. The existing server was reused and the removed automation stays removed.

Caladan victory reinforcement checkpoint, 10 September 2026: HOMEWORLD_VICTORY_REINFORCEMENT_RUNTIME.md records the actual high-Caladan post-victory one-force transfer, current population and survivors, original battle location, exact native/visitor custody, owned controls and all-profile AI. Shared Ambassador arrivals preserve the original reinforcement and its nested children. Independent review reproduced and fixed arrival-to-choice rewinds and a deleted preceding cleanup choice; new revival returns also carry version-bound independent progress, while legacy completed QA saves remain readable. Final types, lint, 3,682 offline cases (89.9 seconds), production build and 40 HTTP cases pass. Eight Caladan production SQLite cases cover competing writes, reloads, private projections, nested arrivals and corruption. Two older Face Dance fixtures now explicitly decline the preceding guarded Caladan option, without choosing the unresolved placement order. Desktop and phone keyboard placement and three-seat refresh passed; final restart restoration passed for both Caladan and revival QA games. All 3,051 pre-existing room versions/hashes remain unchanged after restart and additive HTTP work. Low-Tupile public contact/once-per-faction quoting has seven cases but no playable disclosure action. Face Dancer ordering, guarded entry combinations, occupation, other missing effects and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld revival deployment checkpoint, 10 September 2026: HOMEWORLD_REVIVAL_DEPLOYMENT_RUNTIME.md records newly revived Fedaykin placement and Tleilax ordinary Free Revival deployment, exact typed groups, normal/Emperor-extra/Ghola source distinctions, owned controls and all-profile AI. Signed return, income and Ambassador completion records preserve nested arrivals and CHOAM sale restoration. Independent review found and fixed altered-offer acceptance and deleted-child premature completion. Final types, lint, 3,634 offline cases, production build and 40 HTTP cases pass; seven new production SQLite cases cover competing writes, lost responses, nested Ambassador restoration and corruption. The final suite also made an older auction test deterministic when the purchased Karama creates a second income responder. Desktop and phone keyboard placement, Ghola decline, refresh and three private seats passed without overflow or page errors. The hourly restart preserved all 3,050 saved room versions/hashes and restored the QA seats. First-reaching-high timing, partial/split groups, storm/arrival classification, occupation and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and the automation stays removed.

Homeworld collection and Terror checkpoint, 9 September 2026: HOMEWORLD_COLLECTION_RUNTIME.md records automatic high-Giedi income on actual positive desert receipts, once-per-phase recovery across Ecaz allocations, and low-Grumman original entering-force restrictions. Concealed No-Fields count as one; Ambassador choices and all four bot levels honor count-dependent arrival limits. Independent review found and verified a repair for altered saved arrival counts: original facts are now bound through live Terror, alliance cancellation and forced-discard continuations. Final types, lint, 3,575 offline cases, production build and 40 HTTP cases pass. Thirty-four new cases include seven production SQLite recovery scenarios; the older stale-entry regression now covers both signed and legacy saves. Desktop/390-pixel phone keyboard collection and three-seat refresh preserve seven collected spice plus the automatic two-spice bonus, with readable history and no overflow or browser errors. All 2,958 pre-existing room versions/hashes remain unchanged after the controlled restart and additive QA/HTTP work. Missing whole new receipts/signatures retain explicit legacy compatibility. High Grumman removal custody, occupation and low-Junction rounding questions remain pending; high Grumman operations, other faction effects and complete expansion games remain unfinished. No release gate opened, workflow optimizations remain in use, and automation stays removed.

Homeworld payment income checkpoint, 9 September 2026: HOMEWORLD_PAYMENT_INCOME_RUNTIME.md records low Kaitain and Junction reductions, original payer costs, separate ordinary-income cancellation, public split previews and private Guild contributor receipts. Final types, lint, 3,541 offline cases and production build pass; 40 HTTP cases passed before the final UI/AI funding guard. Twenty-six new cases cover actual auctions, shipment funding, native departure thresholds, Richese special/Ambassador purchases, all four profiles and five production SQLite recovery scenarios. Independent review found and verified repairs for mismatched Ambassador previews and invalid AI funding candidates. Desktop/390×844 phone keyboard allowance and three-seat refresh preserve the 5-spice purchase, 3-spice Emperor receipt and 2-spice bank remainder; screenshots were inspected without page overflow. All 2,894 baseline room versions/hashes remain unchanged. Occupation and contributor rounding questions are pending; divergent low-Junction odd/odd splits reject before declaration/payment rather than adopting an unverified rule. Legacy receipts without all new metadata retain the documented evidence limitation. Occupation, remaining card effects and full expansion games remain unfinished; no release gate opened and automation stays removed.

Kaitain and Ecaz card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records shared end-of-Bidding paid Kaitain discards and CHOAM sales/trades, current-population Ecaz poison income, private receipts and all-profile controls. Winning mandatory cards now discard after winner casualties and Ixian substitution, with reserved physical custody and independent saved battle obligations. Final types, lint, 3,515 offline cases, production build and 40 HTTP cases pass. Forty-seven new cases and updated battle/SQL regressions cover timing, privacy, corruption and races. Independent review found and verified fixes for conditional battle-role corruption, played-card diversion and deleted winner-discard queues. Desktop keyboard and 390×844 phone play completed disposal, private income, trade, sale, closing readiness and all-seat refresh; screenshots were inspected without page overflow. All 2,894 pre-existing room versions/hashes remain unchanged. Occupation, remaining Homeworld effects, complete expansion setup and full module games remain unfinished; no release gate opened. Workflow optimizations remain in use and automation stays removed.

Tupile card economy checkpoint, 9 September 2026: HOMEWORLD_CARD_ECONOMY_RUNTIME.md records high-Tupile restrictions on both Worthless sale prices and CHOAM Ambassador payouts, private legal choices, and Ghola interruption with durable sale restoration and nested Tleilaxu income. Types, lint, 3,468 offline cases, production build and 40 HTTP cases pass. Thirty-one new regressions include all four AI profiles, five production SQLite scenarios and the repaired receipt-binding issue found by independent review. All 2,864 pre-existing room versions/hashes remain unchanged. Kaitain has source and pure-quote coverage only; its shared phase-end window, Ecaz poison-discard income, occupation and complete expansion games remain unfinished. No release gate opened. The optimized workflow remains in use; automation stays removed.

Homeworld mobility and advisor checkpoint, 9 September 2026: HOMEWORLD_MOBILITY_RUNTIME.md records low-Caladan phase-opening foresight restrictions, low-Wallach free-advisor suppression and high-Wallach two-force Polar Sink batches, low-Ix mobile-stronghold restrictions, and low-Richese token movement restrictions. Paid arrivals, physical troop movement and legitimate previously learned knowledge remain available under their separate rules. Final types, lint, 3,437 offline cases and production build pass; 40 HTTP cases passed before the final declared-advisor-count display text. Fifty-three new cases cover pure thresholds, actual actions, all-profile choices, Guild Ambassador continuations, and ten production SQLite recovery scenarios including paid Box interruption. Desktop choices, phone keyboard declaration, another human seat's allowance, saved reaction and settled refresh passed; phone screenshots were visually inspected without overflow. All 2,833 pre-existing room versions/hashes remain unchanged. Occupation-retained penalties, remaining high/occupied effects, full expansion setup and complete Homeworld games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Junction sponsored transport checkpoint, 9 September 2026: JUNCTION_TRANSPORT_RUNTIME.md records optional Guild half/full offers, replacement and expiry, exact Arrakis/Homeworld source groups, native returns, foreign departures, payment provenance, Karama immunity, arrival continuations and all-profile controls/AI. Final types, lint, 3,384 offline cases and production build pass; 40 HTTP cases passed before the final sponsor-panel identity and AI-priority guard adjustments. Forty-four new regressions include production SQLite concurrency/recovery and independent review. Actual desktop keyboard offers/replacements and phone typed shipment/refresh passed; visual inspection found readable layouts without phone overflow. Browser testing prompted preserving the sponsor panel across offer replacement. A controlled restart restored the private QA seat and preserved all 2,802 saved rooms; all 2,802 pre-existing room versions/hashes also remain unchanged after isolated QA/API tests. Occupation, remaining faces, concealed transport, unresolved generic/ordinary Karama interactions and complete module games remain unfinished; no start or publication gate opened. Workflow optimizations remain in use and automation stays removed.

Guild Arrakis-to-Homeworld transport checkpoint, 9 September 2026: GUILD_HOMEWORLD_TRANSPORT_RUNTIME.md records actual Guild invasions and Junction returns from exact Arrakis sector pools, protected mobile-stronghold departures, shared interception, legacy API parity, accessible controls and all-profile AI. Final types, lint, 3,340 offline cases, production build and 40 HTTP cases pass. Thirty-six new regressions cover legality, physical custody, competing requests, interrupted recovery and private projection; independent review found no further defects. Desktop validation and keyboard declaration, phone interception, refresh and visual inspection passed in an isolated QA room. All 2,771 pre-existing room versions/hashes remain unchanged, with none missing. Junction-sponsored routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start or publication gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld invasion shipment checkpoint, 9 September 2026: HOMEWORLD_SHIPMENT_RUNTIME.md records actual world-to-world invasions, explicit native/foreign pools, mixed Emperor origins, Guild native returns, separate shipper/donor payments, Guild interception and present-force alliance restrictions. Final types, lint, 3,304 offline cases and production build pass; 40 HTTP cases passed before final UI/reference edits. Forty new regressions include actual invasion-to-battle discovery, all-profile policies, competing declarations, allowance-versus-stop races and Box-suspended recovery. Independent review fixed a public automatic-work flag that disabled genuine human Guild choices. Desktop mixed-source shipment, phone keyboard allowance and both-seat refresh preserve exact forces/payment; all 2,740 pre-existing room versions/hashes remain unchanged. Arrakis/Junction routes, occupation, remaining faces, unresolved Karama interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld battle runtime checkpoint, 9 September 2026: HOMEWORLD_BATTLE_RUNTIME.md records live Homeworld battle discovery, native strength, sealed plans, native-only Traitor calls, typed explosion losses, late Portable Snooper decisions, Ixian replacement and native Tleilaxu Face Dance. Final typecheck, lint, 3,264 offline cases and production build pass; 40 HTTP cases passed before the final saved-decision and board-selection fixes. Independent review and browser testing fixed paused-decision validation gaps and an off-planet territory-selector crash. Desktop/390×844 keyboard battle settlement and refresh preserved exact typed forces and card disposal in a conserved staged invasion. All 2,709 baseline room versions/hashes remain unchanged. Actual invasion transport, occupation, remaining face effects, unresolved return/support interpretations and complete module games remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld combat foundation and Salusa checkpoint, 9 September 2026: HOMEWORLD_COMBAT_IMPLEMENTATION.md records public typed off-planet armies, pure native battle/explosion rules and connected high-Salusa free Sardaukar support. Final typecheck, lint, 3,221 offline cases and production build pass; 40 HTTP cases passed before the final Ghola guard. Independent review reproduced a population-changing Ghola deadlock after a sealed plan or prescience answer; execution, UI and AI now gate that specific unresolved interaction, with eight Salusa engine regressions covering rejection, privacy, JSON restoration and subsequent completion. All 2,648 baseline room versions/hashes are unchanged. Live Homeworld invasion/battle/occupation, remaining face effects, full module games and new browser acceptance remain unfinished; no start gate opened. User workflow optimizations remain in use and automation stays removed.

Homeworld charity and revival checkpoint, 9 September 2026: HOMEWORLD_BENEFITS_IMPLEMENTATION.md records source-separated charity payments, dynamic low free-revival rates, four-free Fremen capacity, and Tleilax’s durable phase-start income condition. 3,190 offline tests, typecheck, lint, final production build, 40 HTTP tests and 144 focused Homeworld/reference cases pass. Independent review reproduced and integration fixed Box-suspended charity overpayment, invented saved free revivals and an AI/server special-Karama mismatch. Seven production SQLite recovery cases cover races, interrupted choices, privacy and rejected writes. Desktop/390×844 keyboard claims, invalid revival prevention, threshold crossing and refresh pass in an isolated QA room. All 2,648 pre-existing room versions/hashes are preserved. CHOAM opening-income and special-Karama interpretations remain pending; Homeworld battles, invasion, occupation and full module games are unfinished. No start gate opened; automation remains removed.

Homeworld native-reserve runtime checkpoint, 9 September 2026: HOMEWORLD_RUNTIME_IMPLEMENTATION.md records genuine supported-deck setup, saved typed custody, Basic strength-one special counters, exact native shipment sources, Emperor transfers and revival destinations, public controls and all-profile AI. 3,152 offline tests, typecheck, lint, production build and 40 live HTTP tests pass; the final focused Homeworld/reference run passes 106 cases. Actual transfer → shipment → Storm death → revival, Hajr, Ghola receipt integrity and competing SQLite requests are covered. Desktop/390×844 controls, card inspection, invalid-source prevention and refresh pass in a new isolated QA room. Twenty two-player Basic games complete 3,079 accepted actions without rejects/stalls or changed source fingerprints; this is a bounded regression sample. All 2,617 older saved rooms are unchanged. Invasions, Homeworld battles, occupation, card effects, remaining arrival routes and full module games are unfinished; public starts remain disabled. Workflow optimizations are preserved and the automation stays removed.

Homeworld component and custody checkpoint, 9 September 2026: HOMEWORLD_IMPLEMENTATION.md records all 13 cards and 26 verified faces, original bundled planetary art, searchable high/reverse inspectors, typed native/foreign custody and a separate population projection. 3,085 offline tests, typecheck, lint and the final production build pass. Both enlarged faces of every card were exercised on desktop and 390×844 phone; normal reverse controls, artwork loading, full-text search, keyboard activation, scrolling and refresh pass. Screenshot sampling and remaining complete visual acceptance are explicitly bounded in the feature document. The 07:53 UTC controlled restart preserved all 2,617 saved room versions/hashes and restored the authenticated QA seat. Actual Homeworld shipment, battles, occupation, card effects, AI and complete games remain unfinished; no mode gate opened. User workflow optimizations are in use and the automation remains removed.

Ecaz Ambassador alliance checkpoint, 9 September 2026: ECAZ_ALLIANCE_IMPLEMENTATION.md records the reusable token’s owner offer, entrant consent/refusal, immediate reciprocal alliance and original movement/worm continuation. Duke availability is independent; optional loans await a custody ruling. 3,058 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass. Thirty new alliance tests include public-identity quotes, all four AI levels, actual Box suspension, corrupt-save rejection and competing SQLite replies. Browser mobile keyboard proposal, AI acceptance, chronicle and refresh passed; all 2,586 older non-QA room versions/hashes are unchanged. Twenty Basic games completed 12,186 accepted actions and 545 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Full faction/mode/module completion remains gated, user workflow changes are preserved, and the automation stays removed.

Ecaz shared collection checkpoint, 9 September 2026: ECAZ_COLLECTION_IMPLEMENTATION.md records bilateral desert allocation, private proposals/counteroffers, the odd-to-ally default, automatic bank income and scoped Karama cancellation. All 3,028 offline tests, typecheck, lint, production build and 40 HTTP-suite tests pass under the new automatic test-discovery workflow. Sixty collection tests include actual engine transitions, all four AI levels, suspended Box/Karama recovery and SQLite races; review fixed orphaned collection controls. Twenty Basic games completed 10,206 accepted actions and 465 JSON round trips without rejects/stalls or changed source fingerprints. Real browser proposal/AI acceptance, phone keyboard completion and refresh passed; all 2,556 older non-QA room versions/hashes remain unchanged. Full Ecaz combat, its Fremen endgame exception, Tleilaxu Ambassador, remaining Duke interactions and complete Advanced/expansion/module acceptance stay unfinished and gated. User workflow optimizations are preserved; the automation stays removed.

Ecaz joint stronghold victory checkpoint, 7 September 2026: ECAZ_VICTORY_IMPLEMENTATION.md records the three co-occupied stronghold win, shared public server/UI/AI progress, prediction privacy and final Stronghold Card recovery. 2,758 rules/client/component +245 multiplayer tests (3,003 total) pass with TypeScript, lint and production build clean. Twenty Basic games completed 12,818 accepted actions and 568 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Actual browser Mentat victory, verbose chronicle, phone/keyboard and refresh passed; all 2,526 pre-existing non-QA room versions/hashes remain unchanged. Fremen’s Ecaz endgame exception, combined Occupy combat, shared collection, Tleilaxu Ambassador runtime and full Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Ecaz territorial occupancy checkpoint, 7 September 2026: ECAZ_OCCUPANCY_IMPLEMENTATION.md records shared server/AI entry and path checks, permanent Ecaz allied co-occupation, advisor exceptions, physical/hidden-marker conservation and the automatic turn-end notice. 2,730 rules/client/component +242 multiplayer tests (2,972 total) pass, with TypeScript, lint and production build clean. Twenty Basic games completed 11,446 accepted actions and 515 JSON round trips with zero rejects/stalls and unchanged source fingerprints. Desktop/phone, keyboard completion, notices and refresh passed; all 2,496 older non-QA room versions/hashes are unchanged. Combined Occupy combat, shared desert collection, special victory, Tleilaxu Ambassador runtime and complete Advanced/expansion/module acceptance remain unfinished. The automation stays removed.

Tleilaxu Ambassador foundation, 7 September 2026: TLEILAXU_AMBASSADOR_RULES.md records the resolved physical return helper and outstanding interpretation boundaries. Eleven new registered tests pass for typed force custody, the fixed four-counter grant and shared Fedaykin/Sardaukar turn limit, including the Ixian exception; full TypeScript, focused lint and formatting pass. This helper has no engine integration or controls. Ordinary allowance, leader repeat-death and income interpretations remain pending; no full mode gate was opened. The automation stays removed.

Guild Ambassador checkpoint, 7 September 2026: GUILD_AMBASSADOR_IMPLEMENTATION.md records independent free typed reserve shipment, source-bound Guild prevention, BG accompaniment/Intrusion/Terror and chained Ambassador continuation, including phase-one worm riders and the Ixian HMS exception. 2,691 rules/client/component +239 multiplayer tests (2,930 total), typecheck, lint and production build pass. Twenty balanced Basic games completed 10,640 accepted actions and 482 JSON continuations with no rejects/stalls and unchanged source fingerprints. Desktop/mobile forms, keyboard submission, private refresh recovery, notices and chronicle pass; all 2,466 older non-QA room versions/hashes are unchanged. The review fixed orphaned saved shipment decisions; the 11:51 UTC controlled restart preserved all 2,497 games and restored the authenticated browser. No-Field substitution and simultaneous arrival interpretations remain unresolved; Tleilaxu Ambassador, complete Ecaz/Advanced/expansion/module acceptance and broader presentation remain unfinished. The automation stays removed.

Fremen Ambassador checkpoint, 7 September 2026: FREMEN_AMBASSADOR_IMPLEMENTATION.md records independent typed board relocation, concealed markers/HMS, advisor and separate Terror children, Baliset cancellation/re-selection, all-four-profile controls and saved-game recovery. 2,613 rules/client/component +233 multiplayer tests (2,846 total), typecheck, lint and production build pass. Twenty Basic games completed 12,252 accepted actions and 547 JSON continuations with zero rejects/stalls and unchanged source fingerprints. Desktop/phone form, keyboard submission, refresh, chronicle and automatic notice passed. The hourly restart preserved all 2,437 rooms; the subsequent QA changed only its named room, preserving all 2,436 older non-QA versions/hashes. Simultaneous Intrusion/Terror ordering awaits the user's interpretation; Guild/Tleilaxu effects, Occupy combat, full Advanced/expansion acceptance and broader mobile acceptance remain unfinished. The automation stays removed.

Richese Ambassador checkpoint, 7 September 2026: RICHESE_AMBASSADOR_IMPLEMENTATION.md records automatic three-spice purchases for all twelve possible beneficiaries, source-bound Emperor income and Harkonnen bonus, private failure handling, real BG-copy/worm continuation and all-four-profile support. 2,548 rules/client/component +228 multiplayer tests (2,776 total), typecheck, lint and production build pass. Twenty Basic games completed 12,218 accepted actions and 544 JSON continuations with zero rejected actions/stalls; only a reference evidence path changed during that run. Browser purchase, refresh and income cancellation passed, and all 2,406 older non-QA room versions/hashes remained unchanged. Fremen/Guild/Tleilaxu effects, full Ecaz/Advanced/expansion acceptance and mobile acceptance remain unfinished. The Duke revival interpretation question is pending. The automation stays removed.

Ghola lifecycle and AI checkpoint, 7 September 2026: GHOLA_LIFECYCLE_AND_AI.md records all-four-profile ordinary Ghola choices, authoritative target controls, the actual Kwisatz explosion/revival/next-territory fix, Ecaz-only shared-Duke checks and full primary card text. 2,517 rules/client/component +226 multiplayer tests (2,743 total), final typecheck, lint and build pass. Twenty Basic games completed 12,304 actions with zero rejects/stalls and 550 JSON round trips, including 18 actual Ghola plays across all four levels. Browser Ghola revival, refresh and a later sealed Carthag plan with revived Kwisatz pass. The hourly restart preserved all 2,377 saved rooms. Paid/set-aside Duke revival, full Advanced/expansion acceptance and mobile acceptance remain unfinished; the custody interpretation question is pending. The automation stays removed.

Ecaz Duke acquisition checkpoint, 7 September 2026: ECAZ_DUKE_ACQUISITION.md records direct acquisition through the reusable Ecaz Ambassador, same-disc transfer, token return, original entrant resumption, all-four-profile choices and readable controls. 2,474 rules/client/component +224 multiplayer tests (2,698 total), typecheck, lint and production build pass. Twenty Basic games completed 10,450 accepted actions with zero rejected candidates/stalls and 476 JSON round trips. Browser acquisition, refresh, inspection and subsequent battle use passed; Duke was set aside alive after use. Ambassador inventory now collapses without hiding the actual decision. Alliance/loan alternatives, Duke revival/capture, full Advanced/expansion acceptance and mobile acceptance remain unfinished. The automation stays removed.

Placement cancellation checkpoint, 7 September 2026: PLACEMENT_CANCELLATION_RECOVERY.md records source-bound Ecaz/Moritani/Duke denials and shared movement setup, phase income/refunds and victory. Duplicate movement order, absent victory allies and negative saved refunds now reject before supported cancellation costs. 2,450 rules/client/component +220 multiplayer tests (2,670 total), typecheck, lint and production build pass. Twenty Basic games complete 13,655 accepted actions without rejected candidates/stalls, with 603 JSON round trips. Browser cancellation, refresh, shipment and next-player handoff pass. All 2,286 older non-QA room versions/hashes remain unchanged. Full Advanced/expansion acceptance and exhaustive continuations remain unfinished. The automation stays removed.

CHOAM cancellation and revival checkpoint, 7 September 2026: CHOAM_WORTHLESS_CANCELLATION_RECOVERY.md records exact Worthless context restoration, shared unchanged revival checks and public storm offers. Malformed saves can no longer use these cancellation paths to produce negative Tanks, accept invalid revival prices/queues or restore a cross-phase Mentat decision. 2,386 rules/client/component +216 multiplayer tests (2,602 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,008 accepted actions without rejected candidates/stalls and with 536 JSON round trips. Browser cancellation, readiness and restart recovery passed. Controlled maintenance preserved all 2,287 saved room versions and hashes exactly. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Auction cancellation checkpoint, 7 September 2026: AUCTION_CANCELLATION_RECOVERY.md records shared Ixian draw/Technology and paid-sale, income, bonus and next-lot continuations. Independent review reproduced and fixed duplicated unsold-card custody in malformed saves. 2,312 rules/client/component +212 multiplayer tests (2,524 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 10,529 accepted actions without rejected candidates/stalls and with 475 JSON round trips. Browser cancellation, refresh and a subsequent legal bid passed. All 2,196 older non-QA saved rooms retain their exact versions/state. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Restored cancellation checkpoint, 7 September 2026: RESTORED_CANCELLATION_CONTROLS.md records exact Richese gift/purchase restoration, Moritani alliance cancellation and Ixian substitution cleanup. 2,250 rules/client/component +208 multiplayer tests (2,458 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,657 accepted actions without rejected candidates/stalls and with 522 JSON round trips. Browser gift cancellation recovered and exercised the original advisor choice. All 2,196 older non-QA saved rooms retain their exact versions/hashes. Exhaustive continuations, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The automation stays removed.

Combat and terminal cancellation checkpoint, 7 September 2026: COMBAT_TERMINAL_CANCELLATIONS.md records shared combat queues, income/knowledge cancellation, No-Field declaration checks and canceled CHOAM sales. 2,162 rules/client/component +204 multiplayer tests (2,366 total) pass (full suites plus eight focused ownership regressions); typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,552 accepted actions without rejected candidates/stalls and with 521 JSON round trips. Browser Baliset cancellation restored the Voice controls and private hand; the banner and seat highlight now name the actual decision owner. The manual restart preserved all 2,197 saved room versions and hashes. Exhaustive continuations, durable Karama cost frames and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle aftermath checkpoint, 7 September 2026: BATTLE_AFTERMATH_PREFLIGHT.md records shared ordered cleanup, board and collection calculations, movement cancellation and owner-promise prerequisites before supported Karama costs. It fixes zero-force storm geometry and preflights the newly empty Auditor path after a cost card is spent. 2,044 rules/client/component +201 multiplayer tests (2,245 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 11,550 accepted actions without rejected moves/stalls and with 521 JSON round trips. Browser capture cancellation and refresh recovery passed; all 2,105 older non-QA saved rooms retain exact versions/hashes. Exhaustive suffix proof, durable Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Battle, revival and disaster checkpoint, 7 September 2026: BATTLE_REVIVAL_DISASTER_PREFLIGHT.md records shared battle calculations, canceled-revival quotes and typed storm/worm prerequisites checked before Karama costs. 1,961 rules/client/component +197 multiplayer tests (2,158 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,430 actions without rejections/stalls and with 554 JSON round trips. A browser storm cancellation reconnected after the controlled restart; all 2,106 backed-up rooms retained exact versions and state hashes. Later battle aftermath, exhaustive cancellation/promise checks, Karama cost frames and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama cancellation checkpoint, 7 September 2026: KARAMA_CANCELLATION_CONTEXTS.md records original canceled-power bindings, pure Moritani cleanup prerequisites and pure canceled-Baliset arrival checks, preserving nested conversions and summoned-worm rides. 1,850 rules/client/component +194 multiplayer tests (2,044 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 12,735 actions without rejections/stalls and with 567 JSON round trips. Browser cancellation and refresh recovery passed; 2,075 older non-QA rooms retain exact saved versions/state hashes. Exhaustive cancellation/promise preflight, Karama cost frames, Semuta and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Karama preflight and conversion checkpoint, 7 September 2026: KARAMA_PREFLIGHT_AND_CONVERSIONS.md records pending BG purchase capacity, mandatory hand-return reservations, preserved conversion opportunities across nested interruptions, and pure Richese settlement prerequisites. 1,812 rules/client/component +188 multiplayer tests (2,000 total), typecheck, lint and production build pass. Twenty unchanged-source Basic games completed 14,230 actions without rejections or stalls and with 627 JSON round trips. The browser restored its pending BG response after refresh and the manual restart; all 2,076 saved rooms retained exact versions and state hashes. Complete Karama cost continuations, Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ordinary card discard checkpoint, 7 September 2026: ORDINARY_CARD_DISCARD_CONTINUATIONS.md records exactly-once recovery for completed Hajr, Ghola, Harvester, Weather Control and Family Atomics effects, including preserved income and preparation promises. 1,766 rules/client/component +184 multiplayer tests (1,950 total), typecheck, lint and production build pass. Twenty Basic games completed 10,931 actions without rejections or stalls and with 495 JSON round trips; dedicated new tests provide direct ordinary-card coverage. A browser Hajr playtest verified the extra move and refresh recovery. Semuta, remaining discard producers and complete Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Truthtrance discard checkpoint, 7 September 2026: TRUTHTRANCE_DISCARD_CONTINUATIONS.md records consumed-answer receipts, exact queued-question/parent restoration and preserved public history and promises. 1,742 rules/client/component +179 multiplayer tests (1,921 total), typecheck, lint and production build pass. Twenty current-source Basic games completed 12,616 actions with zero rejections/stalls and 559 JSON round trips; they contained no Truthtrance actions, so the 26 dedicated new tests provide direct coverage. All 1,956 saved rooms survived the manual restart unchanged; the QA table reconnected and updated internal guidance was visually checked. Semuta, remaining discard producers and full Advanced/expansion acceptance remain unfinished. The removed automation stays removed.

Ornithopter discard checkpoint, 7 September 2026: ORNITHOPTER_DISCARD_CONTINUATIONS.md records separate completed-arrival and early-ending continuations, exact force/marker/counter recovery and preserved Guild/Sapho queues. 1,721 rules/client/component +174 multiplayer tests (1,895 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 11,522 accepted actions, zero rejections/stalls and 517 JSON round trips; dedicated tests cover the expansion card. An actual two-group browser playtest verified refresh, prevention of reusing moved forces, automatic disposal and unchanged completed state after reconnect. Semuta and complete Advanced/expansion acceptance remain unfinished; the removed automation stays removed.

Box discard checkpoint, 7 September 2026: BOX_DISCARD_CONTINUATIONS.md records a completed paid search, frozen private recovery/shuffle and exact interrupted-control restoration. An independent Auditor corruption probe prompted binding modern saved opportunities to their completed battle receipt; legacy saves remain supported. 1,703 rules/client/component +169 multiplayer tests (1,872 total), typecheck, lint and production build pass. Twenty Basic regression games completed with 12,326 accepted actions, zero rejections/stalls and 551 JSON round trips; this sample preceded the final Advanced-only Auditor guard and does not exercise Box. Browser guide/readable layout and saved QA seat restoration were checked. Semuta, remaining discard producers and full expansion acceptance remain unfinished. The removed automation stays removed.

Forced Terror discard checkpoint, 7 September 2026: TERROR_DISCARD_CONTINUATIONS.md records Sabotage and Robbery overflow saved steps, private exact card custody, preserved victim/draw and optional gift or deferred Nexus continuation. 1,685 rules/client/component +165 multiplayer tests (1,850 total), final typecheck, lint and production build pass. Twenty Basic games completed with 11,332 accepted actions, zero rejections/stalls and 509 JSON round trips; dedicated tests cover the new Terror behavior. The browser rules checklist and saved-seat restoration were verified. Semuta and full expansion acceptance remain unfinished; the removed automation stays removed.

Battle discard checkpoint, 7 September 2026: BATTLE_DISCARD_CONTINUATIONS.md records mandatory mixed-owner disposal, separate winner/Moritani cleanup, frozen effective casualty choices and exact-once post-battle recovery. Independent tests exposed and prompted a fix for corrupted Auditor ownership being accepted by private projection. 1,673 rules/client/component +161 multiplayer tests (1,834 total), typecheck, lint and production build pass. Twenty current-source Basic games completed with 12,114 legal accepted actions, zero rejections/stalls and 540 JSON round trips. All 1,806 saved rooms survived manual restart unchanged, and the QA seat reconnected. Semuta remains inactive; the full goal remains unfinished and the removed automation stays removed.

Discard continuation checkpoint, 7 September 2026: TREACHERY_DISCARD_CONTINUATIONS.md records isolated Semuta transfer rules and saved steps for Ixian/CHOAM Ambassador exchanges and Ixian purchased-card replacement. Concurrent recovery preserves exactly one replacement and each original payout. A public automatic-work signal schedules private saved frames after reconnect. Semuta activation, other discard producers, reaction timing and the full-hand question remain unfinished; no mode gate was opened and the maintenance automation remains removed. 1,653 rules/client/component +156 multiplayer tests (1,809 total), final typecheck, lint and production build pass. The existing QA table restored after browser refresh. This does not certify a playable Semuta reaction or full expansion games.

Juice of Sapho checkpoint, 7 September 2026: JUICE_OF_SAPHO_RUNTIME.md records first/last Once Around and clean combined-turn ordering, full-hand eligibility, protected last beyond Guild deferral, private controls and all-profile AI. 1,631 rules/client/component +152 multiplayer tests (1,783 total), final typecheck, lint and production build pass. Desktop/mobile staged auctions and movement, exact-once disposal, refresh and restart recovery passed. Twenty ordinary-AI Basic games completed without rejected actions or stalls; they cannot exercise Sapho because expansion starts remain gated. Battle aggressor, normal auction scope and other timing modes remain unfinished, with three material questions pending. The maintenance automation remains removed.

Shipment promise checkpoint, 7 September 2026: TRUTHTRANCE_SHIPMENT_PROMISES.md records the new structured Basic reserve-shipment commitment, complete owned preparation search, actual event enforcement, all four AI responders and private human guidance. Full regression: 1,598 rules/client/component +148 multiplayer tests (1,746 total); final focused checks, typecheck, lint and production build pass. Twenty Basic games through public production start completed with zero rejected actions or stalls and fulfilled 30 naturally sourced shipment promises. Desktop/mobile controls and refresh recovery passed in an isolated QA room. Earlier-phase, Advanced/expansion and arbitrary future promises remain unfinished; no mode gate was opened. The maintenance automation remains removed.

Truthtrance and recovery checkpoint, 7 September 2026: named-card count questions now support exact/minimum/maximum comparisons, compound facts, private verified answers and all four AI profiles. TRUTHTRANCE_CARD_COUNT.md records the implementation and desktop/mobile playtest. CHOAM_MARKET_AUTO_AUDIT.md records automatic empty-market completion only during Bidding, where counts are public; independent review caught and removed an initial non-Bidding information leak. Background recovery now schedules empty Auditor offers and unaffordable audit payments. 1,577 rules tests +143 multiplayer tests pass (1,720 total), with typecheck, lint and production build. Twenty CHOAM/base complete games had zero rejected actions or stalls, but no empty-market auto-close event; direct branch evidence comes from focused and browser tests. All 1,686 saved rooms survived the hourly restart unchanged. CHOAM_KULL_SOURCE_UPDATE.md found no new official ruling; Kull and the overall goal remain unfinished.

Auditor checkpoint, 7 September 2026: CHOAM_AUDITOR.md records the new extra leader, private inspection/payment, native lifecycle restrictions, original portrait and actual desktop/phone/recovery checks. All 1,560 rules tests +137 multiplayer tests pass, with typecheck, lint and build. A 20-game CHOAM/base-faction sample completed after fixing a reproduced Emperor AI pending-revival timing bug: 14,316 accepted actions, zero rejections, 627 JSON continuations. The two Auditor revival-cycle interpretations remain pending; Kull Wahad and broad expansion/module work remain unfinished. Prior statements that Auditor is wholly missing are historical. No full-compliance claim or start-gate change is made.

Target: classic GF9 2019 Dune + advanced game + Ixians & Tleilaxu + CHOAM & Richese + Ecaz & Moritani, including optional expansion modules. User additionally requests generated images, animations, AAA polish, a complete navigable rule reference with tooltips/guidance, and addable AI players at Easy/Medium/Hard/Brutal difficulty. The player-facing app must not link to external sites. This is an ACTIVE goal, not a completed implementation.

Current working slice

• Vinext/React/TypeScript, Cloudflare Workers + D1 via Sites.
• Lobby with faction choice, rooms and shareable eight-character invitations.
• D1 authoritative JSON state with optimistic version checks; private HttpOnly seat cookies hashed in storage; personalized projections strip hidden game information.
• Six base factions, traitor setup, Fremen allocation, prediction.
• Basic nine-phase loop: storm dials, spice blow/Nexus, charity, auctions, revival, shipping/movement, sealed battle/traitor choices, collection, victory.
• Base faction choices now include BG optional free shipments; Fremen ally worm protection, post-Nexus multi-sector worm rides and free ally revival; winner card discards; Harkonnen ally traitor support. Server enforces the designated decision owner.
• Battle preparation has guaranteed Voice → prescience → element answer → sealed-plan steps. The faction owner chooses whether to assist an ally, only the requested element is committed, and prescience values stay private to the two combatants.
• Multi-sector movement and Guild shipments, with single total rounded shipment cost. Ally funding supports private phase-specific pledges, refunds and explicit payment splits; committed bids stay funded. Ordinary spice draws preserve deck order.
• Truthtrance now overlays interrupted decisions with storm-order declaration priority, verified named-card/selected-traitor AND/OR questions, public freeform answers, unknown/retry/save flow, turn-stamped records and AI responses. Current-battle conditions now constrain plans, compose with Voice/prescience and release when impossible after an opposing effect. Arbitrary promises, feasibility through future card plays and the full timing audit remain unfinished.
• CHOAM charity, force revival, Inflation, end-phase card sales/allied exchanges, special Karama cash-in and combat funding/income now have engine, private UI and AI support. Kulon, La La La, Baliset, Jubba Cloak and Trip to Gamont Worthless effects also have engine/UI/AI support. Auditor now has its extra disc, survival-based private inspection, full cancellation payment, Karama continuation, capture/foreign-ghola exclusions, first native revival, original portrait and four-level AI controls. CHOAM tables defer victory until their final Mentat opportunity after the market. Kull Wahad, Auditor repeated/sixth-disc revival cycles and interaction audits remain unfinished; the twelve ordinary leader rosters are verified; faction starts remain disabled.
• Partial faction powers and card effects. Explicitly blocks advanced/expansion starts pending implementation, instead of claiming complete compliance.
• Interactive terrain map, hand, table log, phase rail, action forms, responsive layouts, reduced-motion support.
• Original generated artwork: two Arrakis scenes, sixty identity-mapped ordinary leader portraits across all twelve factions, and a separate Duke Prad Vidal portrait, with live text/strength and vector fallback for unsupported identities or image failures.
• Optional tech tokens for tables of three or more: initial ownership, deferred phase income, post-battle transfers, one-owner set victory bonus, public UI, internal rule topic and all four AI policies. Expansion faction starts remain gated.
• Tleilaxu now has private Face Dancer setup, post-battle replacement, three-card recycling and once-per-Mentat replacement with Karama response. Zoal copies leader strength and bounty. Revival commerce now includes private early-leader quotes, force-limit permissions, discounts, income and Karama responses. Foreign ghola acquisition, private buybacks, shared leader control and AI are also implemented. Special Karama revival prevention now has engine/UI/AI support; its timing and exception audit remains unfinished, and starts stay gated.
• Cheap Hero traitor matches either hero card, supports repeated/ally calls and KH protection, and retains public revealed identities for UI/AI use.
• Amal has an explicit public opening window for all nine phases, before automatic phase effects. The engine, UI and bots support halving available spice with upward losses and deferred phase continuation.
• Thumper has phase-opening engine/UI/AI support using a virtual worm encounter that does not alter spice-deck inventory.
• Sandtrout has persistent spice-deck/anti-alliance support with private Atreides preview and public pending status; live expansion starts remain gated.
• Ixian cyborg/suboid combat, half-strength basic dials, fixed suboid support rules and post-casualty substitution have engine/UI/AI support. Ixian movement, collection capacity and typed revival pricing also have engine/UI/AI support. Hidden Mobile Stronghold placement, relocation, sector routes, entry, protection, battles, victory and special Karama now have engine/UI/AI support; setup/bidding technology now has private decisions, Karama responses and AI support. The complete fourteen-card Ix inventory is now assembled; complete-game expansion integration and interaction audits remain unfinished.
• The complete fourteen-card Ix treachery inventory is assembled with distinct identities, including the extra ordinary weapons, defenses, Worthless card and Harvester. The combined base/Ix deck has 47 cards. Full starts remain gated pending card-face and faction/phase interaction audits.
• Current verification: 2,517 registered rules/client/component tests and 226 persisted/API tests pass, with TypeScript, lint and production build. Coverage includes the Basic game, implemented advanced/expansion slices, four AI profiles, staged setup and private authoritative recovery. Public Advanced/expansion starts remain gated; passing slice tests does not certify them.
• Earlier checkpoint: verified Truthtrance current-spice comparisons now have authoritative answers, all-profile AI responses, controls, private restoration and duplicate-answer tests. Source-ordered base setup remains integrated with private prediction, traitor selection, force placement and an automatic final Treachery deal. The new 192-game Basic calibration completed 59,380 accepted actions without rejected candidates or checked failures. The shared offline initializer passes 456 Advanced setup combinations; 456 genuine Advanced games also completed with zero rejected candidates. Difficulty calibration and full expansion/module acceptance remain unfinished.

Stronghold Cards checkpoint (2026-09-07)

All six Advanced Stronghold Cards now have authoritative local battle effects, end-Mentat public custody, event-bound mobile copying, support/payment previews, AI policies, original bundled illustrations and full readable inspectors. A sole copy choice is announced automatically. Card ownership remains fixed until turn end even after defeat. Carthag augments actual defense roles; Habbanya also resolves Stone ties; Arrakeen preserves CHOAM donor/bank accounting. Independent review found and root corrected an inaccurate Stone outcome explanation. All-level testing exposed and root fixed omitted affordable Arrakeen plans for larger armies. STRONGHOLD_CARDS.md records sources, all six identities, interpretations and integration boundaries.

1,528/1,528 rules/client/component tests and 133/133 persistence/API tests pass (1,661 total). New coverage is 12 pure module cases, nine engine cases, four all-profile AI cases, three additional combat-matrix cases and four production-room SQLite cases. Recovery covers actual seat rotation, sealed plans, duplicate/crossed copy choices, exactly-once income/support and eight malformed persisted bindings. Full logs: /tmp/dune-stronghold-full.log (64.65 seconds), /tmp/dune-stronghold-multiplayer.log (18.27 seconds). TypeScript and lint: /tmp/dune-stronghold-final2-type.log, /tmp/dune-stronghold-final2-lint.log. Production build and final ledger rebuild both pass: /tmp/dune-stronghold-build.log, /tmp/dune-stronghold-final-build.log. The initial lint complaint about an ordinary image element was resolved using the installed image component.

A separate 40/40 complete-game sample exercised the module with base factions across all counts two through six and all four homogeneous AI profiles, twice per combination. It accepted 19,665 actions with zero rejected candidates, stalls or checked failures and continued through 912 actual JSON round trips. The unchanged strict base audit initializer is followed by empty optional-module configuration before any setup action; resources/cards/forces are untouched. This does not exercise Ixian or CHOAM complete games. Runner and complete traces: /tmp/dune-stronghold-fullgames.ts and /tmp/dune-stronghold-fullgames.json; summary hash/source evidence is in the module document. Root reviewed the complete runner and every contributed test file, all six generated illustrations, both source audits and runtime review. Comparative difficulty calibration remains unfinished.

Browser inspection verified all six normal desktop faces and all six enlarged faces on desktop and 390×844 phone width. Text remains selectable and readable, images are bundled, Close controls work and the viewport override was reset. The isolated room P2PLZKVL was created through the UI with a Guild host and two Hard AI opponents and completed normal setup. Only that named QA room was then staged for a mobile battle. A reload restored its two eligible public copy choices. Choosing Arrakeen preceded plans; two support spice correctly displayed bank 2/personal 0 and was accepted at zero personal spice. Battle settlement emitted the automatic bank-support notice. The subsequent collection phase awarded the separate four-spice city income; the lost mobile battle did not prematurely transfer its retained card. The sample is a staged control test, not an entire expansion game.

Manual maintenance at 00:46 UTC backed up all 1,593 rooms to /tmp/dune-maintenance-20260907T0046/database.sqlite, then verified all saved JSON hashes and versions exactly. The private Guild transport seat reconnected with its same hand and resources. The known human room remained v14 and idle. Development server session 81510 is the current controlled launch; next maintenance is due about 01:46 UTC if active development and human play permit. The user-removed automation remains removed.

Complete Advanced faction/card timing, all expansion games, Ecaz combined-force battles and every optional-module combination remain unfinished. Public mode gates remain closed. The goal remains active.

Effective battle weapon foundation checkpoint (2026-09-07 local date)

Shared combat now distinguishes physical card identity from effective attack behavior. A pure resolver describes canonical Mirror copies, original attack roles and independent copy-first Tooth/Stone choices. Ordinary leader attacks, Artillery effects and the Lasgun explosion predicate consume these descriptors; the engine and AI use the common explosion check for their entitled inputs. Physical plans, custody, prescience, promises and retention remain unchanged. Mirror plan admission is still disabled: copied-choice persistence, effective Stone outcome, controls and settled cleanup remain necessary before activation. EFFECTIVE_BATTLE_WEAPONS.md records the complete contract and boundaries.

1,500/1,500 rules/client/component tests and 129/129 persistence/API tests pass (1,629 total). Sixteen new tests cover both copy orientations, printed defense matrices, independent Tooth answers, Artillery suppression, explosions, strict identities and blocked partial activation. Full logs: /tmp/dune-effective-weapons-full.log (67.15 seconds), /tmp/dune-effective-weapons-multiplayer.log (18.64 seconds). TypeScript, lint and production build pass: /tmp/dune-effective-weapons-type.log, /tmp/dune-effective-weapons-lint.log, /tmp/dune-effective-weapons-build.log. Independent regression comparison found zero differences across865,580 attack,216,395 explosion and3,364 single-weapon evaluations of existing canonical cards. Root reviewed the helper, both new test files, integration, comparison script and independent audits. Historical648-game calibration was not rerun.

Fresh bounded publisher retrieval did not settle the previously asked Mirror copied-Tooth/Artillery disposal question. No user answer or house rule was inferred. Current Stone and Portable foundations supersede the older Mirror audit's descriptions of missing implementations. Recovery-only follow-ups include plain evaluator errors for malformed Mirror-marked saves and missing event/source validation for existing Poison Tooth answers; no valid-action exploit was demonstrated. No live game was staged or played in this slice. The user-removed automation stays removed; server session24370 remains the last controlled launch, with maintenance next due about00:46UTC if active development and human play permit. The full goal remains active.

Pending physical shipment integrity checkpoint (2026-09-07 local date)

Ordinary physical shipments now revalidate current turn/opportunity, typed reserves, arrival stance, destination, price, funds and reciprocal allied contribution before continuation. Guild allowance and special-stop responses must match the saved public declaration. Invalid state rejects before any room write or response-card disposal. New declarations include their turn; valid older unstamped saves still resume. Concealed No-Fields retain separate contracts. No automatic save repair or cancellation settlement was introduced. See PENDING_SHIPMENT_INTEGRITY.md.

1,484/1,484 rules/client/component tests and 129/129 persistence/API tests pass (1,613 total). Ten new engine cases and three production-room SQLite cases include 24 corrupted declarations checked independently for allowance and stop, stamped/legacy restoration and duplicate CAS. Root integrated and reviewed both agents' complete files; the final runtime includes the reciprocal-donor correction caught by independent testing. Full logs: /tmp/dune-pending-shipment-full.log (61.96 seconds), /tmp/dune-pending-shipment-multiplayer.log (16.80 seconds). TypeScript, lint and production build pass: /tmp/dune-pending-shipment-final-type.log, /tmp/dune-pending-shipment-final-lint.log, /tmp/dune-pending-shipment-final-build.log. The historical 648-game calibration was not rerun for this slice.

Browser inspection confirmed that the existing Guild QA seat remains at its legitimate movement decision, with the same private hand, 20 reserves and two spice. The updated internal phase guidance is readable, searchable and reachable by its direct link after page loading. No new live state was staged. A read-only database comparison found 1,563 rooms and exact unchanged JSON/version pairs for all 1,502 rooms in the 23:45 UTC backup. The known human room remains v14; Guild QA remains v13. The removed automation stays removed. Server session24370 remains the last controlled launch; next manual maintenance is due about00:46 UTC if active work and human play permit.

The allied transit audit confirms that ordinary shipment into allied territory followed by departure is allowed by the November FAQ but remains unsupported by the table. The exceptional outcome after an opposing effect makes departure impossible remains a pending user clarification; no answer was inferred. ALLIED_TRANSIT_RULES.md records source precedence, advisor separation and the distinction from existing co-occupation. Ordinary Guild rate/permission cancellation, nonbattle Truthtrance promises and the wider Advanced/expansion scope remain incomplete. The goal remains active.

Guild contributor routing and transport controls checkpoint (2026-09-07 local date)

The Guild now receives a non-Guild ally’s shipment contribution even when Guild itself ships. Guild’s own payment still goes to the bank. The coordinating review applied November2020 FAQ’s direct-contributor rule over April’s older transfer-to-shipper wording; the source provides a general rule, not an explicit reverse-direction worked example. Both ordinary shipment and direct Guild transport use the same income calculation. Independent Karama, Guild-funded allied shipment and income cancellation retain their distinct payment destinations. Automatic chronicle entries explain collection or prevention.

Guild cross-planet, southern-reserve and return controls now display the actual selected physical-force total, rounded price, personal share and authorized ally pledge. They reject invalid counts, elite allocations, entry and funding before submission; the server remains authoritative. Combined-sector totals override the unrelated scalar control. The private preview does not expose opposing spice or implement future-action feasibility. The source/payment contract and remaining limitations are recorded in GUILD_SHIPMENT_PAYMENTS.md.

1,474/1,474 rules/client/component tests and 126/126 persisted/API tests pass (1,600 total). Nineteen new rules/quote tests and three production-room SQLite cases cover contributor direction, both settlement paths, exact counts, cancellation, duplicate CAS, privacy and restored pending income. Independent UI review compared10,320 synthetic settled-state selections without a quote/server mismatch. Root integrated and reviewed every contribution. Full logs: /tmp/dune-guild-full.log (67.75seconds), /tmp/dune-guild-multiplayer.log (17.60seconds). TypeScript, lint and production build pass: /tmp/dune-guild-final-type.log, /tmp/dune-guild-final-lint.log, /tmp/dune-guild-final-build.log. Historical648-game calibration was not rerun for this change; current full suites include the existing complete-game cases.

Root browser QA created room6XMTUD6U with Guild and two Hard AI seats, completed setup, then explicitly staged only that room atv11 for transport/payment inspection. A1+2 combined group cost2 despite scalar amount19; five-force Red Chasm transport correctly exceeded available1+2spice, while return cost3 remained enabled. Actual return consumed personal1 and pledged2, returned five forces and credited Guild the donor’s2. Finalv13 has20reserves, no Guild forces on Dune, spice2, zero incoming pledge and spent shipment; movement remains unspent. A fresh invitation restored the same private seat, spent shipment and enabled Finish control. Full-page desktop visual inspection found readable labels/counts/costs and no clipped quote controls. This is a focused staged scenario, not full-game or mobile acceptance.

The manual23:45UTC restart backed up all1,502rooms, then verified exact JSON hashes/versions, HTTP200 and private-seat restoration in PRAVNYBG. The known human room remained v14 and idle. The initial sandboxed launch failed on denied network-interface access; the authorized runtime launch succeeded, without database repair. The removed automation remains removed. Current development server session24370 started around23:46UTC; next manual maintenance is due around00:46UTC7September if development continues and human play permits. Production test runs add QA rooms; do not infer that later room-count growth changed earlier saved states.

Shared normalized pending intents, ordinary Guild rate/permission responses and current-turn Truthtrance promises remain incomplete. An additional audit found malformed/stale persisted ordinary intents can bypass revalidation; this was not a valid-action remote exploit and needs a separate exact-custody/context check without inventing cancellation recovery. Advanced and expansion starts remain gated. The overall goal is active.

Truthtrance current-spice checkpoint (2026-09-07 local date)

Truthtrance now asks whether another player currently holds exactly, at least or at most a nonnegative whole amount of personal spice. The server compares p.spice at the answer action, excluding separate pledged aid and incoming payments. It rejects dishonest/unknown answers to this knowable fact and publishes only the requested answer. AND/OR keep their three-valued semantics and reveal no additional per-clause results. The fact does not constrain later legal spending. Freeform interpretation, other facts and nonbattle promises remain incomplete.

The existing private-answer projection lets all four AI levels respond legally without new privileged information or balance fields. The UI adds a styled comparison/amount form, linked input validation and public preview, and the in-game reference adds a five-part checklist. Root reviewed all new tests and the UI; independent privacy/recovery review found no runtime defect. No engine dispatcher, public mode gate or bot strategy was changed. See TRUTHTRANCE_SPICE_FACTS.md.

1,455/1,455 rules/client/component tests and 123/123 persisted/API tests pass. Nine new rules/AI cases include105 comparator lifecycle examples, all profiles, secret-state perturbations and a later paid revival. Four new SQLite cases preserve a genuine auction/payment choice, private composite answers and one history/discard under duplicate CAS. The first broad run included eight of the nine new rules tests; the final broad run includes all nine. Logs: /tmp/dune-truth-spice-final-full.log, /tmp/dune-truth-spice-multiplayer.log. Released-source TypeScript, lint and production build pass: /tmp/dune-truth-spice-final2-type.log, /tmp/dune-truth-spice-final2-lint.log, /tmp/dune-truth-spice-final2-build.log. No additional broad game-calibration claim is inferred from the earlier648-game source checkpoint.

Browser QA in the explicitly staged private roomPRAVNYBG verified a human spice question to Hard AI, disabled invalid amounts, an AI Yes with one card discarded, the resumed first Storm, and invitation recovery. A second canonical card fixture verified the human-target private answer and pending-question restoration. Publishing it produced finalv18: two Yes records, exactly two physical Truthtrances in discard, unchanged personal balances10/7 and the same saved Emperor storm dial3. Root visually inspected both forms. No real human room or earlier completed browser game was modified. The database now contains1,502 rooms; all1,388 rooms from the22:45UTC backup retain exact versions/state hashes except the previously recorded intentional ZJUGV6XW Karama completion. The real human room remainsv14.

The broader source-defined shipment commitment requires shared legal shipment feasibility, declaration/settlement checks, prevention of voluntary evasion through spending or skipping, and honest release after opposing effects. Those requirements and the unresolved Guild cases remain in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md. Full Advanced/expansion acceptance and the overall goal remain unfinished. The removed automation stays removed; the next manual development-server maintenance remains due around23:45UTC if active work continues and human play permits.

Source-ordered setup checkpoint (2026-09-07 local date)

New base tables follow the published sequence: fixed player positions, private Bene Gesserit prediction, private traitor selection, starting spice and forces, then Treachery. The persisted setup stage exposes only the IDs of players whose choices remain. Fremen place before the Advanced starting advisor; absent factions and completed automatic steps need no acknowledgement. Harkonnen keeps four traitors automatically. No starting Treachery identity is available during placement.

Public Basic start and the strict offline initializeBaseGameForAudit share one initializer. The audit entry accepts only a fresh ready base-faction lobby without expansions or optional modules and cannot be selected through a room action. Public Advanced and expansion gates remain intact. Legacy setups without a stage finish using their existing pieces; recovery never repeats the new initializer.

The complete suites pass 1,446 rules/client/component tests and 119 persisted/API tests, including 456 Advanced setup combinations across all 57 base-faction rosters, all four profiles and both actor/physical orders. Stage-ending duplicate requests commit only once through the production SQLite compare-and-swap path. The earlier failures were fixtures assuming the old deal order; the corrected fixtures preserve their gameplay, privacy, pacing and concurrency assertions. Logs: /tmp/dune-staged-setup-full.log, /tmp/dune-staged-setup-multiplayer-final.log, /tmp/dune-staged-setup-type-final.log, /tmp/dune-staged-setup-lint-final.log, /tmp/dune-staged-setup-build-final.log.

Two frozen-source Basic studies complete 192/192 games, 59,380 accepted actions, zero rejected candidates, stalls, exceptions or checked invariant failures. AI_STAGED_SETUP_BASIC_CALIBRATION_20260907.md records exact source boundaries and the historical incorrect-order comparison. Four registered Advanced full-game bot cases now begin genuinely Advanced through the shared initializer. The separate Advanced roster study completed 456/456 games with 116,270 accepted actions, zero rejected candidates or checked failures, and 5,943 actual JSON continuation points. It covers all 57 rosters at four difficulty shifts and two seed blocks. The 20-game pilot exactly reproduces the first 20 full-study rows and is not counted as additional independent games. Medium, Hard and Brutal do not show a consistent increasing strength ladder. These complete games do not resolve the remaining rule gaps or certify full Advanced compliance.

After calibration completed, engine formatting preserved its canonical syntax tree; formatting and setup-reference/checklist changes occurred outside the measured source intervals. The final engine hash is db169e5fc959a7b26469f22f26e6957cbb39fe49aab8ed25a8714dec3c31a3c1. All 22 targeted setup/reference checks and released-source TypeScript, lint and build pass: /tmp/dune-staged-setup-final-reference.log, /tmp/dune-staged-setup-final2-type.log, /tmp/dune-staged-setup-final2-lint.log, /tmp/dune-staged-setup-final2-build.log. The five-part setup checklist now records implementation, controls, AI, documentation and verification separately.

Two fresh browser tables verified prediction before private cards, private traitor selection with empty hands/board, human and AI Fremen placement, and the automatic card deal into Storm. One then completed online atv347 with a turn5 Bene Gesserit victory under voluntary Brutal autopilot; a fresh invitation restored its finished board and private hand. No game-state staging was used. Independent source/privacy review found no substantive defect in valid base setup or legacy continuation. Complete expansion setup and optional-module ordering, broader Advanced interactions and the remaining base Guild/Truthtrance rules remain required. The next bounded Truthtrance slice is documented in TRUTHTRANCE_NONBATTLE_READINESS_20260907.md: verified current-spice questions first, followed by source-defined shipment commitments with their full enforcement and feasibility requirements.

Fremen movement cancellation and Advanced setup checkpoint (2026-09-07 local date)

Ordinary Fremen movement now offers a Karama response only when the selected route uses its two-territory advantage. A stored turn/movement/group intent waits before any force moves. Allowance revalidates and continues the exact group through normal arrival handling. Cancellation spends one cancellation card, preserves the forces and unspent movement, and limits that particular movement use to one territory. Hajr or the second distinct Ornithopter group has a fresh range use; city and fixed-card ornithopter range remain independent. The November 2020 FAQ supersedes the April whole-phase answer; see FREMEN_MOVEMENT_KARAMA_RULES.md.

The public response explains the destination and consequence. The mover sees the current restriction, and ordinary movement and normal-range Ornithopter controls reject an unavailable replacement route before submission. All four bot profiles use the projected current restriction; Hard and Brutal can cancel an enemy movement toward their own public fighters. Advanced Bene Gesserit setup bots now wait for the public Fremen placement prerequisite while completing their own traitor/prediction choices, then consider all legal printed starting sectors.

The complete existing run passed 1,431 tests, and all five subsequently registered independent movement edge tests passed on the same engine. The 116-test persisted/API suite passed. New verification consists of four BG setup tests, nine Fremen tests, five independent continuation/typed-custody tests and three production-room SQLite recovery/concurrency tests. Full suite logs: /tmp/dune-fremen-full.log, /tmp/dune-fremen-multiplayer.log; independent integration log: /tmp/dune-fremen-review-integrated.log. The edge suite was still being edited during the first type/lint run; its released version passed the subsequent type check. Subsequent released-source TypeScript, lint and production build checks passed (/tmp/dune-fremen-type-verified2.log, /tmp/dune-fremen-lint-verified.log, /tmp/dune-fremen-build-verified.log). Browser checks and the 1,388-room restart are recorded in VISUAL_PLAYTEST.md.

Both 96-game Basic studies completed with 56,766 accepted actions and zero rejected candidates, stalls, exceptions or checked invariant failures. The source files stayed unchanged during both runs; AI_FREMEN_MOVEMENT_CALIBRATION_20260907.md preserves hashes, exact boundaries, paired changes and non-monotonic difficulty outcomes. These are four-player Basic studies. The preceding 312-game player-count checkpoint remains historical evidence, not a claim that every prior simulation was rerun on this changed engine.

Two isolated browser rooms verified the human cancellation and replacement controls, including a disabled invalid route, a completed legal replacement and a pending response restored after the 22:45UTC controlled server restart. All 1,388 saved rooms retained exact versions/state hashes through the restart. Their names explicitly mark QA; no real human room was staged. Full Advanced setup and game acceptance, the remaining Guild/Truthtrance rules and all unfinished expansion systems remain required. The removed automation stays removed.

A subsequent setup ordering audit found that this historical checkpoint dealt private cards before BG prediction and starting Treachery before normal traitor/force choices. The following staged setup implementation corrects that defect for new tables. Old saved setup rooms retain their already-known cards and continue without redealing.

AI battle legality checkpoint (2026-09-07 local date)

AI plans now require an available controlled leader or Cheap Hero, retaining the explicit no-leader and forbidden-Hero exceptions. Leaderless plans cannot carry battle cards or the Kwisatz Haderach. Voice compulsion uses each held card’s default role, while prohibition and actual usage use the selected battle slot. This preserves legal Chemistry/Weirding Way alternatives and canonical Portable Snooper behavior.

An own Prescience commitment now restricts the leader, weapon or defense candidates before scoring and slot validation. It no longer overwrites a validated plan afterward, so one physical card cannot be introduced into both slots and the final leader determines KH eligibility. Dial commitments retain typed casualty/support checks. Existing Truthtrance completion hints, Stone preflight, custody and hidden-information boundaries remain active. The authoritative engine and difficulty profiles were not changed.

AI battle selection now uses public fighter presence, storm order and an accessible same-territory path. Polar Sink, advisors, allies, earlier aggressors and storm-separated groups are excluded. The Hidden Mobile Stronghold uses its pointing sector for storm blocking. Concealed No-Field values are never consulted; public marker presence alone supports battle selection.

1,418/1,418 registered rules/client/component tests and 113/113 persisted/API tests pass, plus TypeScript, lint and production build. New coverage is three root Prescience cases, seven independently authored plan cases, nine independently authored battle-choice cases and three independent worm-ride regressions, each testing all four difficulties. Every candidate in those fixtures is applied through the authoritative engine, with private-view invariance checked separately. Final logs: /tmp/dune-battle-ai-final-full.log, /tmp/dune-battle-ai-final-multiplayer.log, /tmp/dune-battle-ai-final2-type.log, /tmp/dune-battle-ai-final-lint.log, /tmp/dune-battle-ai-final-build.log.

A broader player-count run exposed one Fremen worm ride aimed back at its origin. Ride candidates now exclude that territory and apply public destination-entry conditions before the target limit, while preserving unlimited ride distance, multiple source sectors, elite custody and the separate free-reinforcement rules. All original four-player accepted traces remain identical in the final reruns.

The original and second 96-game Basic calibration batches now complete 192/192 games with zero rejected candidates, across 58,238 accepted actions. No deadlock, action-limit, exception or checked invariant failure occurred; every accepted action was the first offered candidate. All 96 original-seed accepted traces/final states match the preceding mobility run exactly, while 92/96 second-seed traces match. The second seed is a previously observed regression set, not a new blind strategy validation. Sources stayed stable. See AI_BATTLE_CALIBRATION_20260907.md for preserved hashes, changed rows and non-monotonic difficulty outcomes.

The final separate two-through-six-player study completed 120/120 Basic games, with 24 at each player count, 51,547 accepted actions, zero rejected candidates and no checked failures. Its only earlier rejection was the now-corrected worm ride. All recorded non-timing row fields match the initial study except that one rejection’s fields. The older harness does not record complete trace/state hashes or seed UUIDs, so no byte-identical replay is claimed. See AI_PLAYER_COUNTS_20260907.md. Combined with the final four-player pair, the current frozen code completed 312 games with zero attempted-candidate rejections; these different studies are not pooled as independent strength trials.

A live Basic two-player game also completed after the human Fremen enabled Brutal autopilot against the Hard Guild. The Guild won on turn 3 with four strongholds; a fresh invitation restored the completed v112 state and exact private seat. No battle occurred in that browser game, so its evidence is online progression, completion and recovery. See VISUAL_PLAYTEST.md. The full Advanced/expansion scope and reliable difficulty ordering remain unfinished.

The independent base Advanced readiness audit separates concrete base-game gaps from unrelated expansion work. Immediate targets are the BG setup AI prerequisite, Fremen movement Karama cancellation, distinct Guild rate/transport cancellations, and unfinished Truthtrance obligations. Some special-Karama settlement policies still await authoritative resolution. Existing Advanced subsystem simulations bypass genuine Advanced setup, so authentic setup, complete games and browser recovery remain required before enabling that mode.

AI movement legality checkpoint (2026-09-07 local date)

All four profiles now filter ordinary movement using the actual selected force group, faction range, city access, Ixian cancellation, CHOAM bonus, storm geometry, occupied strongholds and advisor arrival/lock rules. Legal destinations are filtered before the ranked target limit, preserving reachable alternatives. Easy explicitly includes the minimum required cyborgs when ordinary troops cannot fill its chosen group. Allies can remain legal transit points while prohibited arrivals stay excluded; Baliset and mobile-stronghold exceptions retain their authoritative behavior.

Fremen ordinary reinforcements use static distance from the Great Flat and remain distinct from paid allied Guild transport. Advanced Fremen storm reinforcement remains available. Guild transports use the rounded total shipment cost, own available spice and explicitly pledged ally funds. Hidden opposing hand contents, unpledged spice and foreign No-Field denominations do not enter these choices. Authoritative engine rules and difficulty profiles were not changed.

The ordinary shipment control also explains and disables Fremen destinations outside that radius. Nonzero storm destinations disable ordinary movement and shipment, with the printed Advanced Fremen reserve-shipment exception retained. These are destination checks; full route previews, broader legal-action guidance and card-specific movement controls still need further acceptance. The final UI follow-up passes TypeScript, targeted lint and production build (/tmp/dune-mobility-ui-build.log).

The registered suite passes 1,396/1,396 rules/client/component tests and 113/113 persisted/API tests. New coverage comprises three transport-budget tests and eight independently authored reachability tests across all profiles; existing shipment tests now require legal Fremen radius and funded Guild transport. TypeScript, lint and production build pass. Logs are /tmp/dune-mobility-full.log, /tmp/dune-mobility-multiplayer.log, /tmp/dune-mobility-final-type.log, /tmp/dune-mobility-lint.log and /tmp/dune-mobility-build.log.

Two unchanged-harness Basic simulations completed 96/96 games each, including the original comparison seed and a held-out seed. The original seed's rejected candidates dropped 94.01% (5,508 to 330); the held-out run had 471. Neither new run produced a movement/shipment rejection, stall, action-limit, exception or checked invariant failure. Source fingerprints stayed stable. Medium/Hard/Brutal strength ordering remains unverified, and battle-candidate legality remains an active improvement target. See AI_MOBILITY_CALIBRATION_20260907.md for the complete design, categories, shared-win handling and limits.

A documentation-only CHOAM Auditor audit identifies setup, traitor, capture, revival, privacy and post-battle integration points. It corrects the overbroad historical claim that Auditor cannot use a Ghola card: foreign Tleilaxu acquisition is the specific prohibition. The audit does not implement Auditor; repeated revival cycles and some combined timing remain unresolved. Full Advanced/expansion starts remain gated, and the complete goal remains active.

Browser acceptance completed ordinary Fremen free shipment and movement, then observed the Hard Guild AI's paid shipment and move in a new unmodified two-player Basic table. Fresh invitations restored both that table and the preserved Stone battle QA seat. The corrected radius/storm warnings were inspected in the live UI. Manual restart and final comparison preserved all 1,265 pre-existing room versions and exact state hashes. New QA room JJPGBA2Q remains atv78 with a genuine turn2 movement choice. Details and limits are in VISUAL_PLAYTEST.md. No maintenance automation was recreated; live server session97328 started around21:46UTC and its next manual maintenance is due around22:46UTC during active work.

Stone Burner, complete ordinary portraits and recovery checkpoint (2026-09-06)

• Canonical Stone Burner now uses the weapon slot without changing its saved kind: special identity. It has a named Voice role, Prescience/Truth-compatible original commitments, a private precommit availability check, and an event-bound owner choice after both plans reveal. Kill mode kills both participating leader discs; ignore mode preserves other weapon attacks. Both replace ordinary strength with undialed physical-token comparison, with the aggressor winning ties. Neither adds the Kwisatz Haderach bonus or kills that companion. Normal support, bounty, traitor/explosion precedence, casualty choices and winner/loser/Moritani retention remain shared with the existing battle flow.
• Physical counting enumerates every legal casualty allocation. A winner is accepted only when every permitted pair agrees. The printed Advanced Emperor example includes three possible remaining-token totals; where all give the same winner, the winner still chooses its normal casualty allocation afterward. Where the choice could change the winner, a conservative check rejects Stone before either hidden opposing plan is inspected. Foreign No-Field values are represented by public possibilities, never read to decide availability. Compulsory Stone Voice must leave a common zero-spice completion across those public possibilities.
• Two actual interpretation questions remain unanswered: the commitment procedure when Advanced or Basic Ix physical allocations change the winner, and the priority of opposing Stone/Poison Tooth revealed choices. No policy was inferred from silence. A public Ix-configuration guard prevents accepting a Stone plan whose combined timing cannot yet finish. This is an explicit implementation boundary, not a printed prohibition. Mirror/copied weapons and unfinished modules remain uncertified. See STONE_BURNER_ENGINE_AUDIT.md.
• Player controls show both original plans, exact undialed counts or honest possible totals, the mode choice and a complete internal guide. No victim/death confirmation is added. The card stays physically reserved until standard cleanup; stale events, duplicate requests and corrupted source custody fail before resources change. All four AI profiles use public force possibilities, legal low-dial plans and revealed leader/bounty information. They preserve leader value when Artillery suppresses bounty and leave traitor/explosion precedence intact.
• 1,385/1,385 registered rules/client/component tests and 113/113 persisted/API tests pass, together with TypeScript, lint and the production build. New coverage is eight pure Stone cases, seven root engine cases, nine independent reviews, five AI cases, three persisted recovery cases and four special-art cases. Logs: /tmp/dune-stone-final-full.log (34.28 seconds), /tmp/dune-stone-final-multiplayer.log (16.22 seconds), and /tmp/dune-stone-final-{type,lint,build}.log. All original card identities and the full expansion start gates remain intact.
• Browser QA selected Stone in the normal weapon selector and reached a real revealed choice in synthetic room QPNV5XJJ. The manual hourly restart saved all 1,235 rooms and preserved every version and exact state hash, including the pending choice at v60, event 20d21df3-8e58-4039-b6be-44db4f0d661a. A fresh invitation restored the exact decision with no payment/death. After choosing kill, Harkonnen won 4–0 on undialed tokens; Feyd-Rautha and Ein Calimar each died once, the normal 11-spice bounty was paid, one dialed force was lost, and Stone was retained normally. Final v68 has four Harkonnen forces at Pasty Mesa, 19 spice, one Stone in hand and none in discard, with no battle or decision. All other 1,234 saved room hashes remain unchanged. The enlarged card/guide and corrected decision heading/counts were inspected. Backups: /tmp/dune-maintenance-20260906T1215/; snapshots: /tmp/dune-stone-browser-pending-v60.json and /tmp/dune-stone-browser-complete-v68.json. Live server session11092 started around12:15 UTC; the next manual maintenance is due around13:15 UTC if development continues. The removed automation remains removed.
• Ecaz and Moritani each gained five original portraits, completing 60/60 ordinary leaders across all twelve factions. The separate Duke Prad Vidal portrait brings special-disc coverage to one without adding him to an ordinary roster or traitor inventory. All prior assets and provenance records were preserved. Full-resolution inspection, asset tests and actual192px/80px browser review passed. Duke's actual component additionally passed custody-label, inspector, identity-fallback and real404-fallback checks in an isolated byte-identical harness. Its temporary server was stopped. See ECAZ_PORTRAITS.md, MORITANI_PORTRAITS.md and DUKE_VIDAL_PORTRAIT.md. Auditor, Kwisatz Haderach and other nonordinary component artwork remain separate unfinished work.
• Semuta Drug, Mirror Weapon and Juice of Sapho remain inactive. Source audits now identify Semuta's fresh-discard continuation requirements and Sapho's scoped ordering requirements; these are not runtime completion claims. Other unfinished faction/module systems, mobile acceptance, difficulty-strength calibration and complete Advanced/expansion games still prevent goal completion. No start gate was removed.

Balanced Basic AI calibration (2026-09-06)

A new balanced four-player study completed 96/96 Basic games with no stalls, action limits, exceptions or checked resource/hand invariant failures. Each difficulty appeared 96 times, with balanced faction, seat and physical-circle marginals. Wins were Easy 1, Medium 30, Hard 28, Brutal 37. Easy was weaker in this sample, but the two seed replicates do not establish a reliable Medium → Hard → Brutal ordering. No resource bonuses or unauthorized information were used. The run accepted 28,379 actions; 911 first candidates and 5,508 total candidates were rejected before legal fallbacks progressed, chiefly movement reachability and Fremen entry. Those candidates and 243 unaffordable Guild transports remain concrete improvement targets. Source fingerprints were stable during measurement and a four-game prefix replay reproduced all non-time results. This is Basic completion evidence, not expansion or human-strength certification. See AI_CALIBRATION_20260906.md and tools/ai-calibration-stone.ts.

Portable Snooper runtime and Richese portrait checkpoint (2026-09-06)

• Portable Snooper now supports its ordinary poison-defense slot and optional play after both plans reveal, for all twelve holders in Basic and Advanced development fixtures. Exact canonical role predicates preserve saved kind: special identities without admitting unrelated cards. Normal plan searches, Voice, Prescience, structured Truthtrance names, player selectors and AI use that same role. It stops ordinary poison and weapon Chemistry, but not Tooth, Artillery, Lasgun or the projectile half of Poison Blade.
• Late play uses the spare battle-card slot and preserves the complete original plan. A lone Worthless in either slot is allowed; a real defense, weapon-plus-Worthless or two occupied slots blocks it. Voice compulsion must be met originally when possible, and forbidden poison defense remains forbidden late. The existing own traitor-declaration opportunity is the explicit application deadline, independent of hand contents; no extra holder-only public window or acknowledgement was added.
• Battle.lateDefense records the public played card separately, with exact battle-event and physical-custody validation. The card stays reserved in its owner's hand through remaining decisions and appears in the public component inspector only after play. The effective defense feeds combat, while the original plan remains the source for inspected and structured promised slots. Winner, loser and Moritani retention cleanup all account for that one physical card. Current decisions, Truthtrance and responses retain priority; duplicate and stale requests cannot replay protection or cleanup.
• Source review corrected an earlier retention assumption: the official November 2020 FAQ permits winning battle-card retention even without a keep footer, while explicitly naming Tooth/Artillery exceptions. Portable therefore uses ordinary winner retention. Mirror's ordinary retention follows the same source; inheritance of a copied Tooth/Artillery discard exception remains a separately pending user ruling. PORTABLE_SNOOPER_ENGINE_AUDIT.md and MIRROR_WEAPON_ENGINE_AUDIT.md record provenance and boundaries. Mirror itself remains inactive.
• 1,352/1,352 rules/client/component tests and 110/110 persisted/API tests pass, plus TypeScript, lint and production build. This adds five pure, five root engine, seven independent review and six all-profile AI cases, plus three persisted recovery cases. The recovery race forces both first-commit orderings between late defense and own traitor declaration. Logs: /tmp/dune-portable-final-full.log (35.29 seconds), /tmp/dune-portable-final-multiplayer.log (17.89 seconds), /tmp/dune-portable-final-type.log, /tmp/dune-portable-final-lint.log, /tmp/dune-portable-final-build.log.
• Browser QA verified the ordinary defense selector, sealed an empty original defense, played Portable against revealed Chaumas, and inspected the separate public late card. A fresh invitation preserved the exact pending v46 state and event before resolution. Feyd-Rautha survived, Harkonnen won 8–6, and the normal keep/discard choice retained Portable. Final v51 has three forces at Pasty Mesa, eight spice, Maula Pistol plus exactly one Portable, no Portable in discard, no battle or decision, and a living Feyd-Rautha used in that territory. The enlarged guide was visually inspected. Snapshots: /tmp/dune-portable-browser-pending-v46.json and /tmp/dune-portable-browser-complete-v51.json. All other 1,174 saved room hashes still match the last maintenance backup. This is a focused battle/reconnect check, not complete expansion-game acceptance.
• Final integrated review fixed a late-defense AI omission for Cheap Hero accompanied by the Kwisatz Haderach. All four profiles now preserve the +2 when protection changes defeat into victory; an ordinary zero-strength hero still does not consume the card. The real Advanced Atreides regression follows actual power preparation, legal spice support and both traitor decisions. Portable’s enlarged inspector now opens its specific timing/interaction guide, and its summary explicitly offers both normal and late use. The final 18 guide/reference tests also pass.
• Five original Richese portraits bring ordinary coverage to 50/60, completing both factions in each of the first two expansions as well as the six base factions. All forty-five prior files and manifest entries are unchanged. Full-resolution inspection, four existing asset tests and actual 192px inspector / 80px circular browser review pass. The exact temporary review server was stopped. See RICHESE_PORTRAITS.md. Ten Ecaz/Moritani ordinary portraits and separate special-disc artwork remain unfinished.
• Four Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon and Juice of Sapho. Complete faction/module interactions, mobile acceptance and full Advanced/expansion games remain unfinished. No start gate was removed. The live development server remains the verified session started during the preceding maintenance; the removed automation stays removed and the full goal stays active.

Residual Poison runtime and CHOAM portrait checkpoint (2026-09-06)

• Canonical Residual Poison now has engine, private controls and all four AI policies. Before either combatant commits a leader, it uniformly selects one living, currently controlled opposing leader available in the battle territory, sends that physical disc to the Tanks and discards once. Same-territory reuse remains eligible; dead or elsewhere-used leaders, Cheap Heroes and the Kwisatz Haderach are excluded. There is no payment, bounty, force loss or automatic battle victory.
• A hand-independent shared preparation step gives both combatants an actual opportunity before leader commitment in Richese tables. Both choose readiness; no nonholder is silently passed. This is a disclosed application timing procedure, not a claimed publisher ordering rule. Active interactions retain priority. Exact saved battle events bind both actions and retries. No additional confirmation is added to the random death.
• Foreign ghola revival custody and Duke Vidal's physical disc/death history are preserved. Involuntary death reconciles impossible battle promises and reopens an impossible non-leader Prescience answer without redrawing the victim. All candidate death transitions and prospective hand commitments are validated before randomness. The still-secret Harkonnen captive disclosure ruling remains unresolved: Advanced Harkonnen tables guard the card based on their public configuration, never based on hidden captivity. See RICHESE_RESIDUAL_POISON_ENGINE_AUDIT.md.
• The full registered suites pass 1,329/1,329 rules/client/component tests and 107/107 persisted/API tests, with TypeScript, lint and production build passing. New focused coverage comprises seven pure, six root engine, seven independent review and four AI cases, plus three SQLite/CAS recovery cases. Logs: /tmp/dune-residual-final-full.log (34.00 seconds), /tmp/dune-residual-final-multiplayer.log (16.26 seconds), /tmp/dune-residual-final-type.log, /tmp/dune-residual-final-lint.log, /tmp/dune-residual-final-build.log. Existing No-Field tests now perform the genuine readiness actions; independent-battle privacy comparisons normalize only the new random public event IDs.
• The manual maintenance restart preserved all 1,175 saved room versions and exact state hashes, including a real browser-created open preparation step in synthetic QA room QPNV5XJJ v29. Backup: /tmp/dune-maintenance-20260906T1117/database.sqlite. The known human room remained idle and unchanged. A fresh invitation restored the exact event and opponent readiness. Browser play then killed Flinto Kinnis once, left spice and forces unchanged, removed the card from hand and placed exactly one in discard. Ready resumed normal planning; the AI sealed a valid plan. Refresh retained v34, the same event, one death and one discard. All other 1,174 saved room hashes remained unchanged. No automation was recreated. Snapshots: /tmp/dune-residual-browser-complete-v31.json and /tmp/dune-residual-browser-planning-v34.json.
• Five original CHOAM portraits bring ordinary coverage to 45/60, completing the six base factions plus Ixians, Tleilaxu and CHOAM. All forty earlier files and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and actual 192px inspector / 80px circular browser review pass. The temporary contact-sheet server was stopped. See CHOAM_PORTRAITS.md. Fifteen ordinary portraits and separate special-disc artwork remain unfinished.
• Five Richese effects remain inactive: Semuta Drug, Stone Burner, Mirror Weapon, Portable Snooper and Juice of Sapho. Other incomplete faction/module systems and unresolved interactions remain tracked. No full Advanced or expansion game was certified and no start gate was removed. The full goal remains active.

Ornithopter runtime and Tleilaxu portrait checkpoint (2026-09-06)

• Canonical Ornithopter now supports both printed movement choices in the engine, player controls and all four AI profiles: one group moves up to three territories, or two different groups move with normal movement range. The played physical card leaves the hand for public played-card custody until the effect finishes, then enters discard exactly once. It grants no additional reserve shipment.
• Two-group movement records the original remaining ordinary and elite forces separately. Later arrivals from the first move cannot replenish those quotas, and the second group must also fit current physical custody. Exact No-Field token/event identity is tracked; an eligible marker revealed during the effect contributes its actual revealed forces to the remaining group, without permitting a moved marker or moved forces to be reused. Event and custody checks survive saved reactions, stale submissions and recovery.
• The movement controls expose both modes, active progress and remaining eligible groups; a source containing only already-moved forces is disabled. All four AI policies use the authorized movement projection and handle the continuation. Prior movement/Hajr composition and the fixed-three-territory interaction with Kulon remain explicit interpretation guards. Six other Richese card effects and broader combined interactions remain unfinished; no Advanced or expansion start gate was removed.
• Focused coverage adds 28 pure/engine/review/AI cases (eight pure, eight root engine, six independent review and six AI), plus four persisted/CAS cases. The full registered suite passes 1,305/1,305 rules/client/component tests and 104/104 persisted/API tests, in /tmp/dune-ornithopter-final-full.log (36.51 seconds) and /tmp/dune-ornithopter-final-multiplayer.log (17.40 seconds). Final UI TypeScript, lint and production build all exited successfully; the initial lint findings were fixed before the successful rerun. Logs: /tmp/dune-ornithopter-ui-final-type.log, /tmp/dune-ornithopter-ui-final-lint.log, /tmp/dune-ornithopter-final-build.log.
• Real browser QA in the synthetic room moved two forces from Red Chasm sector 7 to Pasty Mesa sector 5 (v23→24). Reusing that moved group was disabled. A fresh invitation restored the exact v24 state and three-force remaining quota. The second browser move advanced to v25: five total forces in pasty_mesa:5, two completed moves, eight spice, fifteen reserves, only Maula Pistol retained, exactly one Ornithopter in discard and no pending played card. Snapshot: /tmp/dune-ornithopter-browser-complete-v25.json. All other 1,114 room hashes remained unchanged against the controlled-maintenance backup. This is focused movement/recovery evidence, not a complete expansion-game claim.
• Five original Tleilaxu portraits bring coverage to 40/60 ordinary leaders, completing all six base factions plus Ixians and Tleilaxu. All thirty-five prior assets and manifest entries remain unchanged. Full-resolution inspection, four existing asset tests, and coordinating-agent browser inspection at actual 192px square and 80px circular sizes pass. The temporary review server was stopped after inspection. See TLEILAXU_PORTRAITS.md for exact names, prompts, local paths and hashes. Twenty ordinary portraits and separate special-disc artwork remain unfinished.

Nullentropy Box runtime and Ixian portrait checkpoint (2026-09-06)

• Canonical Nullentropy Box now charges two uncommitted own spice to the bank before granting a private discard search. The paid search is persisted, owner-only and bound to an exact event, player, turn, phase and discard signature. Selecting a non-Box card transfers that physical card, commits one shuffled remainder order and places the used Box on top. No Emperor income, purchase bonus, recipient acknowledgement or Karama cancellation window is introduced.
• The private search layout now uses available container width, keeping candidate cards readable in the narrow decision sidebar. Final reference/presentation/art checks pass all 22 cases, including two new reference cases. Final reference/layout type checking and targeted lint pass.
• The Box remains reserved in hand while the real discard pile is locked. Existing response, decision, pending Karama and phase opening are saved and restored exactly. Early Truthtrance, CHOAM, gift and Distrans mutations, discard recycling and automatic continuation cannot alter the search. Seat recovery and voluntary autopilot takeback remain available. One eligible card completes automatically after payment; multiple eligible cards require the genuine private choice. A refresh or duplicate request neither pays again nor rerolls a committed result.
• Full-hand activation, empty/only-Box searches and the existing provisional Guild shipping-Karama refund conflict remain explicit guards. Active Truthtrance keeps answer-first priority; payment cannot break a binding battle promise. Semuta's future discard reaction, remaining Richese card effects, broader timing disputes and full combined-game acceptance remain unfinished. No Advanced or expansion start gate was removed.
• Owner controls and all four AI profiles use the authorized paid-search projection. Before payment, the projection contains no discard faces; after settlement the search entitlement expires. The current original portrait registry also reaches 35/60 ordinary leaders, adding the complete five-leader Ixian roster. Twenty-five ordinary expansion portraits and separate special-disc artwork remain. The Ixian sources were visually inspected and four existing asset tests pass; actual 192px inspector and 80px circular browser inspection now passes in the root-reviewed contact sheet. See IXIAN_PORTRAITS.md.
• Focused Box verification passes 17 new rules/AI cases (six root engine, six independent review, five AI) and four persisted recovery cases. The seven pure Box cases were already registered at the previous checkpoint. Review coverage includes paid privacy, exact parent restoration, real Truthtrance fee constraints, gift reservations, central locks, corruption before RNG, automatic singleton completion and duplicate begin/selection CAS. TypeScript and targeted lint pass for the independent review checkpoint.
• Combined test verification passes: 1,275/1,275 registered rules/client/component tests and 100/100 persisted/API tests. Logs: /tmp/dune-box-final-full.log (31.97 seconds) and /tmp/dune-box-final-multiplayer.log. Current aggregate TypeScript, lint and production build pass. After adding two reference cases and extending the existing portrait roster assertion, all 22 targeted reference/presentation/art tests pass (/tmp/dune-box-final-reference-art.log). Root browser review passed the five Ixian portraits at actual 192px and 80px sizes. A real paid Box search survived a controlled server restart with all 1,115 room state hashes unchanged; browser selection of Maula Pistol then advanced v21→22 with the same eight spice, one Box on top of discard and the exact earlier Richese gift restored. The other 1,114 rooms remained unchanged after that deliberate QA action. No automation was recreated. The current development server restarted successfully at approximately10:12UTC; the next manual maintenance check is due around11:12UTC if active development continues and human play permits.

Distrans engine, controls and recovery checkpoint (2026-09-06)

• Activated canonical Distrans for any faction holder: select another player and a different card from the owner hand, transfer it intact, then discard Distrans once. No fee, purchase bonus, recipient acknowledgement or new Karama response is added. Donor/recipient cards stay private, and the public history identifies only the played Distrans and transfer participants.
• Shared transfer validation checks both outgoing cards against exact gift, plan, prescience, retention, Black Market and accepted Ix replacement commitments, including saved parent responses. Prospective completion preserves binding Truthtrance answers, compulsory Ambassador discards, the Harkonnen returner's required card count and the target's reserved incoming slots. It improves those same saved-context protections for existing Richese gifts.
• The synchronous action preserves a pending response, decision or phase-opening window. Tests show a recipient can free space for a pending gift, or another legal Distrans transfer can fill that space and make gift settlement abort cleanly. Active Truthtrance has priority. Unpaid open lots and self-transfer remain named guards pending the existing questions; a completed purchase income/bonus response is distinct from an unresolved bid. Semuta reactions and the remaining eight Richese effects remain unfinished.
• The hand panel has recipient/card selectors, both inspectors, unavailable reasons and an explicit give-and-discard action. All four AI profiles use entitled choices to give Worthless cards to suitable allies or share duplicate ordinary weapons/defenses/Karamas from a full hand. They do not inspect other hands and respect existing decision priority. Full expansion starts remain gated.
• Integrated verification passes 1,247/1,247 registered rules/client tests and 96/96 persisted/API tests, TypeScript, lint and production build. Distrans coverage comprises six pure custody, six root engine, six independent review, five AI and three persisted cases. The root matrix spans all twelve donor factions, nine phases and both modes. Logs: /tmp/dune-distrans-full.log, /tmp/dune-distrans-multiplayer.log, /tmp/dune-distrans-type.log, /tmp/dune-distrans-lint.log, /tmp/dune-distrans-build.log; card/reference checks pass22/22 in /tmp/dune-distrans-reference.log.
• Real browser QA used only the synthetic roomQPNV5XJJ: a staged Harkonnen hand held Distrans and Shield while its incoming Richese gift awaited an observer's Karama response (v18). Clicking the explicit transfer button gave Shield to Richese, discarded Distrans once and preserved the exact pending gift event (v19). A fresh invitation tab restored the empty donor hand and same pending gift, without replay. Root visually inspected the selectors and result. Fixtures: /tmp/dune-distrans-browser-before-v17.json, /tmp/dune-distrans-stage.ts, /tmp/dune-distrans-browser-complete-v19.json. No human table changed.
• Four original Bene Gesserit portraits complete all six base-faction portrait rosters, bringing ordinary leader coverage to30/60. Root inspected all four final full-resolution images; the agent also checked192px inspector and80px circular presentation. Exact names, prompts, corrections and hashes are in docs/BENE_GESSERIT_PORTRAITS.md. All prior26 manifest records and Irulan remain unchanged. The existing four asset tests are now registered in npm test, and their roster assertion covers all six base factions.
• Nullentropy Box now has a source/insertion-risk audit (docs/NULLENTROPY_BOX_ENGINE_AUDIT.md) and pure custody helper (game/nullentropy-box.ts) with seven passing registered cases. Payment, private search, event-bound selection, automatic one-choice completion, discard locking, parent restoration and AI/UI remain the next runtime work. The existing full-hand question remains pending; provisional Guild discard-refund custody also requires an explicit guard or resolution before search can compose with that case.
• Final combined verification:1,258/1,258 registered rules/client/component tests,96/96 persisted/API tests, TypeScript, lint and production build pass. Final combined logs are /tmp/dune-distrans-final-full.log, /tmp/dune-distrans-final-type.log, /tmp/dune-distrans-final-lint.log, /tmp/dune-distrans-final-build.log; the unchanged runtime's96-case multiplayer evidence remains /tmp/dune-distrans-multiplayer.log. No test files are left unregistered. Full expansion compliance remains unproven.
• No automation was recreated. Manual maintenance remains due around10:10UTC, subject to active human play. Nullentropy Box's private paid search and the remaining portrait inventory are the next independent slices; no broad compliance claim is made.

Richese gift integration checkpoint (2026-09-06)

• Integrated the Basic Richese alliance gift for exact canonical cards already held by the donor. A transfer creates no spice payment, auction income, bonus draw or replacement. The gift can suspend ordinary decisions, responses and phase opening; resolving it restores their exact ownership, passes and pending Karama. Active Truthtrance still has priority.
• The card stays reserved in the donor hand until its separate Karama opportunity resolves. Only donor and recipient see its pending identity. Declaration and settlement revalidate custody, mutual alliance, capacity and commitments, including auction slots, battle promises and accepted exchanges. Random Harkonnen extraction is rejected before RNG when it would disturb a reserved gift. A Harkonnen bonus rechecks actual capacity before drawing.
• Independent review found a stale-alliance defect that could overwrite the old recipient hand using the new ally hand. Settlement now validates the full original owner/recipient/card intent before assigning either hand. Engine and real SQLite CAS regressions confirm all hands remain unchanged on stale-alliance abort.
• A further real Harkonnen special-Karama regression verifies mandatory return capacity: gifts cannot fill slots needed by the return, but remain legal when the recipient still has room afterward. Both restored exchanges complete without lost or duplicated cards.
• Owner controls provide inspectable card selection and unavailable reasons; both allies can privately inspect pending gifts. All four AI profiles gift the functional canonical Karama to free a full bidding hand when public ally counts support it. Other nine Richese effects and broader gift strategy remain unfinished. Same-card retry after cancellation during the same phase explicitly awaits a ruling; no complete mode gate was removed.
• 1,230/1,230 registered rules/client and 93/93 persisted/API tests pass, along with TypeScript, lint and production build. Gift coverage comprises six pure custody, five root engine, eight independent review, four AI and three persisted cases. The root matrix exercises all ten identities in both rule modes across nine phases. Logs: /tmp/dune-gift-final-full.log, /tmp/dune-gift-final-multiplayer.log, /tmp/dune-gift-final-type.log, /tmp/dune-gift-final-lint.log, /tmp/dune-gift-final-build.log.
• Real browser controls in synthetic QA room QPNV5XJJ gave Karama to the ally automatically when no one could cancel (v13→14). The exact completed state is /tmp/dune-gift-browser-complete-v14.json. A second staged case retained an observer Karama, declared the gift through the UI (v15→16), and restored that exact pending response/card in a fresh invitation tab. /tmp/dune-gift-browser-pending-owner-v16.json preserves the original pending owner fixture. Only synthetic role IDs were then swapped (v17); the recipient browser showed the exact pending card, an empty private hand and no spurious acceptance button. Both donor and recipient presentation were visually checked with the existing authenticated QA seat. No human table was modified, and this is not real seat-switch coverage.
• The next Distrans slice has a source/insertion audit in docs/RICHESE_DISTRANS_ENGINE_AUDIT.md and an immutable pure helper in game/distrans.ts. Six registered pure tests pass across all twelve structural donor factions, ordinary and Richese targets, custody, capacity and replay. The card is not activated in engine/UI/AI. Open-bid timing and self-transfer were asked once and remain unanswered; next work is synchronous action integration after Truthtrance priority with both-card reservations and the new mandatory incoming-capacity guard.
• No automation was recreated. The server remains the one started at 09:10 UTC; next manual hourly restart is due around 10:10 UTC if development continues and human activity permits. This bounded checkpoint does not certify complete Richese or combined expansion games.

Allied No-Field shipment and recovery checkpoint (2026-09-06)

• Added a persisted Richese offer-or-pass opportunity before the ally’s normal shipment. This preserves a human supplier’s decision when the active ally uses AI, regardless of seating order. The supplier privately selects a different token, destination and payment; the recipient accepts and selects its physical ordinary/elite mix or declines without cost. Denomination, typed offer details and recipient finances remain private to their entitled viewers.
• Successful shipment first reveals an existing supplier marker, immediately materializes the allied token from the recipient’s available reserves, updates shared no-repeat history and uses the recipient’s shipment slot. Prices are one spice in a stronghold or two elsewhere. Either ally can pay the full cost, or both can explicitly pay one for a two-spice shipment. Guild income and Heighliner accrual use the appropriate recipient/payment identities.
• Exact consent and token events fence stale/replayed actions. Richese cancellation and Guild prevention preserve token/fund custody; stale post-response allocation aborts safely. Arrival preflight catches unsupported simultaneous reactions before consent becomes committed, leaving decline available. AI tries legal acceptance and retains decline as a fallback after authoritative rejection.
• Fremen’s ordinary reserves are on-planet, so they do not satisfy this off-planet-only shipment method. Guild-recipient/active-Karama price and routing conflicts have been asked explicitly and remain guarded. HMS/Homeworld and combined arrival work, mixed No-Field battle arithmetic, whole-plan prescience and other expansion systems remain unfinished. No incomplete mode gate was removed.
• Final verification: 1,207/1,207 registered rules/client tests, 90/90 persisted/API tests, TypeScript, lint and production build pass. The new allied tests comprise eleven engine, seven independent review, seven AI and three persisted cases. Six additional pure Richese-gift tests pass, but gift engine/control/AI integration is not yet implemented. Final logs: /tmp/dune-allied-final-full.log, /tmp/dune-allied-final-multiplayer.log, /tmp/dune-allied-final-type.log, /tmp/dune-allied-final-lint.log, /tmp/dune-allied-final-build.log.
• Browser roomQPNV5XJJ made a real private No-Field3 proposal (v10), then recovered that exact pending decision in a fresh invitation tab after the 09:10 UTC server restart. For recipient-control QA only, the two synthetic player-role IDs were swapped in a saved fixture (v11), preserving the authenticated QA seat; this was not a claim of switching real user seats. Clicking Accept then created three Harkonnen forces in Arrakeen, reduced its reserves20→17, charged Richese one spice, and used only the recipient’s shipment (v12). Root visually inspected the recipient terms and buttons. The original proposal fixture is saved in /tmp/dune-allied-browser-owner-v10.json.
• Controlled hourly maintenance backed up995 tables to /tmp/dune-maintenance-20260906T0910/. Every table’s exact state hash and version matched after stop, restart and browser reconnect, before subsequent deliberate QA actions. The known human table remained v14, idle203minutes at restart. Health returnedHTTP200. No recurring automation was recreated. Next manual maintenance is due around10:10UTC if active development continues and human play permits.

No-Field engine, controls and recovery checkpoint (2026-09-06)

• Integrated own concealed shipment at the one-force rate, selected allied funding, separate Karama/Guild responses, immutable token custody, stale-event fencing, marker-only and mixed physical movement, voluntary reveal, effective occupancy/control/collection, exposed storm and unprotected worm losses. Physical force arrays contain actual units only; the marker never fabricates a reserve or Tank token.
• Marker-only battles support all three secret values, scarce reserves, joint plan revelation, zero-token leader/card resolution and ordinary Atreides dial restrictions. Mixed ordinary/No-Field battle dialing and entire-plan special prescience remain guarded pending source resolution. Allied token shipment, protected-worm/Truthtrance/other optional combinations remain unfinished; Richese and other incomplete mode gates remain intact.
• Trip to Gamont reveals a marker in the selected sector, including when ordinary forces share it, then returns one actual force if present. A zero-result play still uses the card. Karama cancellation preserves concealment; a changed restored marker event aborts the pending effect without consuming the card.
• Owner controls show private inventory, payment, last-use restrictions, marker movement and reveal. Opponent board markup is identical across secret values. All four AI profiles use their entitled views for own shipments, marker moves/reveals and marker-only Basic/Advanced battle fixtures.
• 1,176/1,176 registered rules/client tests and 87/87 persisted/API tests pass. TypeScript, lint and production build pass. Logs: /tmp/dune-no-field-full.log, /tmp/dune-no-field-multiplayer.log, /tmp/dune-no-field-final-type.log, /tmp/dune-no-field-final-lint.log, /tmp/dune-no-field-build.log. New tests include eight presence, ten engine, eight independent review, nine AI and four persisted recovery scenarios. Full game acceptance for Richese remains outstanding.
• Browser QA room QPNV5XJJ advanced through real token-5 shipment (one spice, reserves unchanged), marker-only Arrakeen→Imperial Basin sector10 movement, invitation reopening in a fresh tab, and voluntary reveal exactly once. Final v8 has nine spice, fifteen reserves, five actual forces in Imperial Basin and token5 faceup as last used. Root visually inspected the board and private inventory. Initial QA fixture staging was backed up to /tmp/dune-no-field-browser-before.json; no human table was modified. Battle/Gamont/mobile browser acceptance remains outstanding.
• No recurring automation was recreated. The development server from the 08:10 UTC controlled restart is still running; the next hourly maintenance is due around09:10 UTC if human activity permits. This checkpoint advances the active goal and does not certify full rules compliance.

Richese acquisition, No-Field model and Guild art checkpoint (2026-09-06, 08:19 UTC)

• Richese special Karama now validates and buys one secretly selected canonical cache card for three uncommitted own spice, discards the activating Karama and consumes its once-per-game Advanced power atomically. Full-hand timing and consuming the final cache card remain explicit unresolved guards; the user was asked about full-hand timing. Offered auction cards remain reserved.
• Emperor receives the purchase payment through a separate cancellable income response. Cancellation never reverses the uncancelable special purchase. The persisted continuation preserves the original response, decision and pending Bene Gesserit conversion, then restores them once. Direct cache purchase creates no Harkonnen bonus or Ixian allied replacement.
• Private hand controls provide both selectors, card inspectors, price, payment recipient and authoritative availability explanations. All four AI profiles can conservatively buy the currently usable canonical Karama; nine other Richese card effects remain unfinished. A browser-discovered generic Karama purchase button outside an ordinary auction is now disabled with a visible reason.
• No-Field has an isolated immutable three-token model, single concealed deployment, shared own/allied consecutive-shipment history, capped materialization and private projection. Independent review fixed sparse inventory validation. Root review fixed Polar Sink’s sector-zero address. Thirteen focused model tests pass; shipment, board, battle, casualty, victory, AI and multiplayer adapters are still outstanding.
• Four original Guild portraits complete its five ordinary leaders. Original art now covers26/60 identities. Root visually reviewed the complete Guild row and all four new enlarged portraits in the browser.
• Final verification: 1,141/1,141 rules/client tests, 83/83 persisted/API tests, TypeScript, lint and production build pass. Logs: /tmp/dune-acquisition-final-full.log, /tmp/dune-acquisition-multiplayer.log, /tmp/dune-acquisition-final-type.log, /tmp/dune-acquisition-final-lint.log, /tmp/dune-acquisition-final-build.log. Focused acquisition tests include eight engine, nine independent review and four all-profile AI scenarios; two new persisted race/restart scenarios extend the Richese recovery suite to nine.
• Browser roomQPNV5XJJ purchased a cache Karama via real controls, restored its private seat and pending Emperor income through the invitation in a fresh tab after the controlled restart, and paid income exactly once. Finalv4 has Richese7 spice, Emperor13 spice, one acquired Karama, nine cache cards and a consumed special power. The final ordinary purchase button guard and both internal reference topics/links were checked in the browser.
• Hourly maintenance saved905 rooms under /tmp/dune-maintenance-20260906T0809/. All original states matched after stopping; after restart and verification only the deliberately advanced QA room changed. The known potentially human table remained v14, idle142minutes at restart. Local server was restored; no recurring automation was created. Gifts, Distrans, Box, No-Field integration, other faction/modules, full Advanced/expansion games and mobile/component audits remain unfinished. No mode gate was removed and the overall goal remains active.

Richese bidding and component checkpoint (2026-09-06)

• Added all ten separate Richese cache identities and the missing five CHOAM/five Richese ordinary leaders. There are now60 ordinary leaders and22 original portrait matches; Auditor remains a separate unfinished advanced component. Ten Richese guides have printed categories and enlarged inspectors; ordinary card-effect integration remains incomplete, with Karama inheriting the existing generic handler in development fixtures.
• The engine wraps ordinary bidding with a first/last cache auction and optional advanced Black Market prelude. Cache supports Once Around/Silent; Black Market supports all three methods for other buyers. Exact card custody, selected own/allied payment, private sealed submissions, storm-order ties, zero outcomes, seller income, Atreides inspection, Harkonnen bonus and source-specific Ixian ally replacement are integrated. No fake normal auction object is used for a special sale.
• Independent review fixed concealed physical-ID leakage, a reserved Truthtrance queue deadlock, and malformed funding-error probes of private allied bids. Full-hand participants automatically pass or submit zero; a full-hand owner automatically removes an unbid cache card. Losing bids release reservations, and a normal pool is not drawn and lost when all hands fill. Automatic room recovery uses the existing CAS fence; legitimate waiting states produce no writes.
• Controls and all four AI profiles handle the supported auction paths. AI currently declines an optional Black Market offer, while responding legally to its three offered methods. Browser acceptance covers cache declaration, Once Around purchase, Silent private bid restoration and all ten enlarged card guides; it found and fixed rule-link expansion and unsupported hand-action presentation defects.
• Explicit unresolved guards remain for cache-auction cancellation count, exhausted-cache arithmetic, positive Black Market seller bids and Advanced Ixian Technology on special lots. No-fields, the special cache purchase/gift, nine card effects and other full faction/module interactions remain unfinished. These guards are implementation limitations, not assertions that the official rules prohibit the interactions. Live Advanced/expansion starts remain disabled.
• Final verification:1106 rules/client tests,81 persisted/API tests, TypeScript, lint and production build pass. The120-game Basic regression study completed with unchanged per-game outcomes and no stalls; it does not certify an expansion mode. See RICHESE_AUCTION_RULES.md, RICHESE_COMPONENTS.md, CHOAM_RICHESE_LEADERS.md, AI_CALIBRATION.md and VISUAL_PLAYTEST.md for scoped evidence.
• The07:06UTC controlled restart preserved all843 then-existing room states and versions. No recurring automation was recreated.

Shipment funding controls and Atreides artwork (2026-09-06)

• Ordinary reserve shipment now displays its selected price, normal price when discounted, available own/pledged funds and selected payment split. Invalid force/elite counts, invalid explicit shares and insufficient selected funding disable the submit button with accessible reasons. An obsolete explicit share is ignored when the player has no ally, so a hidden old field cannot block a later shipment. The server remains responsible for geometry and all final action validation.
• The pure presentation component consumes only caller-provided values. The parent uses the same ordinary reserve price helper as server/AI and the same default-own-first contribution calculation as the engine. Independent review found no new pricing or privacy defect. This does not implement Guild rate cancellation.
• Four additional original portraits complete the five Atreides native leaders: Lady Jessica, Gurney Halleck, Duncan Idaho and Dr. Yueh join Thufir. Ten of the 50 currently cataloged ordinary leaders now have artwork. Each new asset is inspected, 1254px square, with its exact prompt preserved and exact identity mapping. All required twelve-faction art/component work remains incomplete.
• Desktop QA restored S85SLVRR, used an isolated version40 fixture with two Guild spice, showed three forces costing two and five costing three, and disabled the unaffordable action. Submitting three forces reached version41 with exactly two spice paid and three placed. EN4L8NTV retained version83 while its complete Atreides roster and expanded Lady Jessica were inspected. TypeScript, lint and production build pass. No engine/bot behavior changed in this slice; the prior 951-rule/45-persisted test checkpoint remains the latest full regression run.
• GUILD_RATE_KARAMA_RULES.md now records publisher support for separately canceling discounts, transport permission and income, with the later November FAQ overriding the older April transport answer. The user was asked how to handle a declaration made unaffordable by cancellation. That answer remains pending, so the new cancellation engine is not activated.

Portraits, shipment proposals and Extortion accounting checkpoint (2026-09-06)

• Six original leader portraits now appear in authorized roster and expanded identity views: Thufir Hawat, Feyd-Rautha, Hasimir Fenring, Stilgar, Staban Tuek and Princess Irulan. Exact ID/name matching prevents inferred identities; unknown identities and failed assets retain existing vector components. Names and current strengths remain interface text. Six of the 50 currently cataloged ordinary leaders have portraits; this is not the complete twelve-faction component inventory.
• Ordinary reserve shipment pricing is shared between authoritative payment and AI budget filtering. Bots preserve existing destination, amount and candidate order, removing only unaffordable proposals using their own balance plus projected pledged aid. Seven tests cover all difficulties, Guild rounding/alliance, Karama beneficiary, free Fremen, aid and hidden balances. Existing Guild transport and movement candidate filtering are unchanged.
• A paired 120-game Basic run at seed20260907 completed without deadlocks or checked invariant failures before and after filtering. Every recorded per-game field other than elapsed time and rejected-candidate diagnostics matched, including assignments, winners, finishing turn and accepted-action count. Rejections fell26,146→9,081 (65.27%); 16,735 insufficient-spice proposals and330 proposals rejected earlier for occupancy disappeared. All other rejection-reason counts match. See AI_CALIBRATION.md; the four-level strength ranking remains unproven.
• Extortion now has an isolated, immutable accounting helper and nine tests for the reserved five spice, Mentat collection, storm-order three-spice payment, affordability and recovery outcome. It has no engine, UI or AI activation. The official rules do not resolve collection/recovery versus the same Mentat's Terror placement order; the user's interpretation is pending. Do not count this helper as a working Extortion effect.
• Independent review confirmed a preexisting missing Guild rule: ordinary Guild or ally half-rate shipment can be canceled once with Karama under November2020 FAQ p7. Current pricing preserves existing rates and does not implement that cancellation window. This remains on the full-rules completion backlog.
• Validation:951 rules/client tests and45 persisted multiplayer tests pass; TypeScript, lint and production build pass. The hourly manual restart at04:52UTC restored exact hashes and versions of all four selected QA saves; HTTP health and the Atreides saved browser seat recovered. The removed automation remains removed.

Moritani allied card retention checkpoint (2026-09-06)

• A defeated Moritani ally may choose one eligible card from its revealed Battle Plan when the battle has a winner, or decline. The same mandatory-discard predicate serves winner cleanup and ally eligibility, including hero, Tooth, Artillery and traitor-preempted effects. Moritani itself and mutual-loss outcomes do not gain this benefit.
• The engine reserves the exact played cards as soon as combat settles. Winner casualty/card cleanup continues first, then ally retention, then the existing CHOAM income, technology, capture and Face Dancer continuation. Selecting a card declares the ordinary faction-power use with Moritani as Karama owner; cancellation discards all played cards, otherwise only the chosen card remains. No combat outcome, payment or RNG step is repeated.
• Controls use single-choice radios, full existing card rules and inspectors, an explicit decline and a visible declared-card inspector during the response. Reserved Bene Gesserit cards cannot be converted to Karama; reserved CHOAM cards cannot be cashed in. Public projection exposes only the previously revealed played cards and declaration, not the rest of the hand. All four AI profiles handle the choice and response.
• Twenty-three focused engine/AI tests cover actual combat, exact custody, no-eligible-card paths, owner/target rejection, JSON recovery, cancellation and nested Worthless conversion, hidden hand boundaries and continuation into income/capture/Face Dance. Full validation reached 935 passing rules tests and 45 passing persisted multiplayer tests; TypeScript, lint and production build pass. The targeted 18-case engine file was also rerun after replacing a redundant predicate test with an actual no-retainable-card battle.
• Browser QA S85SLVRR versions37–39 inspected Crysknife, selected it, refreshed during the response, allowed the ability and continued to Spice Collection with Crysknife/Baliset retained and exactly Snooper discarded. This is an isolated scenario, not a complete expansion game.
• This ordinary alliance ability is integrated, but full Moritani remains gated. The November 2020 official FAQ explicitly allows cancellation of alliance abilities; the exact serialized postbattle ordering remains a documented composition without a dedicated publisher ruling. See MORITANI_ALLY_RETENTION_RULES.md. Terror Atomics/Aftermath, Extortion, advanced assassination and other expansion interactions remain unfinished.

Native leader revival consistency checkpoint (2026-09-06)

• The server now projects owner-specific native leader eligibility, normal/discounted prices, early-revival status and affordability through one pure helper used by action validation. Reading a table does not advance revival cycles. Kwisatz revival uses the same projection boundary.
• The Revival selector uses those options and rejects empty, stale or unaffordable selections in the interface. A spent leader slot is explained. All four bot profiles continue an opened ordinary revival cycle even while an earlier returned leader is alive; unavailable leaders and unaffordable revivals no longer enter their ordinary action candidates. Bots avoid unnecessary new early-service requests when ordinary revival is available while preserving existing quotes and foreign-ghola buybacks.
• Sixteen added tests cover actual server actions, capture/ghola boundaries, face-down repeat deaths, phase/slot/prevention, discounts, JSON restoration, owner projections and all four AI profiles. Full validation: 912 unit tests and 45 persisted multiplayer tests pass. This does not certify complete expansion rules.
• Browser QA in isolated room S85SLVRR showed four remaining eligible Atreides leaders after an earlier return, a disabled empty selection, Lady Jessica revived for five spice, and the consumed slot surviving refresh. See VISUAL_PLAYTEST.md.
• Ecaz's special five-dead threshold and shared Duke revival remain unfinished. ECAZ_REVIVAL_RULES.md records the verified price/threshold, unresolved post-revival custody and repeated six-disc cohort handling. Shared Duke has not been appended to native rosters or silently made revivable by this change. MORITANI_ALLY_RETENTION_RULES.md records the next battle-cleanup implementation contract; that ability is not implemented yet.

Latest card and recovery checkpoint (2026-09-06)

• Shared pure availability rules now drive Weather Control, Family Atomics, Hajr and Harvester server checks and hand controls. Invalid timing shows an explanation linked to the disabled action; inspection remains available. Eight focused tests cover timing, ownership, pending-decision precedence, card disposal, advisor-only forces, repeated Harvesters, input immutability and hidden-information independence.
• Public spice-pile top cards and the authorized private Atreides preview have separate read-only inspectors. The component receives only its projected card, displays base amount/sector or worm/Sandtrout identity, and separates original guidance from card values. Desktop Cielago North and mobile Rock Outcroppings inspection passed; mobile Close restored focus. Gated advanced double-pile and private-preview browser journeys remain outstanding.
• Current validation: 797 unit tests, 34 persisted multiplayer tests, TypeScript, lint and production build passed. Tests do not certify full Advanced or expansion modes.
• Controlled local restart at approximately 01:49 UTC preserved EN4L8NTV version76 and ZUUFRHF6 version8 byte-for-byte state hashes; both browser seats restored their pending decisions. Consistent backup: /tmp/dune-maintenance-20260906T0148/database.sqlite. No maintenance automation was recreated.
• Primary component evidence now verifies the three Ecaz treachery faces and quantities; see ECAZ_TREACHERY_RULES.md. Battle timing and late-Recruits accounting questions remain explicit; this source evidence does not enable an expansion.

Revival correctness and Ecaz component checkpoint

• Fremen normal revival shares one server/view/UI/AI allowance calculation. Correction: official November2020FAQp5 permits paid Fremen revivals when Tleilaxu is seated, subject to the current three-force or granted five-force limit. Without Tleilaxu, the free-only restriction remains; an Ix module flag alone does not grant the exception. La La La blocks free returns but leaves legal paid returns with Tleilaxu. Nine focused tests cover the correction, payment settlement, cancellation, JSON recovery and all AI profiles. FREMEN_REVIVAL_AUDIT.md explicitly retracts the earlier contrary interpretation.
• Player.freeForcesRevived records actual settled free normal returns, separately from total normal revival. Pending/canceled requests and special/leader returns do not consume it. Missing legacy usage remains unknown after prior revivals and resets at the next Revival phase. Five focused settlement, conservation, private-view and JSON/lifecycle tests pass; existing prices do not change.
• game/recruits.ts supplies isolated turn-scoped arithmetic from explicitly resolved current rates, limits and usage. Eleven tests cover ordinary caps, unlimited physical rosters, typed pricing and prevention. The helper is not yet called by the engine: late-paid accounting and pending-transaction policy await the user clarification recorded in RECRUITS_RULES.md.
• game/ecaz-cards.ts supplies exactly one each of the three verified cards, immutable source/coverage metadata and original gameplay paragraphs. Canonical authorized cards receive full expanded text in the existing inspector; metadata remains developer-only. Eight tests cover the 50-card manual inventory composition, no implicit activation, exact identities and existing presentation regression. The live deck factory still rejects the unfinished variant.
• Live turn-four playtesting caught a storm draft shared with battle dials. Separate storm state now renders and submits the legal first/later-turn range; the later-turn browser submission revealed3+3. The test game continues and is not a completed visual acceptance run.
• Final runtime checkpoint:797 unit tests,34 persisted multiplayer tests,TypeScript,lint and production build passed. A subsequent text-only reference correction received its focused reference check. Full Advanced and all expansion starts remain gated.

Voluntary seat control checkpoint

• A human can opt their own setup/playing seat into Easy, Medium, Hard or Brutal AI, then take back control. autopilot remains distinct from a permanent bot, preserving credentials and recovery. Control changes preserve pending/sealed game state; the server rejects ordinary human actions while delegated and rejects foreign targets. Public control labels and responsive explicit controls are integrated.
• AI uses the same private projection for both kinds of seat. Server background batches re-read saved control and CAS-fence every update; competing takeover and continuation tests pass. Existing botsPending recovery is retained. Durable unattended scheduling after server interruption remains missing; see AUTOPILOT.md for the full boundary and traceable ledger.
• Seven engine/control tests, five SQLite continuation tests and six HTTP recovery/completion tests were added. Current complete suites:797 unit and45 persisted/API tests pass, along with TypeScript,lint and production build.
• Browser room2SG3ZS3E verified opt-in, refresh, same-seat takeback, mobile Hard control and a completed Basic game (Harkonnen,turn7). A separate three-human HTTP game completed through server continuation after all opted intoAI, with no later gameplay POSTs. These do not establish relative difficulty strength or complete expansion support.
• New primary Moritani audit records all six Terror effects, hidden token lifecycle, official FAQ/Karama anchors and legible printed leader values. MORITANI_TERROR_RULES.md distinguishes implementation-ready rules from remaining reaction-order and exceptional-custody questions. Faction starts remain gated.

Verified Ecaz/Moritani ordinary leader inventory

The publisher-authored page3 illustration was independently inspected by two agents. All five Moritani and all five Ecaz native names/strengths now have stable component instances in game/cards.ts, with seven roster/traitor/regression tests. Duke Prad Vidal6 stays separate and has no traitor; his special custody lifecycle remains unimplemented. The total available ordinary leader definitions is50; CHOAM and Richese remain missing. Faction starts stay gated. After these additions the full797-unit suite, TypeScript, lint and production build passed; the45-test persisted/API suite passed after the seat-control integration.

Required remaining work

1. Complete base rules: leader/captured-leader edge cases, auction deadlines, temporary allied-territory entry, remaining Karama powers, Truthtrance and explicit timing windows. Audit interactions among card play and committed battle elements, plus supported cancellation windows.
2. Printed-board audit: geometry adapted from MIT Truthsayer, approximate generated connectivity must be compared to printed GF9 map; verify terrain categories, spice sectors, starting positions. SVG sectors now oriented 1=SW, 2=S, increasing counterclockwise.
3. Advanced game: finish BG advisor timing/forced-flip cancellation audit, Worthless auction edge-case verification, remaining cancellation timing and expansion special Karamas; summoned-worm/card sequencing, Atreides full-plan timing and Guild canceled-shipment settlement clarification. KH, captured leaders and increased stronghold spice income now have engine/UI support, with repeated-revival and expansion-interaction audits remaining. Double spice blow, Fremen storm forecasts/half losses/additional worms and out-of-order Guild movement now have engine/UI support; full advanced-game integration and scenario audits remain. Elite accounting, spice combat and deferred casualty choices now have engine/UI foundations and focused tests; complete-game advanced support is still blocked.
4. All six expansion faction engines, cards and remaining optional modules: skills, stronghold cards, homeworlds, Nexus cards, discoveries. Tech-token support exists for 3+ players; two-player allocation and unfinished-faction/module interactions remain.
5. More complete phase scenarios, property/conservation tests, six-seat integration, security request checks, runtime build and UI validation where authorized.
6. AAA presentation refinement: readable tactical overlays, cards and leader portraits, reveal/event animations, responsive/control polish. Original art is integrated; Browser playtests and screenshots are explicitly authorized. Initial lobby, setup and storm checks have been performed; the remaining critical journeys and responsive layouts still need visual validation.
7. Register WebMCP read tool implemented; supported-context validation remains unperformed. Add task-completing mutation tools after game journeys stabilize.
8. AI players: legal action selection through private projections, host-controlled bot seats, distinct Easy/Medium/Hard/Brutal policies, and automated turn progression. Basic-game implementation now exists and passes complete-game simulation and multiplayer tests. Relative playing strength needs calibration; advanced/expansion policies remain.
9. Complete the rules reference: current searchable /rules has action guides, phase topics, card coverage, faction/module placeholders, examples and related links. Tooltip infrastructure and inline phase guidance exist. Base faction rules and six advanced faction rule topics are written; full advanced/expansion content and interaction examples still need completion alongside implementation.
10. Publish complete validated site with Sites hosting, not this incomplete slice. Registered project exists; never create again.

Moritani setup and hidden placement checkpoint

Implemented the isolated setup/placement slice, with expansion starts still gated. Moritani deploys six forces last into an unoccupied printed territory, retaining fourteen reserves and twelve spice. Advisors count as occupation. Six shuffled, opaque physical Terror IDs keep private faces separate from public placement. Mentat opens one optional placement or relocation before the existing victory check; decline and Karama cancellation consume the opportunity for that turn. The pending private intent survives JSON reload, commits only after responses and never leaks through the public response or log. Cancellation leaves custody unchanged.

Rule family	Runtime	Controls	AI	Verification
Setup last, six deployed/fourteen reserves	Implemented	Board/sector selection	All four profiles	Completion order, occupied/advisor targets, invalid sectors, conservation
Hidden supply and placed token privacy	Implemented	Six original token illustrations and readable inspectors; public hidden map marker	Owner projection only	Seven pure model tests and equivalent public views for different secret declarations
One Mentat placement or relocation; storm permitted	Implemented	Private token/destination selectors; explicit declare/pass	All four profiles	Later-turn relocation, no duplicate custody, decline, stale rejection
Placement Karama	Implemented	Standard response window	Pass/legal response support	Allowed/reloaded settlement, canceled relocation, preserved source and consumed turn
Mentat continuation	Implemented for this slice	Pending decision ownership	Legal progression	Deferred victory and CHOAM market/final-opportunity continuity
Terror entry/revelation and six effects	Unimplemented	Rules/inspection only	Unimplemented	Source audit only; no expansion full-game claim

Files: game/moritani-terror.ts, game/engine.ts, game/bots.ts, components/moritani-terror.tsx, components/game-table.tsx, game/reference.ts. Added 17 named tests in tests/moritani-terror.test.ts and tests/moritani-placement.test.ts. Full814-unit and45-persisted/API suites, TypeScript, lint and build pass. Browser QA used a separately named local fixture, not an enabled expansion start: mobile inspector, restored focus, private declaration, refresh during response and final placement/map marker passed. See VISUAL_PLAYTEST.md for limits.

Next: explicit persistent entry continuations with committed force-cohort accounting, all six effects, Enemy of My Enemy, Aftermath, Extortion and advanced powers. Do not restore pre-Atomics Fremen storm casualty counts against forces already destroyed. Previously revealed Extortion must receive a fresh opaque public ID before hidden redeployment. The full expansion remains unavailable. The final owner-only pending-declaration reminder passed24focused tests, TypeScript, lint and build after the full814/45check. Controlled02:49UTCmaintenance preserved exact versions/state hashes for four saved QArooms and restored both the Basic Nexus and placed Terror token in the browser.

Terror entry, Robbery and Sabotage checkpoint

Persistent entry records now capture the entrant, location, committed force/elite counts, cause, turn/phase, effect stage and worm-ride continuation. Hooks cover ordinary shipment, cross-territory movement, Guild transport, spiritual-advisor arrival and worm rides. No-Field and Face Dancer modules remain outside this implementation. Self/allied entry and moving within the same territory do not open Terror. Existing occupation alone does not trigger it.

The Moritani owner may leave a token hidden or reveal an implemented effect. Robbery transfers half the entrant’s available spice rounded up, or draws before enforcing a chosen hand discard. Sabotage randomly discards once, then offers an optional own-card gift. Only authorized hands are projected; unrevealed identities and random discarded cards do not enter public logs. Reload preserves the stage and never replays shipment payment or the original force transfer. Truthtrance completion reconciles an already-cleared Robbery overflow. Fremen’s summoned-worm interruption now opens its owed Nexus before remaining rides after Terror completes.

Work	Controls/AI	Evidence	Remaining boundary
Entry opportunities and optional decline	Human controls; all four AI profiles	18entry tests across five arrival paths, hidden-face invariance and JSON recovery	Arrivals with another pending response/decision reject atomically; timing question awaits user clarification
Robbery and Sabotage	Reveal, choices, own-card discard/gift; legal AI choices	Full-hand draw, spice rounding, random discard exactly once, gift/decline, Truthtrance	Exceptional Sabotage gift overflow remains explicitly unsupported; no full-faction certification
Worm/Nexus interruptions	Existing Karama/Truth/Nexus controls continue	3new overlay regressions include actual alliance decisions and no extra draw/force transfer	Destructive Terror effects and their cohort reconciliation remain unfinished
Revealed/returned token custody	Reveal integrated; return helper ready	11pure custody tests	Return helper is not yet wired to Enemy of My Enemy or Extortion; it rotates all available supply IDs and shuffles positions before hidden redeployment
Assassination, Atomics, Extortion, Sneak Attack and advanced powers	Rule inspection only	Primary-source audit	Unimplemented

Full843-unit suite passes with TypeScript, lint and production build. All45persisted/API tests also pass. Browser QA completed the Robbery draw/forced-discard journey through refresh in the isolated S85SLVRRfixture. The table banner now prioritizes an interrupted decision’s owner over the original active mover. Combined arrival timing and later-ally Aftermath semantics remain unresolved in MORITANI_ENTRY_TIMING.md. Full Advanced and expansion starts remain gated.

Local operation

• npm run dev -- --host 0.0.0.0 (port 3000).
• npm run db:local applies Drizzle migrations to .wrangler/state (local only).
• npm test; npm run test:multiplayer.
• npm run typecheck; npm run build.
• Current app preview http://localhost:3000/ was opened via open_in_codex (tool returned queued; no tab ID available).

Sources and evidence

• GF9 base: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf
• Text mirror: https://www.rulespal.com/dune/rulebook
• Base PDF mirror: https://cdn.1j1ju.com/medias/37/57/71-dune-rulebook.pdf
• Ix: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf
• Ix mirror: https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf
• CHOAM: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf
• Ecaz: https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf
• Ecaz mirror: https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf
• Designer source hub: https://futurepastimes.com/dune-launch
• Reference aid (secondary): https://www.orderofgamers.com/downloads/Dune2019_v2.pdf
• https://www.landsraad-vegas.com/rules mixes GF9 and tournament house rules: do NOT silently adopt house rules.
• GF9 downloads currently give 403/non-PDF responses. tools/fetch_rules.py records original URLs, saved files only to /tmp/dune-rules.
• Board reference: https://github.com/marekyggdrasil/truthsayer ; THIRD_PARTY_NOTICES.md retains MIT license. tools/import_board.py consumes /tmp/dune-config.json; generated JSON already checked into workspace.

Sites

Project ID persisted in .openai/hosting.json. Private unpublished registration only. No source push, save version, or deployment yet. Workspace .git is read-only/empty; hosting will need a writable source staging Git repository or approved repository initialization when complete. Source credentials expired; obtain fresh credential for existing project when ready. Never store credentials in source or print them.

Current reaction and funding design

• Game.decision is a single server-gated decision union: advisor / wormProtection / wormRide / battleCards. spiceResolution persists resumable worm draws; wormRides resolves after all Nexus choices. Existing JSON rooms normalize missing fields on the next action.

• Game.aid holds spice earmarked by a donor for its ally in phase 3 or 5. A bid records its exact ally contribution. Unspent funding can be revoked unless committed to the current high bid; remaining funds return at phase end. Projections show only the player’s own pledge and ally credit.

• Harkonnen is an additional traitor voter when allied to a combatant, regardless of whether it holds a relevant card, preserving secret hand information. Resolution waits for its affirmative reveal or decline.

• Printed base PDF is downloaded at /tmp/dune-rules/base.pdf, extracted with layout at /tmp/dune-rules/base.txt. Reviewed pages 9–12, 16–19 confirm group movement, ally funding, optional discards and faction choices.

• Battle.preparation owns Voice/prescience steps. prescience.value commits a single element only after an existential legal-plan check, so Voice cannot force an impossible answer. components/battle-preparation.tsx owns these action forms. Karama cancellation now covers Voice and prescience. Add Truthtrance on top of these explicit windows.

Official FAQ priority

The November 2020 official FAQ is indexed at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf although direct fetch is still 403. Use targeted web searches to read its indexed sections. It supersedes the older base PDF mirror where they differ. Implemented: Weather Control and Family Atomics may be played after the dial distance is known but before actual movement. Remaining corrections: bribery is intended as advanced; Karama auction acquisition wording updated; audit simultaneous expansion stronghold victories. Storm-contested occupation is now excluded from victory counts. Truthtrance may ask any game-related yes/no question including current-turn commitments; unknown answers allow another question or later play. Full enforcement will need explicit structured commitments plus handling for freeform questions; do not silently limit its semantics and call it complete.

Latest windows and cards

• Game.stormPending reveals the total before movement; all players confirm and card changes reset confirmations. Weather Control can replace revealed dials.

• Game.spiceWindow keeps each base spice blow open for Harvester before Nexus/charity. Harvester doubles new spice only; the old incorrect collection multiplier was removed.

• Game.response suspends normal play for a public power use. Every seat may allow; another faction may spend Karama to cancel. Supported: Voice, prescience (before answer), spiritual advisor, Emperor auction income, Harkonnen bonus card. More response kinds remain.

• Auction winner now receives an auctionPayment decision: pay bid or use Karama. Holding Karama allows overspice bids; an eligible player may take the current card directly. Full-hand limits still apply. Payment, income and bonus-card resolution are separated.

• Exact official Karama list was retrieved via targeted search site:gf9games.com/dune/wp-content/uploads/2020/11 "unlimited"; indexed page 7 gives rules, superseding the April FAQ. Shipment with Karama costs Guild rates paid to the bank (not free); implemented with a benefit for the active recipient, who chooses their own shipment. Remaining base cancellations include Guild rates/transport, Fremen movement. Guild income and Harkonnen ally traitor support now have cancellation windows.

• Rule UI: /rules is searchable reference; /rules/coverage retains implementation ledger. Data in game/reference.ts; client in components/rules-reference.tsx; reusable HelpTip and TooltipProvider integrated in layout.

• AI: game/bots.ts accepts personalized views for candidate selection; authoritative rules filter candidates. runBots copies input state and advances up to 96 actions per transaction, with botsPending allowing authenticated continuation. Host-only lobby actions manage seats; no player cookie is issued for bots. game/bot-profiles.ts supplies UI descriptions without importing the engine into the client.

• Player-facing external hyperlinks have been removed from lobby and rule pages. Research provenance remains in developer documentation. Rule topic deep links open their target details.

• Fremen setup accepts sector-specific allocations and retains compatibility with earlier territory-level setup actions.

• Emperor alliance actions: immediately spendable spice gifts, and up to three extra allied force revivals at two spice each. Both have cancellation windows; canceled uses cost no spice or quota. Extra revivals are tracked separately from normal revival. Gift amounts are projected only to Emperor and recipient.

• Full base-faction reference topics now describe printed starting conditions, powers, allies and special victories. Six advanced-faction reference topics document their powers while clearly marking execution support as planned.

Advanced combat checkpoint

• game/combat.ts enumerates casualty combinations matching both dial strength and spice support. Exhaustive independent small-army assignments verify the solver, including the printed Sardaukar example.
• Optional Player.elites tracks subsets of the existing total forces in reserves, tanks and individual sectors. Shipment, cross-shipment, multi-sector movement, worm rides, kills, revival and Ghola preserve elite counts. UI has explicit elite selection inputs.
• Advanced plans accept half-strength increments, seal support privately and reserve its spice against gifts/bribes. Prescience checks whether any legal support commitment permits the chosen dial without revealing that support.
• Battle resolution pays support (except a traitor winner), then gives the normal winner a battleLosses decision before card discards. Casualty options preserve the player's choice of token types; traitor/explosion losses include all elite tokens.
• Elite revival quota resets at the next turn, not when Revival starts. Ordinary revival, Ghola and Emperor extra revivals share it. November FAQ page 2 explicitly confirms no Ghola/Emperor/Tleilaxu exception.
• Advanced bot battle policies now evaluate feasible spice support and preserve valuable elites in casualty choices. Complete advanced AI games remain unverified because the remaining advanced rules are not implemented.
• Guild alliance transport now includes half-price off-planet shipment, on-planet cross-shipping, and Fremen paid cross-shipment from southern reserves. Only Guild may ship back to reserves. Allied cross-shipping pays the Guild, except the Guild-funded share, which pays the bank. Guild funding of its ally's ordinary shipment goes to the bank; only the recipient's paid share becomes Guild income.
• New primary evidence: November FAQ page 2 allows temporary allied-territory entry during shipping/movement provided the entrant moves out. Current allowedEntry still rejects allied destinations; must implement the complete movement obligation without creating unresolvable turns or inventing a voluntary-loss rule. Passing through an ally's territory is already possible.
• Latest full checkpoint: 141 unit/reference/combat/advanced tests + 3 persisted multiplayer tests, lint, typecheck and production build all pass. No deployment yet.

Advanced storm/spice and foresight checkpoint

• Each advanced blow has its own discard pile and completes its Harvester/Nexus/ride sequence before the next blow. First-turn worms return after both blows. Additional worm placement is optional; its Karama cancellation blocks further placements for the current turn only.
• Fremen worm survival and optional allied protection have separate response windows before devouring. Only a surviving Fremen group can ride after the Nexus. Cancellation of one protection does not silently cancel the other.
• Advanced Fremen privately forecasts a randomly selected 1–6 storm card after movement. The next turn reveals that card instead of dialing; Weather Control can override it. Foresight cancellation hides the card without changing the distance. Without Fremen, normal dials remain.
• stormResolution resumes sector traversal around elite casualty decisions. Half losses round up per exposed group, and repeated laps recalculate against survivors. Legal Fremen reserve shipments into storm damage the arriving group only. Storm-protection responses cover the current storm movement or that individual shipment.
• Atreides auction and movement spice peeks now pause before private revelation. Each auction card gets a fresh response; a full Atreides hand does not suppress its peek. Movement shows one card even with double blow. An empty spice deck refills before foresight, preserving the revealed top card.
• Corrected allied Guild cross-shipment payments using the current GF9 base rulebook FAQ, page 23: all allied shipments pay Guild. The Guild's own contribution still pays the bank (November 2020 FAQ page 2). This supersedes the earlier implementation note saying cross-shipments pay the bank.
• End-of-game fallback is now implemented from base FAQ page 23: Fremen when Guild is absent; highest individual stronghold counts including ties when both are absent. Expansion victory interactions and optional extra-turn ties remain to implement.
• Advanced starts and all expansion starts remain disabled. These tests verify individual rules in advanced fixtures; they do not establish full advanced compliance.

Guild timing and integrated checks

• movementRemaining tracks uncompleted turns independently of fixed storm order. Advanced Guild gets a now/wait choice at each boundary, may take its whole turn first/last/between others, and cannot interrupt an active player. Once Guild completes its turn it is removed from the queue permanently for that phase.
• The first attempt to take an early turn or delay the normal slot has a guildTiming Karama response. Cancellation locks normal order for that phase. Allowing a delayed turn grants the timing use; Guild can decide at subsequent boundaries without declaring its eventual position in advance. Flags reset at the next movement phase.
• Allied co-occupation resolution uses actual completed movement turns, which matters when Guild changes order. Temporary allied entry still needs implementation; the current entry check remains restrictive.
• Fixed a pre-existing recursive phase-transition bug: skipping an empty battle phase could invoke spice collection twice. The transition now returns after advancing; a regression test checks the exact per-force collection cap.
• Bot elite revival choices respect the shared one-per-turn limit, and stronger policies deliberately deploy elite reserves. Hard/Brutal scenarios combine the currently implemented advanced storm/spice/combat/timing systems and finish without stalling or violating elite conservation. This is not a claim of complete advanced play.
• Verified current checkpoint: 141 unit/AI/reference tests + 3 persisted multiplayer tests; typecheck, lint and production build pass. No deployment yet.
• Next advanced implementation: advisors and remaining cancellation/special Karama powers, followed by full timing audits. Then all expansion mechanics and full integration.
• Primary base page 13 explicitly resolves blow A and its Nexus before revealing blow B. Its combat example and increased spice-flow rule were retrieved directly from the indexed official GF9 PDF.

KH and advanced economy checkpoint

• Advanced Collection adds 2 spice for Arrakeen, 2 for Carthag and 1 for Tuek's Sietch, stacking separately from ground-spice collection. Empty-battle transitions still pay collection only once.

• Plan.kwisatz is a privately sealed optional bonus. Validation requires advanced Atreides, seven accumulated battle losses, a living KH, a leader/Cheap Hero, matching per-turn territory and no cancellation. Loss counter/activation/used territory are projected only to Atreides. The battle's response window is identical whether KH is active or not.

• A surviving accompanying leader/hero adds +2; a killed one adds nothing. KH blocks traitor calls, including allied Harkonnen support through the shared voter path. A lasgun/shield explosion kills KH only if actually played and the explosion resolves; traitor victory overrides it. KH never increases normal leader bounty. Seventh-loss activation is immediate for another battle that turn; territorial use resets at the next turn.

• Normal KH revival costs 2 and shares the phase's one-leader revival quota. Eligibility tracks the required Atreides revival cycle independently; KH never participates in the five-leader cycle calculation. After revival, a subsequent KH death requires the next cycle. Ghola can return it early/free without using normal quota. The repeated/late-cycle interpretation still needs broader source and expansion-interaction audit before advanced mode is enabled.

• AI plans account for KH strength and traitor protection and can revive a dead KH. Advanced simulation fixtures remain partial rules integration, not full advanced-game certification.

• components/revealed-battle.tsx renders complete public plans for combatants and spectators, including card names, support and KH. The server supplies labels for played cards only after both plans reveal; unrelated hands remain hidden. Ghola now has an explicit force/leader/KH target selector.

• Primary evidence: GF9 base page 13 (stronghold income/combat), page 17 (KH/captures), November FAQ pages 3 and 7 (immediate activation and Karama), page 6 (Tleilaxu can offer KH revival). Official indexed GF9 source URLs remain above.

• Remaining timing audit: the guaranteed KH cancellation window currently precedes Voice/prescience. Broader legal card timing, including intervention after other preparation choices, still requires verification before full advanced compliance is claimed.

• Final verification for this checkpoint: 141 unit/AI/reference tests pass, plus the three persisted multiplayer journeys. TypeScript, lint and the production build pass. Advanced/expansion starts remain disabled; the full goal remains active.

Harkonnen capture checkpoint

• Leader records remain with their original faction. capturedBy determines temporary control, and controlledLeaders is the common server source for battle validation, prescience feasibility and resolution. This avoids duplicating leaders or losing their death/revival history.

• A winning advanced Harkonnen battle queues capture after casualty and card choices. Harkonnen can decline; acceptance opens a Karama response before any random draw. Only surviving eligible leaders enter the draw, including the just-used leader in the same territory. Then Harkonnen privately chooses retention or execution.

• A concealed snapshot preserves outsiders' pre-capture knowledge without exposing the captive's identity through the original owner's leader roster. Captor and owner see actual state; Tleilaxu additionally sees concealed executions, not living captives. Revealed use or revival clears concealment. Turn resets clear obsolete territory markers from both current and concealed records.

• Execution pays 2 spice and places the leader face down, with at least two deaths. Live captives return after one battle; dead captives enter their original owner's tanks. Losing every native Harkonnen leader immediately returns unused captives. Captured leaders can turn traitor and retain their territory restrictions.

• Original-owner revival now treats capture as unavailability when opening a leader revival cycle. Executed face-down leaders remain restricted until their later cycle, with Ghola able to revive them early. KH cycle initialization avoids non-finite values when all native leaders are captured.

• Captive UI, ownership-aware leader selectors, AI capture/use/return policies and a searchable internal capture reference are implemented. Basic/advanced test suites include twelve capture scenarios and JSON round-trip privacy checks.

• Primary sources: GF9 base page 17, November 2020 FAQ pages 5–7, Ix Karama table. CHOAM FAQ page 12 says captured leaders provide only battle-use skill effects; leader skills and further expansion interactions remain to be implemented.

• Verified capture checkpoint: 141 unit/AI/reference tests and 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment; advanced and expansion starts remain disabled while required rules are incomplete. The goal remains active.

Combat cancellation and endgame checkpoint

• Advanced battle preparation now queues separate public response windows for elite strength and Fremen free spice support, alongside KH. Emperor gets no redundant elite-strength response against Fremen, where Sardaukar is already ordinary. No elite response is offered without elite forces in the battle.
• Canceling doubled strength changes combat arithmetic for that battle only; the physical elite token identity remains intact through casualties, reserves and revival. Canceling Fremen support requires spice for full strength, permits unsupported half strength, and retains the traitor-winner payment exemption. AI plans and player support forms use the same flags. Both cancellation notices are visible with the battle.
• Eight focused combat tests cover independent cancellations/card consumption, support, casualty identity, ownership, secrecy, atomic rejection, fresh-battle reset and basic-mode isolation. Full legal intervention timing after other preparation and before reveal remains a required audit: these guaranteed windows currently precede Voice/prescience. Advanced starts remain disabled.
• Victory counts exclude strongholds with opposing occupants, as specified by November FAQ page 1. Sole occupation under storm still counts. Final-turn fallback now awards Fremen when Guild is absent, or the highest individual qualifying stronghold count (all ties) when neither is present. Normal wins retain priority over special/fallback outcomes, and BG prediction cannot replace Guild/Fremen special wins.
• Six new endgame tests cover contested/sole occupation, missing factions, priority, ties including zero, earlier turns and prediction. The shared test setup now predicts a different seat when Bene Gesserit is the first player. The internal victory topic and Mentat guidance describe these cases without external links.
• Primary evidence: GF9 base rulebook pages 18 and 23; November 2020 FAQ pages 1 and 7; Ix expansion Karama table. Expansion extra-stronghold/tech ties, advisor occupation and the complete expansion victory system remain unimplemented.
• Verified checkpoint: all 155 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The full goal remains active and advanced/expansion starts stay disabled. No deployment yet.

Bene Gesserit advisor checkpoint

• Player.advisors records one stance per territory, with optional arrival-turn locks; existing force totals and sector counts stay canonical. game/advisors.ts distinguishes physical force counts from fighter counts, plans arrival stance and removes obsolete advisor records. Lone advisors promote automatically.
• Advisor presence no longer contributes to battles, normal/fallback stronghold victory, Fremen special-condition blocking, stronghold entry limits, ornithopters, collection/stronghold income or Atomics eligibility. Area destruction still includes advisors. Wrapping action results settles stance after a whole action, avoiding mid-explosion promotion. Collection, victory and battle enumeration settle before calculating their result.
• Initial placement follows Fremen setup. Direct shipments, including allied Guild cross-shipment, enter as fighters unless joining existing advisors. Normal movement can preserve advisors, match existing fighters/advisors, or request an optional fighter flip after arrival. Arrival locks are carried when moving/joining advisors. Advanced starts remain disabled, so setup is exercised in controlled fixtures.
• Intrusion choices interrupt ordinary shipments, movement and worm rides, including repeated entry. The optional whole-territory flip has a Karama response. Free accompaniment follows intrusion, and a worm ride resumes its spice/Nexus sequence only after the reaction resolves.
• Advanced free accompaniment offers valid sectors in the shipment territory as well as the Polar Sink. Successful advisor accompaniment locks that territory’s group for the turn. Before the first shipment, eligible advisor territories receive individual prepare-for-battle choices/responses; allies and storm-inaccessible battles are excluded.
• November FAQ page 4 supersedes April’s conflicting same-type/arrival text. Primary sources: base page 18 and November FAQ pages 4 and 7. Remaining audits include the full declaration timing range between Nexus and first shipment, mandatory/matching flips under Karama, precise scope of carried arrival locks, and all expansion interactions. Advanced charity and Worthless-as-Karama are still pending. Do not claim complete BG advanced compliance.
• Advisor setup, stance decisions and movement options are available in the existing table UI. Dashed map rings and territory labels identify advisors. AI handles intrusion/declarations/accompaniment and uses fighter counts for enemy control/strength estimates. The internal advisor reference now documents these behaviors as Partial.
• The advisor storm test exposed a pre-existing graph bug: distance(from, from, blocked) returned zero before checking the blocked sector. Checking blockage first now prevents battles under storm even when both armies occupy the same location.
• Seventeen focused scenarios cover occupancy, economy, Atomics, movement/type matching, intrusion sequencing, setup, arrival locks, worm rides, storm/worm/explosion casualties, sector choices and JSON round-trip state. Verified checkpoint: all 172 unit/AI/reference tests and 3 persisted multiplayer journeys pass. TypeScript, lint and production build pass. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Bene Gesserit charity and Worthless Karama checkpoint

• charityTurn enforces one charity claim per turn for all factions, closing repeated claims after bribing proceeds away. Advanced BG receives +2 even from one spice and on turn one. At two or more spice the claim has a bgCharity response; cancellation consumes the claim without paying. The private view exposes claim availability only to the owner.
• game/karama.ts is the shared eligibility predicate used by engine, AI and player forms. Advanced BG can select Worthless cards for all currently implemented Karama uses, and holding one enables overspice bidding. Full-hand acquisition checks run before discarding. Sealed battle cards and prescience-committed cards cannot be spent again.
• pendingKarama stores a structured continuation for cancel/shipment/purchase/auctionPayment. A Worthless card is discarded before its worthlessKarama response. Allowed conversion completes the original use; canceled conversion grants no benefit and never returns the Worthless card. A canceled attempted cancellation restores the suspended response and its previous passes. The stored continuation is not projected, preventing private Emperor-gift amounts from leaking. Real Karama has no additional conversion window.
• Auction payment UI now selects the exact card. AI can claim advanced charity and use Worthless payment/cancellation. Internal searchable guidance covers the implemented behavior and remaining limitations.
• IMPORTANT unresolved source edge: the primary GF9 November FAQ confirms discarded Worthless cards on cancellation but does not specify an unfunded winning bid afterward. Current provisional recovery offers another funded payment or available Karama; otherwise it resets bidding for the same unseen card, original opener and unchanged ally funds. Do not treat the passing recovery test as proof of printed-rule compliance. Research surfaced similar restart rules in nonofficial compilations, which are NOT accepted as authoritative default rules. Confirm or replace this branch before enabling advanced mode.
• Primary sources: base rulebook page 18; November FAQ pages 7 and 9; Ix expansion Karama table. Advanced starts remain disabled. Twelve new focused scenarios cover charity thresholds/quota/cancellation, conversion timing, privacy and resumability, hand limits, bids/payments, commitment protection and private-view AI. All 184 unit/AI/reference tests and 3 persisted multiplayer journeys pass; typecheck, lint and production build pass. A final public-intent display check follows the same privacy test. The goal remains active, with no deployment.

Emperor and Harkonnen special Karama checkpoint

• specialKaramaUsed persists once-per-game usage publicly per faction. The special card action validates advanced mode, phase, actual Karama ownership and unused power before applying effects. Ordinary Karama uses remain available afterward.
• Emperor’s Revival-phase power returns up to three own forces or one own dead leader for free, independently of normal quotas/cycle. The shared one-elite-per-turn limit applies and token totals are conserved. Living/captured/foreign leaders, combined force-plus-leader targets, wrong phases and ally-force targets are rejected atomically. Expansion revival/income and full timing audits remain.
• Harkonnen’s Bidding-phase power draws 1–4 unseen random cards from another hand, temporarily exceeding the hand limit if necessary. Its owner then returns exactly that many distinct cards from the combined hand, including any newly acquired ones. The card is discarded and game usage is consumed before the draw.
• pendingExchange privately suspends an existing auction decision/response. During the exchange all ordinary actions are gated. Completion restores the exact response including its passes and private amount, or resumes the pending payment. The continuation is never projected. Card IDs are absent from public exchange logs/decisions; each owner sees only their own current hand.
• Losing the only Karama backing a winning bid now uses the existing provisional unfunded-payment recovery. Auction finalization checks funding as well, so taking the backing card before the final pass cannot stall the game. This recovery remains a source-verification gap; tests prove conservation/resumability, not official printed-rule compliance.
• Player forms provide blind-draw amount/target, private return checkboxes, Emperor force/leader targets and help tips. Internal faction and special-Karama topics describe the two implemented powers and identify the remaining powers. AI selects targets from public hand counts and return cards from its own hand; Emperor can invoke special revival then continue normal revival.
• Twelve focused tests cover conservation, transient hand limits, privacy/JSON projection, suspension/resumption, atomic rejections, once-per-game usage, revival quotas and private-view AI. The AI invariant permits excess cards only for the active Harkonnen exchange, within its declared count.
• Primary evidence: GF9 base page 14; November FAQ page 3 (phase restrictions/once per game), page 6 (blind draw, inspect, equal return and temporary hand limits), page 2/base page 19 (one elite per turn). No tournament compilation was adopted as a primary rule source.
• All 196 unit/AI/reference tests and 3 persisted multiplayer journeys passed, along with typecheck, lint and production build. Final guidance-only validation follows. Advanced and expansion starts remain disabled; no deployment. The full goal remains active.

Guild special shipment-stop checkpoint

• Ordinary off-planet shipments now validate destination, availability, elites, cost and private ally contribution before opening a Guild decision. The decision appears regardless of the Guild’s hidden hand until its once-per-game power is spent. Fremen southern reinforcements and on-planet cross/return transport are excluded; Guild’s own off-planet shipment can also be allowed/stopped under the rulebook’s “any one player” wording.

• pendingShipment stores the validated shipment privately. No payment, troop/elite placement, Guild income, intrusion or accompanying advisor happens during the pause. Only the Guild can allow it or spend its actual Karama to stop it. The special power resolves directly and cannot open a normal Karama counter-response. Mutation stays atomic and private projections never include pending funding.

• Allowing invokes the shared shipment commit once and resumes Guild income, then intrusion/advisor choices. Stopping spends Guild’s card and once-per-game power, consumes the shipper’s shipment opportunity, keeps troops/spice/allied credit untouched and leaves ordinary movement available. Any shipment-rate card is tracked privately and returned to its original owner on stop; allowed shipment consumes it normally. Converted Worthless benefits are tested as well.

• Unverified settlement details: GF9 base page 14 confirms one off-planet shipment of any one player; November FAQ page 3 supplies phase/once-per-game scope and page 7 establishes Fremen’s reserve immunity. Those retrieved primary passages do not settle retaining/returning rate cards, consuming the canceled shipment opportunity, stopping a separate spiritual advisor, or special-power counter timing. Current settlement is provisional engineering behavior, not a full-compliance claim. Historical/Avalon Hill/tournament and unofficial compilation text must not silently supersede GF9. Audit this before enabling advanced starts and extend it for homeworld/expansion interactions.

• UI provides declared target/count/sector, an allow button and a special-stop button only for actual cards in the Guild’s own hand, plus internal tooltips and rule links. AI at every difficulty resolves the decision from its private projection; higher difficulties protect occupied territories or contest substantial stronghold shipments and preserve allied shipments.

• Fourteen focused tests cover deferred effects, canceled and allowed payment accounting, elite conservation, allied contributions, gifted/converted rate cards, private projection, invalid/bypass attempts, once-per-game scope, movement after stop, basic/Fremen/cross-shipment exclusions, all AI difficulties and JSON-persisted intrusion continuation. Existing rate-benefit shape assertions now include the tracked card internally, while the public view preserves its prior shape.

• Primary sources: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf (p14); https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (p3/p7). Product references remain internal only.

• Verified checkpoint: all 210 engine/AI/reference tests and all 3 persisted multiplayer tests pass, as do TypeScript, lint and production build. Advanced/expansion starts remain disabled. No deployment; the full goal remains active.

Atreides full battle-plan inspection checkpoint

• Advanced Atreides now receives a special-Karama offer after Voice and ordinary prescience are resolved or declined. The offer occurs independently of its hidden hand and is available even in an unrelated battle. Declining preserves its card and game-wide usage; the offer cannot be reopened after sealing has begun.

• Spending an actual Karama consumes the once-per-game power and chooses either combatant. Battle.fullPlan records observer and target; the target must submit a fully validated plan first. Dial, leader, weapon, defense, spice support and KH are committed using the ordinary battle plan store, so existing support reservations and sealed-card protections apply. Invalid actions are atomic.

• Full-plan inspection now persists privately until public reveal without an acknowledgement decision. Its entitled Atreides owner can be an external ally; the assisted ally does not receive the private projection. Legacy saved fullPlanRead normalizes through authoritative recovery. Target-first sealing and the normal reveal/traitor sequence remain intact.

• A canceled ordinary prescience request still leads to the special offer. An answered element and the Voice remain binding during the full-plan submission. The special resolves without a normal cancellation window. Its game-wide usage persists across later battles/turns.

• Added a private plan panel and request/acknowledgement guidance. Existing battle form handles target commitment; other players see the specific wait. Internal faction, card, special-Karama and coverage topics include this behavior and identify incomplete timing coverage.

• AI can initiate, answer, decline and acknowledge the inspection at all four difficulties. When Atreides has inspected its own opponent, its battle scoring uses actual enemy dial/leader/weapon/defense, survivor strength and explosion risk. Unseen hand contents and traitors cannot alter the chosen candidates. Broader difficulty calibration still remains.

• Twelve dedicated scenarios cover Voice/prescience ordering, targeted commitment, selected-card privacy, acknowledgement ownership, unrelated battles/allies, hidden-hand-independent offers, ordinary cancellation, invalid input atomicity, once-per-game scope, sealed Worthless protection, all four AI difficulties, actual-information tactics and KH visibility. Existing advanced combat/KH/advisor fixtures now explicitly decline the new offer before testing their original mechanics; their original assertions are retained.

• Primary evidence: GF9 base rulebook p14 (once-per-game Karama; inspect any one player’s entire Battle Plan), November 2020 FAQ p3/p9 (advanced power scope/once-per-game). The exact post-prescience commitment/acknowledgement order is an engineering timing choice pending the remaining pre-reveal card audit. Re-answer/replanning rules after other card effects, interaction with cancellations already committed, and all expansion plan components must still be audited. Historical/unofficial compilations were not adopted as proof of GF9 compliance.

• Advanced and expansion table starts remain disabled; no deployment. The full goal remains active.

• Verified checkpoint: all 222 engine/AI/reference tests and all 3 persisted multiplayer tests pass. TypeScript, lint and production build pass. The full goal remains active, with advanced/expansion starts still gated.

Fremen summoned sandworm checkpoint

• Added once-per-game Fremen Karama during Spice Blow and Nexus, restricted to sand. The call does not draw/discard a spice card or mutate the existing discard-pile order. Destruction, optional ally protection, ordinary Karama cancellation of protection, elite conservation and worm rides reuse the existing worm engine.

• summonedWorm.resume privately suspends the interrupted response/decision, Worthless conversion, fresh-blow window and spice sequence until protection/destruction finishes. Only the called territory is projected. Resumption preserves response passes and private payloads; devoured fresh spice is marked unavailable to Harvester.

• Timing corrected to primary evidence: November 2020 FAQ p3 explicitly places the called worm’s Nexus at the end of the spice-blow phase, not immediately before remaining draws. The initial local interruption prototype was replaced before release. A pre-draw call now defers its Nexus while preserving its ride queue; normal draw completion opens negotiations. In advanced play this follows the current pass’s ordinary Nexus point before proceeding to the other pile. Calling during an open Nexus adds the new ride and resets confirmations. A call during an unmade ride requeues it and opens negotiations; a completed ride’s pending BG intrusion/flip resolves before the new Nexus.

• UI adds a sand-territory picker and summon control to Fremen’s actual Karama card, with internal tooltip/reference guidance. AI uses public sand-territory threats and its own available card. All four difficulty policies can initiate the call; existing response/Nexus/ride policies perform the continuation.

• Fourteen focused tests cover deferred Nexus ordering, unaltered deck/pile state, troop/elite/spice effects, protection cancellation, merged Nexus rides, JSON suspension, interrupted additional-worm choice, Harvester prevention, invalid/repeated actions, first-turn token versus drawn-card behavior, private-view AI, pending rides, BG intrusion and suspended Worthless conversions.

• Rule precedence: https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf p3 supplies summon timing, destruction/protection, rides and second-Karama survival cancellation. It supersedes the older contradictory “no Nexus” answer still printed in the current base PDF p22. Base p14 supplies sand placement/one-use scope. Remaining audit: simultaneous/late card timing, whether a called worm changes subsequent additional-worm counting, first-turn token interactions and expansion discovery/Homeworld/Nexus mechanics. Advanced starts remain gated pending the complete audit.

• Verified checkpoint: 236 engine/AI/reference tests and all 3 persisted multiplayer tests pass. Final TypeScript, lint and production build pass after the UI handler and test declaration corrections. Advanced/expansion starts remain gated; no deployment; the full goal remains active.

Tech-token module checkpoint

• Added game/tech-tokens.ts with the three printed tokens, designated initial owners, per-phase triggers, public escrow and a one-owner stronghold-set helper. Host-controlled lobby selection is independent of expansion factions and resets human readiness. Three or more players are currently required.
• Initial Fremen/Ixian/Tleilaxu assignments occur at setup. After the first storm, shuffled missing tokens go to factions without tokens in storm order. The printed-map/seat-order audit remains separately outstanding.
• Charity, free revival and off-planet arrivals trigger their matching token once per phase, excluding BG-only charity, Tleilaxu-only revival and Guild-only shipping. Income is based on the owner's full token count and paid at the phase boundary. Actual BG advisor arrivals can trigger Heighliners; Fremen reinforcements, cross-planet/return transport and stopped Guild-special shipments do not. Ghola and Emperor special free revival use the Axlotl hook only in Revival. These card-revival and free-arrival readings follow the printed trigger wording; expansion interactions still need a comprehensive audit.
• Battle outcomes preserve pending token transfer through advanced casualty and winner-card decisions, then resolve one automatic token or an owner-only choice before Harkonnen capture. No token changes in mutual destruction; single traitor victory takes a token even when it overrides lasgun/shield. Surviving winning forces are not required.
• Victory includes one extra stronghold only when a single player owns all three tokens, including in alliances. Collect all normal qualifying winners before BG prediction, so a token-assisted win can tie another normal win. Tokens also participate in the existing final-turn fallback count.
• Added public holdings/income to player panels, capture-choice controls, lobby tooltip, searchable internal tech-token topic and updated coverage. AI considers enemy token holdings, complete-set victory pressure and legal token selection without access to other hands.
• Evidence: GF9 Ixians & Tleilaxu rulebook pages 4–5 (https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf; same primary document at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf); November 2020 FAQ page 9 confirms the tech-token normal-victory tie. Ecaz & Moritani rulebook page 15 reiterates that allies cannot combine token holdings and says homeworld shipments trigger Heighliners (homeworld engine still unimplemented).
• Verification: full 251-test suite passed before the final focused battle-outcome addition; all 15 focused tech tests then passed, bringing total tested cases to 252. All four persisted multiplayer journeys pass, including a complete six-seat human/AI game with tech tokens and reconnect checks. TypeScript, lint and production build passed. No browser visual QA or deployment performed. The full goal remains active.

Ix combined/alternate battle-card checkpoint

• Added four typed card identities via ixBattleCards() and shared game/battle-cards.ts logic. Poison Blade requires both projectile and poison protection; Shield Snooper supplies both and remains a shield for lasgun explosions. Weirding Way defaults to projectile weapon and can fill the defense slot with another weapon; Chemistry defaults to poison defense and can fill the weapon slot with another defense. Each occupies exactly one slot.

• Authoritative plan validation, combat casualties, feasible prescience answers, Voice prohibitions/compulsions, UI selectors and AI now use the same card roles. Voice can name each special card directly; generic prohibitions follow the played role, and compulsion considers default roles so it does not force an alternate use. Prescience reveals only the actual selected slot and preserves the other card's privacy.

• AI evaluates full-plan inspection with the shared lethality/explosion functions. Ordinary prescience now identifies the explicitly revealed card through the catalog instead of guessing from its label; Hard/Brutal select Shield Snooper against revealed Poison Blade. No opponent hand or deck data enters those decisions.

• Added internal searchable rules, readable Voice labels and descriptions on the new hand cards. Complete expansion deck assembly is not enabled: this is tested subsystem support, not a claim that Ixians/Tleilaxu are playable.

• Primary evidence: GF9 November 2020 FAQ pages 3–5 for effective-slot prescience, generic/named Voice and default-role compulsion; page 9 for Weirding Way versus lasgun and Shield Snooper. Ixians & Tleilaxu rulebook page 11 confirms ordinary Shield does not stop Poison Blade while Shield Snooper does. CHOAM & Richese rulebook page 4 says revised Poison Tooth and Artillery Strike replace their Ix versions; implement those revised effects next, not the superseded text. URLs are retained in the earlier source sections and the tech-token checkpoint; no external links were added to player-facing pages.

• Still audit printed card edge cases involving Worthless as the complementary slot and Chemistry/Weirding Way together (current representation permits both assignments when both slots are occupied). Complete Ix card inventory, card text revisions, Cheap Hero traitor, Sandtrout, Amal, and faction integrations remain. A base-deck name audit is also needed: Basilia Weapon appears in the current base list, while sources suggest it belongs to the Ix expansion and the base card should be Ellaca Drug; verify against printed primary components before changing the catalog.

• Verification: all 265 unit/engine/AI/reference cases and four persisted multiplayer journeys pass; TypeScript and lint pass. The new 13-test file includes a 36-pair lethality matrix, authoritative leader death/explosion outcomes, failed-plan immutability, generic/named/default-role Voice, JSON/private prescience, legal AI choices at all levels, and targeted Hard/Brutal defense selection. No browser visual QA or deployment. Full goal remains active.

• Production build completed successfully for this checkpoint; final subsequent UI edits only replace the card-type label with its readable label and update the coverage text.

Poison Tooth and Artillery Strike checkpoint

• Added poisonTooth and artillery card identities to the implemented Ix battle-card catalog. Full room decks still use the gated base setup; no partial expansion deck is offered.
• Battle revelation now opens an owner-only Poison Tooth activation decision before traitor choices. This is separate from the sealed plan and ordinary prescience commitments. Activation is public, serialized and immutable once submitted. No leaders, forces or spice are changed until battle resolution. The queue can handle multiple tooth-bearing plans in storm order for future card-copy effects; complete Mirror Weapon semantics remain unimplemented.
• Shared battleCardEffects handles attacks on both leaders. A tooth can be declined, or activated against each side's defense; Chemistry as defense protects while Snooper/Shield Snooper do not. Unused winning tooth is optionally retained; used tooth is discarded. Artillery attacks each side's shield, suppresses surviving leader/KH strength and all leader bounty, and is discarded after use. Other weapons still apply, and advanced spice support/casualty accounting is preserved.
• Traitor victories bypass these effects and preserve the winning faction's otherwise single-use weapon; explosions take precedence. This follows the base rule that the successful traitor caller loses nothing. Opposing leaders/forces/cards follow normal traitor losses.
• AI models both leaders' exposure and artillery suppression during planning. At the revealed tooth decision it compares public totals with/without activation, preferring a win and preserving its leader and unused card when possible. Easy retains variation; Medium/Hard/Brutal choose based on these outcomes. The UI shows revealed plans to the tooth owner, activation/decline controls and the submitted result; internal card topics describe effects, timing and current coverage.
• Evidence: GF9 November 2020 FAQ p8 explicitly covers Chemistry versus tooth, Snooper exceptions, used/unused tooth discard and Shield Snooper explosions; p9 confirms Shield Snooper versus Artillery and the Weirding Way exception. Pages 4–5 govern named versus generic Voice. CHOAM & Richese rulebook p4 directs replacement of the original tooth/artillery cards. Direct retrieval of the replacement printed card faces remains incomplete, so do not claim that printing audit is finished; the implementation currently follows the FAQ-backed behavior and known card text. Do not use the separately found Dune movie-game rulebook as classic-game evidence. Stone Burner, leader skills, Mirror Weapon and other later card interactions still need implementation/audit; specifically confirm artillery/KH suppression against later clarifications.
• Verification: all 277 unit/engine/AI/reference tests and all four persisted multiplayer journeys pass. The 12 new tests cover ownership, invalid-action immutability, JSON/private revelation, activation, retained/discarded tooth, defenses on both sides, self-exposure, suppressed bounty, traitor/explosion precedence, Voice, four AI levels and advanced force/spice/KH outcomes. TypeScript, final lint and production build pass. Final coverage text was updated after build. No visual browser QA or deployment; full goal remains active.

Sandtrout spice-deck checkpoint

• Added a Sandtrout spice-card variant and optional 22-card Ix deck construction. Start chooses that deck when the Ix expansion is selected, but the existing expansion-start gate still applies. The 21-card base deck remains unchanged.
• Drawing Sandtrout breaks alliances, clears offers and returns any outstanding ally credit to its donor. It is represented as a public set-aside card while waiting, so it cannot re-enter a reshuffle before consumption. Normal territory draws do not consume it, including between advanced piles and across turns.
• A subsequent active drawn Shai-Hulud consumes Sandtrout without destruction, protection responses, Fremen rides or its own Nexus. Only an immediate territory replacement receives double spice. A second worm resolves normally against the preceding effective card and cancels the bonus. Suppressed discard entries carry metadata so they do not count as normal worms for Fremen extra placement; reshuffling strips that metadata.
• Harvester doubles the enhanced amount; storm still prevents it. First-turn ignored worms currently do not consume a waiting Sandtrout. A Fremen summoned worm is not a drawn card and does not consume it. A prior already-triggered Nexus is preserved when Sandtrout appears later in that draw sequence.
• Added a public pending-status notice, an internal searchable Sandtrout topic, and the previously missing table display for Atreides' private spice foresight (territory, Shai-Hulud or Sandtrout). The existing server projection controls who can see the next card. Status notices sit outside the play grid so they do not displace its columns.
• Primary evidence: GF9 Ixians & Tleilaxu rulebook p4 (add one Sandtrout) and p11 (immediate alliance cancellation, next Shai-Hulud suppression, immediate land doubling or second-worm normal Nexus), at https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf. First-turn ordering, the exact suppressed-card discard layout, prior-worm Nexus and special-summon interpretations remain audit items; later discovery and other expansion spice interactions are not implemented. Live expansion starts stay gated pending full integration and that audit.
• Verification: all 292 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 14 Sandtrout scenarios cover deck inventory, alliance/escrow cleanup, pending-state JSON, suppression versus normal worms, both advanced piles, Fremen protection/placement, Harvester/storm, reshuffle metadata and private foresight. An additional full-game AI test runs Hard/Brutal with Sandtrout and checks exactly one card across deck/discards/set-aside state plus force conservation. Final TypeScript, lint and production build all pass. No browser QA or deployment; full goal remains active.

Thumper checkpoint

• Added the implemented Thumper entry to ixSpecialCards(). The full expansion treachery deck is not yet assembled/enabled; Amal, generic expansion duplicates and Cheap Hero traitor setup remain.
• Playing Thumper before the first Spice Blow draw discards it once and passes a virtual Shai-Hulud into the shared spice resolver. It targets the prior effective card in pile A, pauses for normal Fremen/allied protection before drawing any real card, opens the ordinary Nexus/rides, and counts toward advanced extra-worm placement. Pile B continues separately.
• Virtual worm markers retain their identity in serialized discard history and are removed on refill rather than becoming extra Shai-Hulud cards. Sandtrout suppression preserves the virtual marker and doubles only an immediate land replacement. First-turn ignored Thumper is never returned to the spice deck. Pending ordinary/summoned worm continuation remains unchanged.
• Added public beforeSpiceDraw timing to the view, a disabled-until-legal card button and hand guidance, plus an internal Thumper rule topic. AI uses only the public prior territory and force counts to prefer hitting enemies while preserving the card when Sandtrout would suppress it; Easy retains variation.
• Source status: the GF9 Ix rulebook establishes the expansion inventory and shared worm/Sandtrout framework. The Thumper card's opening-phase/instead-of-reveal wording was located in transcribed card references (https://www.scribd.com/document/745862168/DUNE-Factions-TreacheryCards-EXP1-3-v2 and the classic-card section of https://www.landsraad-vegas.com/rules/gencon). These are secondary and the latter includes tournament/house amendments; do not treat the whole source as the target rules. Direct primary card-face verification of first-turn allowance, exact opening timing and Sandtrout handling remains required before enabling expansion starts. The implementation currently permits first-turn use but ignores its worm effect, and limits play to the phase opening before pile A.
• Verification: all 302 unit/engine/AI/reference tests and four persisted multiplayer journeys pass; final TypeScript, lint and production build pass. Ten focused Thumper tests cover treachery consumption, deck order/conservation, JSON-paused protection, ally responses, Nexus/rides, extra worms, second pile, Sandtrout, first-turn handling, refill and timing rejection/AI policy. No browser QA or deployment. Full goal remains active.

Cheap Hero traitor checkpoint

• Added game/traitors.ts: one expansion traitor identity maps both Cheap Hero treachery cards without inventing a faction leader disc. The deck builder includes it only for the Ix expansion; full expansion starts remain gated.
• Setup, authoritative traitor calls and private-view AI share this identity. Normal traitor losses apply, with zero hero bounty and no fake leader in the tanks. The holder retains the card for subsequent opponents. Harkonnen ally calls use their existing Karama response; KH protects an accompanying hero.
• Resolved traitor calls now retain public identity history in revealedTraitors; uncalled selections remain private. Player panels display the history. Medium/Hard/Brutal plan scoring avoids publicly exposed leaders held by an opponent or its Harkonnen ally, unless KH protects the plan. Setup scoring handles the hero identity and all four AI levels can call it.
• Added a searchable internal rule entry with related links. No player-facing external navigation added.
• Primary evidence from the previously indexed GF9 Ixians & Tleilaxu rulebook p11: Cheap Hero traitor may be revealed against any opponent playing a hero, can be used repeatedly, and is known after its first revelation. Base rules p17 protect KH-accompanied heroes and permit Harkonnen ally support. Sources: https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf and https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf. Direct retrieval of the Ix PDF remains intermittently forbidden. Later Face Dancer/Tleilaxu and other expansion interactions remain unimplemented. Public identity becomes visible at simultaneous call resolution; canceled Harkonnen support does not publish it, pending the broader timing audit.
• Verification: all 314 engine/AI/reference tests and all four persisted multiplayer journeys pass, as do TypeScript, lint and production build. Twelve new tests cover inventory, private setup, both heroes, repeated use, no leader/bounty fabrication, invalid-action immutability, KH, Harkonnen cancellation, mutual traitors, all difficulty levels and public-knowledge-only AI planning. No browser QA or deployment; full goal remains active.

Amal and phase-opening checkpoint

• Added Amal to the implemented Ix special-card catalog. On play each player's available spice becomes its floor-half; the card is discarded once. Unpaid bribes and deferred token income are separate balances. Full expansion deck assembly and starts are still gated.
• Refactored phase entry into openPhase and beginPhase. Ix-enabled tables receive the same public window at every phase opening, regardless of who holds Amal. Everyone plays or passes; an Amal play resets passes. After all passes, the saved initializer runs once. This includes the initial Storm and the post-storm Spice Blow entry, serializes through JSON, and preserves the Fremen storm-forecast response.
• Automatic auctions, movement preparation/prescience, empty battle skipping, collection, Mentat bribe payout/victory and new-turn resets wait for the opening. Previous-phase tech income and unused alliance credit settle before it. The window blocks normal phase actions and special Karama play; advanceBots remains a harmless polling continuation. More beginning-of-phase powers and universally timed cards will need explicit integration here.
• UI supplies an opening panel, pass count and owner-only Amal control with its exact personal spice loss. Hand controls disable Amal outside the opening. The public view does not reveal hidden card holdings, rival spice or internal continuation details. A searchable internal rule topic describes the timing and current limits.
• All four AI policies can pass openings; the Amal policy uses only its own low spice balance (and Easy variation), without inspecting rival wealth. Hard and Brutal complete games with all phase windows and exactly one Amal conserved across deck/hand/discard.
• Source status: transcribed printed-card wording specifies beginning of any phase, half of spice behind shields rounded up, then discard. References are the previously recorded classic-card transcription and https://www.scribd.com/document/851223590/ (Chinese card reference). Official Ix PDF confirms the expansion framework but direct primary card-face retrieval is still incomplete. The earlier PDF search results remain indexed despite direct 403 responses. Do not claim the printed-face or simultaneous beginning-of-phase audit is complete. CHOAM inflation, homeworld reserves, Richese auctions and other unreleased economy interactions remain unimplemented. Current pass commitment/reopening semantics are the digital timing protocol and require the complete card-window audit.
• Verification: 328 engine/AI/reference tests and all four persisted multiplayer journeys pass. Fourteen new Amal tests cover exact rounding, bribe/collection ordering, deck draws, prior income/credit settlement, charity, setup/turn boundaries, empty phases, hidden information, ownership/timing/immutability, all difficulty levels, full games and Fremen forecast/Thumper continuation. Final TypeScript, lint and production build all pass. No browser QA or deployment; the full goal remains active.

Tleilaxu Face Dancers and Zoal checkpoint

• Obtained a readable mirror of the publisher's 12-page Ix rulebook at https://cdn.1j1ju.com/medias/20/16/31-dune-ixians-tleilaxu-rulebook.pdf. Stored genuine PDF/text as /tmp/dune-rules/ix-official-mirror.pdf and .txt; the older /tmp/dune-rules/ix.pdf remains invalid HTML. Rendered and inspected printed p3 to verify all ten Ix/Tleilaxu leader names and strengths; catalog includes both sets. The printed rulebook's older ghola-buyback answer is superseded by November 2020 FAQ p6 (a foreign ghola cannot be sold back while alive).

• Tleilaxu are excluded from ordinary traitor dealing/selection. After others select, the unused deck is reconstructed from valid faction cards minus held traitors, shuffled and dealt as three private Face Dancers. The reserve is stored authoritatively and never projected. Staged fixture setup covers conservation and secrecy; live expansion-start gates remain in place.

• Every other faction's battle victory opens an optional Tleilaxu decision independently of its hidden holdings, after winner losses/card choices/tech transfers/Harkonnen capture. A matching unrevealed Face Dancer returns the winner's surviving forces to reserves, preserving elite subsets, and allows replacement from Tleilaxu reserves and any board locations up to that count. Killing a living winning leader adds no bounty and does not repeat an earlier death. Cheap Hero identity survives its treachery discard for matching; KH cannot prevent Face Dancing. Karama cannot cancel it. Winner rewards remain unchanged.

• Replacement currently removes the winning faction's forces, preserves peaceful BG bystanders, permits zero replacement forces, and lets Tleilaxu choose a sector in the battle territory. These sector/zero/bystander readings and later mobile-stronghold/homeworld/terror/ambassador interactions remain explicit cross-module audit items. Captive release is rechecked when a Face Dancer kills Harkonnen's last native leader.

• Revealed Face Dancers are public and unavailable for reuse. Revealing the third shuffles all three into the reserve and deals three new cards. During Mentat, Tleilaxu may replace one unrevealed card with a cancelable response. The selected identity is hidden from other players in the response projection; cancellation preserves the cards and uses the turn's replacement opportunity. Full simultaneous timing and Mentat/victory ordering still require the global audit.

• battleLeaderStrength copies the opposing disc for Zoal, excluding KH, and uses zero against a hero. Ordinary totals, poison/weapon bounty and traitor bounty share the helper. Zoal retains a separate effective ordinary revival value of three through his catalog strength; battle selectors display X. AI sealed-plan estimation and Poison Tooth evaluation use dynamic leader strength.

• Added an owner-only Face Dancer control component with sources, sector and counts; private hand and public revealed-card panels; Mentat replacement buttons; searchable rule/faction entries. AI at all four levels can reveal/decline using its own private identities, preserves one force in source strongholds, and replaces dead-leader Face Dancers during Mentat. Tleilaxu revival strategy is not yet implemented.

• Closed a start-validation gap: an expansion faction supplied with an empty expansion selection is rejected, so direct API construction cannot silently start an unfinished faction. All expansion starts remain gated pending actual completion.

• Primary evidence: Ix printed p3, p6–7, p10–12; November 2020 FAQ p6 and p8 at https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf. The FAQ confirms unlimited Tleilaxu force/own-leader revival, their own free-revival income, Zoal revival value three/no copied KH bonus, Emperor extra-revival payments to Tleilaxu and the separate Karama effects. Revival income/discounts/negotiation, foreign gholas, special Karama and their UI/AI are the next major Tleilaxu work, not completed here.

• Nineteen focused scenarios pass: private setup/deck conservation, reward ordering, force/elite conservation, invalid-action immutability, declined/unmatched reveals, Cheap Hero, KH, dead leaders, third-card recycling, private/canceled Mentat replacement, Zoal totals/bounty, all AI difficulties, unfinished-faction gating, BG bystanders and Harkonnen captive release. The fixture's Guild-to-Tleilaxu substitution now remaps dealt identities before setup; an earlier randomized fixture failure was corrected. Final regression/build results are recorded below.

• Setup finalization is shared by all successful setup actions and bot continuations. This prevents the Harkonnen–Tleilaxu two-faction combination from waiting indefinitely when neither faction has an ordinary traitor-selection prompt. A nineteenth scenario covers automatic completion and deck conservation for that pairing.

• Final verification: all 347 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and production build pass after the setup-finalization and UI/reference edits. No browser visual QA or deployment. The original goal remains active and incomplete; the next required Tleilaxu work is revival economy/negotiation, foreign gholas and special Karama.

Tleilaxu revival commerce checkpoint

• Added shared revival quoting and transactions in game/revival.ts and the authoritative engine. Tleilaxu can revive their own forces without the ordinary three-force limit, revive multiple own leaders before all five are dead, and pay half normal prices rounded up. Other factions retain their native revival-cycle and one-leader restrictions. Elite revival remains limited to one per turn across ordinary, Ghola and Emperor-funded revivals.
• Tleilaxu can grant another faction up to five normal force revivals and grant their current ally half-price ordinary revival. The recipient pays; no implicit Tleilaxu funding is created. Dedicated Karama responses occur when the extra limit or paid discount is used. A canceled limit aborts the transaction without partial revival; a canceled discount restores the normal price and aborts if the payer cannot afford it.
• Other factions privately request an early dead leader or KH, and Tleilaxu quotes or declines. Acceptance revalidates eligibility, funds and the one-leader allowance before its Karama response. A zero-spice agreement is allowed. When all native leaders are unavailable, including capture, ordinary revival rules apply instead of the early negotiation path. Early-revival cancellation blocks that selected leader for the phase without revealing a concealed identity to outsiders.
• Paid revivals now route to Tleilaxu through a separate income response. Normal free revival rewards one spice once per faction per turn, including Tleilaxu themselves; split free-force actions and canceled income cannot repeat that reward. A Ghola treachery play has its separate one-spice reward, including outside the Revival phase. Income cancellation preserves the completed revival. Emperor-funded extra allied forces also pay Tleilaxu, and their separate three-force quota can combine with a granted normal five for eight forces.
• Pending transactions serialize safely and remain internal. Quote records are visible only to Tleilaxu and the requester; payment amounts only to Tleilaxu and the payer. Target IDs are validated against actual players before indexing request records, including rejection of prototype-property targets. No hidden rival spice enters AI quotation or revival choices.
• Added components/revival-commerce.tsx, private quote/accept/decline/withdraw controls, Tleilaxu permission controls, remaining-limit/free-revival/price guidance, response labels and an internal searchable revival rule entry. All four AI levels can quote, grant permissions, request/accept eligible early returns, use discounts and complete the phase through response windows.
• Primary evidence: printed Ix rulebook p7 and November 2020 FAQ p6 and p8. The FAQ confirms unlimited own leaders, one leader for other factions, half-price rounding, KH negotiations, captured-leader unavailability, ally self-payment and Emperor extra-force income. Sources are the genuine publisher-rulebook mirror and official November FAQ recorded above. Foreign gholas, special Karama, Ix cyborg pricing and later expansion economy remain unimplemented. Exact cancellation duration/scope, combined paid/free-income cancellation, ally-permission timing, Emperor special free-revival income and full card-window integration remain audit items; tournament-wide free-income cancellation rules have not been silently adopted.
• Verification: all 368 engine/AI/reference tests and all four persisted multiplayer journeys pass. The 21 focused revival scenarios cover private quotes, rejection/immutability, zero-price and KH revival, captured/concealed leaders, repeated free-income prevention, canceled discounts/limits/payments, Zoal rounding, elite/tech-token accounting, Emperor funding and complete AI phase progression. Final TypeScript, lint and production build pass. No browser visual QA or deployment. The original goal remains active; expansion starts stay gated until their full rules and interactions are complete.

Foreign ghola checkpoint

• Added game/leader-control.ts and persistent Leader.gholaBy. Every leader remains a single record under its original faction, preserving traitor identity and death history; ghola control overrides native use, and temporary Harkonnen capture overrides ghola control. The engine, battle preparation, battle selectors and AI share the controller predicate. Public ghola pools are projected without copying authoritative identities.
• Advanced Tleilaxu can acquire dead foreign leaders during Revival at their discounted bank price while their active controlled pool has fewer than five leaders. Multiple acquisitions are allowed up to that pool limit. Face-down executed leaders remain eligible and retain death counts. KH and the Auditor are excluded. The full-price discount cancellation still reprices before any payment or transfer.
• Acquisition has a dedicated Karama response. Cancellation aborts it without spice or leader mutation and blocks that particular foreign leader for the current turn; another eligible leader can be chosen. Selected pending identities and canceled-identity history remain private to Tleilaxu. The turn key persists independently of Revival-phase initialization.
• Foreign gholas remain associated with Tleilaxu after death. A living ghola cannot be sold back. The native faction may request a private dead-ghola buyback through the existing quote/decline/accept controls even when all its native leaders are unavailable. Acceptance restores native control and uses the one-leader revival allowance. Stale quotes are revalidated. Ordinary paid revival and Emperor special revival cannot bypass ghola ownership; the Ghola treachery card can revive an existing leader in the acting faction's controlled pool.
• A foreign ghola is unavailable to its native faction for ordinary cycle eligibility. It can fight for Tleilaxu, turn traitor under its original identity, die again and retain the death history. Capture of a foreign ghola now reveals the captured identity to its current controller and Harkonnen; the original faction is an outsider to that capture. Capture logs identify the losing controller. After one Harkonnen use, capture clears and Tleilaxu control resumes.
• Added foreign-ghola revival controls, price/limit checks, pool status, dead-ghola buyback labels and a searchable internal tleilaxu-gholas rule topic. All four AI difficulties select affordable gholas from their personalized projection, recognize combat control and request eligible buybacks when their native leaders are unavailable. No player-facing external links were added.
• Primary evidence: publisher Ix rulebook p7 (acquisition and five-active-leader pool), p10 (buyback permission) and p12 (Karama table); November 2020 official FAQ p6 supersedes the older living-ghola buyback wording, confirms multiple foreign revivals and face-down leader history. CHOAM rulebook p8 excludes the Auditor. Original sources and the genuine PDF mirror remain recorded above. Remaining audits include exact buyback pricing/normal-revival and card exceptions, captured-leader pool counting, returning own leaders above five total active leaders, Harkonnen native-ghola/captive-release edges, cancellation timing and all leader-skill/homeworld/Ecaz interactions. Tleilaxu special Karama remains unimplemented; expansion starts remain gated.
• Sixteen focused scenarios cover acquisition/payment/identity conservation, JSON/public pools, five-leader cap, authority/timing/funds, specific cancellation and privacy, discount cancellation, face-down leaders, living/stale/declined buybacks, original-owner cycles, Ghola card ownership, traitors, illegal native battle use, capture and return, all AI difficulties and complete AI revival progression. Final full verification passes all 384 engine/AI/reference tests, including the additional AI buyback-selection regression. All four persisted multiplayer journeys also pass. TypeScript, lint and the production build pass. No browser visual QA or deployment. The full goal remains active and incomplete.

Tleilaxu special Karama checkpoint

• Added an authoritative revivalStop decision before another faction's advanced normal revival commits. The window appears independently of Tleilaxu's hidden card holdings while their once-per-game power is unused. Only Tleilaxu may allow or spend a real Karama. The decision exposes the recipient and force/leader category, not the pending identity, price or private continuation. A successful stop consumes the card once, marks the special power spent permanently and cancels the pending transaction without spice, force, leader, elite or ordinary-revival quota mutation.

• Current implementation prevents the selected faction's remaining normal force and leader revivals for that turn's Revival phase. It covers ordinary revivals, negotiated leaders, buybacks, KH and Emperor-funded allied extra forces. Requests for the stopped faction are cleared; later requests/revivals reject, while other factions and the next turn remain eligible. Already completed revivals are not undone. Ghola treachery and Emperor special Karama currently remain separate. No ordinary cancellation response is created for the special use itself.

• Emperor allied extra revivals now use the shared pending revival transaction after their ordinary Emperor-power response. The Emperor remains the payer; the ally receives forces and the separate extra quota; Tleilaxu receives paid-revival income only after completion. A stopped extra revival consumes neither the Emperor's spice nor the ally's force/elite/extra quota. Shared transactions carry explicit payer/source fields and serialize through JSON.

• Added a player decision panel, matching tooltip, public prevention status, blocked-revival guidance and updated internal faction/special-power/coverage references. All four AI difficulties allow without a Karama, protect allies and use public tank/leader threats to choose when to spend it. Blocked bots pass normal Revival and continue the game; the policy does not inspect rival spice or concealed leader identities.

• Primary source: printed publisher Ix rulebook p6 and indexed official PDF describe preventing a player's revival, forces and/or leader. This wording is brief and does not independently settle every duration or exception. November FAQ p7–8 clarifies ordinary Karama effects, which must not be confused with this special power. WBC 2022's explicitly amended tournament reference describes full-turn normal-revival prevention and a Ghola-card exception, but is not itself proof of target GF9 rules. The current full-turn scope, guaranteed declaration window, Ghola/Emperor-special exceptions, interactions with prior partial revival and later CHOAM/card-prevention effects remain explicitly provisional audit items. Expansion starts remain disabled; do not label the full Tleilaxu rules certified.

• Eleven focused special-power tests cover private/public windows independent of holdings, ownership and card validation, immutable rejected actions, permanent one-use tracking, stopped force/leader/KH/elite transactions, private negotiated requests, continuation into ordinary response chains, Emperor-funded payment/quota accounting, card exceptions, public-knowledge AI policies and complete blocked-phase progression. Existing revival and foreign-ghola test helpers now explicitly allow the new decision where those tests exercise a completed revival. Final verification: all 395 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass after a test-only const correction. No browser visual QA or deployment; the original goal remains active.

• Next concrete expansion work: Ixian cyborg/suboid force model and casualty substitution, then setup/auction technology and Hidden Mobile Stronghold. Printed Ix p8–9 establishes 7 cyborgs/13 suboids, initial 3+3 in the mobile stronghold, cyborg strength 2/movement 2/collection 3/revival 3, suboid strength one-half and post-loss substitution. The current combat model assumes normal strength one (or unsupported one-half); it must be generalized before Ix is enabled.

Ixian combat and suboid substitution checkpoint

• Generalized CombatForces with a fixed-half-strength normal-force mode. Ixian suboids always contribute one-half in basic and advanced play and cannot consume spice support. Basic cyborgs contribute two; advanced cyborgs contribute one unsupported or two for one spice. Other factions preserve their existing basic/advanced arithmetic. validatePlan, casualty resolution and AI now accept the Ixian half-strength basic dial range, with matching human/prescience input controls.
• Ixian leader/force identity stays within the existing physical-force model: seven cyborgs are tracked as a subset of twenty total forces, with thirteen suboids as the remainder. The lobby initializes seven cyborgs; changing factions clears or restores that subset appropriately. Base-game start also clears stale force-type metadata. Mobile stronghold setup remains gated and unimplemented.
• Basic Ixian double-strength cancellation now enters the pre-plan Karama queue. The November FAQ specifically limits this cancellation to basic cyborg strength; advanced cyborg and suboid strength do not receive that response. Suboid substitution has its own separate cancellation window when the owner chooses the exchange.
• Winning Ixians choose matching physical casualties in both game modes. The engine records cyborg losses by sector. If surviving suboids remain, ixSubstitution allows a partial/full exchange or decline. Selected surviving suboids go to the tanks and an equal number of cyborgs lost in that battle return to their original casualty sectors. Total physical casualties and the seven-cyborg inventory are preserved; unrelated prior cyborg deaths cannot be recovered. The loss and recovery transaction serializes, rejects invalid sources/counts immutably and resumes winner card choices/tech transfers/capture/Face Dancers after its response.
• Added components/ix-substitution.tsx with sector/count controls, distinct suboid/cyborg casualty labels, dial guidance/tooltips, internal faction rules and a searchable ix-forces topic with the printed example. All four AI policies generate legal basic/advanced plans using the shared solver and can make legal substitutions. Relative strength and opponent force-type estimation still require calibration.
• Primary evidence: publisher Ix rulebook p9 (force strengths, fixed suboid support, movement/collection/revival, substitution) and p10 (two cyborgs plus six suboids dialing six, then sacrificing the two surviving suboids to retain both lost cyborgs); November 2020 official FAQ p7 (basic-only cyborg-strength cancellation, substitution cancellation, no suboid-strength effect). The genuine local PDF/text remains /tmp/dune-rules/ix-official-mirror.pdf and .txt. Exact multi-sector loss selection/substitution restoration, later mobile-stronghold sectors, additional card timing and expansion interactions remain audit items.
• Fifteen focused tests cover the printed example in both modes, independent exhaustive token assignments, unsupported/supported cyborgs, unboostable suboids, half-strength basic plans, physical/typed conservation, optional/partial/canceled substitution, ownership and input validation, multi-sector restoration, traitor destruction, all AI difficulties and lobby force-type cleanup. Final verification: all 410 engine/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and the production build pass, including the final basic-Ixian 20.5-strength input-range correction. No browser visual QA or deployment; the original goal remains active and expansion starts remain gated.
• Next required Ixian work: cyborg movement and collection capacity, per-type revival pricing and free-revival selection/limits, complete Hidden Mobile Stronghold setup/occupancy/movement/protection/income, auction/setup technology and its ally/special Karama interactions. Combat support does not establish complete Ixian play.

Ixian movement, collection and revival checkpoint

• Cyborgs in the selected group now allow two-territory movement, carrying accompanying suboids. Cyborgs left behind do not grant speed. Ornithopters still grant three to either type. A move needing cyborg speed stores the validated group/sector/type choices in pendingIxMove, opens a Karama response before removal, and resumes through shared completeMove if allowed. Cancellation preserves the army and movement opportunity but restricts cyborg speed for that movement index; a shorter move remains legal. Exact cancellation duration across Hajr and broader simultaneous movement windows remain audit items.
• Normal spice collection now counts cyborg capacity as three per token while suboids retain the normal two/three ornithopter rate. Collection remains sector-specific and excludes storm/advisors. This is ordinary ground collection; mobile-stronghold travel income is still unimplemented.
• forceRevivalPrice and paidForceRevivalCost share typed prices between engine, UI and AI. Each paid cyborg costs three spice and suboid two. The free allowance may be assigned to either type via an explicit free-cyborg count; the UI offers cyborg-first or suboid-first selection. Default allocation uses free cyborgs first. Mixed Tleilaxu discounts halve the paid total and round up; discount cancellation restores the original typed total before payment. This aggregate mixed-price rounding remains part of the complete cross-faction economy audit.
• eliteRevivalRemaining distinguishes the one-per-turn Sardaukar/Fedaykin restriction from cyborg inventory. Cyborgs may fill their ordinary force-revival allowance with multiple cyborgs, and Ghola can return several more without consuming the ordinary allowance. All paths retain physical and typed counts. The official November FAQ p2 names Sardaukar/Fedaykin explicitly; it does not impose their limit on cyborgs.
• Emperor-funded extra returns now validate and pay each selected force's actual type price, with no free allowance. The Emperor is still the payer and the ally's extra quota remains separate. Cyborgs therefore cost three each in the current implementation; the printed Emperor ability pays revival costs without a cyborg-specific exception. That expansion interaction remains an explicit primary-source audit item alongside later homeworld/CHOAM effects.
• Added seven-cyborg-capacity force selectors, movement/cost guidance, free-type selection, correct mixed price previews and typed selectors for Ghola cards and Emperor allied extras. The Emperor's own elite choice and its ally's extra-revival choice are separate UI state. AI revival candidates now enumerate affordable amounts/type mixes using the same prices and proper special-force allowance; existing movement candidates can use the newly legal speed and complete response windows. Stronger economic/movement cancellation strategy still needs calibration.
• Thirteen focused scenarios cover mixed/selected-only/multi-sector movement, saved continuation, canceled retry and shorter move, ornithopters, collection capacity, explicit free-type pricing, multiple cyborg returns/Ghola and base elite limits, Tleilaxu discounts/cancellation, Emperor funding/funds rejection, shipment count/type conservation and all AI difficulties. All 423 engine/AI/reference tests and all four persisted multiplayer journeys pass. Final TypeScript, lint and production build pass, including the explicit Ghola/Emperor ally selectors and a test-only const correction. No browser visual QA or deployment. The goal remains active and incomplete.
• Primary sources: printed publisher Ix p8–9 and November 2020 FAQ p2/p7. Remaining Ixian work: complete Hidden Mobile Stronghold setup/occupancy/entry/movement/protection/income, setup and auction technology, allied card replacement, special Karama and full interaction audit. Live expansion starts remain gated.

Hidden Mobile Stronghold checkpoint

• Added room-local mobile-stronghold state and an explicit virtual territory at hidden_mobile_stronghold:0. gameTerritories includes it only after placement; gameDistance connects it through its pointing sector with a one-territory entry/exit cost. Shared printed board metadata and other rooms remain unchanged. Normal movement, battle enumeration, stronghold victory and allied co-occupation checks now enumerate room territories. Expansion starts remain gated.
• The future Ix setup branch assigns three cyborgs and three suboids inside, with four cyborgs and ten suboids in reserves. The initial placement decision occurs after first-storm destruction and before the Spice Blow opening/advanced Fremen forecast. It accepts canonical sectors in non-stronghold territories, including Polar Sink. Advanced BG setup cannot use an unplaced mobile stronghold.
• Later Storm initialization offers an occupied Ixian stronghold relocation before dials or the advanced storm-card reveal. Declining resumes that initialization once. A route consists of adjacent printed sector locations, charges one per territory transition, forbids duplicate locations and ends in a non-stronghold territory within three steps. The normalized declaration survives JSON persistence. A public Karama response precedes movement/income; cancellation preserves pieces, location and spice, consumes that opportunity and resumes storm initialization.
• Relocation keeps every occupant inside. Current collection interpretation takes up to two spice per Ixian force from each visited spice sector, including departure and arrival, optionally declined for the whole route. It does not grant cyborg/ornithopter collection bonuses inside. This per-pile capacity and the no-repeat/within-territory sector-route interpretation are explicitly provisional pending further primary clarification, not certified full compliance. Storm-sector traversal is corrected in the later checkpoint below using the explicit printed p11 answer: relocation into, out of or through storm is forbidden. Passage through printed strongholds and the relationship between entry cost and separate movement opportunities remain audit items.
• Ixians may ship directly inside at ordinary stronghold rates, regardless of controller, subject to normal capacity/alliance restrictions. Other factions, including Guild cross-shippers, cannot. Advanced BG accompaniment is supported. Ordinary forces enter/exit only through the pointing sector; a storm there blocks transit. Inside forces remain separate from outside territory worms/storms and battles. Captured control counts toward the controller's win but never grants relocation authority. Contested/advisor-only occupation does not grant a winning hold.
• Advanced Ix special Karama relocates at most two territories on its own Shipment and Movement turn, requires occupying Ixian forces, spends a real card once, and leaves normal shipment/movement counters intact. It uses the same provisional route/collection interpretation. Later special-power cancellation and expansion interactions remain audit items.
• Added an original SVG stronghold marker, dotted attachment line, destination/force overlays, a keyboard-native sector-route editor with undo/collection preview, public pending-route display, special-Karama route controls, tooltip and searchable partial rules topic. No player-facing external navigation was added. No browser visual QA was performed or authorized.
• All four AI levels can place and relocate via private projections, use profitable special relocation, and move armies into/out of the virtual territory. Fixed movement-candidate filtering so unreachable high-scoring destinations cannot crowd out all reachable options before the 24-candidate limit. Relative strength and strategic placement remain uncalibrated.
• Twenty new scenarios cover room isolation, serialized timing/cancellation, invalid placement/routes and rollback, direct/Guild/BG shipping, movement cost/storm obstruction, capacity, inside/outside worms/battles, controller/contested/advisor victory, captured/empty movement restrictions, advanced reveal ordering, special Karama, all AI levels and BG setup validation. 443 unit/AI/reference tests and 4 persisted multiplayer tests pass. TypeScript, lint and production build pass. No deployment. Goal remains active and incomplete.
• Primary evidence: publisher Ix rulebook p8–10 (initial forces, mobile stronghold, BG accompaniment), p6 (special Karama) and November 2020 FAQ p7 (movement/collection cancellation), using the genuine publisher PDF mirror already recorded above. The currently indexed publisher copy at https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf confirms p9 wording. Do not adopt tournament/house amendments to fill the provisional items silently.
• Next concrete work: Ixian setup/auction technology and allied purchased-card replacement, including their Karama/timing/private-information handling; then complete Ix deck assembly and the remaining advanced/expansion audits. CHOAM/Richese and Ecaz/Moritani engines and optional modules, full rules compliance, art/presentation polish and final validated deployment are still required.

Ixian setup and auction technology checkpoint

• Wired the future gated Ixian start path to draw one starting card per faction into a private choice. Selecting one shuffles and privately deals the remainder; Harkonnen then draws its extra card from the deck. Pending choice prevents setup completion, is owned by Ixians, and survives JSON serialization. The decision/dealing path is exercised in setup fixtures; public expansion starts still reject unfinished rules and are not claimed end-to-end complete.
• Beginning an Ixian bidding round offers a public Karama window before any cards are drawn or inspected. Allowing draws the eligible-bidder count plus one, then offers a private card/top-or-bottom choice. The remaining cards are shuffled for bidding. Canceling draws only the ordinary count, with no Ixian inspection. A full Ixian hand does not disable this faction advantage; zero eligible bidders skip it. The chosen deck end is publicly logged, while card identity remains private.
• The private projection records an unordered inspected pool. It never exposes the actual next card to Ixians or the pool to other factions. The record includes cards already auctioned and deduplicates an earlier purchase returned through technology; it is not an inferred view of remaining hidden hands. UI labels make this distinction explicit.
• Advanced technology is offered before each card's bidding and before Atreides' independent inspection response. Ixians commit a hand card without seeing the incoming card; a separate Karama window precedes the swap. Declining preserves the option for another card. Declaring uses the round's attempt even if canceled. Successful exchange preserves hand count and makes the replacement the card Atreides can inspect. Canceling pool inspection does not also cancel advanced substitution.
• After an ally purchases a card, the buyer may keep it or request replacement before Emperor income and Harkonnen's separate bonus draw. The replacement response belongs to Ixians and names the buyer publicly; only the buyer sees the purchased identity. Success discards that exact purchase and draws the top deck card privately. Spice payment remains settled exactly once, canceled/declined replacements preserve the purchase, and Karama-paid purchases qualify without Emperor income. Bonus cards do not recursively receive this purchased-card privilege.
• Existing Harkonnen special exchanges can interrupt these windows. A pending offered card that no longer belongs to Ixians skips the stale swap and resumes Atreides inspection; a stale purchased-card decision exposes no replacement and can be declined to settle the sale. These recovery paths preserve card ownership and progress. The exact legality/order of such interruptions remains a primary timing audit rather than certification of every interaction. Bene Gesserit Worthless conversion cancellation restores the suspended private Ixian response correctly.
• Added the IxTechnology decision component, setup-aware decision routing, inspected-pool details, tooltip, searchable partial technology rules, updated faction guidance/coverage page, and all four AI policies. AI chooses starting cards, prepares pools, evaluates offered cards against known pool values and replaces weak allied purchases; complete advanced bidding phases terminate through legal private projections at every level. Strategic strength remains uncalibrated.
• Twenty-one new technology tests cover pre-draw cancellation/privacy, eligible/full-hand counts, top/bottom placement, invalid/unauthorized choices, order-independent pool projection, pre-Atreides swaps, one-attempt timing, setup/Harkonnen conservation, paid/free/allied/Harkonnen purchase sequencing, Worthless reactions, stale-card recovery, empty/short decks and every AI level. Short-deck fallback permits a lone available card to auction without removing it; multi-card insufficient-pool behavior remains an explicit rules audit, alongside Richese/other auction modes and exact Amal phase-opening order.
• Primary evidence: publisher Ixians & Tleilaxu p8 (initial and bidding preparation), p9 (advanced substitution and alliance), p11 (explicit Harkonnen extra setup draw), and November 2020 FAQ p7 (three distinct cancelable advantages). Publisher URLs and the genuine mirror remain in the source ledger. No tournament amendments were adopted.

Mobile stronghold storm correction

• The same printed Ix rulebook p11 explicitly answers No to relocation into, out of or through a storm. This contradicts the earlier provisional allowance. validateMobileMove now rejects storm departure, arrival and transit before any special card or resources are spent. AI route generation and the sector-route control share the restriction; an occupied stronghold whose pointer is currently in storm can remain in place until the storm clears.
• Ordinary stronghold storm obstruction also applies to battles inside: the battle check uses the pointing sector, not the virtual internal sector zero. Storm/worm casualty immunity remains. A contested stronghold covered by storm grants no winning control; uncontested control still counts like a printed stronghold. This follows the general stronghold obstruction clarification in the November 2020 FAQ p1; no separate HMS battle exception was found.
• Two added scenarios reject ordinary/special storm routes without mutation and ensure AI routes avoid storm, including blocked origins. The existing internal-battle test now verifies storm obstruction and resumed battle after the pointer clears. Updated tooltips, searchable rules and the earlier provisional ledger note.
• 466 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. The focused 21-test technology suite also passes after the final public deck-end log refinement. No browser visual QA or deployment. Goal remains active and incomplete.
• Next concrete work: audit and assemble the complete fourteen-card Ix expansion inventory, resolve remaining card/auction/mobile-stronghold interpretation gaps and integrate the advanced/base systems. CHOAM/Richese, Ecaz/Moritani, optional modules, full rules compliance, presentation/art refinement and final validated deployment remain required.

Complete Ix treachery inventory checkpoint

• Added the six remaining ordinary-type cards: Hunter Seeker, Basilia Weapon, Shield, Snooper, Harvester and Kull Wahad. ixDeck() composes these with the six special battle cards, Thumper and Amal; treacheryDeck(['ix']) returns 47 distinct cards. Existing base and Ix IDs remain stable; factories return fresh instances. Repeating the Ix option does not duplicate the set. Requests for unimplemented CHOAM/Ecaz/unknown decks fail explicitly. The future gated start path now uses this deck assembler; public expansion starts remain disabled.
• Corrected the base poison at treachery-7 from Basilia Weapon to Ellaca Drug. Projections and action processing normalize that exact legacy ID/name in hands, deck, discard, auction and private Ix pools after cloning state. Expansion Basilia retains its own name and identity; original input states and historical logs are untouched.
• AI prescience recognition now looks up the complete implemented card catalog, including the additional ordinary weapons and defenses. Ordinary rule kinds preserve matching defense, Voice, lasgun/Shield and advanced BG Worthless conversion behavior without special duplicate-name dispatch.
• The second Harvester exposed the old one-use-per-blow assumption. Current behavior allows each physical copy to double the open fresh blow again, leaves pre-existing spice unchanged, resets table acceptance, and tracks the number of plays. Storm still prevents placement. Worm destruction explicitly closes the Harvester window, so adding another copy cannot resurrect spice. A shared availability helper drives engine, AI and guidance. Ambiguous legacy harvested windows stay closed; old live base rooms have only one Harvester.
• Multiple-Harvester timing and multiplier interpretation remain provisional pending primary card-face verification. The card names/count are corroborated secondary inventory facts, with the publisher independently establishing the fourteen-card total. This step improves the implementation without claiming that every card interaction is certified. Full provenance and unresolved limits are in docs/CARD_INVENTORY.md.
• Added a searchable internal Ix deck topic, corrected stale faction/coverage descriptions and updated fresh-blow guidance. No external navigation or copied publisher art was added to the app. Harvester coverage is now honestly marked partial for the multi-copy audit.
• Nine new tests verify exact card names/counts/identities, independent factories, rule types/Voice/Karama, duplicate Harvester conservation and timing, worm/storm restrictions, authoritative Shield explosions and poison leader kills, immutable legacy-name normalization, all AI Harvester choices, and complete six-base-faction Hard/Brutal games with all 47 cards conserved. These full-deck games are engine simulations; the four persisted multiplayer journeys still cover the currently enabled base/tech-token modes.
• 475 unit/AI/reference tests and all 4 persisted multiplayer journeys pass. TypeScript, lint and production build pass. No browser visual QA or deployment. Goal remains active and incomplete.
• Source evidence: publisher Ix p4; unamended inventory portions of the Landsraad compilation corroborated by Ludopedia component-sheet listings; primary designer video page identifying the fourteen-card overview. Designer captions/transcript and the located retailer card photo could not be retrieved, so no card-by-card primary inspection is claimed from them. The source audit explicitly avoids importing tournament changes or the compilation's incorrect Ellaca defense description.
• Next substantive work: close base Truthtrance and binding-choice support, then continue the remaining base/advanced timing and expansion engines/modules. Card-face audits, mobile-stronghold collection/entry interpretations, CHOAM/Richese, Ecaz/Moritani, skills/strongholds/homeworlds/Nexus/discovery, complete internal guidance, generated card/leader art and presentation polish, and final validated deployment all remain required.

Truthtrance question-flow checkpoint

• Added game/truthtrance.ts with a persistent overlay (priority → ask → answer, plus unknown for retry/save). The original response, decision, auction, phase opening, storm/spice state and sealed battle remain in place, so completing a question does not reconstruct or replay their effects. The engine rejects unrelated actions while the overlay is active. Setup completion also waits for the overlay to finish.
• Competing declarations are collected before any question is asked, then sorted by storm order. A holder can declare either or both physical copies. Each definite answer discards exactly its own card; an unknown answer leaves that card available for a different question or later play. The original input state remains immutable, and JSON round-trips preserve pending questions.
• Structured facts cover exact named cards currently held and selected traitor identities, including Cheap Hero. AND/OR combinations expose only the combined Yes/No answer. The server rejects dishonest fact answers, forged targets/card identities, invalid answers and malformed or excessive predicate trees. Only the target's personalized projection includes the expected fact answer before publication; no hand, traitor list or matching disjunct is revealed to other seats.
• Freeform game-related questions accept public Yes/No/unknown responses. An explicit current-turn scope records promises for the table; the engine does not yet enforce the meaning of freeform questions or arbitrary promises. The app/reference state this limitation. Future-turn scope is rejected by the structured payload; natural-language meaning still relies on human players. Facts and promises are recorded with turn/phase and retained in authoritative history.
• The dedicated React action panel remains available above suspended phase/faction controls. Hand cards can declare Truthtrance during those windows. It offers named-card/traitor clauses, AND/OR, a freeform question field, public answer controls, retry/save and current-turn history. Existing internal rule navigation is used; no external links or copied publisher assets were added.
• All four AI levels pass priority, answer server-verified facts through their private view, ask a structured question when resolving their own declaration and save an unanswerable question. AI freeform interpretation and proactive strategic use of Truthtrance remain unfinished. Bots return unknown instead of inventing a freeform answer.
• Twelve focused tests cover storm-order races, separate two-copy disposal, privacy, dishonest/malformed actions, immutable interruption of five window types, sealed plans, JSON reconnects, unknown/retry/save, current-turn records, incomplete setup and all four AI levels. The existing persisted multiplayer journeys cover the unchanged authoritative action/version/private-seat boundary; a dedicated persisted Truthtrance journey is still required.
• Source: GF9 November 2020 FAQ p8, https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf (indexed primary text). It establishes any-time play, game-related yes/no questions, current-turn commitments and impossibility, AND/OR, storm order, and unknown/retry/save. The base rulebook p23 supports Truthtrance during Voice/prescience interactions. Exact printed card-face/immediate-pause wording and a general simultaneous-action timing audit still need primary verification; secondary tournament amendments were not adopted as certification.
• Remaining Truthtrance work: binding current-battle plans and current-turn shipment/other decisions with feasibility escape; arbitrary human commitments and disputes; AI interpretation, question selection and use of learned facts; guaranteed interrupt opportunities between currently atomic game effects; priority/timing audit and complete persisted multiplayer scenarios. Full base/advanced/expansion compliance remains incomplete, with advanced and expansion starts still gated.
• Verified checkpoint: 487 unit/AI/reference tests + 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. New form styling includes consistent dark controls, keyboard focus, grouped fact fields and wrapping for long questions. No browser visual QA or deployment was performed. The active full-game goal is not complete or blocked.

Binding battle Truthtrance checkpoint

• Added game/battle-promises.ts: validated conditions for dial equality/ranges, spice support, named weapon/defense slots (including empty slots and duplicate physical cards), exact leader/Cheap Hero identity, Kwisatz use, and bounded AND/OR combinations. Definite current-battle answers create public constraints attached to that battle; the recorded question receives the actual territory from the server. Arbitrary freeform/current-turn promises remain available and explicitly unenforced.
• The engine searches full legal completions for an answer, including previous active Truthtrance conditions, Voice, prescience, card-role pairings, controlled leaders, support, elite strength and Ixian half-strength suboids. It only offers answers with a currently legal completion; a sealed plan fixes its answer without exposing its other elements or acquiring new mutable commitments. The search consults the questioned player's private choices and public opponent properties, never the opponent's hidden plan or hand.
• Battle-plan validation enforces all active answers while leaving unrelated elements free. AND/OR conditions preserve alternative completions instead of secretly selecting and locking a witness. Contradictory later answers and prescience values are rejected. The prescience existence check now uses full-plan search when Truthtrance restricts an unshown element, removing the old assumption that all other numeric values can be zero.
• Integration exposed and fixed an existing basic Ixian prescience bug: the API now accepts legal half-point dials for Ixians, matching the existing UI and battle validator. A test specifically reveals 2.5 under a bound Ixian dial.
• A pending Voice response resolves before impossibility releases are considered, so a canceled Voice retains the original answer. After an opposing effect completes, promises are evaluated in their declaration order; an impossible one is publicly released while feasible earlier obligations remain. Canceling Fremen free support and elite strength participates in this search. Voluntary card spending, bribes and aid pledges that would make the actor's still-feasible battle promise impossible are rejected atomically.
• Personalized views expose answer options only to the target, and a legal example plan only to its owner. The React interface adds battle condition fields, public bindings/release status, and a private preview that can populate the editable battle form without sealing it. Tooltips and the internal rules explain the feature and its limits. All four bot levels can choose a feasible answer, filter their candidate plans against existing commitments, and use an authoritative private completion when their heuristic candidate set lacks a required exact dial/support/Kwisatz choice.
• Seventeen new tests cover immutable/public-versus-private state, overlapping Yes/No answers, OR alternatives, dual-role Ix pairs, sealed plans, prescience, pending/canceled/completed Voice, voluntary spice/card evasion, optional Kwisatz flags, duplicate cards and Cheap Heroes, basic Ix half dials, malformed payloads, all four AI levels, Fremen/elite cancellations, and comparison of offered answers against an exhaustive authoritative basic-plan oracle. The full Truthtrance-focused group is 29 tests.
• Still partial: feasibility explores currently available plans, not multi-action futures such as reviving a currently dead leader before committing, additional Karama/card sequences, or acquiring a new choice later. Released answers currently stay released; exact revalidation behavior, cancellation timing, self-caused impossibility and multi-promise ordering need a primary-source interaction audit. Guaranteed interrupt opportunities between atomic engine actions also remain unfinished. Do not call this full Truthtrance compliance.
• Source basis remains the official GF9 November 2020 FAQ p8 (current-turn obligations, impossibility, AND/OR, storm order) and base rulebook p23 (Truthtrance during Voice/prescience and freedom to alter unaffected plan components). Tournament amendments requiring reactivation of previously invalid answers are not silently treated as the printed publisher rule.
• Next work: current-turn shipment and broader binding decisions, future-action feasibility/card-sequence audit and persisted Truthtrance game scenarios; complete remaining base/advanced interactions and all expansion faction/module engines. CHOAM/Richese, Ecaz/Moritani, optional skills/strongholds/homeworlds/Nexus/discovery, AI calibration, complete guidance, generated art/AAA polish and final validated deployment remain part of the active goal. Advanced/expansion starts remain gated.
• Verified checkpoint: 504 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; TypeScript, lint and the final production build pass. No browser visual QA or deployment. The full-game goal remains active and incomplete.

Reachable Ghola battle preparation checkpoint

• Expanded battle-answer feasibility from currently legal plans to plans reachable through actual Ghola cards in the questioned player's hand. A bounded-by-card-consumption search explores eligible controlled dead leaders, Atreides' dead Kwisatz, and valid force/elite revival choices. Each physical card is consumed in its simulated branch, so one Ghola cannot revive both a leader and KH. Revived forces remain in reserves and never inflate the current battle's army.
• Extracted applyGholaEffect from the existing card dispatcher so real play and lookahead share revival/control/quota/income logic. The search uses independent state clones and never spends a real card, changes a real leader or leaks rival hands/plans. Selected preparations are suggestions, not locks: other legal ways to satisfy an OR condition remain available. Diverting the last needed Ghola to an incompatible revival is rejected atomically by existing promise enforcement.
• A pending Tleilaxu revival-income response is modeled as a possible future receipt, not currently spendable spice. This includes the original income response suspended beneath a BG Worthless Karama conversion. Promise feasibility waits for the outcome; allowing income enables the supported plan, while successful cancellation releases an otherwise impossible answer without undoing the actual revival. Another faction's income and deferred tech-token income cannot fund the questioned player's current battle.
• Prescience also recognizes Ghola-reachable leaders, including when there is no preceding Truthtrance. A player's personalized battle view exposes compliantPreparation (needed card actions, possible plan, income-wait flag) separately from compliantPlan, which remains immediately legal. The React guide offers a real Ghola play, disables it during other pending windows, and leaves final plan review/sealing separate. All four AI levels execute a required preparation before committing or answering a prescience element.
• Twelve tests cover untouched authoritative state and private projections, pending JSON reconnects, Ghola-to-leader completion, prescience with/without a prior promise, physical-card limits, KH/hero dependencies, native/captured/foreign-ghola control, incompatible diversions and OR alternatives, Tleilaxu income and real/Worthless Karama outcomes, unavailable third-party funding, reserve-force conservation, all four AI levels and sealed-plan immutability. The full Truthtrance-related focused group now contains 41 tests.
• Primary evidence: official base rulebook FAQ p22, https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf, explicitly permits a leader revived by Ghola during Battle to fight in that Battle Phase. The November 2020 FAQ p8 supplies the Truthtrance current-turn obligation/impossibility principle. KH and foreign-ghola treatment reuse the existing engine's revival rules; their outstanding broader source audit is not claimed complete by this step. Older PBEM/tournament restrictions forbidding same-phase Ghola use were not adopted.
• Still required: other future card/power sequences, precise interruption and reactivation rules, current-turn shipment/other obligations and freeform commitment enforcement, dedicated persisted Truthtrance journeys, remaining base/advanced rules and every expansion/module. This addition does not enable advanced/expansion starts or establish full rules compliance. No browser visual QA or deployment was performed.
• Verified checkpoint: 516 unit/AI/reference tests and all 4 persisted multiplayer journeys pass; the 41-test Truthtrance group also passes after expanding AI prescience scenarios. TypeScript, lint and the final production build pass. The full-game goal remains active and incomplete.

CHOAM charity and hand-limit checkpoint

• Publisher CHOAM & Richese rulebook pp. 7–8 and p. 12 cancellation table, verified through the indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . CHOAM takes two spice for each faction, including itself, before other claims. Other factions take their charity from CHOAM. Karama cancels the income and sends charity to the bank, with ordinary charity still available to eligible CHOAM. Printed hand limit is five.

• Added game/charity.ts for shared entitlement and payer selection. beginPhase opens a public CHOAM-income response after any Ix/Amal phase opening. Settlement persists the turn and cancellation state. Ordinary and advanced Bene Gesserit claims transfer actual spice from CHOAM; wealthy Bene Gesserit still has its own cancellation window before any transfer. Cancellation restores bank payments for this turn only. Claimed charity continues to trigger existing Spice Production rules.

• Private projection exposes only the current player's entitlement and the public payer/status. Other players' spice and claim flags remain private. Shared hand limit now supports CHOAM's fifth purchase, and the hand tab displays current count/capacity. UI names the income response and payer; internal rules include a linked, explicitly partial CHOAM economy topic. All four bot levels resolve the response and claim eligible charity; Brutal may spend Karama on enemy income and preserves allied income.

• Fifteen focused scenarios in tests/choam-charity.test.ts cover income timing, ordinary/advanced payout conservation, both cancellation layers, next-turn reset, Amal order and JSON roundtrip, six-player funding, private views, deferred tech income, fifth-card purchase/full-hand Karama exclusion, AI and retained start gates. Existing Bene Gesserit and reference suites pass alongside them (29 focused tests).

• Deliberate unresolved boundary: the publisher text does not explain insolvency if CHOAM spends away its funds before a claim. The engine rejects an unfunded payout atomically rather than inventing a bank subsidy or negative spice. This is not certified full compliance. Inflation, whether CHOAM's automatic income itself triggers Spice Production, self-claims after spending income, and all later module interactions need source audits. CHOAM remains gated.

• Additional primary findings for upcoming work: start two spice/twenty reserves/free revival zero; paid force revival one spice and unlimited. Karama limits it to three (five with Tleilaxu permission) at two spice each. Mentat Inflation places a Double/Cancel token for the following turn, flips at the next Mentat, then is removed from the game at the subsequent Mentat. Karama prevents initial placement, never the mandatory flip. Double face in play prohibits bribes. Exact doubled ordinary charity entitlement, combined Tleilaxu revival discounts and insolvency remain to verify.

• Remaining CHOAM powers: end-phase duplicate sales, Worthless sales/six special effects, once-per-turn two-way allied card trade, allied battle support, advanced Auditor and battle-support income, special Karama, printed leader data and full setup. Auditor checks two random unused opposing hand cards if alive, one if killed (not win/loss); opponent may pay one spice per card to cancel the audit. It cannot be acquired as a foreign ghola by Tleilaxu, be captured or gain a leader skill; CHOAM’s own Ghola card revival is not prohibited (corrected by the 2026-09-07 Auditor audit). The p. 12 cancellation table also covers card sales/Worthless effects, single-battle force income and the audit.

• Validation for this checkpoint: all 531 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM force revival checkpoint

• Primary rulebook p. 7: no native free revivals, no quantity limit for paid forces, one spice per force. Primary p. 12 Karama table: restore three-force limit (five if Tleilaxu permits) and two-spice price. Indexed official PDF verified again: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Genuine Ix rulebook mirror text /tmp/dune-rules/ix-official-mirror.txt p. 6 states allied force/leader revival at half price rounded up.

• RevivalRules.choamBlocked tracks this combined CHOAM cancellation separately from Tleilaxu quantity/discount cancellation and resets on entering Revival. Shared forceRevivalPrice accepts the cancellation status; CHOAM's native cost precedes any separate Tleilaxu discount. forceRevivalLimit preserves native CHOAM unlimited revival when Tleilaxu permissions are canceled.

• choamRevival response belongs to CHOAM and precedes spending/movement. If canceled, a request beyond the newly applicable total allowance aborts without partial payment or revival. A valid request is repriced; insufficient funds abort without changes. Prior revivals remain completed and count against the new total allowance. Applicable Tleilaxu five-force/discount response windows follow. Canceling only Tleilaxu's discount retains active CHOAM native price. This avoids treating the two independent abilities as a single generic half-price flag.

• Free Fremen allowance remains free and is tracked across requests; a completely free request within the normal three-force allowance does not invoke CHOAM's paid/quantity advantage. Emperor extras retain their existing two-spice price and separate allowance. Tleilaxu income receives actual payment, and advanced Tleilaxu special prevention occurs before the CHOAM response. No leader revival prices changed.

• Private views expose the cancellation flag for the player's force quote; UI displays native pricing and the separate allied discount. All four AI levels use the shared quote before spending. Internal CHOAM reference now links to its force-revival topic; remaining powers and faction start gates are retained.

• Seventeen scenarios in tests/choam-revival.test.ts verify quantities through twenty, cancellation/repricing/affordability, independent powers, actual Tleilaxu income, free and Emperor extras, next-phase reset, earlier completed revival, Tleilaxu prevention, JSON reconnect and private projections, AI budgeting and force/spice conservation. All 53 focused CHOAM/Tleilaxu/Ix economy/reference tests pass.

• Interpretations still needing final combined-expansion audit: applying Tleilaxu half-price to CHOAM's native one-spice rate, aggregate rounding per declared transaction, cancellation recovery by repricing versus a fresh player confirmation, and exceptions introduced by Recruits/homeworlds/leader skills. These tests verify the implementation, not publication certification of unresolved interactions. Full CHOAM starts remain disabled. Printed CHOAM leader data, Auditor, Inflation, Worthless powers/sales, ally trades/support and special Karama remain required.

• Validation: all 548 unit/AI/reference tests and four persisted multiplayer journeys pass. TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM Inflation checkpoint

• Verified primary CHOAM rulebook p. 8 Inflation and p. 12 cancellation table at https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Place either side during Mentat; the following turn doubles/cancels all charity including CHOAM income and advanced Bene Gesserit; next Mentat flips; subsequent Mentat removes from the game. Double face in play prohibits bribes. Only initial placement can be canceled by Karama.

• Newly located primary FAQ p. 10 resolves an earlier open question: CHOAM income alone does NOT trigger Spice Production, and Inflation does NOT affect the tech-token payment. Existing separation is retained and directly tested. Same page also confirms Auditor payment is bounded by cards actually available and cannot be partial, and duplicate-card sales require identical cards (Shield Snooper/Portable Snooper do not match Snooper). Record these for subsequent CHOAM work.

• Added persistent Inflation with side, placement turn, update turn and flip flag; inflationUsed prevents reuse after removal; inflationAttemptTurn prevents retry in a canceled placement phase. choamInflation action is available to CHOAM during Mentat, clears table readiness and opens a public Karama response. Successful placement spends the token; cancellation preserves it for a later Mentat.

• Shared charityMultiplier modifies all ordinary and advanced BG claims and CHOAM per-faction income beginning the turn after placement. Cancel records charity initialization without creating a zero-income response; all claim amounts are zero, including wealthy advanced BG. Karama cancellation of CHOAM income retains Inflation and pays doubled ordinary charity from the bank. BG cancellation still resolves before any charge to CHOAM.

• beginPhase flips/removes the token during Mentat after the existing Ix/Amal opening, without a cancelable response. updatedTurn prevents duplicate advancement. Existing bribes still settle; all new bribe actions are rejected while Double is active, including before the first affected Charity phase. Optional placement occurs during normal Mentat controls after existing automatic victory settlement; a finished game needs no subsequent-turn token placement.

• UI shows the public side, affected turn, next lifecycle event and Double bribe prohibition, plus CHOAM placement buttons/save-by-ready guidance and response explanations. Private entitlement and projected income reflect the multiplier. AI levels choose an initial side using their own wealth/forces (Easy varies); Brutal may cancel enemy Double placement. Bots skip suppressed charity and finish their normal phase actions.

• Fourteen scenarios in tests/choam-inflation.test.ts cover both sequences, once-per-game removal, phase/owner/side validation, canceled placement/retry, ordinary/advanced payouts, both cancellation layers, no repeated flips, bribes and deferred payments, unchanged tech income, Amal ordering, persistence, private/public status and all four AI policies. All 43 focused Inflation/charity/BG/reference tests pass.

• Explicit interpretation still under audit: ordinary charity eligibility remains zero or one spice, and Double multiplies the received amount (four from zero, two from one), rather than changing the threshold or automatically raising wealth to four. Primary wording says charity is doubled but the one-spice example was not located. Canceled placement's later-turn retry and full interactions with homeworlds, leader skills, end-phase sales/trades and other unimplemented modules also require final combined-expansion audit. Complete CHOAM faction starts remain gated.

• Validation for Inflation: all 562 unit/AI/reference tests, all four persisted multiplayer tests, TypeScript, lint and production build pass. Check processes exited successfully; logs are /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM end-phase sales and allied exchange checkpoint

• Verified publisher rulebook p. 7 Treachery and p. 8 Alliance: exact duplicates may be revealed and surplus cards discarded for three spice each at phase end; Worthless cards may be discarded for two spice. One two-way allied card exchange per game turn, at the end of any phase. Primary p. 10 FAQ rejects Shield Snooper/Portable Snooper as duplicates of Snooper. Primary p. 12 cancellation table says prevent discarding a card for spice. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . No tournament changes adopted.

• Game.choamMarket provides an always-present closing decision when CHOAM is in a playing table, independent of hidden hand contents. Normal nextPhase now opens this window; advancePhase performs the original continuation only when CHOAM finishes. Storm's separate continuation is handled by resume: storm and advanceAfterStorm, preserving the existing forecast/opening sequence. Automatically skipped phases still receive their closing opportunity.

• game/choam-market.ts builds private sale choices and validates exact-name witnesses. Any distinct matching copy may be retained. CHOAM declares one physical sale at a time; its card (and duplicate name where applicable) is publicly revealed, then a choamSale Karama response precedes discard and payment. Cancellation leaves the card in hand and blocks that physical card from another sale in this closing window. Other cards may still be sold.

• choamTradeReply lets the ally choose a return card or decline; choamTradeConfirm gives CHOAM final approval or decline. Successful exchange atomically swaps the two cards, preserves hand sizes and spends choamTradeTurn. Declines do not consume the turn's successful trade. The market tracks an attempted offer only to avoid AI repeat loops; the human may renegotiate. Trade cards and sale choices appear only in authorized private projections; public decisions contain no card identities.

• Transactions revalidate card custody at settlement. An interrupted sale with a missing card/witness pays nothing; an impossible trade moves neither card. Truthtrance remains available as an overlay and is tested consuming a pending sale card. Other special powers are currently held until the closing decision completes; bots suppress those competing special-card choices while the market exists.

• components/choam-market.tsx provides sale, offer, reply, confirm/decline and phase-finish controls. UI names all new windows. AI sells eligible surplus/Worthless cards, offers a private exchange, handles empty hands/declines, and finishes the phase; higher levels compare the offered/returned values. Internal reference adds the linked CHOAM market topic. Existing CHOAM test helpers now explicitly finish closing decisions rather than assuming an immediate phase transition.

• Twenty-two focused scenarios verify ownership/timing, invariant public windows, delayed sale payment, exact duplicates and arbitrary retained witness, failed/forged sales, Karama/card preservation, private two-way consent, declines/empty hands, custody changes, tech income and auction escrow settlement, storm/automatic battle/auction continuations, persistence, Truthtrance interruption, AI progress and once-per-turn trade across boundaries. All 66 market/CHOAM/reference focused tests pass.

• Remaining audit boundaries: multi-card simultaneous sales versus serial declarations, whether Karama blocks only the selected sale card or the whole sale power for that phase, required ordering among concurrent end-phase income/refund/sale/trade effects, and other anytime card/special-power interactions in the closing window. The current implementation prioritizes the market before deferred tech income and escrow refunds. Full CHOAM starts remain gated. Worthless special effects, allied battle support, Auditor, printed leaders, special Karama and other expansion modules remain required.

• Validation: all 580 unit/AI/reference tests, four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed.

CHOAM special Karama cash-in checkpoint

• Publisher CHOAM & Richese rulebook p. 4 permits the special Karama to discard hand Treachery Cards, including Worthless cards, for three spice apiece at any time. Official indexed source: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Implementation applies the existing advanced-game, real-Karama and once-per-game special-power restrictions. The activation Karama is discarded separately and earns no income; a second Karama may be among the selected cash-in cards. The activation-card interpretation and exact interruption boundaries still require final source audit.

• New shared game/choam-karama.ts filters available cards against the player's sealed battle plan and exact prescience commitments. The authoritative action requires distinct owned physical IDs, at least one selected card and a separate activation card; invalid requests are atomic. It preserves a winning auction's funding using available spice plus the auction's actually committed allied payment, or another retained real Karama. Uncommitted ally pledges never count as already committed funding.

• CHOAM may cash in across all nine playing phases, phase-opening decisions, responses, pending revival and market/trade decisions, preserving the interrupted continuation. An active Truthtrance question still resolves first. A pending sale or trade whose offered card was cashed in is revalidated and aborts without duplicate income or partial exchange. Private projections expose only the acting player's eligible cards; public logs reveal counts and income rather than discarded identities.

• components/choam-cash-in.tsx provides activation selection, eligible-card checkboxes and a live gain preview above the private hand. It excludes stale/committed selections and prevents submission during an active Truthtrance question. Internal faction/reference topics explain the implemented power and its outstanding audit boundaries without external player-facing links.

• Battle-plan reachability now explores actual cash-in preparations alongside Ghola through shared authoritative effects on independent clones. Each branch consumes physical cards and the once-per-game power; retained promised weapons/defenses and leaders remain necessary for the resulting legal plan. The existing battle guide shows the required cash-in and lets the player execute the next preparation. All four AI levels can follow a binding promise that needs the proceeds, then seal a compliant plan. Outside battles, bots sell low-value Worthless cards when short of spice while preserving committed auction funding.

• Fourteen tests cover all nine phases, pricing and once-only use, ordinary disposal of an extra Karama, atomic malformed/forged selections, advanced-game restrictions, response/opening preservation, actual Amal order, funding an interrupted revival, invalidated sales/trades, winning-bid funding, sealed/prescience reservations, private JSON projections, all four AI policies and a binding battle promise requiring both cash-in-funded support and a retained defense. The focused cash-in/Ghola/market suite has 44 passing tests.

• Remaining work includes other future battle preparation sequences, special-power timing and activation-card source clarification, CHOAM Worthless effects, allied battle support/income, Auditor and printed leaders, plus remaining factions/modules and full interaction audits. This step does not enable expansion starts or establish complete rules compliance.

• Validation: all 594 unit/AI/reference tests, all four persisted multiplayer journeys, TypeScript, lint and production build pass. All check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

CHOAM combat funding and force-payment income checkpoint

• Primary CHOAM & Richese rulebook p. 8 verified through the publisher's indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Its alliance rule permits paying some or all of an ally's forces in battle. Advanced Forces pays CHOAM half of other players' force payments, rounded down; its own payments go to the bank, and any revealed traitor prevents the income. Primary p. 12 permits Karama to cancel force-payment collection for one battle. The base November 2020 FAQ p. 7 permits cancellation of alliance powers. Direct publisher PDF fetches remain 403; no local genuine CHOAM PDF was obtained.

• Extended existing authoritative allied escrow to advanced CHOAM during Battle. A new choamBattleFunding decision gives CHOAM a guaranteed chance to set its pledge before ordinary battle preparation begins. Ordinary phase controls can adjust the unspent pledge. A mutual alliance is required; other factions cannot pledge combat funds. A choamBattleAid response precedes sealing and can block the alliance benefit for that battle without consuming the escrow. Later battles get fresh funding/response opportunities.

• Plan.allyPayment records the sealed CHOAM share separately from total support; it is not a prescience-selectable field. The default split spends the combatant's own spice first, then covers its shortfall from eligible escrow. Explicit shares may use more CHOAM funding. Validation bounds total support by actual available resources, rejects foreign/oversized shares, and prevents withdrawal of a committed contribution. Bribes reserve only the combatant's own committed share. Final payment uses the same atomic allied-payment helper as bidding/shipment.

• Unused combat escrow returns after the Battle closing market, alongside the existing phase-end settlement. Pledges remain private to donor/recipient views; an ally does not gain access to the other's spice or sealed plan. Private legal-plan search, prescience feasibility and binding Truthtrance completion now include actual eligible CHOAM funds. Pledged spice cannot bypass a canceled alliance benefit or become a general-purpose transfer.

• Battle resolution records pending CHOAM income from each non-CHOAM combatant's own payment, rounded down separately. CHOAM's own support and the amounts it pays for its ally are excluded. A sole traitor winner spends neither own nor allied support; mutual traitors still pay both commitments. Any traitor suppresses all CHOAM income. An explosion without a traitor still produces normal paid support and income. After casualty/winner-card choices, choamBattleIncome opens a response before technology/capture/Face Dancer continuations. Allowing pays once; canceling sends the amount to the bank without refunding combatants.

• Added private funding controls, payment-split inputs, response explanations, revealed/compliant-plan payment details, linked internal combat reference and tooltip. All four AI levels allocate CHOAM support before allied battles and use it in legal plan generation, including binding support promises. Hard/Brutal may counter an enemy alliance benefit; Brutal may cancel enemy force income. No player-facing external links were added.

• Twenty new scenarios cover funding ownership/timing, mutual alliances, affordability and malformed requests, locked payment shares, explicit splits, per-payer rounding, once-only income, real and BG Worthless Karama responses, canceled funding across two battles, phase refunds, one/two traitors, CHOAM's own payments, Fremen free support, basic-game exclusion, explosions, private projections and JSON reconnects, preserved Atreides full-plan offers, and all four AI levels including a five-spice binding promise with zero own spice. The focused combat/CHOAM Karama/full-plan group has 54 passing tests.

• Remaining audit boundaries: per-player versus combined rounding when both pay odd amounts, exclusion of CHOAM-funded allied contributions under the own-payment clause, exact timing of the alliance cancellation and income versus simultaneous post-battle powers, and later module interactions. The implementation follows the literal payment interpretation, but these edge cases lack explicit publisher examples. Worthless special effects, Auditor/printed leaders, other factions/modules and full-game interaction work remain. Advanced/expansion starts stay gated.

• Validation: all 614 unit/AI/reference tests and all four persisted multiplayer journeys pass; TypeScript, lint and final production build pass. The first full run found only an existing case-sensitive error-message assertion, corrected by restoring compatible wording; the entire suite then passed. All check processes exited successfully. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log, /tmp/dune-build-check.log. No browser QA or deployment performed. The goal remains active and incomplete.

CHOAM Kulon and La La La checkpoint

• Verified publisher CHOAM & Richese rulebook p. 7 and cancellation table p. 12 through indexed official PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Kulon adds one territory on CHOAM's Shipment and Movement turn. La La La prevents a player's Free Revival during Revival. Karama prevents discarding a Worthless card in that phase for its special effect. Both are basic faction advantages and also work in advanced play.

• Added a shared CHOAM Worthless declaration/settlement path with pendingChoamWorthless and the choamWorthless Karama response. The physical owned card and declared target are validated before announcing. Discard occurs only on successful settlement. Cancellation retains the card and tracks its physical ID as blocked for that phase. Card custody is rechecked: if special Karama cash-in consumes the pending card, no special effect occurs and an interrupted revival continues.

• Kulon requires CHOAM's active movement turn and an available move. Its turn-stamped bonus adds to normal range and ornithopters; it does not grant extra actions or bypass storm, occupancy or allied-entry validation. The current interpretation applies the bonus to both available Hajr movements. A later turn ignores the old bonus. Private views now include the actual number of allowed movement actions for controls/AI.

• Added freeRevivalRemaining shared by authoritative revival quotes and the private projection; UI and bots use that projected entitlement. RevivalRules.freeBlocked denies ordinary free forces for the rest of Revival, including a Fremen allied allowance granted before or after the denial. Normal paid revival and separate Ghola card returns remain possible. Earlier force returns and quota consumption stay unchanged; the next Revival initialization clears denial.

• Every CHOAM table opens a choamFreeRevival decision when another faction declares a normal force revival with a free portion, independently of CHOAM's private hand. CHOAM may allow the request or declare La La La. Success stops the entire pending request without payment, force movement or quota use; the requester can explicitly select a paid revival afterward. Cancellation/missing card resumes the original quote through the existing Tleilaxu special-prevention window and later revival responses. This ordering avoids automatic spending at a newly increased price.

• New components/choam-worthless.tsx supplies private phase/reaction controls, target selection and allow/pass. Phase UI shows extra movement range and free-revival denial, and a linked internal topic/tooltip explains the two implemented cards. All AI levels use Kulon when movement is available. Easy saves La La La; higher levels may deny an enemy's free request while preserving allied requests. AI revival budgets use the denied entitlement rather than faction defaults.

• Sixteen new scenarios cover basic/advanced range, ornithopters, storm/alliance restrictions, Hajr action counts and next-turn expiry, ownership/phase/timing rejection, Karama retention/retry, earlier free returns, hand-independent public decisions, mixed request aborts, cancellation resumption, cash-in interruption, later Fremen grants, Ghola exception, Tleilaxu continuation, next-phase reset, private JSON reconnects, AI policies/budgets and unsupported/forged effects. The focused Worthless/CHOAM revival group has 33 passing tests. One preexisting revival scenario now explicitly allows CHOAM's new free-revival decision before testing Tleilaxu cancellation.

• Still required: Baliset, Jubba Cloak, Kull Wahad and Trip to Gamont effects; Auditor/printed leaders; remaining factions/modules and combined-expansion audits. Outstanding interpretations include physical-card versus whole-power Karama scope, Kulon with Hajr/ornithopters, reactive La La La request cancellation versus repricing, ordering with other prevention effects and later free-revival exceptions. Full CHOAM/advanced starts remain gated.

• Unit validation: all 630 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript and lint pass; lint caught an obsolete faction import after centralizing AI revival entitlement, which was removed. The final production build passes; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active.

Trip to Gamont and deferred CHOAM Mentat victory checkpoint

• Primary CHOAM & Richese p. 7 permits returning any one force belonging to another player to its reserves during Mentat Pause; p. 12 supplies the Worthless-effect Karama cancellation. Official indexed PDF: https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf . Primary base p. 11 checks occupied strongholds during Mentat; November 2020 FAQ p. 1 excludes unresolved opponent co-occupation and discusses ties with extra strongholds/tech. The ordering below ensures a legal Mentat return can affect the board used for victory; the detailed schedule is an implementation interpretation requiring later interaction audit.

• Extended the CHOAM Worthless declaration with Trip to Gamont, target player, board sector and ordinary/elite choice. Rejects self, absent player/force, reserves, invalid sector, unavailable force type and quantities other than one. The public response includes the selected recipient, sector and force type. Settlement rechecks both card and typed force, then moves exactly one token to that player's reserves. Elite totals/type are preserved; no tanks, battle-loss count, revival allowance, spice or transport income changes.

• The return can select forces in storm, Bene Gesserit advisors or occupants of the Hidden Mobile Stronghold. Returning a stronghold occupant does not relocate the stronghold. Existing advisor stance settlement runs after the return so removal of the last opposing force is reflected in control. A missing card/force aborts without an extra discard or reserve token. Karama keeps the selected force and card, blocking that physical card's effect for the phase.

• At tables containing CHOAM, beginPhase(8) still settles bribes and Inflation once but defers victory. Ordinary Mentat actions and readiness lead to the existing closing market. advancePhase then opens a hand-independent choamMentat decision; a newly exchanged Trip card remains usable before victory. After each Trip response, this final decision reopens. CHOAM's explicit completion calls victory on the resulting board and only advances the turn if play continues. Other tables retain the existing entry-time victory behavior. completePhase isolates that continuation without repeating settlement or the market.

• New components/choam-gamont.tsx offers owner/sector/type choices and final victory confirmation. Public Mentat guidance explains the delay; internal faction, phase and Worthless topics now link to a detailed Trip to Gamont topic. All four AI levels can select and return an enemy force and finish the window. Higher levels prioritize single stronghold occupants and elite forces. Bots preserve a usable Mentat Trip from proactive cash-in, market sale and their own trade offer so the final chance is not accidentally lost.

• Nineteen new tests cover deferred/unchanged winning boards, ordinary/advanced returns, public empty/full-hand windows, readiness, Karama, ordinary/elite conservation, invalid actions, storm/advisors, automatic advisor stance, mobile stronghold occupants, closing allied acquisition, interrupted card/force custody, JSON reconnects, final-turn Guild fallback/BG prediction, once-only bribes/Inflation, tech-token victory and all four AI policies. The focused Gamont/market/Inflation/reference suite passes 53 tests. The shared Worthless reconnect case now covers both La La La and Kulon; the first full run caught optional response fields serialized differently, fixed by emitting force/recipient fields only when applicable. One existing exchange-limit test now completes the additional Mentat decision before asserting the next turn.

• Remaining timing audit: exact ordering of sales/trades and Trip versus other simultaneous Mentat abilities, opportunities to revisit an already closed market after a canceled Trip, future force-type/stronghold/module exceptions, and the existing advisor-force cancellation rules. Baliset, Jubba Cloak and Kull Wahad remain unfinished, alongside Auditor/printed leaders, all other remaining factions/modules and complete-game audits. Advanced and expansion starts remain gated.

• Validation: all 649 unit/AI/reference tests and all four persisted multiplayer journeys pass. TypeScript, lint and final production build pass; all check processes exited successfully. Logs remain in /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log and /tmp/dune-build-check.log. No browser QA or deployment performed. The full-game goal remains active and incomplete.

Baliset and development reliability checkpoint

• CHOAM’s Baliset has proactive player/territory controls and a public response decision before another player enters a CHOAM-occupied territory by movement. The response is offered independently of the private hand. The declared force group remains server-private; public intent includes mover, destination, sector and count.
• Allowing or canceling resumes the original typed force group after rechecking custody, entry, movement availability and route. Successful Baliset leaves forces in place and the movement unspent. Shipment and movement between sectors inside the same territory remain possible. Restriction enforcement checks the current turn/phase, chosen player/territory and current CHOAM occupation.
• All four AI levels handle the response. Movement candidates respect active restrictions without removing shipment candidates; Hajr second movements and Kulon plus ornithopter range are considered. Cash-poor CHOAM preserves a reactive Baliset. The internal Worthless reference and tooltip describe these flows.
• Twenty-two focused scenarios cover basic/advanced blocking, cancelation, typed forces, empty-hand privacy, JSON decision restoration, shipments, expiry, stale custody/routes, lost occupation, cash-in, Ix transport ordering, same-territory moves and AI behavior. All 671 unit/rules/AI/reference tests and four persisted multiplayer tests pass. TypeScript, lint and production build passed at integration; final presentation-only checks are recorded below.
• Interpretation audit remains: exact Baliset duration and destination/transit scope, consumption of a prevented movement, simultaneous prevention ordering, and later module exceptions. These are implementation choices under audit, not certification of complete expansion compliance; full faction starts remain disabled.
• Found repeated Vite page reloads from Wrangler registry heartbeats and database state updates in the running server log. server.watch.ignored now excludes .wrangler; the restarted server no longer logs these reloads. Saved data was preserved.
• The hourly automation was created, then the app reported it removed. The user explicitly requested leaving it removed. Do not recreate it. During active development, follow the objective’s controlled-restart requirements: preserve data, warn before active human play and defer until safe, verify health/reconnection/restoration. Do not use restarts as a substitute for fixing root causes.
• Revised objective read from /home/quintine/.codex/attachments/b71d2b8c-373e-499e-801d-5bdce7d72e33/goal-objective.md. It preserves the full twelve-faction scope, official source precedence, complete-game acceptance gates, original internal guidance, all four AI levels, and explicitly authorizes browser screenshots/playtesting.
• Current local development server: exec session 97563, log /tmp/dune-dev-server.log. Sandbox network-interface restrictions required approved escalation to launch it. Tests use approved escalation because tsx requires local IPC pipes.

Parallel review, card inspection and browser acceptance

• Latest controlling objective: /home/quintine/.codex/attachments/70120c7b-5b79-41a3-b429-edac4afcf059/goal-objective.md. It additionally authorizes proactive parallel agents and requires authentic, inspectable physical components and a verified complete component inventory. No recurring automation: the user explicitly requested leaving it removed.
• Independent read-only Baliset review found no confirmed crash, deadlock, duplicate-force or hidden-hand leak. Its observer-context suggestion is implemented: non-CHOAM seats see the public pending mover/destination/sector/count. Additional passing tests cover BG Worthless Karama, countering that conversion, multisector elite custody and advisor arrival locks. Exact timing interpretations still require authoritative resolution before full starts.
• Integrated CardRules and CardInspector from the card-presentation agent into the authorized private hand. Both receive only a visible card; they do not read game/deck state. Enlarged cards include crisp original gameplay guidance and internal explanations, accessible dialogs, focus return, keyboard dismissal and reduced-motion handling. Normal cards are wider for readable text. These are current gameplay guides, NOT verified complete printed card text; all-card inventory/text acceptance remains open.
• Reviewed and integrated docs/COMPONENT_INVENTORY.md from the inventory agent. It distinguishes factory counts from official verification, records replacement-card versus additive-deck distinctions and separate caches, and traces inventory/text/engine/UI/AI/test gaps. Its UI matrix describes the pre-inspector baseline; this checkpoint records the newly verified subset without implying every component was inspected.
• Browser playtest room EN4L8NTV, Atreides human test seat + Medium Harkonnen AI: created room, added AI, ready/start, private traitor selection, sealed storm choice/confirmation, spice reveal/acceptance, charity readiness, auction powers, bid/counterbid/pass, payment and private card receipt, revival readiness, shipment and map-selected movement all worked. Atreides shipped one force to Arrakeen and moved one to Imperial Basin sector 9. Refresh restored 1 spice, 9 reserves, 10 forces at Arrakeen, 1 at Imperial Basin and the Kulon/Snooper hand; the spent movement stayed spent.
• Browser-discovered control fixes: auction bids now default to at least the current minimum, reset for a new auction card and disable unaffordable raises; spent movement disables Move forces and explains that the turn can be finished. The server remains authoritative for all legal-action checks.
• Visually inspected enlarged Kulon at normal desktop and 390×844 mobile viewport. Dialog fits mobile width, its body scrolls to expanded rules, Close remains reachable, Escape closes and focus returns to Inspect Kulon. Temporary viewport override was reset. Full forty-seven-card normal/enlarged review, unseen component families, mobile whole-game flow, sound and combat visual QA remain open.
• Initial refresh briefly renders the landing page before restoring the room. Restoration works, but a dedicated restoration/loading state would avoid this misleading flash; this is a remaining UX refinement.
• No recurring .wrangler hot reloads appeared in the new dev-server log after exclusion. Browser test room is paused at its test human’s completed movement turn; no unattended progression is required. Current browser tab 4 may be kept for later authorized QA.

Jubba Cloak and bounded client recovery checkpoint

• Latest objective read: /home/quintine/.codex/attachments/3c2d7613-9ed4-4489-a95a-5502776c4a29/goal-objective.md. It preserves complete classic/advanced/all-expansion scope, parallel development, complete component text/inventory and browser acceptance. The user explicitly left the hourly automation removed; no replacement automation was created.
• Jubba Cloak now opens a hand-independent CHOAM decision before storm traversal when CHOAM has exposed forces. The owner can declare an available physical Jubba for one threatened territory or continue. Successful settlement discards the card and protects only CHOAM's forces in that territory for this storm movement; spice and opponents remain exposed. Multiple sectors of the chosen territory share protection. Further threatened territories are offered again before continuing into Fremen protection and normal casualties.
• The shared Karama response retains a canceled card and prevents its special reuse in that phase. Missing/cashed-in custody aborts the effect and restores storm continuation. Private projections include the owner's exact pending Worthless card so AI cash-in cannot consume its own declared card, including while BG conversion is nested. Human cash-in remains possible and correctly aborts the pending effect.
• Added components/choam-storm.tsx, public waiting context, internal linked Jubba guidance and all four AI policies. Independent source/code review found and reproduced the poor-CHOAM pending-card cash-in bug; the integrated fix passes direct and nested regression tests. No additional confirmed defect was found in that review. Exact multi-sector scope and simultaneous priority remain interpretations under audit; CHOAM starts remain gated.
• Twenty new Jubba tests verify basic/advanced scope, multi-sector and separate territories, conservation, Karama/counter behavior, custody interruption, privacy/JSON restoration, sheltered terrain/HMS, zero movement, destroyed Shield Wall, Weather Control/Atomics, first storm and sector wrap, expiry, Fremen continuation and all AI levels.
• Integrated bounded request helper and client recovery: 15-second fetch plus body deadline, abort, no automatic replay of an uncertain POST, GET-only reconciliation, completion-scheduled/coalesced polling, monotonic versions and recovery epochs, immediate duplicate-click guard, explicit reconnect/AI resume, and initial restoration placeholder. Ten focused helper tests pass. Independent review is checking initial-invite failure recovery; browser timeout/reconnect acceptance is still outstanding. Initial create/join receipts and lost-cookie seat recovery remain separate missing server capabilities.
• Click/tap help now uses an accessible popover with hover support; the browser confirmed visible spice help and Escape dismissal. Enlarged private-card inspection and mobile checks are described above. The browser game has reached turn two from Mentat Pause without lost state; this is not yet a complete visual game.
• Integrated validation: 701/701 unit tests and 7/7 persisted multiplayer tests pass, along with TypeScript and lint; all four commands exited zero. The multiplayer command now includes the three recovery regressions. Logs: /tmp/dune-unit-check.log, /tmp/dune-multiplayer-check.log, /tmp/dune-type-check.log, /tmp/dune-lint-check.log. Final client follow-up and production build remain to be checked after the initial-invite recovery review.
• Remaining CHOAM implementation includes Kull Wahad and Auditor/verified printed leaders, plus timing audits. Richese, Ecaz, Moritani, leader skills, stronghold cards, homeworlds, Nexus, discoveries and full combination/AI/component acceptance remain required. No full-compliance or release claim is made.

Owner-proved seat recovery, visual combat and AI calibration

• Added authenticated recovery-key setup and private-proof recovery at POST /api/rooms/:code/control. Recovery preserves player identity, game state and sealed plans, increments the room version, revokes older seat credentials and installs the new token. Storage keeps cryptographic hashes; private keys and tokens do not enter GameView or public history. An exact operation receipt can reissue the current cookie without rotating twice; changed credentials/proof, later rotations and replaced keys invalidate older receipts.

• SeatAuth now contains player ID and token hash. Every authoritative game write checks that exact active credential in the same conditional SQL statement as the room version. Private reads join the live credential with the room. This fences requests authenticated before revocation as well as later reads. Additive Drizzle migrations 0001_fancy_king_cobra.sql and 0002_famous_piledriver.sql are applied locally; apply them before dependent code in other environments.

• Integrated SeatRecoverySetup below the table and SeatRecoveryClaim in the join area. The owner saves the complete generated private kit before enabling it; the setup retains that kit through uncertain and confirmed results. Recovery validates the saved kit and retains the exact operation ID/new session token for explicit retries. No automatic retry or localStorage secret storage. Normal game actions and management share the pending guard. Restored-seat integration isolates owner identity and discards stale epoch/version results, including WebMCP reads from an exited/recovered context.

• Initial invite failures now show a GET-only retry screen for transient errors and a usable join form for missing/auth-rejected seats. HTTP 408/5xx mutation errors are treated as uncertain. Independent client review confirmed both fixes and identified stale read return values; obsolete reads now reject instead of escaping through the WebMCP return value. Additional settlement guards verify seat/epoch as well as room.

• Seven new backend tests pass, covering owner setup/rotation, private state preservation, lost-response receipt replay, altered/stale receipts, same-key/key replacement invalidation, simultaneous claims, actual SQL fencing of an already-authenticated old writer and byte-identical sealed-battle JSON. Existing seven multiplayer tests also pass after the authentication change. Five recovery-kit helper tests and twelve request tests pass within the aggregate 708/708 unit suite. TypeScript/lint/build pass at integration; final presentation/context-guard checks follow separately.

• Browser test completed a Carthag battle: weapon prescience, sealed plans, public reveal, traitor decline, victory, chosen card discard and refresh restoration all worked. It exposed an enabled Reveal traitor button without a matching card; controls now use only entitled traitors and revealed plans to disable with a reason, including hero and Kwisatz cases. The disabled state was visually verified. Detailed evidence and remaining visual limits are in docs/VISUAL_PLAYTEST.md.

• Reproducible calibration completed 120 basic base games across 2–6 players with balanced difficulty/faction/seat rotations: no deadlocks, unhandled exceptions, action-limit failures or checked invariant failures. Win counts across 120 appearances per level: Easy 1, Medium 41, Hard 37, Brutal 41. This separates Easy in the measured sample but does not demonstrate an increasing strength ladder among upper levels. The run recorded 31,388 rejected candidate proposals; first-choice rejection frequency was not measured. Methodology, correlated-sample limits, seeds and deterministic replay are in docs/AI_CALIBRATION.md; source files were unchanged during measurement.

• Lost initial create/join response receipts, intentional seat transfer and prior-consent AI delegation remain missing. Owner recovery requires a previously saved kit; it does not make a completely abandoned unprepared seat replaceable. No advanced/expansion starts or release gates were lifted. Independent backend review is still underway.

• Controlled maintenance at approximately 10:04 Australia/ACT, 2026-09-06: consistent SQLite backup in /tmp/dune-maintenance-20260906T0003, prior server97563 stopped cleanly, new server73638 started with approved network permission. Recent active rooms were test fixtures, and the browser game was paused at its collection decision. Complete saved JSON hash and version47 matched after restart; browser reload restored the same state. No recurring automation was created. New server log remains /tmp/dune-dev-server.log.

• Independent backend review found no confirmed custody/privacy defect. Actual room-module SQLite reproductions verified transaction rollback, key replacement between proof and commit, rotation/key replacement during receipt reads, stale version batches and old credential fencing. Six deterministic rollback/interleaving cases are now permanent tests, including a barrier-controlled race between distinct recovery claims. The prior14-test suite passed after restart; the expanded20-test suite is running. The13-test seat-recovery file includes7 original scenarios and6 new cases.

• Read-only mobile recovery-panel inspection at390×844 confirmed wrapping, reachable controls and no horizontal overflow; no recovery key was enabled for the browser test seat. Detailed record is in docs/VISUAL_PLAYTEST.md. Latest production build, lint and TypeScript checks completed successfully after the context-guard fixes.

• Expanded persisted/database validation completed: 20/20 pass, terminal exit0, including all six newly permanent interleaving/rollback cases. Aggregate unit checkpoint remains708/708. No application source changed during the final multiplayer run.

Battle-wheel presentation checkpoint

• Integrated the independently authored original SVG battle wheel with native range and numeric controls. The parent preserves the existing numeric label as a sibling, supplies the same dial limits/step/commitment as before and disables while sending. The graphic is decorative for assistive technology; native controls remain keyboard/tap usable, with no animation or external assets.

• Added a basic battle-wheel practice example to the internal battle topic and expanded internal recovery guidance. The practice is local UI state and cannot change a live game. Its ten-force dial is clamped to0–10. Tick labels were adjusted to selectable step values after the ten-force example exposed fractional printed labels on an integer-only wheel.

• Browser desktop/mobile checks verified exact-number, arrow-key and range synchronization, explanatory totals, practice bounds and readable mobile controls. Found and fixed pre-existing horizontal overflow of the mobile rules reference caused by its grid’s automatic minimum width. Screenshots and limitations are in docs/VISUAL_PLAYTEST.md; viewport reset and temporary tab closed.

• Reviewed the Richese source/architecture plan in docs/RICHESE_IMPLEMENTATION_PLAN.md. No Richese implementation or mode enabling occurred. The immediate architecture work is a bidding schedule separate from ordinary auction state, with explicit sale provenance and sealed bid handling; No-Field requires a separate concealed board object. Printed cache faces and leader roster/strengths still need verified primary components.

• Final checks for this presentation slice: reference-link validation1/1, TypeScript, repository lint and production build all exited0. The most recent aggregate checkpoints are708/708 unit tests and20/20 persisted/database recovery tests. The running server73638 returns200 for the saved playtest; browser tab4 remains available at turn2 collection. No deployment or full-compliance declaration occurred. All three agents' contributions from this checkpoint were reviewed and integrated or retained as explicitly scoped developer plans.

Initial room-entry recovery checkpoint

• Create and join now optionally accept a private operation receipt. The server hashes its operation, exact normalized request identity and session token, atomically stores the room/seat/receipt, and returns the current original private view on an exact retry. Duplicate operations converge without additional rooms, seats or state versions. A mismatched request, revoked credential or cross-room operation cannot claim the receipt. Migration 0003_magical_hawkeye.sql was applied locally before dependent runtime changes.

• The browser saves an immutable, versioned, tab-scoped request before sending. Refresh restores an explicit retry screen; no POST retries automatically, and a cookie-only GET cannot erase the proof. Only a matching receipt or a confirmed fresh already-seated join acknowledges success. A clearly rejected first request returns the form for correction; uncertain and replayed attempts retain their proof. Failed storage writes prevent sending; failed deletion keeps the record visible. Invalid/future records are preserved for deliberate handling.

• Saved-kit recovery and entry attempts cannot silently discard each other's unresolved operation. Uncertain recovery blocks conflicting entry/navigation and retains its exact payload. A deliberate acknowledged abandonment provides an exit when another recovery invalidates that receipt; it does not undo any completed recovery. The original saved kit remains necessary for future recovery.

• Independent backend audit found a concurrent token-reuse classification issue; the fixed path rolls back and returns ENTRY_TOKEN_USED instead of a generic server error. Thirteen permanent entry cases cover accepted response loss, duplicate create/join, normalized/mismatched inputs, cookie precedence, started-game private projection, revocation, competing faction claims, failed receipt inserts and deterministic operation/token collision barriers. An independent eight-case isolated audit found no remaining confirmed custody/privacy defect.

• Ten client entry tests cover frozen payloads, strict parsing, fresh versus uncertain response acknowledgment, storage failures, retained proof through refresh and first-request rejection policy. Aggregate verification: 718/718 unit tests and 33/33 persisted/database tests pass. TypeScript, repository lint and production build pass. Browser creation, refresh, same-seat rejoin, explicit retained-request retry, deliberate abandonment and corrected-invitation flows passed; mobile layout was inspected and improved. See VISUAL_PLAYTEST.md for precise scope.

• Richese source checks are recorded in RICHESE_BLACK_MARKET_RULES.md and RICHESE_LEADER_AUDIT.md. Black Market custody/payment/continuation need separate engine state; self-purchase and pre-bid Ixian exchange remain unresolved. Official indexed evidence did not establish a complete Richese leader roster/strengths or printed Auditor strength. No unverified component data was added.

• Full Advanced/expansion starts remain gated. Intentional seat transfer, prior-consent AI delegation, missing factions/modules, full component text/art, upper AI difficulty calibration and complete combination acceptance remain required. The goal is active. The user-requested removed automation remains removed.

• Subsequent live basic battle-wheel verification exposed and fixed a physical 20-point ceiling that exceeded the two fighters present. The basic non-Ix wheel now derives its maximum from own territorial fighters, excludes advisors and shares a bounded step-aligned value between display/submission. Existing advanced/Ix ceiling remains unchanged. A visible 20 draft became 2 and the authoritative revealed plan was 2. The battle resolved through winner retention controls. Independent review found no display/submission or privacy issue; full details and outstanding advanced/committed UI checks are in VISUAL_PLAYTEST.md.

Prepared special Karama and leader inspection checkpoint

• The eight implemented faction special-Karama paths now separate pure preparation from explicit execution. Serializable typed intents copy declared selections, bind the original turn/phase and relevant battle/shipment/revival declaration, and revalidate exact card custody and resources before effects. Preparation performs no resource changes, discards, once-per-game spending or random draws. Existing public actions still prepare and execute synchronously; this does not implement Kull Wahad's reaction window.
• Independent review found missing dispatcher timing checks in the direct executor path. Preparation now blocks unresolved Truthtrance and preserves the existing faction-specific phase-opening, market and revival gates, including CHOAM's established exceptions. Battle-plan feasibility clears the resolved Truthtrance only in its hypothetical clone while retaining binding battle promises.
• Execution is a mutating helper for a disposable working Game, not a transactional API. Callers must publish the clone only after success; the public applyAction boundary preserves its input even if Harkonnen's random exchange fails. Ten regressions cover all special variants, pure preparation, copied selections, stale contexts/custody/resources, declaration binding, dispatcher parity, exact-once commitment and failure isolation.
• Added a read-only Your leaders roster and enlarged leader/private-traitor inspectors. They use only the viewer's authorized identities and display actual strength, faction and leader status. Original geometric medallions are interface artwork; they do not claim to be verified printed faces or completed portraits. Independent review found and fixed an accessible strength-label issue. Browser checks verified desktop/mobile dialog readability, contained scrolling and Escape focus return. Full component art, printed text/inventory and expansion identity verification remain outstanding.
• Verification at this checkpoint: 728/728 unit tests and 33/33 persisted/database tests pass. TypeScript, lint and production build pass. Browser verification also confirmed the final accessible strength labels and mobile roster keyboard navigation.
• After the previous development process was observed terminated, the persisted database was backed up to /tmp/dune-maintenance-20260906T0048/database.sqlite and the server restarted using the same database. Room EN4L8NTV retained version 72 and an identical state hash; the browser reconnected at turn three Battle. Inspection checks performed no game actions. The removed automation remains removed.
• Kull's precise counter order and Bene Gesserit conversion placement remain unresolved in the retrieved primary sources. A user clarification is pending for a documented provisional interpretation; no dependent Kull policy has been installed. CHOAM and all unfinished Advanced/expansion starts remain gated. The complete goal remains active.

Printed player circles and authorized component inspection checkpoint

• Corrected the base storm's initial sector from 18 to the printed Meridian Storm Start (sector 1 in this board's numbering). The six printed player circles are fixed at sectors 2, 5, 8, 11, 14 and 17. They no longer redistribute with player count. After movement, order proceeds toward the next occupied circle counterclockwise; a circle already reached by the storm waits for the next circuit. Source: GF9 base rulebook pp.4,6–7, with printed map checked independently.
• New rooms persist playerPositions. Players can choose an unoccupied circle for themselves in the lobby; readiness resets, bot readiness remains automatic, and removal/join reuse vacancies without moving other circles. Public labels and six map markers show those positions. The first dialers bracket Storm Start using occupied circles rather than player-array endpoints. First dials remain 0–20; later Basic dials remain 1–3 from the last battle-wheel users, retaining previous storm dialers if there was no intervening battle.
• Existing rooms without positions derive the same six-circle defaults on read without mutation. Their next valid authoritative action persists the mapping and a one-time migration note. In-progress games retain their current storm, phase order and pending choices; the next completed storm uses the corrected order. Old lobbies display and adopt Storm Start 1. Past phases are not replayed.
• Eighteen focused regressions verify all eighteen sector boundaries, two through six players, sparse circles, ownership/range/occupied errors, readiness, bot removal/rejoin, first-dial ownership and secrecy, zero/full/multiple circuits, storm casualties/conservation, Weather Control, later dialers and legacy-state recovery. Three old endpoint expectations were updated to the corrected start. A persisted multiplayer race verifies competing circle choices, occupied retry rejection, owner enforcement and refresh without secret exposure.
• Expanded authorized inspection to setup traitor choices, private Face Dancers, Atreides auction faces, Ixian setup/pool/offered/purchased faces, winner card choices, public revealed battle components and private full-plan insight. Face Dancer guidance is distinct from traitor-call guidance. Action selection remains separate from enlargement; no opponent-hand or deck lookup was added. Setup now disables ordinary card activation until play, while retaining legal setup Karama responses and Truthtrance.
• The CHOAM/Richese rulebook p.4 expressly clarifies that the treachery discard pile is private and may only be searched under an enabling effect. A generic discard browser was therefore not added. Existing server projections keep the pile and deck identities private. Effect-specific inspection, including missing Nullentropy Box support, remains required.
• Independent UI review found clipped outer player circles and undefined CSS color variables; expanded board framing and corrected theme variables fix those issues. Browser verification covered saved circle selection/refresh, occupied-circle controls, setup inspection without selection, and enlarged revealed Stunner on desktop/mobile. See VISUAL_PLAYTEST.md for exact game checkpoints.
• Validation: 746/797 unit tests, 34/34 persisted/database tests, TypeScript and production build pass. Lint found one missing numeric comparator in the new race test; corrected and lint passes. Complete Basic/tech-token AI games continue to pass after the order change. The earlier AI strength calibration is historical and has not been rerun for this revised seating model.
• Added ECAZ_AMBASSADORS_RULES.md with verified core ambassador anchors and integration boundaries. Its official/mirrored Occupy rounding discrepancy remains recorded for resolution. Kull's timing clarification is still pending; Advanced/expansion starts remain gated, and all remaining full-scope requirements remain active.

Assassination and Sneak Attack checkpoint — 2026-09-06

Four Terror effects now have partial runtime, owner controls, private projection and AI support. Assassination immediately selects one random living ordinary native leader, updates its death count and battle-use marker, pays its native strength (Zoal 3), consumes the revealed token and resumes the interrupted entry. A client cannot choose the victim. Missing/unverified rosters, exceptional capture/Ghola custody and empty living pools reject before reveal or RNG. Advanced Harkonnen configurations uniformly reject this reveal so availability cannot disclose concealed captures.

Sneak Attack has a persisted reserve-count decision for zero through five available forces. Positive entry validates the recorded sector, storm and occupancy, transfers reserves without a spice fee or ordinary shipment/movement consumption, and resumes the original continuation. Owner-only limits and unfinished BG/Heighliners combinations are shown before revelation. Zero remains available after revealing; AI retains the hidden token when no positive entry is available. These restrictions identify unfinished implementation, not new official prohibitions.

Fifteen focused force/leader tests cover random selection, all five ordinary discs, Zoal, death history, invalid counts/sectors, resource conservation, reload and duplicate rejection, hidden projections and all four AI profiles including blocked offers. Independent review checked custody, RNG timing and continuation. Full integrated validation: 858 unit tests, 45 persisted/API tests, TypeScript, lint and production build pass. Source boundary: MORITANI_ASSASSINATION_SNEAK.md.

Atomics/Aftermath, Extortion, Enemy of My Enemy, advanced Assassinate Leaders, exceptional leader pools and combined arrival timing remain unfinished. Full Advanced and expansion starts stay disabled; these isolated QA scenarios do not constitute full-game certification.

Enemy of My Enemy checkpoint — 2026-09-06

The special Terror alliance branch now has a persisted declaration, Karama response and entrant accept/refuse decision. Acceptance detaches both former partners, refunds only unused escrow attached to broken pairs, clears affected Nexus offers, forms the mutual alliance and returns the token hidden through the existing identity-rotation helper. Already paid shipment costs and committed forces stay unchanged. Refusal immediately enters the ordinary token effect within the same action; Moritani cannot decline again. Karama cancellation preserves the token and permits reveal/decline but prevents repeating that entry’s alliance offer.

Entrant UI branches before every owner-only token lookup. Public stages, names and alliance consequences contain no hidden face; owner controls show why an offer is unavailable. Unsupported mandatory effects and Ecaz are rejected before an offer, so the entrant is never asked to refuse into an unimplemented effect. All four AI profiles complete offer, response, reply, refusal and cancellation paths from private views. Sandtrout does not impose an invented ongoing special-alliance ban.

A related base-rule correction records allySinceTurn for Enemy and ordinary Nexus alliances. Newly allied co-occupants are not destroyed at the end of the same turn’s movement; the later mover still loses remaining co-occupants in a following turn if neither leaves. Future entry into an ally-occupied territory remains prohibited.

Fifteen focused alliance tests, independent source/code review, the full 873-unit suite, 45 persisted/API tests, typecheck, lint and build pass. An earlier run during test drafting failed only on the new public formation-turn field missing from a test expectation; the completed tests and integrated rerun pass. Browser acceptance survives refresh with hidden token return and exact shipment custody. Source/timing record: MORITANI_ENEMY_ALLIANCE.md.

The exact Karama-before-reply ordering is a tested draft using the existing power-response convention; a user clarification is pending because no specialized official timing ruling was retrieved. Full expansion starts remain gated. Atomics/Aftermath, Extortion, advanced Assassinate Leaders, Duke Vidal and other previously recorded scope remain unfinished.

Duke Vidal shared-leader checkpoint — 2026-09-06

One separate Ecaz-identity disc of strength six now has explicit controller/source/turn custody. It is not appended to any native five-leader roster or traitor deck. Moritani's committed end-of-movement check counts distinct strongholds with actual upcoming battles, excludes Ecaz opponents and uses the existing storm/occupancy geometry; the Hidden Mobile Stronghold counts. A generic Karama window can prevent acquisition, with a once-per-turn marker preventing repeats. A held Duke is not stripped by a new cancellation.

The controller may select Duke in an ordinary supported battle. Death and six-strength bounty resolve on the shared disc; after one battle his controller clears while death history remains. An unused Moritani tenure expires at turn end, and a later qualifying turn can acquire him again. Ecaz permanent custody and unresolved allied-loan return are preserved by the custody helper; no loan-return destination is invented. The next storm clears the shared battle-use marker.

The public original purple/gold component and scrolling inspector show strength, custody, no-Traitor status and complete original-language core instructions. Controller-specific battle choices use explicit shared control, so an Ecaz identity never automatically grants control. Truthtrance battle questions and their readable logs now recognize Duke; traitor questions still reject him. Four integration regressions cover that distinction and legal promised plans.

Verification comprises nine pure custody tests, ten engine scenarios including Basic/Advanced casualties and all four AI candidate plans, four Duke/Truthtrance regressions, independent source/code review, full896-unit suite,45 persisted/API tests, typecheck, lint and build. Desktop browser QA exercises actual end-of-movement acquisition, full inspection, Duke battle use, set-aside status and refreshed second-battle options without Duke. These are bounded component/interaction checks, not complete expansion games.

Advanced Harkonnen configurations and captured/ghola custody remain explicitly unsupported for this acquisition/use slice because they affect the shared capture pool and release destination. Ecaz Ambassador acquisition, loans, Ecaz-only five-spice/Ghola revival and its five-in-Tanks revival threshold remain unfinished. Source details: DUKE_VIDAL_RULES.md. Advanced and expansion starts stay gated.

Ecaz placement, automatic responses, pacing and rules checklists — 2026-09-06

Ecaz now has an eleven-token Ambassador inventory, escalating end-of-Revival placement, owner controls, public compact/expanded inspectors and all-four-profile placement choices. The pure custody model covers original-group recycling, reusable Ecaz, permanent BG removal and destruction return. Runtime entry effects and destruction hooks are still missing. Public unplaced supply is a documented default-open inference; CHOAM market → deferred technology income → Ecaz placement is a composed implementation order, not certified combined FAQ priority. Full Ecaz setup, Occupy, Duke revival, optional modules and expansion starts remain unfinished/gated.

A sole legal Advanced battle casualty allocation now settles immediately, while real typed-casualty, Ixian substitution and card-retention choices remain. Power responses automatically proceed when the owner and all players without a usable physical cancellation card are the only seats left. Shared physical eligibility checks cover Advanced BG conversion, sealed/prescience bindings and Moritani retention reservations. Explicit passes and cancel-card IDs are viewer-local; automatic eligibility is not published per seat. Active Truthtrance/phase opening retains precedence, restored nested windows recheck current custody, and voluntary battle promises are validated before automatic consequences. Promise-constrained physical candidates remain conservative until commit, so this is not yet complete promise-aware option filtering.

Successful casualties, Ecaz placements, Emperor auction income and Harkonnen bonus draws emit server-authored public notice metadata. A local toggle controls a nonblocking, reduced-motion-aware queue with 1.5 seconds per event, consumed disabled events and an initial-history baseline. A two-effect auction browser check showed the Emperor notice followed by Harkonnen's bonus, while bidding had already continued; no drawn identity enters public event text. Untagged powers, acknowledgement-only auction payment/full-plan/collection flows and further animations still require work.

Online AI now commits at most one accepted decision per 1.5-second persisted deadline, including consented human autopilot. Human actions commit immediately. Authenticated reads resume pending work; overlapping reads share one per-room worker within an isolate, with database CAS still fencing separate workers and take-back-control. Legacy uncancelable responses use a separate bounded authoritative continuation, keeping viewGame pure. Offline simulations remain fast. Durable progress while every client stays disconnected is still a liveness gap after the bounded request worker ends. See AI_PACING.md and AUTOMATIC_RESPONSE_AUDIT.md.

The in-app reference now includes five-facet feature checklists for the reviewed Ecaz, automatic-action and pacing slices, with internal cross-links and actual regression evidence. This is a growing traceable checklist, not finished coverage for every rule. Eighteen of the existing fifty ordinary leader identities have original portraits: full Atreides, Harkonnen and Emperor rosters plus the earlier Fremen/Guild/BG pilot faces. CHOAM/Richese component verification, remaining portraits and complete component browser acceptance remain open.

Integrated verification: 991/991 rules/client tests and 63/63 persisted/API tests pass, with typecheck, lint and production build passing. The initial integration identified obsolete mandatory-pass expectations; these were changed to immediate-resolution assertions or genuine pre-held cancellation resources while preserving privacy, custody, refresh and concurrency checks. Fifteen focused automatic-response cases and seven persistence/coalescing cases are included in those totals. Independent reviews covered Ecaz authority/interpretation boundaries, server pacing and automatic continuation. Browser evidence is in VISUAL_PLAYTEST.md; this does not certify complete Advanced/expansion games.

Hourly maintenance first saved a backup at05:52UTC and deferred restart for recent non-QA setup activity. After that room remained idle for over18 minutes, a fresh backup at /tmp/dune-maintenance-20260906T0605/database.sqlite preceded a controlled restart. All812 rooms retained exact versions and state hashes, HTTP health returned200, and the saved Harkonnen browser seat reconnected. The user-removed maintenance automation was not recreated. The full goal remains active.

Ambassador entry and automatic decisions checkpoint (2026-09-06)

Implemented five Ambassador effects end to end: Emperor bank grant, Atreides current-hand snapshot, Harkonnen random held Traitor snapshot (including physical Tleilaxu Face Dancers), CHOAM chosen card sales, and Ixian discard/replacement. Bene Gesserit can copy those supported effects from outside the original six-token supply, regardless current custody zones. Ecaz chooses whether to trigger and its current allied beneficiary; the beneficiary controls its own private choices. Every action binds the persisted event ID and stage. Inspection results remain private snapshots and require no acknowledgement.

The committed entry pauses subsequent work without replaying movement or shipment. Self, ally, advisors and physical-marker faction immunity are applied independently of a copied effect. Cohort replenishment waits until the final triggered effect finishes; BG never re-enters the pool. Exposed-city storm crossings and actual Lasgun–shield explosions return Ambassadors to supply without triggering them. Traitor precedence preserves a token when it prevents an explosion.

Independent review found and fixed two exchange deadlocks: CHOAM cash-in and delayed Truthtrance disposal could otherwise spend the beneficiary’s final required discard. Voluntary interruptions must preserve a legal completion, including queued Truthtrance reservations. Legal interruptions retaining a card still complete through JSON recovery.

Auction payments now execute automatically only when the exact declared own/ally split is funded and no physically usable Karama remains. Genuine payment choices and provisional unfunded recovery are retained. Full-plan inspection has no Finish action; the persistent private inspector also supports an external Atreides ally. Authenticated recovery schedules both legacy decision types and persists only actual changes through the existing CAS fence.

Verification: 1,029/1,029 rules/client tests; 74/74 persisted/API tests; TypeScript, lint and production build pass. Logs: /tmp/dune-ambassador-full.log, /tmp/dune-ambassador-multiplayer.log, /tmp/dune-ambassador-type.log, /tmp/dune-ambassador-lint.log, /tmp/dune-ambassador-build.log. The fresh 120-game Basic calibration completed with no deadlock, action-limit, exception or invariant failure; 47,965 accepted actions, 9,081 rejected candidate actions. Relative to the prior same-seed run, every per-game field except accepted-action count and elapsed time is unchanged.

Limits: Ecaz/Duke/alliance, Fremen movement, Guild shipment, Richese purchase and Tleilaxu revival effects still need completion; competing arrival ordering remains unresolved and rejects the original entry atomically. Occupy, full Ecaz setup, other expansion systems and full-mode games remain unfinished. The first-slice checklist in the internal rules marks these boundaries. No expansion or Advanced start gate was removed, and the user-removed automation stays removed.

Four additional original Fremen portraits complete the five native Fremen faces: Chani6, Otheym5, Shadout Mapes3 and Jamis2 join Stilgar7. Root inspected all four final source files, the complete live browser row, and each new enlarged component. The registry now covers22 of the existing50 catalog identities; full twelve-faction component inventory remains incomplete. Final bundle after assets and guide updates passes (/tmp/dune-ambassador-final-build.log). Final guide tests8/8, TypeScript and lint pass after the prose updates.