@aephia/atlas-kit 0.6.0-next.17 → 0.6.0-next.171

package/dist/claim-stakes/actions/index.js

@@ -1,21 +1,49 @@
-import { getAddressEncoder, getBytesEncoder, getProgramDerivedAddress, isAddress, } from '@solana/kit';
+import { deriveCurrencyCache, validateCurrencyCache, } from '../../internal/c4/currency-cache.js';
+import { isAddress } from '@solana/kit';
 import { InvalidActionInputError, SageSdkError } from '../../client/errors.js';
 import { readContextRawAccounts } from '../../client/reconciliation.js';
-import { sage } from '../../internal/c4/bindings.js';
+import { StarbaseLevel } from '../../internal/c4/runtime-bindings.js';
 import { readFreshGameClaimStakeConfiguration, } from '../../registry/claim-stakes.js';
-import { characterAccountDefinition, findCharacterPda, } from '../../internal/c4/identity.js';
+import { characterAccountDefinition, findCharacterPda, } from '../../internal/c4/character.js';
 import { deriveFactionOwnershipAddress, factionOwnershipAccountDefinition, } from '../../internal/c4/factions.js';
 import { claimStakeAccountDefinition } from '../../internal/c4/claim-stake.js';
-import { deriveFleetCrewBindingAddress, fleetCrewBindingAccountDefinition, } from '../../internal/c4/fleet-crew-binding.js';
+import { deriveClaimStakeRegistration } from '../../internal/c4/claim-stake-standing.js';
+import { CLAIM_STAKE_PLOT_ROWS, claimStakePlacementRow, claimStakePlotPositions, } from '../../internal/c4/claim-stake-plots.js';
+import { factionValue } from '../../internal/c4/faction.js';
+import { deriveFleetCrewBindingAddress, fleetCrewBindingAccountDefinition, matchesFleetCrewBindingIdentity, } from '../../internal/c4/fleet-crew-binding.js';
 import { deriveFleetAddress, fleetAccountDefinition, } from '../../internal/c4/fleet.js';
 import { deriveProfileFactionAddress, profileFactionIdentityAccountDefinition, } from '../../internal/c4/profile-faction.js';
 import { deriveStarbasePlayerAddress, starbasePlayerAccountDefinition, } from '../../internal/c4/starbase.js';
-import { celestialBodyAccountDefinition, decodeIndexedCelestialBodyAccount, deriveCelestialBodyAddress, deriveStarSystemAddress, starSystemAccountDefinition, } from '../../internal/c4/world.js';
+import { celestialBodyAccountDefinition, deriveCelestialBodyAddress, deriveStarSystemAddress, starSystemAccountDefinition, } from '../../internal/c4/world.js';
+import { resolveXpRuntime } from '../../internal/planning/xp-runtime.js';
+import { readClaimStakeStorageAction } from '../../internal/planning/claim-stake-storage-actions.js';
+import { RENT_ADDRESS } from '../../internal/planning/rent.js';
+import { planStorageFunding } from '../../internal/planning/storage-actions.js';
+import { requireDisabledStakeRent, requireNewStakeRent, } from '../../internal/planning/rent-catalog.js';
+import { deriveStructureXpAccrualAddress } from '../../internal/c4/pda.js';
+import { requireProfileStarbasePlayer } from '../../internal/planning/starbase-player-owner.js';
 import { requireGameAddress } from '../../internal/game-context.js';
-import { adaptCancelClaimStakeBuildingChangesInstruction, adaptClaimStakeBuildingChangesInstruction, adaptDeconstructClaimStakeInstruction, adaptFinalizeClaimStakeBuildingChangesInstruction, adaptPlaceClaimStakeInstruction, adaptRecoverClaimStakeFleetTransferInstruction, adaptStartClaimStakeFleetTransferInstruction, adaptTopUpClaimStakeRentInstruction, validatePlanAuthorization, } from '../../internal/planning/authorization-adapter.js';
-import { createPlan, } from '../../planning/index.js';
+import { cargoStorageUnits } from '../../internal/cargo.js';
+import { adaptCancelClaimStakeBuildingChangesInstruction, adaptClaimStakeBuildingChangesInstruction, adaptDeconstructClaimStakeInstruction, adaptFinalizeClaimStakeBuildingChangesInstruction, adaptPlaceClaimStakeInstruction, adaptRecoverClaimStakeFleetTransferInstruction, adaptStartClaimStakeFleetTransferInstruction, adaptTopUpClaimStakeRentInstruction, readPlanAuthorization, } from '../../internal/planning/authorization-adapter.js';
+import { buildPlannerPlan } from '../../planning/plan-construction.js';
 import { readFreshGameCargoDefinitions } from '../../registry/cargo.js';
 import { resolveCargo } from '../../registry/index.js';
+import { accountAbsentPrecondition, accountStatePrecondition, } from '../../internal/planning/account-state.js';
+async function resolveClaimStakeXp(ctx, game, structure, character) {
+    const xp = await resolveXpRuntime(ctx, {
+        game,
+        structure,
+        ...(character === undefined ? {} : { character }),
+    });
+    const guard = {
+        kind: 'xp-runtime',
+        address: game,
+        intent: xp.intent,
+        accounts: xp.accounts,
+        describes: 'The Game and canonical Claim Stake XP accounts remain supported; accrued XP may change. Initialize or repair missing XP state using the game client, then recreate the Plan.',
+    };
+    return { accounts: xp.accounts, guard };
+}
 const U64_MAX = (1n << 64n) - 1n;
 const U16_MAX = 65_535;
 const I32_MAX = 2_147_483_647;
@@ -31,13 +59,13 @@ const LEVEL_INDEX = Object.freeze({
     css: 6,
 });
 const CLAIM_STAKE_PLOT_LEVELS = Object.freeze([
-    sage.StarbaseLevel.Level0,
-    sage.StarbaseLevel.Level1,
-    sage.StarbaseLevel.Level2,
-    sage.StarbaseLevel.Level3,
-    sage.StarbaseLevel.Level4,
-    sage.StarbaseLevel.Level5,
-    sage.StarbaseLevel.Css,
+    StarbaseLevel.Level0,
+    StarbaseLevel.Level1,
+    StarbaseLevel.Level2,
+    StarbaseLevel.Level3,
+    StarbaseLevel.Level4,
+    StarbaseLevel.Level5,
+    StarbaseLevel.Css,
 ]);
 const TIER_INDEX = Object.freeze({
     one: 0,
@@ -83,51 +111,28 @@ function u16(value, field) {
 }
 function validateOptions(value) {
     const options = record(value, 'options');
-    exactKeys(options, 'options', [
-        'authorization',
-        'claimStake',
-        'claimStakeDefinitionId',
-        'hubBuildingId',
-        'initialRentAmount',
-    ]);
-    const authorizationRecord = record(options.authorization, 'authorization');
-    exactKeys(authorizationRecord, 'authorization', ['profile', 'authority', 'keyIndex'], ['certificate']);
-    const authorization = authorizationRecord;
-    address(authorization.profile, 'authorization.profile');
-    address(authorization.authority, 'authorization.authority');
-    if (authorization.certificate !== undefined) {
-        address(authorization.certificate, 'authorization.certificate');
-    }
-    validatePlanAuthorization(authorization);
-    if (typeof options.initialRentAmount !== 'bigint' ||
-        options.initialRentAmount <= 0n ||
-        options.initialRentAmount > U64_MAX) {
-        invalid('initialRentAmount', options.initialRentAmount, `a positive raw bigint from 1 through ${String(U64_MAX)} (unsigned u64)`, 'Set initialRentAmount to the exact positive raw rent deposit within the instruction codec range.');
+    exactKeys(options, 'options', ['authorization', 'claimStake', 'claimStakeDefinitionId', 'hubBuildingId'], ['initialRentAmount']);
+    const authorization = readPlanAuthorization(options.authorization);
+    if (options.initialRentAmount !== undefined &&
+        (typeof options.initialRentAmount !== 'bigint' ||
+            options.initialRentAmount <= 0n ||
+            options.initialRentAmount > U64_MAX)) {
+        invalid('initialRentAmount', options.initialRentAmount, `a positive raw bigint from 1 through ${String(U64_MAX)} (unsigned u64)`, 'Set initialRentAmount to the exact positive raw rent deposit within the instruction codec range, or omit it to place without rent.');
     }
     return {
         authorization,
         claimStake: address(options.claimStake, 'claimStake'),
         claimStakeDefinitionId: u16(options.claimStakeDefinitionId, 'claimStakeDefinitionId'),
         hubBuildingId: u16(options.hubBuildingId, 'hubBuildingId'),
-        initialRentAmount: options.initialRentAmount,
+        ...(options.initialRentAmount === undefined
+            ? {}
+            : { initialRentAmount: options.initialRentAmount }),
     };
 }
-function validateAuthorization(value) {
-    const authorizationRecord = record(value, 'authorization');
-    exactKeys(authorizationRecord, 'authorization', ['profile', 'authority', 'keyIndex'], ['certificate']);
-    const authorization = authorizationRecord;
-    address(authorization.profile, 'authorization.profile');
-    address(authorization.authority, 'authorization.authority');
-    if (authorization.certificate !== undefined) {
-        address(authorization.certificate, 'authorization.certificate');
-    }
-    validatePlanAuthorization(authorization);
-    return authorization;
-}
 function validateBuildingChangeOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['authorization', 'buildingChanges']);
-    const authorization = validateAuthorization(options.authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     const values = options.buildingChanges;
     if (!Array.isArray(values) || values.length === 0) {
         invalid('buildingChanges', values, 'a non-empty dense array of add/remove building changes', 'Provide at least one exact building change before retrying.');
@@ -168,22 +173,22 @@ function validateBuildingChangeOptions(value) {
 function validateFinalizeBuildingChangeOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['authorization']);
-    return { authorization: validateAuthorization(options.authorization) };
+    return { authorization: readPlanAuthorization(options.authorization) };
 }
 function validateCancelBuildingChangeOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['authorization']);
-    return { authorization: validateAuthorization(options.authorization) };
+    return { authorization: readPlanAuthorization(options.authorization) };
 }
 function validateDeconstructOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['authorization']);
-    return { authorization: validateAuthorization(options.authorization) };
+    return { authorization: readPlanAuthorization(options.authorization) };
 }
 function validateTopUpRentOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['amount', 'authorization']);
-    const authorization = validateAuthorization(options.authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     if (typeof options.amount !== 'bigint' ||
         options.amount <= 0n ||
         options.amount > U64_MAX) {
@@ -220,7 +225,7 @@ function validateCargoRequests(value, field, seen) {
 function validateStartFleetTransferOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['authorization', 'load', 'unload']);
-    const authorization = validateAuthorization(options.authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     const seen = new Set();
     const load = validateCargoRequests(options.load, 'load', seen);
     const unload = validateCargoRequests(options.unload, 'unload', seen);
@@ -232,7 +237,7 @@ function validateStartFleetTransferOptions(value) {
 function validateRecoverFleetTransferOptions(value) {
     const options = record(value, 'options');
     exactKeys(options, 'options', ['atUnixSeconds', 'authorization']);
-    const authorization = validateAuthorization(options.authorization);
+    const authorization = readPlanAuthorization(options.authorization);
     if (typeof options.atUnixSeconds !== 'bigint' ||
         options.atUnixSeconds < 0n ||
         options.atUnixSeconds > U64_MAX) {
@@ -240,53 +245,9 @@ function validateRecoverFleetTransferOptions(value) {
     }
     return { atUnixSeconds: options.atUnixSeconds, authorization };
 }
-async function deriveCurrencyCacheAddress(game) {
-    const [derived] = await getProgramDerivedAddress({
-        programAddress: sage.SAGE_PROGRAM_ADDRESS,
-        seeds: [
-            getBytesEncoder().encode(new TextEncoder().encode('CurrencyConfig')),
-            getAddressEncoder().encode(game),
-        ],
-    });
-    return derived;
-}
-function validateCurrencyCache(account, game, canonicalAddress, action) {
-    const decoder = sage.getCurrencyConfigCacheDecoder();
-    const validDiscriminator = sage.CURRENCY_CONFIG_CACHE_DISCRIMINATOR.every((byte, index) => account.data[index] === byte);
-    if (account.address !== canonicalAddress ||
-        account.owner !== sage.SAGE_PROGRAM_ADDRESS ||
-        account.data.length !== decoder.fixedSize ||
-        !validDiscriminator ||
-        decoder.decode(account.data).gameId !== game) {
-        fail(`CurrencyCache ${account.address} does not match the configured Game, canonical PDA, owner, or pinned account layout. Refresh the Game currency configuration and retry ${action}.`, account.address);
-    }
-}
 function requireAccount(account, accountAddress, message) {
     return account ?? fail(message, accountAddress);
 }
-async function hashAccountState(account) {
-    const owner = getAddressEncoder().encode(account.owner);
-    const canonical = new Uint8Array(owner.length + account.data.length);
-    canonical.set(owner);
-    canonical.set(account.data, owner.length);
-    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', canonical));
-    return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('');
-}
-async function precondition(account, describes) {
-    return Object.freeze({
-        address: account.address,
-        dataHash: await hashAccountState(account),
-        describes,
-        kind: 'account-state',
-    });
-}
-function absentPrecondition(accountAddress, describes) {
-    return Object.freeze({
-        address: accountAddress,
-        describes,
-        kind: 'account-absent',
-    });
-}
 function findDefinition(configuration, id, game) {
     const definition = configuration.claimStakes.definitions.find((candidate) => candidate.id === id);
     return (definition ??
@@ -297,18 +258,27 @@ function findHub(configuration, id, game) {
     return (hub ??
         fail(`Hub building ${String(id)} is not a member of the configured Game building catalog. Choose an exact current bundled hub id, refresh the Game definitions, and retry.`, game));
 }
-function claimedCount(details, definitionId) {
-    return (details.claimedPlots.find(({ key }) => key === definitionId)?.structures
-        .length ?? 0);
-}
 /** Plans placement of one Claim Stake with its exact bundled hub.
  *
  * The planner validates the configured Game/Profile/Character/System/Body
  * graph, current catalog membership, known plot/cargo/crew availability, and
- * absence of the caller-created Claim Stake account. It returns one inert Plan;
+ * absence of the caller-created Claim Stake account. It also checks the
+ * Character's productive plot count and tier limits, the bundled hub's tags
+ * against the Planet and Claim Stake definition, and that the Character's
+ * ATLAS covers the placement fee plus any initial rent. It returns one inert Plan;
  * permissions, placement races, rent arithmetic, and program capacity remain
  * chain-authoritative.
  *
+ * The new Claim Stake's rent settlement authority must not exist and stays
+ * guarded absent until signing.
+ *
+ * The program funds the new stake to its rent floor, the size it can reach
+ * once Deactivated with a cargo line for each resource it produces, and the
+ * Planet's claimed plot from the Profile vault with the signing key. The Plan
+ * bounds that debit; when it is positive the key must be Profile AUTH or hold
+ * `drainSolVault`, and the Profile needs that many lamports above its rent
+ * reserve. Execution checks again before signing.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -332,21 +302,11 @@ export async function planPlaceClaimStake(ctx, body, player, input) {
     if (canonicalBody !== body.address) {
         fail(`Celestial Body ${body.address} is not the canonical Body ${String(body.id)} for the configured Game. Refresh the Body and retry.`, body.address);
     }
-    if (player.playerProfile.address !== options.authorization.profile) {
-        fail(`Starbase Player ${player.address} does not belong to authorization Profile ${options.authorization.profile}. Refresh the Starbase Player for that Profile and retry.`, player.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (player.character.address !== character) {
-        fail(`Starbase Player ${player.address} does not reference the canonical Character ${character} for authorization Profile ${options.authorization.profile}. Refresh the Starbase Player and retry.`, player.address);
-    }
-    const canonicalPlayer = await deriveStarbasePlayerAddress(player.system.address, character);
-    if (canonicalPlayer !== player.address) {
-        fail(`Starbase Player ${player.address} is not canonical for its Character and System. Refresh the Starbase Player and retry.`, player.address);
-    }
+    const character = await requireProfileStarbasePlayer(player, options.authorization.profile, game);
     if (body.system.address !== player.system.address) {
         fail(`Celestial Body ${body.address} belongs to System ${body.system.address}, but Starbase Player ${player.address} belongs to System ${player.system.address}. Choose both snapshots from the same System and retry.`, body.address);
     }
-    const [freshGame, currentAccounts] = await Promise.all([
+    const [freshGame, currentAccounts, rent] = await Promise.all([
         readFreshGameClaimStakeConfiguration(ctx),
         readContextRawAccounts(ctx, [
             body.address,
@@ -355,13 +315,15 @@ export async function planPlaceClaimStake(ctx, body, player, input) {
             body.system.address,
             options.claimStake,
         ]),
+        requireNewStakeRent(ctx, options.claimStake),
     ]);
     if (freshGame === undefined) {
         fail(`Configured Game ${game} is missing. Refresh the Game catalog and retry placement.`, game);
     }
     const definition = findDefinition(freshGame.data, options.claimStakeDefinitionId, game);
     const hub = findHub(freshGame.data, options.hubBuildingId, game);
-    if (hub.hubValue !== definition.hubValue ||
+    if (hub.hubValue <= 0 ||
+        hub.hubValue !== definition.hubValue ||
         hub.minimumTier !== definition.tier ||
         hub.constructionCost.length !== 0) {
         fail(`Hub building ${hub.id} (${hub.name}) is not the exact zero-cost ${definition.tier} bundled hub for Claim Stake definition ${definition.id} (${definition.name}). Choose the matching bundled hub from the current Game catalog and retry.`, game);
@@ -385,11 +347,10 @@ export async function planPlaceClaimStake(ctx, body, player, input) {
     }
     const currentBodyAccount = requireAccount(bodyAccount, body.address, `Celestial Body ${body.address} is missing. Refresh the Body and retry placement.`);
     const currentPlayerAccount = requireAccount(playerAccount, player.address, `Starbase Player ${player.address} is missing. Refresh it and retry placement.`);
-    const currentCharacterAccount = requireAccount(characterAccount, character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry placement.`);
     const currentSystemAccount = requireAccount(systemAccount, body.system.address, `Star System ${body.system.address} is missing. Refresh the System and retry placement.`);
     const currentBody = celestialBodyAccountDefinition.decode(currentBodyAccount);
     const currentPlayer = starbasePlayerAccountDefinition.decode(currentPlayerAccount);
-    const currentCharacter = characterAccountDefinition.decode(currentCharacterAccount);
+    const { account: currentCharacterAccount, current: currentCharacter } = requireProfileCharacter(characterAccount, character, options.authorization.profile, game, 'placement');
     const currentSystem = starSystemAccountDefinition.decode(currentSystemAccount);
     const canonicalSystem = await deriveStarSystemAddress(game, currentSystem.systemId);
     if (canonicalSystem !== body.system.address ||
@@ -411,10 +372,6 @@ export async function planPlaceClaimStake(ctx, body, player, input) {
         currentPlayer.totalCrew - currentPlayer.busyCrew !== player.availableCrew) {
         fail(`Starbase Player ${player.address} changed or does not match the authorization Profile, canonical Character, System, or available crew. Refresh it and retry.`, player.address);
     }
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry.`, character);
-    }
     const currentCargo = currentPlayer.cargo.amounts.find(({ cargoId }) => cargoId === definition.cargoId)?.amount ?? 0n;
     if (currentCargo !== cargoQuantity || currentCargo < 1n) {
         fail(`Starbase Player ${player.address} Claim Stake cargo changed from the loaded snapshot or is no longer sufficient. Refresh its cargo and retry.`, player.address);
@@ -424,51 +381,100 @@ export async function planPlaceClaimStake(ctx, body, player, input) {
     if (currentMissingTag !== undefined) {
         fail(`Planet ${body.name} (${body.address}) no longer provides required Claim Stake tag ${String(currentMissingTag)} for ${definition.name}. Refresh it and retry.`, body.address);
     }
+    // The bundled hub's tags must come from the Planet and the Claim Stake
+    // definition; the hub cannot satisfy its own requirements.
+    const hubMissingTag = hub.requiredTagIds.find((tag) => !currentDetails.providedTags.includes(tag) &&
+        !definition.providedTagIds.includes(tag));
+    if (hubMissingTag !== undefined) {
+        fail(`Bundled hub ${hub.name} requires tag ${String(hubMissingTag)}, which neither Planet ${body.name} nor ${definition.name} provides. Choose another Planet or definition.`, body.address);
+    }
     const level = LEVEL_INDEX[currentSystem.starbase.level];
     const tier = TIER_INDEX[definition.tier];
-    const plotLimit = currentDetails.claimStakePlots[level][tier];
-    const usedPlots = claimedCount(currentDetails, definition.id);
-    if (usedPlots >= plotLimit) {
-        fail(`Planet ${body.name} (${body.address}) has no available ${definition.name} plot at Starbase ${currentSystem.starbase.level}; ${String(usedPlots)} of ${String(plotLimit)} known plots are occupied. Choose another eligible Planet or tier, refresh it, and retry.`, body.address);
-    }
+    // The program places the stake in the first plot row up to the Starbase's
+    // level with room for its tier; stakes of every tier share each row.
+    if (claimStakePlacementRow(currentDetails.claimStakePlots, currentDetails.claimedPlots, tier, level) === undefined) {
+        fail(`Planet ${body.name} (${body.address}) has no free tier-${definition.tier} Claim Stake plot at Starbase ${currentSystem.starbase.level} or any lower level; every reachable plot row is full. Choose another eligible Planet or tier, refresh it, and retry.`, body.address);
+    }
+    // The Character's research caps the productive plot tier and count.
+    const modifiers = currentCharacter.modifiers.values;
+    if (modifiers.maxProductivePlotTier !== undefined &&
+        tier + 1 > modifiers.maxProductivePlotTier)
+        fail(`Character ${character} may place up to tier ${String(modifiers.maxProductivePlotTier)}, below ${definition.name}'s tier ${definition.tier}. Research a higher plot tier or pick a lower tier.`, character);
+    if (currentCharacter.counts.claimStakes >= modifiers.maxProductivePlots)
+        fail(`Character ${character} already holds ${String(currentCharacter.counts.claimStakes)} of its ${String(modifiers.maxProductivePlots)} productive plots. Research more plots or deconstruct a Claim Stake.`, character);
+    const placementFee = claimStakePlacementFee(currentDetails.baseClaimStakePlacementFee[level][tier].raw, definition.placementFeeMultiplier.raw);
+    const rentDeposit = options.initialRentAmount ?? 0n;
+    if (currentCharacter.atlasRaw < placementFee + rentDeposit)
+        fail(`Character ${character} has ${String(currentCharacter.atlasRaw)} raw ATLAS, below the ${String(placementFee)} raw placement fee plus ${String(rentDeposit)} raw initial rent. Add ATLAS or lower the rent, then retry.`, character);
     const profileFaction = await deriveProfileFactionAddress(options.authorization.profile);
-    const currencyCache = await deriveCurrencyCacheAddress(game);
-    const description = `Place ${definition.name} on Planet ${body.name} (${body.address}) with bundled hub ${hub.name}, ${String(hub.neededCrew)} crew, and ${String(options.initialRentAmount)} raw initial rent.`;
-    return createPlan({
+    const currencyCache = await deriveCurrencyCache(game).then(([address]) => address);
+    const instruction = adaptPlaceClaimStakeInstruction({
+        authorization: options.authorization,
+        celestialBody: body.address,
+        character,
+        claimStakeDefinitionId: definition.id,
+        claimStakeInstance: options.claimStake,
+        currencyCache,
+        game,
+        hubBuildingId: hub.id,
+        initialRentAmount: options.initialRentAmount ?? null,
+        profileFaction,
+        rentAuthority: rent.rentAuthority,
+        systemAndStarbasePlayerStarbasePlayer: player.address,
+        systemAndStarbasePlayerSystem: body.system.address,
+    });
+    // The new stake and the claimed plot are funded from the Profile vault.
+    const storage = await planClaimStakeStorage(ctx, instruction, options.authorization.profile, [freshGame.account, currentBodyAccount, currentSystemAccount], 'Claim Stake placement');
+    const description = `Place ${definition.name} on Planet ${body.name} (${body.address}) with bundled hub ${hub.name}, ${String(hub.neededCrew)} crew, a ${String(placementFee)} raw ATLAS placement fee and ${String(rentDeposit)} raw initial rent. ${storage.disclosure}`;
+    return buildPlannerPlan({
         kind: 'claim-stakes.place',
         preconditions: [
             ...(await Promise.all([
-                precondition(freshGame.account, `The configured Game retains Claim Stake definition ${String(definition.id)} and bundled hub ${String(hub.id)} eligibility.`),
-                precondition(currentBodyAccount, `Planet ${body.name} retains an available ${definition.name} plot and its configured Game/System relationship.`),
-                precondition(currentPlayerAccount, `Starbase Player ${player.address} retains its Profile, Character, System, available crew, and ${cargoName} balance.`),
-                precondition(currentCharacterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} in the configured Game.`),
-                precondition(currentSystemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, and active Starbase level.`),
+                accountStatePrecondition(freshGame.account, `The configured Game retains Claim Stake definition ${String(definition.id)} and bundled hub ${String(hub.id)} eligibility.`),
+                accountStatePrecondition(currentBodyAccount, `Planet ${body.name} retains an available ${definition.name} plot and its configured Game/System relationship.`),
+                accountStatePrecondition(currentPlayerAccount, `Starbase Player ${player.address} retains its Profile, Character, System, available crew, and ${cargoName} balance.`),
+                characterPrecondition(currentCharacterAccount, options.authorization.profile),
+                accountStatePrecondition(currentSystemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, and active Starbase level.`),
             ])),
-            absentPrecondition(options.claimStake, 'The caller-supplied Claim Stake signer address remains unallocated.'),
+            accountAbsentPrecondition(options.claimStake, 'The caller-supplied Claim Stake signer address remains unallocated.'),
+            ...rent.guards,
+            storage.guard,
         ],
         steps: [
             {
                 describes: description,
-                instruction: adaptPlaceClaimStakeInstruction({
-                    authorization: options.authorization,
-                    celestialBody: body.address,
-                    character,
-                    claimStakeDefinitionId: definition.id,
-                    claimStakeInstance: options.claimStake,
-                    currencyCache,
-                    game,
-                    hubBuildingId: hub.id,
-                    initialRentAmount: options.initialRentAmount,
-                    profileFaction,
-                    systemAndStarbasePlayerStarbasePlayer: player.address,
-                    systemAndStarbasePlayerSystem: body.system.address,
-                }),
+                instruction,
                 signers: [options.authorization.authority, options.claimStake],
             },
         ],
         summary: description,
     });
 }
+/** Plans a Claim Stake action's Profile storage funding from the fresh
+ * accounts the planner already read, plus the Profile and Rent sysvar. */
+async function planClaimStakeStorage(ctx, instruction, profile, known, label) {
+    const [profileAccount, rentAccount] = await readContextRawAccounts(ctx, [
+        profile,
+        RENT_ADDRESS,
+    ]);
+    const accounts = new Map([
+        ...known.map((raw) => [raw.address, raw]),
+        [profile, profileAccount],
+        [RENT_ADDRESS, rentAccount],
+    ]);
+    return planStorageFunding({
+        action: readClaimStakeStorageAction(instruction, accounts),
+        accounts,
+        label,
+    });
+}
+/** The ATLAS placement fee: the Planet's U32F32 base fee for the Starbase
+ * level and tier, times the definition's U8F56 multiplier, rounded to the
+ * nearest raw unit with halves rounded up. */
+function claimStakePlacementFee(baseFeeRaw, multiplierRaw) {
+    const product = ((baseFeeRaw << 24n) * multiplierRaw) >> 56n;
+    return (product + (1n << 55n)) >> 56n;
+}
 function quantities(buildings) {
     return new Map(buildings.map(({ buildingId, quantity }) => [buildingId, quantity]));
 }
@@ -481,9 +487,10 @@ function sameQuantities(left, right) {
         [...leftById].every(([buildingId, quantity]) => rightById.get(buildingId) === quantity));
 }
 function sameStakeState(left, right) {
-    if (left.kind === 'deactivated')
-        return false;
     switch (left.kind) {
+        case 'deactivated':
+            return (right.kind === 'deactivated' &&
+                left.deactivatedAtUnixSeconds === right.deactivatedAtUnixSeconds);
         case 'active':
             return right.kind === 'active';
         case 'design':
@@ -492,12 +499,192 @@ function sameStakeState(left, right) {
                 sameQuantities(left.buildings, right.buildings));
     }
 }
-const LEGACY_CONTROLLER_ID = Object.freeze({
-    unaligned: 0,
-    mud: 1,
-    oni: 2,
-    ustur: 3,
-});
+/** Finalization and deconstruction release crew the stake committed, which
+ * only a version-1 instance records; the program refuses a version-0 instance,
+ * whose stored crew is an unverified nominal value. */
+function requireCommittedCrewVersion(current, stake, outcome) {
+    if (current.version !== 1) {
+        fail(`Claim Stake ${stake.address} is a version ${String(current.version)} instance, which records no committed crew, so it cannot be ${outcome}. Only version-1 Claim Stakes support this action; choose another Claim Stake.`, stake.address);
+    }
+}
+// Common facts for planners acting on an owned, placed Claim Stake. Each
+// planner keeps its own eligibility checks and Plan wording at its call site;
+// `action` completes the shared remedies ("retry <action>").
+/** Requires the loaded Claim Stake to belong to the configured Game and to the
+ * authorization Profile, and returns that Profile's canonical Character. */
+async function requireOwnedStake(stake, game, profile) {
+    if (stake.game !== game) {
+        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
+    }
+    if (stake.ownerProfile.address !== profile) {
+        fail(`Claim Stake ${stake.address} belongs to Profile ${stake.ownerProfile.address}, not authorization Profile ${profile}. Choose a Claim Stake this Profile owns, refresh it, and retry.`, stake.address);
+    }
+    return findCharacterPda(profile, game);
+}
+/** Reads and decodes the fresh Claim Stake and Body, with `extra` accounts in
+ * the same batch. */
+async function readOwnedStake(ctx, stake, action, extra = []) {
+    const [stakeCandidate, bodyCandidate, ...extraAccounts] = await readContextRawAccounts(ctx, [
+        stake.address,
+        stake.body.address,
+        ...extra,
+    ]);
+    const stakeAccount = requireAccount(stakeCandidate, stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry ${action}.`);
+    const bodyAccount = requireAccount(bodyCandidate, stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry ${action}.`);
+    return {
+        bodyAccount,
+        currentBody: celestialBodyAccountDefinition.decode(bodyAccount),
+        currentStake: claimStakeAccountDefinition.decode(stakeAccount),
+        extraAccounts,
+        stakeAccount,
+    };
+}
+/** Whether the fresh Claim Stake keeps the loaded ownership, Body,
+ * definitions, buildings and System generation. */
+function sameOwnedStake(current, stake, game, profile) {
+    return (current.game === game &&
+        current.body === stake.body.address &&
+        current.ownerProfile === profile &&
+        current.claimStakeDefinitionId === stake.claimStakeDefinitionId &&
+        current.claimStakeDefinitionSeqId === stake.claimStakeDefinitionSeqId &&
+        current.buildingDefinitionSeqId === stake.buildingDefinitionSeqId &&
+        current.systemSeqId === stake.systemSeqId &&
+        sameQuantities(current.buildings, stake.buildings));
+}
+/** Whether the fresh Claim Stake keeps the loaded transfer facts: ownership,
+ * Body, active state, System generation, resources and capacity. */
+function sameTransferStake(current, stake, game, profile) {
+    return (current.game === game &&
+        current.ownerProfile === profile &&
+        current.body === stake.body.address &&
+        current.systemSeqId === stake.systemSeqId &&
+        current.state.kind === 'active' &&
+        current.production.cargoPod.storageCost ===
+            stake.resources.capacity.usedRaw &&
+        current.production.resourceCapacityRaw ===
+            stake.resources.capacity.totalRaw &&
+        sameCargoAmounts(current.production.cargoPod.amounts, stake.resources.inventory.items.map(({ id, quantityRaw }) => ({
+            amount: quantityRaw,
+            id,
+        }))));
+}
+/** Whether the fresh Fleet keeps the loaded Game, owner, name, cargo and
+ * capacities. */
+function sameTransferFleet(current, fleet, game, profile) {
+    return (current.game === game &&
+        current.ownerProfile === profile &&
+        current.name === fleet.name &&
+        current.ammoBank.cargoId === fleet.ammo.id &&
+        current.ammoBank.amount === fleet.ammo.amount &&
+        current.fuelTank.cargoId === fleet.fuel.id &&
+        current.fuelTank.amount === fleet.fuel.amount &&
+        current.cargoHold.storageCost === fleet.cargoHold.storageCost &&
+        sameCargoAmounts(current.cargoHold.amounts, fleet.cargoHold.items) &&
+        current.stats.cargo.ammoCapacity === fleet.capacities.ammo.total &&
+        current.stats.cargo.fuelCapacity === fleet.capacities.fuel.total &&
+        current.stats.cargo.cargoCapacity === fleet.capacities.cargo.total);
+}
+/** Requires the fresh Body to be the Claim Stake's canonical Planet in the
+ * configured Game at the Claim Stake's System generation. */
+async function requireStakePlanet(currentBody, stake, game, action) {
+    if (currentBody.kind !== 'planet' ||
+        currentBody.game !== game ||
+        currentBody.systemSequenceId !== stake.systemSeqId ||
+        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
+            stake.body.address) {
+        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying ${action}.`, stake.body.address);
+    }
+    return currentBody;
+}
+/** Refuses a building change the game would refuse for the stake's Planet
+ * registration, which is independent of its rent. */
+function requireStakeRegistered(claimedPlots, stake, starbaseLevel, action) {
+    const registration = deriveClaimStakeRegistration(stake, claimedPlots, starbaseLevel);
+    if (registration.kind === 'operable')
+        return;
+    fail(registration.kind === 'unregistered'
+        ? `Planet ${stake.body.address} does not register Claim Stake ${stake.address}. Refresh the Body and Claim Stake before retrying ${action}.`
+        : registration.kind === 'off-level'
+            ? `Claim Stake ${stake.address} is registered in plot row ${String(registration.plotRow)}, above the Starbase's current ${starbaseLevel}, so it is evicted and ${action} is refused. Respawn it to reclaim it.`
+            : `A Starbase takeover, destruction or downgrade evicted Claim Stake ${stake.address}, so ${action} is refused. Respawn it to reclaim it.`, stake.address);
+}
+/** {@link requireStakePlanet} for building changes. An eviction is reported
+ * first: a takeover or destruction also advances the System generation, which
+ * would otherwise hide the real cause behind a refresh remedy. */
+async function requireDesignStakePlanet(currentBody, stake, game, action) {
+    if (currentBody.kind === 'planet')
+        requireStakeRegistered(currentBody.details.claimedPlots, stake, 'css', action);
+    return requireStakePlanet(currentBody, stake, game, action);
+}
+/** Requires and decodes the canonical Character of the authorization Profile in
+ * the configured Game. */
+function requireProfileCharacter(candidate, character, profile, game, action) {
+    const account = requireAccount(candidate, character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry ${action}.`);
+    const current = characterAccountDefinition.decode(account);
+    if (current.playerProfile !== profile || current.game !== game) {
+        fail(`Character ${character} does not match authorization Profile ${profile} and configured Game ${game}. Refresh the Character and retry ${action}.`, character);
+    }
+    return { account, current };
+}
+/** Reads the Claim Stake's System and the authorization Profile's canonical
+ * Starbase Player there, with `extra` accounts in the same batch. Requires a
+ * canonical, current System with an active Starbase that lists the Body, and a
+ * Starbase Player of the Profile, Character and System. */
+async function readStakeStarbase(ctx, stake, game, system, character, profile, action, extra = []) {
+    const player = await deriveStarbasePlayerAddress(system, character);
+    const [systemCandidate, playerCandidate, ...extraAccounts] = await readContextRawAccounts(ctx, [system, player, ...extra]);
+    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry ${action}.`);
+    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${profile}. Register or refresh it in the Claim Stake's System before retrying ${action}.`);
+    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
+    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
+    if (currentSystem.game !== game ||
+        currentSystem.sequenceId !== stake.systemSeqId ||
+        currentSystem.starbase === undefined ||
+        !currentSystem.celestialBodyAddresses.includes(stake.body.address) ||
+        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
+        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, active nested Starbase, or Claim Stake Body relationship. Refresh the System and retry ${action}.`, system);
+    }
+    if (currentPlayer.playerProfile !== profile ||
+        currentPlayer.character !== character ||
+        currentPlayer.system !== system) {
+        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry ${action}.`, player);
+    }
+    return {
+        currentPlayer,
+        currentSystem,
+        extraAccounts,
+        player,
+        playerAccount,
+        starbase: currentSystem.starbase,
+        systemAccount,
+    };
+}
+async function claimStakeCurrencyCache(game) {
+    const [currencyCache] = await deriveCurrencyCache(game);
+    return currencyCache;
+}
+/** Requires the canonical CurrencyCache and returns its Plan guard. */
+async function requireCurrencyCache(candidate, currencyCache, game, action, planName) {
+    await validateCurrencyCache(requireAccount(candidate, currencyCache, `Canonical CurrencyCache ${currencyCache} is missing for configured Game ${game}. Refresh the Game currency configuration and retry ${action}.`), game, planName);
+    return {
+        kind: 'currency-cache',
+        address: currencyCache,
+        game,
+        describes: 'The canonical CurrencyCache remains assigned to the configured Game; shared accounting may change.',
+    };
+}
+function planetPrecondition(account, system) {
+    return accountStatePrecondition(account, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`);
+}
+function characterPrecondition(account, profile) {
+    return accountStatePrecondition(account, `The canonical Character remains assigned to Profile ${profile} in the configured Game.`);
+}
+function systemPrecondition(account, name) {
+    return accountStatePrecondition(account, `Star System ${name} retains its configured Game, sequence, nested Starbase, and Claim Stake Body relationship.`);
+}
+function playerPrecondition(account, player, facts = 'Profile, Character, and System') {
+    return accountStatePrecondition(account, `Starbase Player ${player} retains its ${facts}.`);
+}
 function buildingDescription(change, name) {
     return `${change.kind} ${String(change.quantity)} ${name}`;
 }
@@ -505,9 +692,26 @@ function buildingDescription(change, name) {
  *
  * The planner verifies the fresh Claim Stake, definition sequences, canonical
  * Profile/Character/Body/System/Starbase Player graph, optional
- * FactionOwnership sidecar, building quantities, slots, crew, and known
- * construction cargo. Rent synchronization and the final concurrent sequence
- * race remain chain-authoritative.
+ * FactionOwnership sidecar, building quantities, slots, Starbase Player crew,
+ * non-negative power, a single unremovable hub of quantity one, building tags
+ * provided by the Claim Stake definition, the Planet and the buildings, and
+ * known construction cargo. A stake whose stored construction time is still
+ * running is refused; that time advances only on a production tick. Construction cargo is debited from the Starbase Player's
+ * Starbase cargo at finalization, never from the Claim Stake's own storage, so
+ * the planner checks the fresh Starbase Player pod. Rent synchronization and
+ * the final concurrent sequence race remain chain-authoritative.
+ *
+ * Entering a design adds the design state and an entry for each building id
+ * the design does not yet hold. The program funds that growth, up to the
+ * stake's rent floor, from the Profile vault with the signing key; the Plan
+ * bounds the debit with the same key and balance checks as placement.
+ *
+ * Requires Game 2 and its existing canonical Claim Stake XP ledger.
+ * Missing XP state must be repaired outside this Plan; no accounts are created.
+ *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history.
  *
  * @example
  * ```ts
@@ -521,88 +725,46 @@ function buildingDescription(change, name) {
 export async function planClaimStakeBuildingChanges(ctx, stake, input) {
     const options = validateBuildingChangeOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
     if (stake.state.kind === 'deactivated') {
         fail(`Claim Stake ${stake.address} is deactivated; building changes require an active or design Claim Stake. Refresh it or choose another owned Claim Stake before retrying.`, stake.address);
     }
-    if (stake.game !== game) {
-        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned Claim Stake, refresh it, and retry.`, stake.address);
-    }
-    const [freshGame, firstAccounts] = await Promise.all([
+    const character = await requireOwnedStake(stake, game, profile);
+    const action = 'building changes';
+    const [freshGame, loaded, rent] = await Promise.all([
         readFreshGameClaimStakeConfiguration(ctx),
-        readContextRawAccounts(ctx, [stake.address, stake.body.address, character]),
+        readOwnedStake(ctx, stake, action, [character]),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
     if (freshGame === undefined) {
         fail(`Configured Game ${game} is missing. Refresh the Game catalog and retry building changes.`, game);
     }
-    const stakeAccount = requireAccount(firstAccounts[0], stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry building changes.`);
-    const bodyAccount = requireAccount(firstAccounts[1], stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry building changes.`);
-    const characterAccount = requireAccount(firstAccounts[2], character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry building changes.`);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = celestialBodyAccountDefinition.decode(bodyAccount);
-    const currentCharacter = characterAccountDefinition.decode(characterAccount);
-    if (currentStake.game !== game ||
-        currentStake.body !== stake.body.address ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.claimStakeDefinitionId !== stake.claimStakeDefinitionId ||
-        currentStake.claimStakeDefinitionSeqId !==
-            stake.claimStakeDefinitionSeqId ||
-        currentStake.buildingDefinitionSeqId !== stake.buildingDefinitionSeqId ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
-        !sameQuantities(currentStake.buildings, stake.buildings) ||
+    const { bodyAccount, currentStake, stakeAccount } = loaded;
+    if (!sameOwnedStake(currentStake, stake, game, profile) ||
         currentStake.neededCrew !== stake.neededCrew) {
         fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, crew, or System generation. Refresh it and retry building changes.`, stake.address);
     }
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry building changes.`, character);
+    if (currentStake.constructionRemainingSeconds > 0n) {
+        fail(`Claim Stake ${stake.address} records ${String(currentStake.constructionRemainingSeconds)} seconds of construction remaining, and a stake under construction cannot change its buildings. The stored time advances only when a production tick processes the stake: wait for construction to finish, let a production tick record it, refresh the Claim Stake, and retry.`, stake.address);
     }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying.`, stake.body.address);
-    }
-    const system = currentBody.system;
-    const [player, ownership, profileFaction] = await Promise.all([
-        deriveStarbasePlayerAddress(system, character),
+    const planetBody = await requireDesignStakePlanet(loaded.currentBody, stake, game, action);
+    const { system } = planetBody;
+    const { account: characterAccount } = requireProfileCharacter(loaded.extraAccounts[0], character, profile, game, action);
+    const [ownership, profileFaction] = await Promise.all([
         deriveFactionOwnershipAddress(game, 'starbase', system),
-        deriveProfileFactionAddress(options.authorization.profile),
+        deriveProfileFactionAddress(profile),
     ]);
-    const [systemAccountCandidate, playerAccountCandidate, ownershipAccount, profileFactionAccountCandidate,] = await readContextRawAccounts(ctx, [
-        system,
-        player,
-        ownership,
-        profileFaction,
-    ]);
-    const systemAccount = requireAccount(systemAccountCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry building changes.`);
-    const playerAccount = requireAccount(playerAccountCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake's System before retrying.`);
-    const profileFactionAccount = requireAccount(profileFactionAccountCandidate, profileFaction, `ProfileFaction ${profileFaction} is missing for authorization Profile ${options.authorization.profile}. Choose or repair the Profile faction, refresh it, and retry building changes.`);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
+    const { currentPlayer, currentSystem, extraAccounts: [ownershipAccount, profileFactionCandidate], player, playerAccount, starbase, systemAccount, } = await readStakeStarbase(ctx, stake, game, system, character, profile, action, [ownership, profileFaction]);
+    requireStakeRegistered(planetBody.details.claimedPlots, stake, starbase.level, action);
+    const profileFactionAccount = requireAccount(profileFactionCandidate, profileFaction, `ProfileFaction ${profileFaction} is missing for authorization Profile ${profile}. Choose or repair the Profile faction, refresh it, and retry building changes.`);
     const currentProfileFaction = profileFactionIdentityAccountDefinition.decode(profileFactionAccount);
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, or an active nested Starbase. Refresh the System and retry building changes.`, system);
+    if (currentProfileFaction.profile !== profile) {
+        fail(`ProfileFaction ${profileFaction} does not match authorization Profile ${profile}. Refresh or repair the Profile faction before retrying building changes.`, profileFaction);
     }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry building changes.`, player);
-    }
-    if (currentProfileFaction.profile !== options.authorization.profile) {
-        fail(`ProfileFaction ${profileFaction} does not match authorization Profile ${options.authorization.profile}. Refresh or repair the Profile faction before retrying building changes.`, profileFaction);
-    }
-    let controllerFactionId = LEGACY_CONTROLLER_ID[currentSystem.starbase.owner];
+    let controllerFactionId = factionValue(starbase.owner);
     let ownershipPrecondition;
     if (ownershipAccount === undefined) {
-        ownershipPrecondition = absentPrecondition(ownership, `The canonical Starbase FactionOwnership ${ownership} remains unallocated so the chain applies its legacy controller gate.`);
+        ownershipPrecondition = accountAbsentPrecondition(ownership, `The canonical Starbase FactionOwnership ${ownership} remains unallocated so the chain applies its legacy controller gate.`);
     }
     else {
         const currentOwnership = factionOwnershipAccountDefinition.decode(ownershipAccount);
@@ -614,7 +776,7 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
         }
         controllerFactionId =
             currentOwnership.controllingFactionId ?? controllerFactionId;
-        ownershipPrecondition = await precondition(ownershipAccount, `The Starbase FactionOwnership remains assigned to System ${system} at its current generation.`);
+        ownershipPrecondition = await accountStatePrecondition(ownershipAccount, `The Starbase FactionOwnership remains assigned to System ${system} at its current generation.`);
     }
     if (currentProfileFaction.factionId !== controllerFactionId) {
         fail(`ProfileFaction ${profileFaction} faction ${String(currentProfileFaction.factionId)} does not match the current Starbase controller faction ${String(controllerFactionId)}. Use a Profile aligned with the current controller, refresh the faction relationship, and retry building changes.`, profileFaction);
@@ -647,6 +809,9 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
         if (definition === undefined) {
             fail(`Building ${String(change.buildingId)} has no definition in the current Game catalog. Refresh the definitions and choose a valid building before retrying.`, game);
         }
+        if (change.kind === 'remove' && definition.hubValue > 0) {
+            fail(`Building ${definition.name} is Claim Stake ${stake.address}'s bundled hub and cannot be removed. Remove other buildings, or deconstruct the whole Claim Stake, instead.`, stake.address);
+        }
         const current = result.get(change.buildingId) ?? 0;
         const next = change.kind === 'add'
             ? current + change.quantity
@@ -664,10 +829,15 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
         descriptions.push(buildingDescription(change, definition.name));
     }
     let usedSlots = 0;
-    let crewSlots = 0;
     let neededCrew = 0;
+    let power = 0;
+    let hubs = 0;
     let resourceStorageRaw = 0n;
-    const providedTags = new Set(claimDefinition.providedTagIds);
+    // Tags come from the Claim Stake definition, the Planet and every building.
+    const providedTags = new Set([
+        ...claimDefinition.providedTagIds,
+        ...planetBody.details.providedTags,
+    ]);
     for (const [buildingId, quantity] of result) {
         const definition = definitions.get(buildingId);
         if (definition === undefined) {
@@ -680,9 +850,15 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
             definition.hubValue !== claimDefinition.hubValue) {
             fail(`Hub building ${definition.name} does not match Claim Stake ${claimDefinition.name}'s hub value. Choose the matching hub before retrying.`, stake.address);
         }
+        if (definition.hubValue > 0) {
+            hubs += 1;
+            if (quantity !== 1) {
+                fail(`The resulting Claim Stake design has ${String(quantity)} of hub building ${definition.name}; a Claim Stake holds exactly one hub. Remove the extra hub before retrying.`, stake.address);
+            }
+        }
         usedSlots += definition.slots * quantity;
-        crewSlots += definition.crewSlots * quantity;
         neededCrew += definition.neededCrew * quantity;
+        power += definition.power * quantity;
         resourceStorageRaw += definition.resourceStorageRaw * BigInt(quantity);
         if (neededCrew > U16_MAX) {
             fail(`The resulting Claim Stake design has ${String(neededCrew)} needed crew, exceeding the ${String(U16_MAX)} maximum representable by its unsigned u16 needed-crew field. Remove crew-requiring buildings and retry.`, stake.address);
@@ -695,8 +871,11 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
     if (usedSlots > claimDefinition.slots) {
         fail(`Building changes require ${String(usedSlots)} slots, exceeding Claim Stake ${claimDefinition.name}'s ${String(claimDefinition.slots)} slot capacity. Remove buildings and retry.`, stake.address);
     }
-    if (neededCrew > crewSlots) {
-        fail(`Building changes require ${String(neededCrew)} crew, exceeding the resulting ${String(crewSlots)} crew capacity. Add crew-slot capacity or remove crew-requiring buildings before retrying.`, stake.address);
+    if (hubs > 1) {
+        fail(`The resulting Claim Stake design has ${String(hubs)} hub buildings; a Claim Stake holds exactly one hub. Remove the extra hubs before retrying.`, stake.address);
+    }
+    if (power < 0) {
+        fail(`The resulting Claim Stake design uses ${String(-power)} more power than its buildings generate. Add power-generating buildings or remove power consumers before retrying.`, stake.address);
     }
     for (const [buildingId] of result) {
         const definition = definitions.get(buildingId);
@@ -714,10 +893,7 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
     if (addedCrew > availableCrew) {
         fail(`Building additions require ${String(addedCrew)} crew, but Starbase Player ${player} has only ${String(availableCrew)} known crew capacity available. Free crew, refresh the Starbase Player, and retry.`, player);
     }
-    const cargo = new Map(currentStake.production.cargoPod.amounts.map(({ cargoId, amount }) => [
-        cargoId,
-        amount,
-    ]));
+    const cargo = new Map(currentPlayer.cargo.amounts.map(({ cargoId, amount }) => [cargoId, amount]));
     const constructionCosts = new Map();
     for (const change of options.buildingChanges) {
         if (change.kind !== 'add')
@@ -732,7 +908,7 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
         const available = cargo.get(cargoId) ?? 0n;
         if (required > available) {
             const snapshotItem = stake.resources.inventory.items.find(({ id }) => id === cargoId);
-            fail(`Building construction requires ${String(required)} raw ${snapshotItem?.name ?? `cargo ${String(cargoId)}`}, but Claim Stake ${stake.address} has only ${String(available)} known. Add construction cargo, refresh the Claim Stake, and retry.`, stake.address);
+            fail(`Building construction requires ${String(required)} raw ${snapshotItem?.name ?? `cargo ${String(cargoId)}`}, but Starbase Player ${player} has only ${String(available)} known in Starbase cargo. Construction cargo is taken from the Starbase, not from the Claim Stake. Deposit it at the Starbase, refresh the Starbase Player, and retry.`, player);
         }
     }
     if (currentStake.production.resourceCapacityRaw !==
@@ -744,38 +920,47 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
     if (currentStake.production.cargoPod.storageCost > resourceStorageRaw) {
         fail(`The resulting Claim Stake design provides ${String(resourceStorageRaw)} raw storage capacity, below the fresh known cargo usage of ${String(currentStake.production.cargoPod.storageCost)}. Keep enough storage buildings, remove cargo, refresh the Claim Stake, and retry building changes.`, stake.address);
     }
-    const currencyCache = await deriveCurrencyCacheAddress(game);
-    const description = `Change buildings on Claim Stake ${stake.address}: ${descriptions.join('; ')}.`;
-    return createPlan({
+    const currencyCache = await claimStakeCurrencyCache(game);
+    const xp = await resolveClaimStakeXp(ctx, game, stake.address);
+    const instruction = adaptClaimStakeBuildingChangesInstruction({
+        ...xp.accounts,
+        authorization: options.authorization,
+        buildingChanges: options.buildingChanges.map(({ buildingId, kind, quantity }) => [buildingId, kind === 'add' ? quantity : -quantity]),
+        celestialBody: stake.body.address,
+        claimStakeInstance: stake.address,
+        currencyCache,
+        factionOwnership: ownership,
+        game,
+        profileFaction,
+        ...rent.accounts,
+        sequenceId,
+        starbasePlayer: player,
+        system,
+    });
+    // The grown design is funded from the Profile vault.
+    const storage = await planClaimStakeStorage(ctx, instruction, profile, [stakeAccount], 'Claim Stake building changes');
+    const description = `Change buildings on Claim Stake ${stake.address}: ${descriptions.join('; ')}. ${storage.disclosure}`;
+    return buildPlannerPlan({
         kind: 'claim-stakes.building-changes',
         preconditions: [
             ...(await Promise.all([
-                precondition(freshGame.account, 'The configured Game retains the exact Claim Stake and building definitions.'),
-                precondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, buildings, cargo, crew, and Body relationship.`),
-                precondition(bodyAccount, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`),
-                precondition(characterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} in the configured Game.`),
-                precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, and nested Starbase.`),
-                precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, System, and available crew.`),
-                precondition(profileFactionAccount, `ProfileFaction ${profileFaction} remains assigned to Profile ${options.authorization.profile} and aligned with the current Starbase controller.`),
+                accountStatePrecondition(freshGame.account, 'The configured Game retains the exact Claim Stake and building definitions.'),
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, buildings, cargo, crew, and Body relationship.`),
+                planetPrecondition(bodyAccount, system),
+                characterPrecondition(characterAccount, profile),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player, 'Profile, Character, System, and available crew'),
+                accountStatePrecondition(profileFactionAccount, `ProfileFaction ${profileFaction} remains assigned to Profile ${profile} and aligned with the current Starbase controller.`),
             ])),
             ownershipPrecondition,
+            xp.guard,
+            ...rent.guards,
+            storage.guard,
         ],
         steps: [
             {
                 describes: description,
-                instruction: adaptClaimStakeBuildingChangesInstruction({
-                    authorization: options.authorization,
-                    buildingChanges: options.buildingChanges.map(({ buildingId, kind, quantity }) => [buildingId, kind === 'add' ? quantity : -quantity]),
-                    celestialBody: stake.body.address,
-                    claimStakeInstance: stake.address,
-                    currencyCache,
-                    factionOwnership: ownership,
-                    game,
-                    profileFaction,
-                    sequenceId,
-                    starbasePlayer: player,
-                    system,
-                }),
+                instruction,
                 signers: [options.authorization.authority],
             },
         ],
@@ -789,6 +974,20 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
  * CurrencyCache, and a known positive rent balance. Rent timing and the final
  * crew/building validation remain chain-authoritative.
  *
+ * Finalization can draw Profile storage this Plan does not bound: a removed
+ * building's refund can open a Starbase Player cargo line, and a final layout
+ * that produces a new resource raises the stake's rent floor. The program
+ * funds both from the Profile vault with the signing key, so simulate before
+ * signing.
+ *
+ * Requires Game 2 and its existing canonical Claim Stake XP ledger.
+ * The Character XP budget and configuration must also be reconciled.
+ * Missing XP state must be repaired outside this Plan; no accounts are created.
+ *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -804,22 +1003,19 @@ export async function planClaimStakeBuildingChanges(ctx, stake, input) {
 export async function planFinalizeClaimStakeBuildingChanges(ctx, stake, input) {
     const options = validateFinalizeBuildingChangeOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
     if (stake.state.kind !== 'design') {
         fail(`Claim Stake ${stake.address} is not in design state. Refresh it and finalize only a pending building design.`, stake.address);
     }
-    if (stake.game !== game) {
-        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned Claim Stake, refresh it, and retry.`, stake.address);
-    }
+    const character = await requireOwnedStake(stake, game, profile);
     if (stake.rentBalanceRaw <= 0n) {
         fail(`Claim Stake ${stake.address} has a known delinquent rent balance of ${String(stake.rentBalanceRaw)} raw units. Top up rent, refresh the Claim Stake, and retry finalization.`, stake.address);
     }
-    const [freshGame, firstAccounts] = await Promise.all([
+    const action = 'finalization';
+    const [freshGame, loaded, rent] = await Promise.all([
         readFreshGameClaimStakeConfiguration(ctx),
-        readContextRawAccounts(ctx, [stake.address, stake.body.address, character]),
+        readOwnedStake(ctx, stake, action, [character]),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
     if (freshGame === undefined) {
         fail(`Configured Game ${game} is missing. Refresh the Game catalog and retry finalization.`, game);
@@ -828,81 +1024,51 @@ export async function planFinalizeClaimStakeBuildingChanges(ctx, stake, input) {
         freshGame.data.buildings.sequenceId !== stake.buildingDefinitionSeqId) {
         fail(`Claim Stake ${stake.address} definition sequence is stale against the current Game catalog. Refresh the Claim Stake and definitions to rule out stale local data. If the on-chain generation still differs, use a Claim Stake matching the current catalog before retrying finalization.`, stake.address);
     }
-    const stakeAccount = requireAccount(firstAccounts[0], stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry finalization.`);
-    const bodyAccount = requireAccount(firstAccounts[1], stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry finalization.`);
-    const characterAccount = requireAccount(firstAccounts[2], character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry finalization.`);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = celestialBodyAccountDefinition.decode(bodyAccount);
-    const currentCharacter = characterAccountDefinition.decode(characterAccount);
-    if (currentStake.game !== game ||
-        currentStake.body !== stake.body.address ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.claimStakeDefinitionId !== stake.claimStakeDefinitionId ||
-        currentStake.claimStakeDefinitionSeqId !==
-            stake.claimStakeDefinitionSeqId ||
-        currentStake.buildingDefinitionSeqId !== stake.buildingDefinitionSeqId ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
+    const { bodyAccount, currentStake, stakeAccount } = loaded;
+    if (!sameOwnedStake(currentStake, stake, game, profile) ||
         currentStake.rentBalanceRaw !== stake.rentBalanceRaw ||
-        !sameQuantities(currentStake.buildings, stake.buildings) ||
         currentStake.state.kind !== 'design' ||
         currentStake.state.sequenceId !== stake.state.sequenceId ||
         !sameQuantities(currentStake.state.buildings, stake.state.buildings)) {
         fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, design sequence, rent, or System generation. Refresh it and retry finalization.`, stake.address);
     }
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry finalization.`, character);
-    }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying finalization.`, stake.body.address);
-    }
-    const system = currentBody.system;
-    const player = await deriveStarbasePlayerAddress(system, character);
-    const currencyCache = await deriveCurrencyCacheAddress(game);
-    const [systemCandidate, playerCandidate, currencyCandidate] = await readContextRawAccounts(ctx, [system, player, currencyCache]);
-    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry finalization.`);
-    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake's System before retrying finalization.`);
-    const currencyAccount = requireAccount(currencyCandidate, currencyCache, `Canonical CurrencyCache ${currencyCache} is missing for configured Game ${game}. Refresh the Game currency configuration and retry finalization.`);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, or an active nested Starbase. Refresh the System and retry finalization.`, system);
-    }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry finalization.`, player);
-    }
-    validateCurrencyCache(currencyAccount, game, currencyCache, 'finalization');
-    const description = `Finalize building changes on Claim Stake ${stake.address}.`;
-    return createPlan({
+    requireCommittedCrewVersion(currentStake, stake, 'finalized');
+    const planet = await requireDesignStakePlanet(loaded.currentBody, stake, game, action);
+    const { system } = planet;
+    const { account: characterAccount } = requireProfileCharacter(loaded.extraAccounts[0], character, profile, game, action);
+    const currencyCache = await claimStakeCurrencyCache(game);
+    const { currentSystem, extraAccounts: [currencyCandidate], player, playerAccount, starbase, systemAccount, } = await readStakeStarbase(ctx, stake, game, system, character, profile, action, [currencyCache]);
+    requireStakeRegistered(planet.details.claimedPlots, stake, starbase.level, action);
+    const currencyGuard = await requireCurrencyCache(currencyCandidate, currencyCache, game, action, 'Claim Stake finalization');
+    const description = `Finalize building changes on Claim Stake ${stake.address}. A building refund that opens a Starbase Player cargo line, or a new resource that raises the stake's rent floor, is funded from the Profile vault with the signing key, which this Plan does not bound; simulate before signing.`;
+    const xp = await resolveClaimStakeXp(ctx, game, stake.address, character);
+    return buildPlannerPlan({
         kind: 'claim-stakes.finalize-building-changes',
-        preconditions: await Promise.all([
-            precondition(freshGame.account, 'The configured Game remains current.'),
-            precondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, rent balance, Body, and System generation.`),
-            precondition(characterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} in the configured Game.`),
-            precondition(bodyAccount, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`),
-            precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, and nested Starbase.`),
-            precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, and System.`),
-            precondition(currencyAccount, 'The canonical CurrencyCache remains assigned to the configured Game.'),
-        ]),
+        preconditions: [
+            xp.guard,
+            ...(await Promise.all([
+                accountStatePrecondition(freshGame.account, 'The configured Game remains current.'),
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, rent balance, Body, and System generation.`),
+                characterPrecondition(characterAccount, profile),
+                planetPrecondition(bodyAccount, system),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player),
+            ])),
+            currencyGuard,
+            ...rent.guards,
+        ],
         steps: [
             {
                 describes: description,
                 instruction: adaptFinalizeClaimStakeBuildingChangesInstruction({
+                    ...xp.accounts,
                     authorization: options.authorization,
                     celestialBody: stake.body.address,
                     character,
                     claimStakeInstance: stake.address,
                     currencyCache,
                     game,
+                    ...rent.accounts,
                     systemAndStarbasePlayerStarbasePlayer: player,
                     systemAndStarbasePlayerSystem: system,
                 }),
@@ -920,6 +1086,13 @@ export async function planFinalizeClaimStakeBuildingChanges(ctx, stake, input) {
  * state; rent arithmetic and concurrent state transitions remain
  * chain-authoritative.
  *
+ * Requires Game 2 and its existing canonical Claim Stake XP ledger.
+ * Missing XP state must be repaired outside this Plan; no accounts are created.
+ *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -934,85 +1107,54 @@ export async function planFinalizeClaimStakeBuildingChanges(ctx, stake, input) {
 export async function planCancelClaimStakeBuildingChanges(ctx, stake, input) {
     const options = validateCancelBuildingChangeOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
     if (stake.state.kind !== 'design') {
         fail(`Claim Stake ${stake.address} is not in design state. Refresh it and cancel only a pending building design.`, stake.address);
     }
-    if (stake.game !== game) {
-        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned Claim Stake, refresh it, and retry.`, stake.address);
-    }
-    const firstAccounts = await readContextRawAccounts(ctx, [
-        stake.address,
-        stake.body.address,
+    const character = await requireOwnedStake(stake, game, profile);
+    const action = 'cancellation';
+    const [{ bodyAccount, currentBody, currentStake, stakeAccount }, rent] = await Promise.all([
+        readOwnedStake(ctx, stake, action),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
-    const stakeAccount = requireAccount(firstAccounts[0], stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry cancellation.`);
-    const bodyAccount = requireAccount(firstAccounts[1], stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry cancellation.`);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = celestialBodyAccountDefinition.decode(bodyAccount);
-    if (currentStake.game !== game ||
-        currentStake.body !== stake.body.address ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.claimStakeDefinitionId !== stake.claimStakeDefinitionId ||
-        currentStake.claimStakeDefinitionSeqId !==
-            stake.claimStakeDefinitionSeqId ||
-        currentStake.buildingDefinitionSeqId !== stake.buildingDefinitionSeqId ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
-        !sameQuantities(currentStake.buildings, stake.buildings) ||
+    if (!sameOwnedStake(currentStake, stake, game, profile) ||
         currentStake.state.kind !== 'design' ||
         currentStake.state.sequenceId !== stake.state.sequenceId ||
         !sameQuantities(currentStake.state.buildings, stake.state.buildings)) {
         fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, design sequence, or System generation. Refresh it and retry cancellation.`, stake.address);
     }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying cancellation.`, stake.body.address);
-    }
-    const system = currentBody.system;
-    const player = await deriveStarbasePlayerAddress(system, character);
-    const currencyCache = await deriveCurrencyCacheAddress(game);
-    const [systemCandidate, playerCandidate, currencyCandidate] = await readContextRawAccounts(ctx, [system, player, currencyCache]);
-    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry cancellation.`);
-    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake's System before retrying cancellation.`);
-    const currencyAccount = requireAccount(currencyCandidate, currencyCache, `Canonical CurrencyCache ${currencyCache} is missing for configured Game ${game}. Refresh the Game currency configuration and retry cancellation.`);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, or an active nested Starbase. Refresh the System and retry cancellation.`, system);
-    }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry cancellation.`, player);
-    }
-    validateCurrencyCache(currencyAccount, game, currencyCache, 'cancellation');
+    const planet = await requireDesignStakePlanet(currentBody, stake, game, action);
+    const { system } = planet;
+    const currencyCache = await claimStakeCurrencyCache(game);
+    const { currentSystem, extraAccounts: [currencyCandidate], player, playerAccount, starbase, systemAccount, } = await readStakeStarbase(ctx, stake, game, system, character, profile, action, [currencyCache]);
+    requireStakeRegistered(planet.details.claimedPlots, stake, starbase.level, action);
+    const currencyGuard = await requireCurrencyCache(currencyCandidate, currencyCache, game, action, 'Claim Stake cancellation');
     const description = `Cancel the pending building design on Claim Stake ${stake.address} and return it to active state.`;
-    return createPlan({
+    const xp = await resolveClaimStakeXp(ctx, game, stake.address);
+    return buildPlannerPlan({
         kind: 'claim-stakes.cancel-building-changes',
-        preconditions: await Promise.all([
-            precondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, buildings, Body, and System generation.`),
-            precondition(bodyAccount, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`),
-            precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, and nested Starbase.`),
-            precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, and System.`),
-            precondition(currencyAccount, 'The canonical CurrencyCache remains assigned to the configured Game.'),
-        ]),
+        preconditions: [
+            xp.guard,
+            ...(await Promise.all([
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, design sequence, buildings, Body, and System generation.`),
+                planetPrecondition(bodyAccount, system),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player),
+            ])),
+            currencyGuard,
+            ...rent.guards,
+        ],
         steps: [
             {
                 describes: description,
                 instruction: adaptCancelClaimStakeBuildingChangesInstruction({
+                    ...xp.accounts,
                     authorization: options.authorization,
                     celestialBody: stake.body.address,
                     claimStakeInstance: stake.address,
                     currencyCache,
                     game,
+                    ...rent.accounts,
                     starbasePlayer: player,
                     system,
                 }),
@@ -1024,13 +1166,19 @@ export async function planCancelClaimStakeBuildingChanges(ctx, stake, input) {
 }
 /** Plans deconstruction of one owned active Claim Stake.
  *
- * The planner derives the current Planet chronology index and exact plot bucket
- * from the Claim Stake definition tier and fresh Body plot matrix. The only
+ * The planner derives the plot level from the fresh Planet plot row that
+ * records the stake, and the index from its position in that row. The only
  * remaining building must be the definition-compatible zero-cost bundled hub,
  * which deconstruction discards.
  * Rent settlement, cargo return, account closure, and concurrent races remain
  * chain-authoritative; the Plan does not estimate a refund.
  *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history. Deconstruction also
+ * requires the canonical Currency Cache and closes the Claim Stake's XP ledger;
+ * a Claim Stake without a ledger accrued no XP.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -1043,46 +1191,27 @@ export async function planCancelClaimStakeBuildingChanges(ctx, stake, input) {
 export async function planDeconstructClaimStake(ctx, stake, input) {
     const options = validateDeconstructOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
     if (stake.state.kind !== 'active') {
         fail(`Claim Stake ${stake.address} is not in active state. Refresh it, finalize or cancel any pending design, and retry deconstruction.`, stake.address);
     }
-    if (stake.game !== game) {
-        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned Claim Stake, refresh it, and retry.`, stake.address);
-    }
-    const [freshGame, firstAccounts] = await Promise.all([
+    const character = await requireOwnedStake(stake, game, profile);
+    const action = 'deconstruction';
+    const [freshGame, { bodyAccount, currentBody, currentStake, stakeAccount }, rent,] = await Promise.all([
         readFreshGameClaimStakeConfiguration(ctx),
-        readContextRawAccounts(ctx, [stake.address, stake.body.address]),
+        readOwnedStake(ctx, stake, action),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
     if (freshGame === undefined) {
         fail(`Configured Game ${game} is missing. Refresh the Game definitions and retry deconstruction.`, game);
     }
-    const stakeAccount = requireAccount(firstAccounts[0], stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry deconstruction.`);
-    const bodyAccount = requireAccount(firstAccounts[1], stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry deconstruction.`);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = decodeIndexedCelestialBodyAccount(bodyAccount);
-    if (currentStake.game !== game ||
-        currentStake.body !== stake.body.address ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.claimStakeDefinitionId !== stake.claimStakeDefinitionId ||
-        currentStake.claimStakeDefinitionSeqId !==
-            stake.claimStakeDefinitionSeqId ||
-        currentStake.buildingDefinitionSeqId !== stake.buildingDefinitionSeqId ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
-        !sameQuantities(currentStake.buildings, stake.buildings) ||
+    if (!sameOwnedStake(currentStake, stake, game, profile) ||
         currentStake.state.kind !== 'active') {
         fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, active state, or System generation. Refresh it and retry deconstruction.`, stake.address);
     }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying deconstruction.`, stake.body.address);
-    }
+    requireCommittedCrewVersion(currentStake, stake, 'deconstructed');
+    const planet = await requireStakePlanet(currentBody, stake, game, action);
+    const { system } = planet;
     if (freshGame.data.claimStakes.sequenceId !== stake.claimStakeDefinitionSeqId) {
         fail(`Claim Stake ${stake.address} definition generation is stale against the current Game catalog. Refresh the Claim Stake and definitions to rule out stale local data. If the on-chain generation still differs, use a Claim Stake matching the current catalog before retrying deconstruction.`, stake.address);
     }
@@ -1104,92 +1233,84 @@ export async function planDeconstructClaimStake(ctx, stake, input) {
         bundledHub.hubValue !== claimDefinition.hubValue ||
         bundledHub.minimumTier !== claimDefinition.tier ||
         bundledHub.constructionCost.length !== 0) {
+        // Only a building with a construction cost is player-funded; a zero-cost
+        // hub from another definition family is a foreign bundled hub.
         const hasPlayerFundedBuilding = stake.buildings.some((building) => {
             const definition = definitions.get(building.buildingId);
-            return (definition === undefined ||
-                definition.hubValue !== claimDefinition.hubValue ||
-                definition.minimumTier !== claimDefinition.tier ||
-                definition.constructionCost.length !== 0);
+            return (definition !== undefined && definition.constructionCost.length !== 0);
         });
         fail(hasPlayerFundedBuilding
             ? `Claim Stake ${stake.address} still contains a player-funded building. Remove and finalize every player-funded building so only its verified bundled hub remains before retrying deconstruction.`
-            : `Claim Stake ${stake.address} does not contain exactly one verified bundled hub. Refresh it and restore the definition-compatible bundled hub before retrying deconstruction.`, stake.address);
-    }
-    const groups = currentBody.details.claimedPlots.filter(({ key }) => key === claimDefinition.id);
-    if (groups.length !== 1) {
-        fail(`Claim Stake definition ${String(claimDefinition.id)} does not have exactly one coherent group in Planet ${stake.body.address}'s Claim Stake Body data. Refresh the Body before retrying deconstruction.`, stake.body.address);
-    }
-    const group = groups[0];
-    const chronologyMatches = group.chronoAddresses
-        .map((address, index) => ({ address, index }))
-        .filter(({ address }) => address === stake.address);
-    if (chronologyMatches.length !== 1) {
-        fail(`Claim Stake ${stake.address} must appear exactly once in the Planet chronology before its deconstruction index can be derived. Refresh the Body and retry.`, stake.body.address);
-    }
-    const activeStructures = group.structures.filter(({ address, deactivationTimeUnixSeconds }) => address === stake.address && deactivationTimeUnixSeconds === 0n);
+            : bundledHub === undefined
+                ? `Claim Stake ${stake.address} does not contain exactly one verified bundled hub. Refresh it and restore the definition-compatible bundled hub before retrying deconstruction.`
+                : `Claim Stake ${stake.address} holds ${bundledHub.name} (${String(bundledHub.id)}), which is not the zero-cost ${claimDefinition.tier} bundled hub for Claim Stake definition ${String(claimDefinition.id)} (${claimDefinition.name}). Refresh the Claim Stake and Game definitions so the recorded hub matches its definition before retrying deconstruction.`, stake.address);
+    }
+    // Each plot row is a Starbase level; the stake's row and its position in
+    // that row's chronology give the deconstruction level and index.
+    const positions = claimStakePlotPositions(planet.details.claimedPlots, stake.address);
+    if (positions.length !== 1) {
+        fail(`Claim Stake ${stake.address} must appear exactly once in Planet ${stake.body.address}'s plot chronology before its deconstruction level and index can be derived. Refresh the Body and retry.`, stake.body.address);
+    }
+    const { index: claimStakeIndex, row } = positions[0];
+    const rowGroups = planet.details.claimedPlots.filter(({ key }) => key === row);
+    if (!Number.isInteger(row) ||
+        row < 0 ||
+        row >= CLAIM_STAKE_PLOT_ROWS ||
+        rowGroups.length !== 1) {
+        fail(`Planet ${stake.body.address} records Claim Stake ${stake.address} in plot row ${String(row)}, which is not exactly one Starbase level row. Refresh the Body and verify the pinned binding version before retrying deconstruction.`, stake.body.address);
+    }
+    const activeStructures = rowGroups[0].structures.filter(({ address, deactivationTimeUnixSeconds }) => address === stake.address && deactivationTimeUnixSeconds === 0n);
     if (activeStructures.length !== 1) {
         fail(`Claim Stake ${stake.address} is not represented exactly once as an active structure in the Planet Body data. Refresh the Body and retry deconstruction.`, stake.body.address);
     }
-    const claimStakeIndex = chronologyMatches[0].index;
-    const tierIndex = TIER_INDEX[claimDefinition.tier];
-    const plotCapacities = currentBody.details.claimStakePlots.map((row) => row[tierIndex]);
-    if (plotCapacities.some((capacity, index) => index > 0 && capacity < plotCapacities[index - 1])) {
-        fail(`Planet ${stake.body.address} Claim Stake plot capacity is not coherent across Starbase levels for definition tier ${claimDefinition.tier}. Refresh the Body and verify the pinned binding version before retrying deconstruction.`, stake.body.address);
-    }
-    if (group.chronoAddresses.length > plotCapacities[plotCapacities.length - 1]) {
-        fail(`Planet ${stake.body.address} Claim Stake plot capacity does not cover its definition-group chronology. Refresh the Body before retrying deconstruction.`, stake.body.address);
-    }
-    const plotLevelIndex = plotCapacities.findIndex((capacity) => claimStakeIndex < capacity);
-    const claimStakeLevel = CLAIM_STAKE_PLOT_LEVELS[plotLevelIndex];
-    const system = currentBody.system;
-    const player = await deriveStarbasePlayerAddress(system, character);
-    const [characterCandidate, systemCandidate, playerCandidate] = await readContextRawAccounts(ctx, [character, system, player]);
-    const characterAccount = requireAccount(characterCandidate, character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry deconstruction.`);
-    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry deconstruction.`);
-    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake's System before retrying deconstruction.`);
-    const currentCharacter = characterAccountDefinition.decode(characterAccount);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry deconstruction.`, character);
-    }
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        !currentSystem.celestialBodyAddresses.includes(stake.body.address) ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, or an active nested Starbase. Refresh the System and retry deconstruction.`, system);
-    }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry deconstruction.`, player);
-    }
+    const claimStakeLevel = CLAIM_STAKE_PLOT_LEVELS[row];
+    const [currencyCache, [xpAccrual]] = await Promise.all([
+        claimStakeCurrencyCache(game),
+        deriveStructureXpAccrualAddress(stake.address),
+    ]);
+    const { currentSystem, extraAccounts: [characterCandidate, currencyCandidate, ledgerCandidate], player, playerAccount, systemAccount, } = await readStakeStarbase(ctx, stake, game, system, character, profile, action, [character, currencyCache, xpAccrual]);
+    const { account: characterAccount } = requireProfileCharacter(characterCandidate, character, profile, game, action);
+    const currencyGuard = await requireCurrencyCache(currencyCandidate, currencyCache, game, action, 'Claim Stake deconstruction');
+    // Deconstruction closes an existing XP ledger; a stake without one accrued nothing.
+    const xp = ledgerCandidate === undefined
+        ? {
+            accounts: {},
+            guard: accountAbsentPrecondition(xpAccrual, `Claim Stake ${stake.address} XP ledger ${xpAccrual} remains absent, so no Building XP has accrued.`),
+        }
+        : await resolveClaimStakeXp(ctx, game, stake.address, character);
     const description = `Deconstruct Claim Stake ${stake.address} and discard its bundled hub ${bundledHub.name}; rent settlement, cargo return, account closure, and any refund remain chain-authoritative.`;
-    return createPlan({
+    return buildPlannerPlan({
         kind: 'claim-stakes.deconstruct',
-        preconditions: await Promise.all([
-            precondition(freshGame.account, `The configured Game retains Claim Stake definition ${String(claimDefinition.id)}, bundled hub ${String(bundledHub.id)}, and their current generations.`),
-            precondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, active state, definitions, bundled hub, Body, and System generation.`),
-            precondition(bodyAccount, `The Planet retains Claim Stake ${stake.address} at chronology index ${String(claimStakeIndex)} in definition group ${String(claimDefinition.id)}.`),
-            precondition(characterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} in the configured Game.`),
-            precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, nested Starbase, and Claim Stake Body relationship.`),
-            precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, and System.`),
-        ]),
+        preconditions: [
+            ...(await Promise.all([
+                accountStatePrecondition(freshGame.account, `The configured Game retains Claim Stake definition ${String(claimDefinition.id)}, bundled hub ${String(bundledHub.id)}, and their current generations.`),
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, active state, definitions, bundled hub, Body, and System generation.`),
+                accountStatePrecondition(bodyAccount, `The Planet retains Claim Stake ${stake.address} at chronology index ${String(claimStakeIndex)} in definition group ${String(claimDefinition.id)}.`),
+                characterPrecondition(characterAccount, profile),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player),
+            ])),
+            currencyGuard,
+            xp.guard,
+            ...rent.guards,
+        ],
         steps: [
             {
                 describes: description,
                 instruction: adaptDeconstructClaimStakeInstruction({
+                    ...xp.accounts,
                     authorization: options.authorization,
                     celestialBody: stake.body.address,
                     character,
                     claimStakeIndex,
                     claimStakeInstance: stake.address,
                     claimStakeLevel,
+                    currencyCache,
                     game,
+                    ...rent.accounts,
                     systemAndStarbasePlayerStarbasePlayer: player,
                     systemAndStarbasePlayerSystem: system,
+                    xpAccrual,
                 }),
                 signers: [options.authorization.authority],
             },
@@ -1197,13 +1318,19 @@ export async function planDeconstructClaimStake(ctx, stake, input) {
         summary: description,
     });
 }
-/** Plans one exact raw rent top-up for an owned placed Claim Stake.
+/** Plans one exact raw rent top-up for an owned Claim Stake.
  *
+ * Active, design and Deactivated (rent-delinquent) stakes all accept a top-up;
+ * topping up a Deactivated stake is how its owner keeps it from eviction.
  * The planner validates the fresh Claim Stake and its canonical
  * Profile/Character/Planet/System/Starbase Player graph, plus the Character's
  * known raw ATLAS balance. Permission checks, concurrent balance changes, rent
  * arithmetic, and duration purchased remain chain-authoritative.
  *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history.
+ *
  * @example
  * ```ts
  * declare const ctx: SageContext;
@@ -1219,87 +1346,40 @@ export async function planDeconstructClaimStake(ctx, stake, input) {
 export async function planTopUpClaimStakeRent(ctx, stake, input) {
     const options = validateTopUpRentOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
+    // Under Disabled rent a top-up has no lifecycle gate: a Deactivated stake
+    // accepts one, and that is how its owner avoids eviction.
     const loadedState = stake.state;
-    if (loadedState.kind === 'deactivated') {
-        fail(`Claim Stake ${stake.address} is not placed. Refresh it and choose an active Claim Stake or pending building design before topping up rent.`, stake.address);
-    }
-    if (stake.game !== game) {
-        fail(`Claim Stake ${stake.address} does not match the configured Game ${game}. Refresh it through this context and retry.`, stake.address);
-    }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned Claim Stake, refresh it, and retry.`, stake.address);
-    }
-    const firstAccounts = await readContextRawAccounts(ctx, [
-        stake.address,
-        stake.body.address,
-        character,
+    const character = await requireOwnedStake(stake, game, profile);
+    const action = 'the rent top-up';
+    const [{ bodyAccount, currentBody, currentStake, extraAccounts: [characterCandidate], stakeAccount, }, rent,] = await Promise.all([
+        readOwnedStake(ctx, stake, action, [character]),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
-    const stakeAccount = requireAccount(firstAccounts[0], stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry the rent top-up.`);
-    const bodyAccount = requireAccount(firstAccounts[1], stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry the rent top-up.`);
-    const characterAccount = requireAccount(firstAccounts[2], character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry the rent top-up.`);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = celestialBodyAccountDefinition.decode(bodyAccount);
-    const currentCharacter = characterAccountDefinition.decode(characterAccount);
-    if (currentStake.game !== game ||
-        currentStake.body !== stake.body.address ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.claimStakeDefinitionId !== stake.claimStakeDefinitionId ||
-        currentStake.claimStakeDefinitionSeqId !==
-            stake.claimStakeDefinitionSeqId ||
-        currentStake.buildingDefinitionSeqId !== stake.buildingDefinitionSeqId ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
+    if (!sameOwnedStake(currentStake, stake, game, profile) ||
         currentStake.rentBalanceRaw !== stake.rentBalanceRaw ||
-        !sameQuantities(currentStake.buildings, stake.buildings) ||
         !sameStakeState(currentStake.state, loadedState)) {
-        fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, rent balance, placed state, or System generation. Refresh it and retry the rent top-up.`, stake.address);
-    }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying the rent top-up.`, stake.body.address);
-    }
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry the rent top-up.`, character);
+        fail(`Claim Stake ${stake.address} changed or does not match its loaded ownership, Body, definitions, buildings, rent balance, lifecycle state, or System generation. Refresh it and retry the rent top-up.`, stake.address);
     }
+    const { system } = await requireStakePlanet(currentBody, stake, game, action);
+    const { account: characterAccount, current: currentCharacter } = requireProfileCharacter(characterCandidate, character, profile, game, action);
     if (currentCharacter.atlasRaw < options.amount) {
         fail(`Character ${character} has only ${String(currentCharacter.atlasRaw)} known raw ATLAS, below the requested ${String(options.amount)} raw rent top-up. Reduce the amount or add ATLAS, refresh the Character, and retry.`, character);
     }
-    const system = currentBody.system;
-    const player = await deriveStarbasePlayerAddress(system, character);
-    const [systemCandidate, playerCandidate] = await readContextRawAccounts(ctx, [
-        system,
-        player,
-    ]);
-    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake's System and retry the rent top-up.`);
-    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake's System before retrying the rent top-up.`);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        !currentSystem.celestialBodyAddresses.includes(stake.body.address) ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, active nested Starbase, or Claim Stake Body relationship. Refresh the System and retry the rent top-up.`, system);
-    }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry the rent top-up.`, player);
-    }
+    const { currentSystem, player, playerAccount, systemAccount } = await readStakeStarbase(ctx, stake, game, system, character, profile, action);
     const description = `Top up Claim Stake ${stake.address} rent with ${String(options.amount)} raw rent units; rent arithmetic remains chain-authoritative.`;
-    return createPlan({
+    return buildPlannerPlan({
         kind: 'claim-stakes.top-up-rent',
-        preconditions: await Promise.all([
-            precondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, rent balance, placed state, Body, and System generation.`),
-            precondition(bodyAccount, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`),
-            precondition(characterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} with at least ${String(options.amount)} known raw ATLAS.`),
-            precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, nested Starbase, and Claim Stake Body relationship.`),
-            precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, and System.`),
-        ]),
+        preconditions: [
+            ...(await Promise.all([
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its ownership, rent balance, lifecycle state, Body, and System generation.`),
+                planetPrecondition(bodyAccount, system),
+                accountStatePrecondition(characterAccount, `The canonical Character remains assigned to Profile ${profile} with at least ${String(options.amount)} known raw ATLAS.`),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player),
+            ])),
+            ...rent.guards,
+        ],
         steps: [
             {
                 describes: description,
@@ -1310,6 +1390,7 @@ export async function planTopUpClaimStakeRent(ctx, stake, input) {
                     character,
                     claimStakeInstance: stake.address,
                     game,
+                    ...rent.accounts,
                     systemAndStarbasePlayerStarbasePlayer: player,
                     systemAndStarbasePlayerSystem: system,
                 }),
@@ -1341,10 +1422,10 @@ function requireTransferCapacity(destination, address, used, requested, total) {
         fail(`${destination} has ${String(remaining)} raw capacity units remaining, but this transfer requires ${String(requested)}. Reduce the request or free capacity, refresh both snapshots, and retry.`, address);
     }
 }
-function fleetCargoAmount(fleet, cargoId) {
-    return ((fleet.ammoBank.cargoId === cargoId ? fleet.ammoBank.amount : 0n) +
-        (fleet.fuelTank.cargoId === cargoId ? fleet.fuelTank.amount : 0n) +
-        cargoAmount(fleet.cargoHold.amounts, cargoId));
+/** Reads a Fleet's cargo-hold balance; Claim Stake transfers never touch the
+ * fuel tank or ammo bank, so Fuel and Ammunition count only when in the hold. */
+function fleetCargoHoldAmount(fleet, cargoId) {
+    return cargoAmount(fleet.cargoHold.amounts, cargoId);
 }
 function describeCargoRequests(direction, requests) {
     return requests.map(({ amount, cargoId }) => `${direction} cargo id ${String(cargoId)} = ${String(amount)} raw ${amount === 1n ? 'unit' : 'units'}`);
@@ -1354,8 +1435,24 @@ function describeCargoRequests(direction, requests) {
  * The planner validates the shared Profile/Game, idle Fleet with normalized
  * crew, active Claim Stake, canonical Planet/System/Starbase Player graph,
  * exact source balances, exact destination capacities, and an optional present
- * FleetCrewBinding. The chain remains authoritative for range, duration,
- * permission bits, concurrent state changes, and transfer arithmetic.
+ * FleetCrewBinding. Both legs use the Fleet cargo hold only: loaded Fuel and
+ * Ammunition arrive in the cargo hold and consume cargo capacity, and unloads
+ * are sourced from the cargo hold, never from the fuel tank or ammo bank. The
+ * chain remains authoritative for range, duration, permission bits, concurrent
+ * state changes, and transfer arithmetic.
+ *
+ * The Fleet stores the requested load and unload lines while the transfer
+ * runs. The program settles the Fleet and stake together: the stake's lamports
+ * above its rent floor fund the Fleet first and the Profile vault, with the
+ * signing key, funds the rest. The Plan bounds that debit with the same key and
+ * balance checks as placement.
+ *
+ * Requires Game 2 and its existing canonical Claim Stake XP ledger.
+ * Missing XP state must be repaired outside this Plan; no accounts are created.
+ *
+ * Requires Disabled rent: the Game's rent catalog and the Claim Stake's rent
+ * settlement authority must not exist, and both stay guarded absent until
+ * signing. The instruction carries no rent history.
  *
  * @example
  * ```ts
@@ -1374,119 +1471,56 @@ function describeCargoRequests(direction, requests) {
 export async function planStartClaimStakeFleetTransfer(ctx, fleet, stake, input) {
     const options = validateStartFleetTransferOptions(input);
     const game = requireGameAddress(ctx);
+    const { profile } = options.authorization;
     if (fleet.game !== game || stake.game !== game) {
         fail(`Fleet ${fleet.address} and Claim Stake ${stake.address} must both belong to configured Game ${game}. Refresh both snapshots through this context and retry.`, fleet.game !== game ? fleet.address : stake.address);
     }
-    if (fleet.ownerProfile.address !== options.authorization.profile) {
-        fail(`Fleet ${fleet.name} belongs to Profile ${fleet.ownerProfile.address}, not authorization Profile ${options.authorization.profile}. Use the owning Profile, refresh the Fleet, and retry.`, fleet.address);
+    if (fleet.ownerProfile.address !== profile) {
+        fail(`Fleet ${fleet.name} belongs to Profile ${fleet.ownerProfile.address}, not authorization Profile ${profile}. Use the owning Profile, refresh the Fleet, and retry.`, fleet.address);
     }
     if (fleet.state.kind !== 'idle') {
         fail(`Fleet ${fleet.name} is ${fleet.state.kind}, but starting a Claim Stake transfer requires an idle Fleet. Return it to idle state, refresh it, and retry.`, fleet.address);
     }
+    const crewFailure = `Fleet ${fleet.name} has no valid normalized crew and cannot start a Claim Stake transfer. Crew the Fleet, refresh it, and retry.`;
     if (!Number.isSafeInteger(fleet.crewCount) || fleet.crewCount <= 0) {
-        fail(`Fleet ${fleet.name} has no valid normalized crew and cannot start a Claim Stake transfer. Crew the Fleet, refresh it, and retry.`, fleet.address);
+        fail(crewFailure, fleet.address);
     }
     if (stake.state.kind !== 'active') {
         fail(`Claim Stake ${stake.address} is ${stake.state.kind}, but starting a Fleet transfer requires an active Claim Stake. Activate or restore it, refresh it, and retry.`, stake.address);
     }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Choose an owned active Claim Stake, refresh it, and retry.`, stake.address);
-    }
-    const [fleetCandidate, stakeCandidate, bodyCandidate, characterCandidate] = await readContextRawAccounts(ctx, [
-        fleet.address,
-        stake.address,
-        stake.body.address,
-        character,
+    const character = await requireOwnedStake(stake, game, profile);
+    const action = 'the Fleet transfer';
+    const [{ bodyAccount, currentBody, currentStake, extraAccounts: [fleetCandidate, characterCandidate], stakeAccount, }, rent,] = await Promise.all([
+        readOwnedStake(ctx, stake, action, [fleet.address, character]),
+        requireDisabledStakeRent(ctx, game, stake.address, action),
     ]);
-    const fleetAccount = requireAccount(fleetCandidate, fleet.address, `Fleet ${fleet.name} is missing. Refresh it and retry the Claim Stake transfer.`);
-    const stakeAccount = requireAccount(stakeCandidate, stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry the Fleet transfer.`);
-    const bodyAccount = requireAccount(bodyCandidate, stake.body.address, `Celestial Body ${stake.body.address} is missing. Refresh the Claim Stake Body and retry the Fleet transfer.`);
-    const characterAccount = requireAccount(characterCandidate, character, `Canonical Character ${character} is missing. Refresh the Profile Character and retry the Claim Stake transfer.`);
+    const fleetAccount = requireAccount(fleetCandidate, fleet.address, `Fleet ${fleet.name} is missing. Refresh it and retry the Fleet transfer.`);
     const currentFleet = fleetAccountDefinition.decode(fleetAccount);
-    const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    const currentBody = celestialBodyAccountDefinition.decode(bodyAccount);
-    const currentCharacter = characterAccountDefinition.decode(characterAccount);
     if (!Number.isSafeInteger(currentFleet.crewCount) ||
         currentFleet.crewCount <= 0) {
-        fail(`Fleet ${fleet.name} has no valid normalized crew and cannot start a Claim Stake transfer. Crew the Fleet, refresh it, and retry.`, fleet.address);
+        fail(crewFailure, fleet.address);
     }
-    if (currentFleet.game !== game ||
-        currentFleet.ownerProfile !== options.authorization.profile ||
-        currentFleet.name !== fleet.name ||
+    if (!sameTransferFleet(currentFleet, fleet, game, profile) ||
         currentFleet.state.kind !== 'idle' ||
         currentFleet.crewCount !== fleet.crewCount ||
-        (await deriveFleetAddress(currentFleet)) !== fleet.address ||
-        currentFleet.ammoBank.cargoId !== fleet.ammo.id ||
-        currentFleet.ammoBank.amount !== fleet.ammo.amount ||
-        currentFleet.fuelTank.cargoId !== fleet.fuel.id ||
-        currentFleet.fuelTank.amount !== fleet.fuel.amount ||
-        currentFleet.cargoHold.storageCost !== fleet.cargoHold.storageCost ||
-        !sameCargoAmounts(currentFleet.cargoHold.amounts, fleet.cargoHold.items) ||
-        currentFleet.stats.cargo.ammoCapacity !== fleet.capacities.ammo.total ||
-        currentFleet.stats.cargo.fuelCapacity !== fleet.capacities.fuel.total ||
-        currentFleet.stats.cargo.cargoCapacity !== fleet.capacities.cargo.total) {
+        (await deriveFleetAddress(currentFleet)) !== fleet.address) {
         fail(`Fleet ${fleet.name} changed or no longer matches its loaded Game, owner, canonical address, name, idle state, normalized crew, cargo, or capacities. Refresh it and create a new Claim Stake transfer Plan.`, fleet.address);
     }
-    if (currentStake.game !== game ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.body !== stake.body.address ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
-        currentStake.state.kind !== 'active' ||
-        currentStake.production.cargoPod.storageCost !==
-            stake.resources.capacity.usedRaw ||
-        currentStake.production.resourceCapacityRaw !==
-            stake.resources.capacity.totalRaw ||
-        !sameCargoAmounts(currentStake.production.cargoPod.amounts, stake.resources.inventory.items.map(({ id, quantityRaw }) => ({
-            amount: quantityRaw,
-            id,
-        })))) {
+    if (!sameTransferStake(currentStake, stake, game, profile)) {
         fail(`Claim Stake ${stake.address} changed or no longer matches its loaded Game, owner, Body, active state, resources, capacity, or System generation. Refresh it and create a new Fleet transfer Plan.`, stake.address);
     }
-    if (currentBody.kind !== 'planet' ||
-        currentBody.game !== game ||
-        currentBody.systemSequenceId !== stake.systemSeqId ||
-        (await deriveCelestialBodyAddress(game, currentBody.id)) !==
-            stake.body.address) {
-        fail(`Celestial Body ${stake.body.address} does not match the Claim Stake's configured Game, canonical Planet identity, or System generation. Refresh the Body and Claim Stake before retrying the Fleet transfer.`, stake.body.address);
-    }
-    if (currentCharacter.playerProfile !== options.authorization.profile ||
-        currentCharacter.game !== game) {
-        fail(`Character ${character} does not match authorization Profile ${options.authorization.profile} and configured Game ${game}. Refresh the Character and retry the Claim Stake transfer.`, character);
-    }
-    const system = currentBody.system;
-    const player = await deriveStarbasePlayerAddress(system, character);
-    const currencyCache = await deriveCurrencyCacheAddress(game);
-    const crewBinding = await deriveFleetCrewBindingAddress(fleet.address);
-    const [systemCandidate, playerCandidate, currencyCandidate, crewCandidate] = await readContextRawAccounts(ctx, [
-        system,
-        player,
-        currencyCache,
-        crewBinding,
+    const { system } = await requireStakePlanet(currentBody, stake, game, action);
+    const { account: characterAccount } = requireProfileCharacter(characterCandidate, character, profile, game, action);
+    const [currencyCache, crewBinding] = await Promise.all([
+        claimStakeCurrencyCache(game),
+        deriveFleetCrewBindingAddress(fleet.address),
     ]);
-    const systemAccount = requireAccount(systemCandidate, system, `Star System ${system} is missing. Refresh the Claim Stake System and retry the Fleet transfer.`);
-    const playerAccount = requireAccount(playerCandidate, player, `Starbase Player ${player} is missing for authorization Profile ${options.authorization.profile}. Register or refresh it in the Claim Stake System before retrying the Fleet transfer.`);
-    const currencyAccount = requireAccount(currencyCandidate, currencyCache, `Canonical CurrencyCache ${currencyCache} is missing for configured Game ${game}. Refresh the Game currency configuration and retry the Fleet transfer.`);
-    const currentSystem = starSystemAccountDefinition.decode(systemAccount);
-    const currentPlayer = starbasePlayerAccountDefinition.decode(playerAccount);
-    if (currentSystem.game !== game ||
-        currentSystem.sequenceId !== stake.systemSeqId ||
-        currentSystem.starbase === undefined ||
-        !currentSystem.celestialBodyAddresses.includes(stake.body.address) ||
-        (await deriveStarSystemAddress(game, currentSystem.systemId)) !== system) {
-        fail(`Star System ${system} does not match the configured Game, canonical identity, Claim Stake generation, nested Starbase, or Claim Stake Body relationship. Refresh the System and retry the Fleet transfer.`, system);
-    }
-    if (currentPlayer.playerProfile !== options.authorization.profile ||
-        currentPlayer.character !== character ||
-        currentPlayer.system !== system) {
-        fail(`Starbase Player ${player} does not match the authorization Profile, canonical Character, and Claim Stake System. Refresh it and retry the Fleet transfer.`, player);
-    }
-    validateCurrencyCache(currencyAccount, game, currencyCache, 'the Claim Stake Fleet transfer');
+    const { currentSystem, extraAccounts: [currencyCandidate, crewCandidate], player, playerAccount, systemAccount, } = await readStakeStarbase(ctx, stake, game, system, character, profile, action, [currencyCache, crewBinding]);
+    const currencyGuard = await requireCurrencyCache(currencyCandidate, currencyCache, game, action, 'Claim Stake Fleet transfer');
     if (crewCandidate !== undefined) {
         const currentCrewBinding = fleetCrewBindingAccountDefinition.decode(crewCandidate);
         if (crewCandidate.address !== crewBinding ||
-            currentCrewBinding.fleet !== fleet.address ||
-            currentCrewBinding.ownerProfile !== options.authorization.profile) {
+            !matchesFleetCrewBindingIdentity(currentCrewBinding, fleet.address, profile)) {
             fail(`FleetCrewBinding ${crewCandidate.address} does not match Fleet ${fleet.address}, its owner Profile, or its canonical PDA. Refresh the Fleet crew registration or remove the invalid binding before retrying.`, crewCandidate.address);
         }
     }
@@ -1498,64 +1532,63 @@ export async function planStartClaimStakeFleetTransfer(ctx, fleet, stake, input)
         requireCargoBalance(`Claim Stake ${stake.address}`, stake.address, request.cargoId, cargoAmount(currentStake.production.cargoPod.amounts, request.cargoId), request.amount);
     }
     for (const request of options.unload) {
-        requireCargoBalance(`Fleet ${fleet.name}`, fleet.address, request.cargoId, fleetCargoAmount(currentFleet, request.cargoId), request.amount);
-    }
-    const loadAmmo = options.load
-        .filter(({ cargoId }) => cargoId === currentFleet.ammoBank.cargoId)
-        .reduce((total, { amount }) => total + amount, 0n);
-    const loadFuel = options.load
-        .filter(({ cargoId }) => cargoId === currentFleet.fuelTank.cargoId)
-        .reduce((total, { amount }) => total + amount, 0n);
-    const loadCargoStorage = options.load
-        .filter(({ cargoId }) => cargoId !== currentFleet.ammoBank.cargoId &&
-        cargoId !== currentFleet.fuelTank.cargoId)
-        .reduce((total, { amount, cargoId }) => total + amount * BigInt(definitions.get(cargoId).storageCost), 0n);
-    requireTransferCapacity(`Fleet ${fleet.name} ammo destination`, fleet.address, currentFleet.ammoBank.amount, loadAmmo, currentFleet.stats.cargo.ammoCapacity);
-    requireTransferCapacity(`Fleet ${fleet.name} fuel destination`, fleet.address, currentFleet.fuelTank.amount, loadFuel, currentFleet.stats.cargo.fuelCapacity);
+        requireCargoBalance(`Fleet ${fleet.name}`, fleet.address, request.cargoId, fleetCargoHoldAmount(currentFleet, request.cargoId), request.amount);
+    }
+    // Every load, including Fuel and Ammunition, lands in the cargo hold.
+    const loadCargoStorage = options.load.reduce((total, { amount, cargoId }) => total + cargoStorageUnits(amount, definitions.get(cargoId).storageCost), 0n);
     requireTransferCapacity(`Fleet ${fleet.name} cargo destination`, fleet.address, currentFleet.cargoHold.storageCost, loadCargoStorage, currentFleet.stats.cargo.cargoCapacity);
-    const unloadStorage = options.unload.reduce((total, { amount, cargoId }) => total + amount * BigInt(definitions.get(cargoId).storageCost), 0n);
+    const unloadStorage = options.unload.reduce((total, { amount, cargoId }) => total + cargoStorageUnits(amount, definitions.get(cargoId).storageCost), 0n);
     requireTransferCapacity(`Claim Stake ${stake.address} resource destination`, stake.address, currentStake.production.cargoPod.storageCost, unloadStorage, currentStake.production.resourceCapacityRaw);
     const descriptions = [
         ...describeCargoRequests('load', options.load),
         ...describeCargoRequests('unload', options.unload),
     ];
-    const description = `Start fleet ${fleet.name}'s transfer to Claim Stake ${stake.address}: ${descriptions.join('; ')}. Range and transfer duration remain chain-authoritative.`;
-    return createPlan({
+    const xp = await resolveClaimStakeXp(ctx, game, stake.address);
+    const instruction = adaptStartClaimStakeFleetTransferInstruction({
+        ...xp.accounts,
+        authorization: options.authorization,
+        celestialBody: stake.body.address,
+        character,
+        claimStakeInstance: stake.address,
+        ...(crewCandidate === undefined ? {} : { crewBinding }),
+        currencyCache,
+        fleet: fleet.address,
+        game,
+        ...rent.accounts,
+        systemAndStarbasePlayerStarbasePlayer: player,
+        systemAndStarbasePlayerSystem: system,
+        toLoad: options.load.map(({ amount, cargoId }) => [cargoId, amount]),
+        toUnload: options.unload.map(({ amount, cargoId }) => [cargoId, amount]),
+    });
+    // The Fleet's transfer state is funded first from the stake's surplus over
+    // its rent floor, then from the Profile vault.
+    const storage = await planClaimStakeStorage(ctx, instruction, profile, [fleetAccount, stakeAccount], 'Claim Stake Fleet transfer start');
+    const description = `Start fleet ${fleet.name}'s transfer to Claim Stake ${stake.address}: ${descriptions.join('; ')}. Loaded cargo, including Fuel and Ammunition, arrives in the Fleet cargo hold; unloads come from the cargo hold only. Range and transfer duration remain chain-authoritative. ${storage.disclosure}`;
+    return buildPlannerPlan({
         kind: 'claim-stakes.start-fleet-transfer',
-        preconditions: await Promise.all([
-            precondition(fleetAccount, `Fleet ${fleet.name} retains its owner, name, idle state, normalized crew, cargo balances, and destination capacities.`),
-            precondition(stakeAccount, `Claim Stake ${stake.address} retains its owner, active state, cargo balances, destination capacity, Body, and System generation.`),
-            precondition(bodyAccount, `The Claim Stake Planet remains assigned to System ${system} at the current generation.`),
-            precondition(characterAccount, `The canonical Character remains assigned to Profile ${options.authorization.profile} in the configured Game.`),
-            precondition(systemAccount, `Star System ${currentSystem.name} retains its configured Game, sequence, nested Starbase, and Claim Stake Body relationship.`),
-            precondition(playerAccount, `Starbase Player ${player} retains its Profile, Character, and System.`),
-            precondition(currencyAccount, 'The canonical CurrencyCache remains assigned to the configured Game.'),
-            ...(crewCandidate === undefined
-                ? []
-                : [
-                    precondition(crewCandidate, `Fleet ${fleet.name}'s optional FleetCrewBinding remains assigned to the Fleet and owner Profile.`),
-                ]),
-        ]),
+        preconditions: [
+            xp.guard,
+            ...(await Promise.all([
+                accountStatePrecondition(fleetAccount, `Fleet ${fleet.name} retains its owner, name, idle state, normalized crew, cargo balances, and destination capacities.`),
+                accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} retains its owner, active state, cargo balances, destination capacity, Body, and System generation.`),
+                planetPrecondition(bodyAccount, system),
+                characterPrecondition(characterAccount, profile),
+                systemPrecondition(systemAccount, currentSystem.name),
+                playerPrecondition(playerAccount, player),
+                ...(crewCandidate === undefined
+                    ? []
+                    : [
+                        accountStatePrecondition(crewCandidate, `Fleet ${fleet.name}'s optional FleetCrewBinding remains assigned to the Fleet and owner Profile.`),
+                    ]),
+            ])),
+            currencyGuard,
+            ...rent.guards,
+            storage.guard,
+        ],
         steps: [
             {
                 describes: description,
-                instruction: adaptStartClaimStakeFleetTransferInstruction({
-                    authorization: options.authorization,
-                    celestialBody: stake.body.address,
-                    character,
-                    claimStakeInstance: stake.address,
-                    ...(crewCandidate === undefined ? {} : { crewBinding }),
-                    currencyCache,
-                    fleet: fleet.address,
-                    game,
-                    systemAndStarbasePlayerStarbasePlayer: player,
-                    systemAndStarbasePlayerSystem: system,
-                    toLoad: options.load.map(({ amount, cargoId }) => [cargoId, amount]),
-                    toUnload: options.unload.map(({ amount, cargoId }) => [
-                        cargoId,
-                        amount,
-                    ]),
-                }),
+                instruction,
                 signers: [options.authorization.authority],
             },
         ],
@@ -1606,10 +1639,7 @@ export async function planRecoverClaimStakeFleetTransfer(ctx, fleet, stake, inpu
     if (options.atUnixSeconds < fleet.state.endAtUnixSeconds) {
         fail(`Fleet ${fleet.name}'s Claim Stake transfer lock has not elapsed at Unix timestamp ${String(options.atUnixSeconds)}; it ends at ${String(fleet.state.endAtUnixSeconds)}. Wait until the lock elapses, provide a current timestamp, and retry recovery.`, fleet.address);
     }
-    const character = await findCharacterPda(options.authorization.profile, game);
-    if (stake.ownerCharacter.address !== character) {
-        fail(`Claim Stake ${stake.address} does not belong to authorization Profile ${options.authorization.profile}'s canonical Character ${character}. Supply the owned current Claim Stake and retry recovery.`, stake.address);
-    }
+    const character = await requireOwnedStake(stake, game, options.authorization.profile);
     const [fleetCandidate, stakeCandidate] = await readContextRawAccounts(ctx, [
         fleet.address,
         stake.address,
@@ -1618,40 +1648,17 @@ export async function planRecoverClaimStakeFleetTransfer(ctx, fleet, stake, inpu
     const stakeAccount = requireAccount(stakeCandidate, stake.address, `Claim Stake ${stake.address} is missing. Refresh it and retry Fleet transfer recovery.`);
     const currentFleet = fleetAccountDefinition.decode(fleetAccount);
     const currentStake = claimStakeAccountDefinition.decode(stakeAccount);
-    if (currentFleet.game !== game ||
-        currentFleet.ownerProfile !== options.authorization.profile ||
-        currentFleet.name !== fleet.name ||
+    if (!sameTransferFleet(currentFleet, fleet, game, options.authorization.profile) ||
         currentFleet.state.kind !== 'claimStakeTransfer' ||
         currentFleet.state.claimStake !== stake.address ||
         currentFleet.state.planet !== stake.body.address ||
         currentFleet.state.endAtUnixSeconds !== fleet.state.endAtUnixSeconds ||
         !sameCargoAmounts(currentFleet.state.load, fleet.state.load) ||
         !sameCargoAmounts(currentFleet.state.unload, fleet.state.unload) ||
-        (await deriveFleetAddress(currentFleet)) !== fleet.address ||
-        currentFleet.ammoBank.cargoId !== fleet.ammo.id ||
-        currentFleet.ammoBank.amount !== fleet.ammo.amount ||
-        currentFleet.fuelTank.cargoId !== fleet.fuel.id ||
-        currentFleet.fuelTank.amount !== fleet.fuel.amount ||
-        currentFleet.cargoHold.storageCost !== fleet.cargoHold.storageCost ||
-        !sameCargoAmounts(currentFleet.cargoHold.amounts, fleet.cargoHold.items) ||
-        currentFleet.stats.cargo.ammoCapacity !== fleet.capacities.ammo.total ||
-        currentFleet.stats.cargo.fuelCapacity !== fleet.capacities.fuel.total ||
-        currentFleet.stats.cargo.cargoCapacity !== fleet.capacities.cargo.total) {
+        (await deriveFleetAddress(currentFleet)) !== fleet.address) {
         fail(`Fleet ${fleet.name} changed or no longer matches its loaded owner, Game, canonical address, Claim Stake transfer snapshot, cargo, or capacities. Refresh it and retry recovery.`, fleet.address);
     }
-    if (currentStake.game !== game ||
-        currentStake.ownerCharacter !== character ||
-        currentStake.body !== stake.body.address ||
-        currentStake.systemSeqId !== stake.systemSeqId ||
-        currentStake.state.kind !== 'active' ||
-        currentStake.production.cargoPod.storageCost !==
-            stake.resources.capacity.usedRaw ||
-        currentStake.production.resourceCapacityRaw !==
-            stake.resources.capacity.totalRaw ||
-        !sameCargoAmounts(currentStake.production.cargoPod.amounts, stake.resources.inventory.items.map(({ id, quantityRaw }) => ({
-            amount: quantityRaw,
-            id,
-        })))) {
+    if (!sameTransferStake(currentStake, stake, game, options.authorization.profile)) {
         fail(`Claim Stake ${stake.address} changed or no longer matches its loaded owner, Game, Body, active state, resources, capacity, or System generation. Refresh it and retry Fleet transfer recovery.`, stake.address);
     }
     let reason;
@@ -1664,7 +1671,7 @@ export async function planRecoverClaimStakeFleetTransfer(ctx, fleet, stake, inpu
     }
     if (reason === undefined) {
         for (const request of currentFleet.state.unload) {
-            const available = fleetCargoAmount(currentFleet, request.cargoId);
+            const available = fleetCargoHoldAmount(currentFleet, request.cargoId);
             if (available < request.amount) {
                 reason = `Fleet source shortfall for cargo id ${String(request.cargoId)}`;
                 break;
@@ -1690,22 +1697,12 @@ export async function planRecoverClaimStakeFleetTransfer(ctx, fleet, stake, inpu
         }
     }
     if (reason === undefined) {
-        const loadAmmo = cargoAmount(currentFleet.state.load, currentFleet.ammoBank.cargoId);
-        const loadFuel = cargoAmount(currentFleet.state.load, currentFleet.fuelTank.cargoId);
-        const loadCargoStorage = currentFleet.state.load
-            .filter(({ cargoId }) => cargoId !== currentFleet.ammoBank.cargoId &&
-            cargoId !== currentFleet.fuelTank.cargoId)
-            .reduce((total, { amount, cargoId }) => total + amount * BigInt(queuedDefinitions.get(cargoId).storageCost), 0n);
-        const unloadStorage = currentFleet.state.unload.reduce((total, { amount, cargoId }) => total + amount * BigInt(queuedDefinitions.get(cargoId).storageCost), 0n);
-        if (currentFleet.ammoBank.amount + loadAmmo >
-            currentFleet.stats.cargo.ammoCapacity) {
-            reason = 'Fleet ammo destination overflow';
-        }
-        else if (currentFleet.fuelTank.amount + loadFuel >
-            currentFleet.stats.cargo.fuelCapacity) {
-            reason = 'Fleet fuel destination overflow';
-        }
-        else if (currentFleet.cargoHold.storageCost + loadCargoStorage >
+        // Every queued load, including Fuel and Ammunition, targets the cargo hold.
+        const loadCargoStorage = currentFleet.state.load.reduce((total, { amount, cargoId }) => total +
+            cargoStorageUnits(amount, queuedDefinitions.get(cargoId).storageCost), 0n);
+        const unloadStorage = currentFleet.state.unload.reduce((total, { amount, cargoId }) => total +
+            cargoStorageUnits(amount, queuedDefinitions.get(cargoId).storageCost), 0n);
+        if (currentFleet.cargoHold.storageCost + loadCargoStorage >
             currentFleet.stats.cargo.cargoCapacity) {
             reason = 'Fleet cargo destination overflow';
         }
@@ -1718,15 +1715,15 @@ export async function planRecoverClaimStakeFleetTransfer(ctx, fleet, stake, inpu
         fail(`Fleet ${fleet.name}'s Claim Stake transfer is currently executable. Use the permissionless normal exit path; recovery is only for a locally proven non-executable transfer.`, fleet.address);
     }
     const description = `Recover fleet ${fleet.name} from its stuck Claim Stake transfer (${reason}); no cargo moves and the Fleet returns to idle.`;
-    return createPlan({
+    return buildPlannerPlan({
         kind: 'claim-stakes.recover-fleet-transfer',
         preconditions: await Promise.all([
-            precondition(fleetAccount, `Fleet ${fleet.name} retains its owner and exact elapsed, non-executable Claim Stake transfer snapshot.`),
-            precondition(stakeAccount, `Claim Stake ${stake.address} remains active with the current owner, cargo, and capacity used to prove non-executability.`),
+            accountStatePrecondition(fleetAccount, `Fleet ${fleet.name} retains its owner and exact elapsed, non-executable Claim Stake transfer snapshot.`),
+            accountStatePrecondition(stakeAccount, `Claim Stake ${stake.address} remains active with the current owner, cargo, and capacity used to prove non-executability.`),
             ...(gameAccount === undefined
                 ? []
                 : [
-                    precondition(gameAccount, `Game ${game} retains the cargo definitions used to prove the transfer is non-executable.`),
+                    accountStatePrecondition(gameAccount, `Game ${game} retains the cargo definitions used to prove the transfer is non-executable.`),
                 ]),
         ]),
         steps: [