Add private Ecaz Nexus Secret Ally inquiry

docs/CURRENT_STATUS.md

@@ -50,8 +50,10 @@ ally before the first Shipment and Movement turn advances. One spent card,
 a provisional Karama response and exact typed ally-force return are wired
 through human controls, legal bot action, JSON and in-memory SQL continuation,
 and focused gameplay, race and restart tests. A local browser fixture rendered
-the holder-only offer and rival Karama notice without writing a room. Secret
-Ally inquiry, Duke Cunning and combined modes remain gated. The main page
+the holder-only offer and rival Karama notice without writing a room. The
+Secret Ally inquiry has a bounded private prototype; its native-leader
+scope/answer audience, Duke Cunning and combined modes remain release gates.
+The main page
 labels its build's Git commit in the lobby and active-table masthead; local
 Git HEAD does not represent uncommitted work. The main-branch container
 workflow publishes an image but does not deploy the live site automatically.
@@ -258,7 +260,7 @@ These links define bounded working behavior, not complete module certification.
 | Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement and [Advanced Loyalty](ECAZ_LOYALTY.md), separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
 | Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md), [No-Field](SMUGGLER_NO_FIELD.md) and [battle collection](SMUGGLER_BATTLE.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md) and [worm rides](SANDMASTER_WORM.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md) and [bounded retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Orgiz transfers, Jacurutu income, Testing Station and Shrine. Orgiz's per-deposit interpretation, contested/shared benefits and mixed physical allocation remain provisional or pending. The Orgiz path in current source is not yet deployed. |
-| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Secret Ally trade and bounded after-victory inspection](NEXUS_CHOAM_SECRET_ALLY.md), [Moritani Secret Ally losing-card retention](NEXUS_MORITANI_RULES.md#secret-ally-losing-card-retention-prototype) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected. Uniform CHOAM winner and Moritani loser windows are privacy-preserving product inferences, not publisher text; Emperor purchase remains pending. A source audit or helper alone is not a completed effect. |
+| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Secret Ally trade and bounded after-victory inspection](NEXUS_CHOAM_SECRET_ALLY.md), [Moritani Secret Ally losing-card retention](NEXUS_MORITANI_RULES.md#secret-ally-losing-card-retention-prototype), [Ecaz private yes/no traitor inquiry](NEXUS_ECAZ_RULES.md#bounded-secret-ally-traitor-inquiry-runtime) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected. Uniform CHOAM winner/Moritani loser windows and Ecaz inquiry scope/audience are explicit product inferences, not publisher rulings; Emperor purchase remains pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), [recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |
 | Other cards | [Sapho runtime](JUICE_OF_SAPHO_RUNTIME.md) includes first among remaining unstarted movement turns after Advanced Guild has finished. [Recruits](RECRUITS_RUNTIME.md) connects clean Revival play; [Harass & Withdraw](HARASS_WITHDRAW_RUNTIME.md) connects the bounded battle return in the same independent three-card preview. Richese card contracts and the checklist identify other connected effects and explicit gaps. |
 | Multiplayer | [Public and private discussion](TABLE_DISCUSSION.md), saved rooms/seats, [recovery](../README.md#saved-seats-and-reconnecting), uncertain-request retry, [own-seat AI](AUTOPILOT.md), [named-player AI permission](SEAT_AI_PERMISSION.md) and [voluntary seat handover](SEAT_HANDOVER.md) have connected controls and recovery evidence. |

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,13 @@
 # Dune implementation status
 
+## 27 September 2026 — Bounded Ecaz Nexus Secret Ally traitor inquiry
+
+The [Secret Ally prototype](NEXUS_ECAZ_RULES.md#bounded-secret-ally-traitor-inquiry-runtime) lets an unallied holder spend the physical Ecaz Nexus card at a quiet boundary when Ecaz is absent and ask any seated player, including themself, whether that player holds one of the holder's native leaders as an ordinary Traitor Card. The public action names the target but discloses no answer or matching identity; the holder alone can revisit the signed historical yes/no after the target's hand changes and the Nexus discard recycles. Native printed leader scope and holder-only audience are privacy-preserving product interpretations, not publisher rulings. Basic/Advanced real actions, four AI profiles, owner/rival projections, malformed and interrupted requests, JSON recovery and concurrent in-memory SQLite CAS passed six focused cases. A local read-only browser fixture showed the holder's target control and subsequent private answer, while a rival saw neither; no room write occurred. An independent rules/privacy/persistence review found no actionable defect.
+
+The complete offline suite passed 5,571 tests across 699 files after the source tree stopped changing. Two source-bound CLI cases had reported a changed-source fingerprint during the earlier concurrent edit; all 19 CLI cases and the full suite passed on the frozen tree.
+
+The shared clean-play predicate preserves CHOAM's existing boundary (12 focused cases). App build, scoped lint and a project TypeScript check excluding only the unrelated in-progress Nexus/Fremen draft passed. `npm run check` stops on that draft's missing `Player.fremenNexusMovementBlockedTurn`; it was not included here. Full Nexus and combined-module acceptance remain gated. This checkpoint has not been deployed.
+
 ## 27 September 2026 — Bounded Moritani Nexus losing-card retention
 
 The [Secret Ally prototype](NEXUS_MORITANI_RULES.md#secret-ally-losing-card-retention-prototype) now opens the same after-loss choice for every Nexus loser when Moritani is absent and at least one publicly played card can be retained. Only an unallied holder may spend the physical Moritani Nexus card to keep one eligible played card; nonholders continue without disclosing custody. Mandatory discards and the other played cards follow ordinary saved battle cleanup. Native allied retention and its Karama response remain separate. Real Basic/Advanced battles, all four legal AI profiles, CHOAM winner inspection ordering, JSON restoration, rejected-action immutability and concurrent in-memory SQLite commits passed seven focused cases. An independent review found a Homeworld location-label crash; the corrected panel renders the server's public combat location name. Local browser views displayed the Arrakis decision, retained private hand and corrected Homeworld decision through read-only intercepted room responses; no room was mutated.

docs/NEXUS_ECAZ_RULES.md

@@ -78,5 +78,35 @@ pending snapshot binds the card's discard position, ally and exact typed board
 group through the Karama window, even if another Nexus card is discarded
 during that response. The ally's reserve counters are validated before any
 board return. Saved receipts reject replay but are not cryptographic proof of
-historical save authenticity. Ecaz Cunning's Duke override and the Secret
-Ally identity/audience questions above remain unimplemented.
+historical save authenticity. Ecaz Cunning's Duke override remains
+unimplemented; Secret Ally's exceptional leader scope and audience remain
+unsettled beyond the bounded runtime below.
+
+## Bounded Secret Ally traitor inquiry runtime
+
+When Ecaz is absent, an unallied holder may spend its physical Nexus card at
+a quiet play boundary to ask about any seated player, including themself. The
+owner-only offer lists public names and never consults a target's hidden hand
+to determine availability. Acceptance atomically reads the target's currently
+held ordinary Traitor Cards, records one yes/no answer, and consumes the Nexus
+card. The target and public chronicle learn that an inquiry occurred, but only
+the holder sees the historical answer. Later exchanges or leader deaths do not
+rewrite it. No generic Karama response to this borrowed panel is invented.
+
+For this first playable interpretation, “your leaders” means the holder's
+native faction leader identities, including dead and captured native discs,
+but not foreign captives/Gholas, Duke Vidal or Cheap Hero. Face Dancers are
+not ordinary Traitor Cards. This identity scope and the holder-only audience
+are **product interpretations**, not explicit publisher rulings. A fresh
+online search found no authenticated clarification beyond the previously
+inspected primary component and rulebook linked above. The
+exceptional controlled-pool and table-wide disclosure alternatives remain
+visible release boundaries; this prototype does not certify them.
+
+The completed, signed receipt binds the accepted event, original seats and
+factions, turn/phase, native scope and answer without storing or projecting a
+matching identity. The owner's private history survives JSON restoration and
+later Nexus discard recycling. Focused Basic/Advanced, four-profile AI,
+rejection, spectator projection and concurrent saved-room cases are in
+[the inquiry tests](../tests/nexus-ecaz-inquiry.test.ts). Full Nexus and
+combined-mode acceptance remain gated.

docs/RULE_DECISIONS.md

@@ -84,6 +84,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Testing Station contest/timing | Only sole non-advisor occupation is prototyped. Two-occupant priority/stacking remains unresolved; opening after the ordinary storm-card window is an explicit source-timing inference. Weather Control is excluded by the printed text. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | CHOAM Secret Ally battle timing | The printed after-victory inspection is optional and the Nexus identity stays secret. The connected prototype chooses a uniform use-or-continue window for every winner when Nexus is enabled and CHOAM absent; nonholders pass, while a holder may decide after the result. This privacy-preserving prompt is a product inference, not publisher text. A holder-only pause would reveal custody and a precommitment would remove the printed choice. Ordinary Karama cancellation remains unestablished by retrieved sources; no response is invented. | [After-victory inspection boundary](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) |
 | Moritani Secret Ally battle timing | The printed after-loss retention is optional and the Nexus card remains secret. The connected prototype offers the same choice to every loser when Moritani is absent and at least one publicly revealed played card is retainable; a loser with no eligible public card has no useful choice, independent of hidden custody. Only an unallied holder may spend the physical card. This prompt is a privacy-preserving product inference, not publisher timing text. Native Moritani alliance retention and its Karama response remain separate; no generic Secret Ally counter is invented. | [Nexus retention boundary](NEXUS_CARD_RULES.md#moritani-secret-ally-retention-timing) |
+| Ecaz Secret Ally traitor inquiry | The printed panel asks one selected player whether they hold any of the holder's leaders as Traitors, without identifying a leader; it specifies neither native-versus-controlled scope nor answer audience. The connected prototype chooses native printed faction leaders (including dead/captured), ordinary Traitor Cards rather than Face Dancers, and a holder-only historical yes/no. This is a privacy-preserving product interpretation, **not** a publisher ruling. Foreign Ghola/captive scope and table-wide disclosure remain release boundaries. | [Ecaz inquiry source and bounded runtime](NEXUS_ECAZ_RULES.md#bounded-secret-ally-traitor-inquiry-runtime) |
 | Emperor Secret Ally purchase timing | The purchase choice follows winning the bid. A holder-only payment pause exposes concealed card eligibility, while per-bid preauthorization moves the choice earlier. The user has been asked whether to permit a uniform winner payment confirmation, including sole spice payments, or retain the purchase gate. No answer is assumed; the independent three-force revival grant can proceed. | [Purchase source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price) |
 | Discovery prototype inferences | Free entry uses storm order and ordinary source-storm restrictions; these are general-rule inferences. Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |