Prototype Emperor Nexus bank-auction purchase

docs/CURRENT_STATUS.md

@@ -80,6 +80,17 @@ normal-first elite selection and battle-loss accounting remain explicitly
 provisional interpretations, not a publisher or user ruling; full variant and
 public mode gates remain closed. This source is not in the live image.
 
+The bounded [Emperor Nexus Secret Ally bank-auction purchase](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md#bank-auction-purchase-alternative)
+connects the separate retained-price alternative in Basic/Advanced
+classic-faction Nexus-only games. An unallied winner proves the final bid from
+their own spice, keeps it, takes the physical Treachery lot and spends the
+Nexus; owner controls, legal AI, signed history and saved SQLite continuation
+are wired. Every eligible winner receives the same payment confirmation
+regardless of hidden card custody; this privacy-preserving timing is
+**provisional**, with the prior user question still pending. Seller payments,
+allied splits, non-Bidding sources, Betrayal and complete Nexus remain gated.
+This source is not in the live image.
+
 5,408 offline tests, 52 HTTP tests, build, twenty-two administrator HTTP groups
 and desktop/mobile browser acceptance passed. Deployment delivery was
 unconfirmed at that checkpoint; the current production revision is recorded

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,32 @@
 # Dune implementation status
 
+## 27 September 2026 — Bounded Emperor Nexus bank-auction purchase
+
+[The separate Secret Ally purchase alternative](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md#bank-auction-purchase-alternative)
+lets an unallied holder with Emperor absent retain the full personally
+affordable winning bid on an ordinary bank-paid Treachery auction. The actual
+lot enters the winner's hand, the unique Emperor Nexus enters the discard,
+and ordinary auction follow-ups continue. A uniform winner confirmation in
+eligible classic-faction Nexus-only games avoids revealing hidden ownership;
+its timing remains a provisional product choice pending the recorded user
+question. Owner-only controls, all four legal AI profiles, signed event/receipt,
+JSON integrity and concurrent in-memory SQLite CAS/restart/replay are connected.
+Seller-paid/allied/expansion and non-Bidding transactions remain gated, as do
+the forced Emperor-payment Betrayal alternative and complete Nexus acceptance.
+
+Independent review found and prompted repair of a stale cross-lot offer event
+and a bypass of normal-auction physical custody/hand-capacity preflight.
+The offer now binds the public auction index and final price without exposing
+the hidden lot face. Twenty-four focused purchase/automatic-payment cases
+passed; the frozen offline suite passed 5,610/5,610 across 708 files.
+Isolated project TypeScript excluding only the unrelated Fremen Nexus draft,
+scoped oxlint and the app build passed. `npm run check` and full lint stop at
+that draft's missing `Player.fremenNexusMovementBlockedTurn`. A read-only local
+browser fixture displayed the owner's purchase control, bid proof and ordinary
+payment choice; a rival seat saw only the uniform waiting decision and no
+private offer or card. No room write occurred. Production remains on the
+last verified `c9a3625` image.
+
 ## 27 September 2026 — Bounded Reinforcements Battle Plan
 
 [The independent three-card runtime](REINFORCEMENTS_RUNTIME.md) now permits

docs/NEXUS_EMPEROR_RULES.md

@@ -1,6 +1,6 @@
 # Emperor Nexus: battle strength, purchase and revival
 
-Primary-source audit, 10 September 2026. This is a contract for future implementation, not a runtime-completion claim. The [common Nexus rules](NEXUS_CARD_RULES.md) and current release gates remain in force. No new user question was sent.
+Primary-source audit, 10 September 2026, with a bounded purchase-runtime note added 27 September. The source contract does not certify the full mode. The [common Nexus rules](NEXUS_CARD_RULES.md) and current release gates remain in force; no new user ruling is assumed.
 
 ## Authority
 
@@ -50,6 +50,25 @@ For an ordinary bank-paid auction, the practical result is one purchased card, u
 
 Special seller payments require a separate ruling: if Richese or another faction would receive that price, is the seller unpaid or paid by the bank? The text only tells the buyer to keep spice. Likewise, it does not expressly decide purchases outside Bidding, such as a card acquisition from an Ambassador. Do not silently route income or broaden a generic purchase hook to those sources.
 
+### Bounded bank-auction purchase prototype (27 September 2026)
+
+In Basic/Advanced classic-faction Nexus-only games with Emperor absent, the
+unallied holder can spend the physical card at a normal Bidding winner-payment
+window. The full positive final bid must be affordable from the buyer's own
+spice without ally contribution. The bank receives no spice; the winner keeps
+that balance, receives the one purchased physical Treachery Card and continues
+through normal auction follow-ups. One private signed receipt records the
+original lot, final price and unchanged buyer balance across JSON/SQLite
+recovery. No Richese/CHOAM seller payment, allied split, expansion, special
+purchase or generic card-acquisition hook is inferred from this path.
+
+Every winner in this bounded public auction context receives the same payment
+confirmation, even without the card or Karama. Otherwise a pause only for the
+concealed holder would disclose Nexus ownership. This is a **provisional
+privacy-preserving product choice**, not a printed timing rule or a user ruling;
+the previously asked confirmation-versus-gate question remains open.
+The normal spice and Karama payment choices remain available where legal.
+
 ## Secret Ally: three additional free revivals
 
 The express additional/beyond-limits wording supplies a separate force allowance rather than spending the holder's ordinary three-force quota. It revives forces, not a leader or Cheap Hero. Recruits doubles free rates and changes the normal limit; it does not double a fixed three-counter card grant. [Printed card](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), [E3, p.11](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11)
@@ -78,10 +97,11 @@ receipt, suppression and seat-private offer survive JSON and room restart;
 replay cannot spend it twice. Karama remains an independent alternative in
 the same window.
 
-This does not implement the forced-purchase Betrayal alternative or the
-Secret Ally purchase. Emperor Cunning still has its own earlier declaration
-and response; one unique Emperor Nexus card cannot be both Cunning and
-Betrayal at once. The wider Nexus module remains gated.
+This does not implement the forced-purchase Betrayal alternative. The bounded
+Secret Ally bank-auction purchase is connected above; Emperor Cunning still
+has its own earlier declaration and response. One unique Emperor Nexus card
+cannot be both Cunning and Betrayal at once. The wider Nexus module remains
+gated.
 
 The following material cases remain unresolved; no new question was sent:
 

docs/NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md

@@ -1,7 +1,7 @@
-# Emperor Nexus Secret Ally revival
+# Emperor Nexus Secret Ally revival and bank-auction purchase
 
-14 September 2026. **Prototyped**, with **Partial** rules coverage. This connects
-the separate three-force revival alternative in Basic and Advanced base-faction
+27 September 2026. **Prototyped**, with **Partial** rules coverage. These
+separate Secret Ally alternatives connect in Basic and Advanced classic-faction
 games with Nexus alone. Public module starts and publication remain gated.
 
 ## Rules and connected behavior
@@ -37,18 +37,32 @@ physical elite selector only when it offers a real choice, shows unavailability
 reasons, and disables submission while busy. The existing Nexus inspector retains
 all three printed panels. This is legal functional support, not calibrated strategy.
 
-## Purchase alternative: pending interface decision
+## Bank-auction purchase alternative
 
 The printed purchase option preserves the actual buyer's spice after proving
-the price is held. It supplies a choice when buying. A pause only for the hidden
-holder would disclose eligibility; a per-bid instruction would commit earlier,
-before opponents finish passing or bidding. Neither is silently substituted.
+the final price is held. An unallied holder, with Emperor absent, can spend the
+physical Nexus at the winner-payment decision of an ordinary bank auction.
+The winner must have the full positive bid in their own spendable spice and
+cannot use ally contribution. One actual Treachery lot enters their hand,
+their spice remains unchanged, and normal auction/card follow-ups continue.
+The public log announces the price/proof/use without revealing excess spice or
+the Treachery card face. A private signed receipt records the lot, price and
+unchanged balance; independent use markers and physical custody survive JSON
+and in-memory SQLite CAS/restart. Rival seat views omit the offer and receipt.
 
-The user has been asked whether to permit a uniform winner payment step,
-including otherwise forced spice payments, as an exception to the preference
-against forced confirmations. The answer is pending. The purchase effect is
-unimplemented; its source-specific seller-payment and non-Bidding boundaries also
-remain in the [source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price).
+**Timing is a provisional privacy choice, not a user or publisher ruling.**
+Every winner in this bounded public auction context receives the same payment
+confirmation, including a player with only spice and no Nexus card. Otherwise
+the holder-only pause would disclose hidden ownership. The existing ordinary
+spice/Karama payment choices stay available; bots use a legal purchase when
+owned and otherwise use the ordinary decision. The previously asked
+confirmation-versus-gate question remains pending; this prototype does not
+settle it for release.
+
+Seller-paid Richese/CHOAM transactions, allied split, expansions, other
+purchase sources and the forced Emperor-payment Betrayal alternative remain
+gated. The [source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price)
+records those payment boundaries.
 
 ## Prototype entry and evidence
 

docs/RULE_DECISIONS.md

@@ -85,7 +85,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | CHOAM Secret Ally battle timing | The printed after-victory inspection is optional and the Nexus identity stays secret. The connected prototype chooses a uniform use-or-continue window for every winner when Nexus is enabled and CHOAM absent; nonholders pass, while a holder may decide after the result. This privacy-preserving prompt is a product inference, not publisher text. A holder-only pause would reveal custody and a precommitment would remove the printed choice. Ordinary Karama cancellation remains unestablished by retrieved sources; no response is invented. | [After-victory inspection boundary](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) |
 | Moritani Secret Ally battle timing | The printed after-loss retention is optional and the Nexus card remains secret. The connected prototype offers the same choice to every loser when Moritani is absent and at least one publicly revealed played card is retainable; a loser with no eligible public card has no useful choice, independent of hidden custody. Only an unallied holder may spend the physical card. This prompt is a privacy-preserving product inference, not publisher timing text. Native Moritani alliance retention and its Karama response remain separate; no generic Secret Ally counter is invented. | [Nexus retention boundary](NEXUS_CARD_RULES.md#moritani-secret-ally-retention-timing) |
 | Ecaz Secret Ally traitor inquiry | The printed panel asks one selected player whether they hold any of the holder's leaders as Traitors, without identifying a leader; it specifies neither native-versus-controlled scope nor answer audience. The connected prototype chooses native printed faction leaders (including dead/captured), ordinary Traitor Cards rather than Face Dancers, and a holder-only historical yes/no. This is a privacy-preserving product interpretation, **not** a publisher ruling. Foreign Ghola/captive scope and table-wide disclosure remain release boundaries. | [Ecaz inquiry source and bounded runtime](NEXUS_ECAZ_RULES.md#bounded-secret-ally-traitor-inquiry-runtime) |
-| Emperor Secret Ally purchase timing | The purchase choice follows winning the bid. A holder-only payment pause exposes concealed card eligibility, while per-bid preauthorization moves the choice earlier. The user has been asked whether to permit a uniform winner payment confirmation, including sole spice payments, or retain the purchase gate. No answer is assumed; the independent three-force revival grant can proceed. | [Purchase source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price) |
+| Emperor Secret Ally purchase timing | The bounded normal bank-auction prototype chooses a uniform winner payment confirmation in classic-faction Nexus-only games with Emperor absent, including otherwise sole spice payments. This prevents a holder-only pause from exposing hidden card eligibility. It is a provisional product privacy choice, **not** a user or publisher ruling; the previously asked confirmation-versus-gate question remains open. Seller-paid/allied purchases and other sources stay gated. | [Source contract and bounded prototype](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price), [runtime](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md#bank-auction-purchase-alternative) |
 | Discovery prototype inferences | Free entry uses storm order and ordinary source-storm restrictions; these are general-rule inferences. Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |