Integrate Harkonnen Nexus traitor retirement and Mentat replacement

docs/CURRENT_STATUS.md

@@ -1,6 +1,6 @@
 # Current development status
 
-Updated 1 October 2026. **The full twelve-faction goal is unfinished. Basic
+Updated 2 October 2026. **The full twelve-faction goal is unfinished. Basic
 is playable and the six classic factions have a user-authorized Advanced preview.
 Expansion starts and full rules/publication acceptance remain gated.**
 
@@ -16,6 +16,33 @@ open mode gates.
 
 ## Current checkpoint and work
 
+Harkonnen Nexus Betrayal now connects actual personal and allied native traitor
+calls, exact immediate physical retirement, the surviving original battle once
+and one private actual Mentat replacement. Fresh local `harkonnen-betrayal`
+retains classic/base33/Nexus-only bounds, natural card rights and original
+allied counter preemption. Uniform acknowledgements are provisional; the
+previously asked universal reaction-policy question remains open.
+Independent review repaired an orphanable native allowance, added the public
+declared-Traitor inspector and corrected wrong-face bot fixture assumptions.
+Genuine sand battles/native declines replace an invalid Polar Sink fixture;
+real counter-free normalization is retained, not forced into a fictitious pause.
+Both final scoped reviews have no finding. Types/lint, **6,401 offline tests**,
+the **138-case affected union**, final guide **10/10** and build pass.
+Ten actual native cases and printed/BG preemption prove original stock and
+current Mentat continuation. Four privately backed-up same-setup CLI/390px
+rooms exercise human Use/Pass, actual public/own inspectors, partial refresh,
+administrator owner and original native HTTP battle/Collection/Mentat once.
+Saved proof retains all33 Treachery/all12 Nexus/Traitors, identity/circles,
+one actual private reserve-top draw and nineteen earlier QA games.
+The bounded path is **Partial development verified**, not full modes or
+deployment. Final local HTTP integration is **49/55**, not green: six requests
+returned the known Wrangler proxy 503. No automatic POST retry or weaker
+authorization is introduced. After the final isolated worker reload, all
+**70 original seats in twenty-three QA rooms** reauthenticate; saved proof
+preserves all four outcomes and nineteen earlier rooms. The actual expanded
+390px guide shows **Partial / Development: Verified** without page overflow.
+Shipping and exact-revision container evidence remain pending.
+
 The authorized Advanced **leaderless Battle Plan announcement** is now
 connected. Physical PDF page 11 requires disclosure before reveal when no
 leader or Cheap Hero can be used; existing leader/card legality was already

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,93 @@
 # Dune implementation status
 
+## 2 October 2026 — original Harkonnen Nexus traitor retirement and Mentat replacement
+
+Four exclusive implementation owners connect fresh local `harkonnen-betrayal`:
+native personal/allied calls and original continuation, pure physical/current/
+historical obligations, private controls/four minimal legal policies, and
+authenticated SQLite/private-backed-up CLI entry. Parent integrates source
+guidance and raw administrator progress, all verification and shipping. Four is
+this wave's useful slice count, not a restoration of the removed five-agent minimum.
+
+The photographed printed face cancels one revealed Harkonnen traitor, returns
+that exact physical identity immediately and draws one replacement during
+Mentat Pause. The profile admits native Harkonnen plus unique classic 2..6-seat
+Basic/Advanced, base33 Treachery and Nexus alone. No initial Nexus deal,
+old-game retrofit, public start or optional/expansion overlay. Genuine
+alliance-qualified closing Nexus rights remain; effect fixtures need at least
+three seats, with four for two simultaneous unallied receivers.
+
+Original allied Harkonnen Karama/BG counters resolve first; native denial
+opens no Nexus gate or cost. A personal call gains no invented counter.
+After genuine allowance, publicly declare the actual canonical matching
+traitor and roles before outcome; every publicly possible unallied non-Harkonnen
+held-Nexus owner acknowledges uniformly. Private face controls only own Use.
+The local ordering/privacy convention is provisional, not publisher/user
+priority or an answer to the previously asked universal reaction question.
+Outside-profile Harkonnen Betrayal and arbitrary combined stacks remain gated.
+
+Use spends one physical Nexus, shuffles only that called Harkonnen traitor
+into the actual reserve, prevents only the original call and resumes the
+surviving battle once. All-pass retains both cards and original call. One
+successful-Use obligation survives to real current Mentat opening, where the
+actual reserve top is drawn privately once before optional work/victory.
+Final Collection readiness and Mentat opening are atomic; no fictitious
+persisted due-phase8 auto-recovery state is used. Nonrecursive history binds
+each Use even after later passing/recycling, without permanent retired-card
+custody or a second action/confirmation. Returned-card redraw remains legal.
+
+Initial integrated checks exposed missing typings, an invalid Polar Sink
+battle fixture, unwanted optional prescience commitments, incorrect
+two-receiver wrong-face assumptions and a test that mutated empty counter
+passes to the same empty array. Parent retains native source guards: choose
+conserved legal sand staging/native declines, explicit distinct singleton
+receiver faces and genuine live original counter evidence. Native counter-free
+automatic allowance remains legal rather than forcing a false pause.
+Independent review repaired an orphanable native allowance: it now requires
+its exact pending or closed acknowledgement. The public declared-Traitor
+inspector reuses the existing entitled component; original/current replacement
+identities remain correctly private. Both final scoped native and privacy/
+administrator reviews have no finding.
+
+Parent typecheck/lint and **6,401/6,401** offline tests pass; the affected
+eight-file union passed **138/138**. Final reference **10/10** and build pass.
+Actual program smoke exercises eight Basic/Advanced personal/allied Use/all-pass
+paths plus two irrelevant-face partial-pass/refresh paths, from original true
+call/counters through actual native battle/Collection/Mentat. Separate printed
+and Advanced BG Worthless preemption spend native fuel once and preserve the
+original Trait/Nexus stock, with no Nexus offer, cost or replacement.
+
+Four exact-version private-backed-up CLI rooms retain their actual admitted
+undealt setup, identities/circles/decks and native Nexus rights; no redeal:
+
+- `SHMPQ4FK` v14: Basic personal human Use; actual Lady Jessica Traitor
+  and own Harkonnen Nexus inspectors, immediate exact retirement and one
+  private actual reserve-top Mentat draw.
+- `ZAYDHGTU` v15: Advanced allied human Use; caller and Guild beneficiary
+  remain distinct, Thufir Hawat declaration prevented and replacement once.
+- `3ZLRKAYB` v19: Basic allied two-receiver wrong-face human Pass/all-pass;
+  Richese/Guild cards retained. Partial v11 refresh and raw administrator
+  projection agree on sole remaining Guild, without private source disclosure.
+- `GBFG2C75` v16: Advanced personal wrong-face human Pass; original
+  Soo-Soo Sook traitor outcome and native capture/Collection suffix retained.
+
+Original remaining native votes/cleanup/readiness continue through the real
+HTTP API to Mentat, not a scripted phase jump. Read-only saved proof retains
+all33 Treachery/all12 Nexus/Traitor identities, typed forces, original names/
+circles, exact returned identity and one private pre-Mentat reserve-top draw.
+Activation has no spice/force/Treachery cost; legitimate battle/income effects
+are preserved, not hidden in an incorrect unchanged-wallet assertion.
+Nineteen earlier QA states/versions remain unchanged. Actual 390px public
+declaration/own-card inspectors and Use/Pass controls are observed; panel width
+is 354px. After final isolated worker reload, all **70 original seats in
+twenty-three QA rooms** reauthenticate and all saved outcomes remain unchanged.
+The actual expanded guide displays **Partial / Development: Verified**.
+
+Current local HTTP integration is **49/55**, not green: six requests returned
+the known Wrangler proxy 503. No automatic write retry, authorization weakening
+or reset. Complete Harkonnen/Nexus games, universal reaction policy, combined
+modules, strategic calibration, public starts and live deployment remain open.
+
 ## 1 October 2026 — Advanced leaderless declaration before reveal
 
 The supplied authorized Advanced PDF, physical page 11 **Leaders**, requires

docs/NEXUS_CARD_RUNTIME.md

@@ -1,5 +1,16 @@
 # Nexus cards: common lifecycle checkpoint
 
+**Later Harkonnen Betrayal checkpoint:** the separate fresh local
+`harkonnen-betrayal` profile connects actual personal and allied native
+traitor calls. Native allied counters precede provisional neutral
+acknowledgements; Use returns only the declared physical traitor immediately,
+prevents that call and preserves one actual private Mentat replacement.
+The previously asked universal reaction-policy question remains open.
+Verification is **Partial development verified** for frozen native/private/
+SQLite/CLI/phone evidence, including immediate retirement and actual Mentat draw;
+see the [bounded existing source contract](NEXUS_HARKONNEN_RULES.md#bounded-betrayal-preview-contract--1-october-2026).
+No historical checkpoint verifies this path or opens public/combined modes.
+
 **Later Ixian Betrayal prototype:** the fresh local `ixian-betrayal` profile
 connects both printed alternatives to original native attempts: Bidding
 extra-card inspection/draw and Advanced Technology exchange. Native counters

docs/NEXUS_HARKONNEN_RULES.md

@@ -2,6 +2,81 @@
 
 Source audit, 10 September 2026. This is a rules contract, not a runtime completion claim. The [common Nexus lifecycle](NEXUS_CARD_RULES.md) and existing expansion release gates still apply. The pending reaction-privacy question remains unresolved; this audit does not authorize a Betrayal reaction policy.
 
+**1 October bounded local follow-up, verified 2 October:** `harkonnen-betrayal`
+connects a separate fresh classic/base-deck/Nexus-only Basic/Advanced preview.
+Native allied Harkonnen counters precede a uniform acknowledgement by public
+possible unallied held-Nexus owners before the original battle outcome.
+This is an explicitly provisional local ordering/privacy convention, not an
+answer to the previously asked universal reaction policy or a publisher ruling.
+The old audit's pending questions remain open outside this profile. No public
+start, old-game retrofit or combined-module gate is opened. Verification is
+**Partial**, with development stage **Verified** for the bounded evidence below.
+
+## Bounded Betrayal preview contract — 1 October 2026
+
+The profile requires native Harkonnen and unique 2..6 classic seats,
+the physical base33 Treachery Deck and twelve Nexus cards alone. Ix/CHOAM/Ecaz
+decks and factions, Homeworlds, Leader Skills, Discoveries, Semuta and other
+overlays are excluded. Natural alliance-qualified closing Nexus rights still
+apply; no initial deal is added. An effect needs at least three actual seats;
+two simultaneous unallied receivers need four. Two-seat ordinary continuation
+is valid without a fabricated card or alliance.
+
+Admit only an actual legally matching native personal or allied traitor call
+with canonical original battle/event, revealed plans, provider, combatant
+beneficiary, target and physical identity. Original allied Karama/BG counter
+allowance comes first; native cancellation opens no Nexus gate or cost.
+Personal calls gain no new native counter. Invalid, false, protected,
+non-Harkonnen, finished or changed sources reject rather than offering a retry.
+
+After genuine native allowance, the actual matched traitor is publicly declared
+before its outcome. Every publicly possible unallied non-Harkonnen held-Nexus
+owner acknowledges uniformly, independently of private face; only own eligibility
+exposes Use or a blocked reason. Public roles and that actual identity grant no
+other Harkonnen traitor, rival Nexus, reserve order, source or receipt entitlement.
+Other unsubmitted traitor choices stay private. Own Nexus inspection uses only
+the existing actual-card entitlement.
+
+Pass retains both cards; all required passes preserve the original call once.
+Use spends one physical Harkonnen Nexus, removes only the declared Harkonnen
+Traitor Card, shuffles it into the actual reserve immediately, prevents that call
+and resumes the surviving original battle once. Preserve a consistent historical
+declaration without implying current Harkonnen ownership after return. No battle
+rewind, automatic refund, other traitor cancellation, Treachery slot, spice,
+force or leader cost is added.
+
+One exact successful-Use obligation survives to actual current Mentat opening.
+The native transition draws the actual reserve top privately once before optional
+Mentat work/victory acceptance in this bounded profile, records drawn provenance
+and retires the due marker. It can legitimately redraw the retired identity
+after its shuffle. There is no extra click or selector and no artificial saved
+half-phase draw state: final Collection readiness and Mentat opening are atomic.
+Refresh/recovery cannot reshuffle, redraw or repeat the battle/phase suffix.
+Nonrecursive history binds each Use obligation rather than whichever later
+all-pass receipt is last; closed history does not freeze retired-card ownership.
+
+Both actions submit the offered event only. Pending gates retain native
+response/decision/Truthtrance priority and independent own-seat autopilot, while
+blocking ordinary votes and competing custody mutation. All four difficulties
+use canonical private minimal Use/Pass choices, not strategic calibration.
+Current-source corruption and foreign/stale/extra payloads reject immutably.
+
+Parent verification is **Partial development verified**: types/lint and
+**6,401/6,401** offline tests pass; the affected eight-file union passed
+**138/138**. Ten actual native personal/allied Basic/Advanced Use/all-pass/
+partial-refresh cases reach the real Mentat transition; printed and Advanced
+BG Worthless preemption retain original cards and spend native fuel once.
+Four privately backed-up original-setup CLI/390px rooms exercise human Use,
+wrong-face Pass, both public/own inspectors, partial refresh and actual native
+HTTP battle/Collection/Mentat continuation. Read-only proof retains all33
+Treachery/all12 Nexus/Traitor stock, identity/circles, exact retired identity,
+one private actual reserve-top replacement and nineteen earlier QA rooms.
+Administrator progress matches the sole public unfinished acknowledgement.
+Both final scoped native and privacy reviews have no finding.
+The printed face, separate universal reaction question, competing-module/
+Traitor-Deck priority and deployment remain distinct. This is not complete
+Harkonnen/Nexus play or a deployed claim.
+
 ## Primary authority
 
 - [The original printed Nexus components](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani): the Harkonnen face was freshly inspected in the previously acquired 3024×4032 photograph, `/tmp/dune-nexus-cards.jpg`. Its three panels establish the effects below. The photographed publisher text is the authority, not the uploader's commentary.

docs/RULE_DECISIONS.md

@@ -122,6 +122,7 @@ independent decisions are not reconciled by this cutover.
 | Guild Nexus Betrayal shipment payment | Replace one original funded positive fee in full, including own pre-funded payment and the printed full occupied-Junction override; preserve original payer/contributions, consume already-debited donor escrow once and deliver the original physical shipment once. Native applicable stop/rate responses precede the bounded gate; zero/stopped shipments supply no award or Nexus cost. Public possible held-Nexus seats acknowledge uniformly; private Use changes no public price/source disclosure. Fresh classic/native-Guild/Nexus with optional genuinely seeded Homeworlds only; unsupported native Cunning/Richese shipment overlays block before card/parent commitment, and restored transport independently requires the native Guild grant. Bounded engine/SQL/bot/CLI/phone custody and refresh are locally verified; no new priority/immunity, ordinary occupation/rounding ruling or extra shipment. Broad/public/live gates remain closed. | [Printed source and bounded contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal), [common protocol](NEXUS_CARD_RULES.md#guild-betrayal-funded-payment-protocol), [internal checklist](../game/reference.ts) |
 | Ixian Nexus Secret Ally replacement | Fresh classic/base-deck/Nexus-only Basic or Advanced local `ixian-replacement` profile binds one genuine normal paid/printed Karama purchase. Discard exactly that purchased physical card before privately drawing the actual deck top; full-hand and exhausted-deck same-card redraw are legal. Keep original payment, income and native auction suffix once; no refund, re-auction or new native Ixian Karama response. Every publicly possible supported unallied held-Nexus buyer gets the same neutral choice irrespective of hidden face; only the owner has Pass/entitled inspection and private eligible Use. This is an inferred development privacy convention, not publisher timing. Harkonnen buyers, Richese cache/Black Market/special origins, anytime overlays and combined modules stay guarded pending their independent source/priority questions. Existing native Ixian ally replacement is distinct. Verification Planned; no retrofit, public start or full-family certification. | [Photographed face and bounded runtime contract](NEXUS_IXIAN_REPLACEMENT_RULES.md#bounded-local-runtime-contract) |
 | Ixian Nexus Betrayal: Bidding or Technology | Fresh native-Ixian/classic-or-Tleilaxu Basic/Advanced local `ixian-betrayal` uses Ix47 Treachery and Nexus alone, with no initial Nexus deal or old-save retrofit. Resolve actual native Karama/BG counters first; a native denial opens no Nexus gate or cost. After all native passes, uniform publicly possible unallied non-Ixian held-Nexus seats acknowledge before the native effect; concealed face governs only private Use. These are bounded privacy/ordering inferences, not publisher universal priority. One physical Ixian Nexus denies one current Bidding attempt (normal count, no Ixian inspection/return) or one Advanced Technology declaration (both card locations preserved, attempt remains used); all-pass allows the original effect and suffix once. No whole-phase ban, completed undo, invented direct-Nexus Karama counter or blanket immunity. Richese special-lot exchange, wider priority/modules, complete games, strategy and public/live release remain open; verification is Planned pending frozen direct evidence. | [Photographed face and native source protocol](NEXUS_CARD_RULES.md#bounded-ixian-betrayal-source-protocol--1-october-2026), [fresh local runtime and acceptance](NEXUS_CARD_RUNTIME.md#bounded-ixian-betrayal-local-runtime--1-october-2026), [five-facet internal topic](../game/reference.ts) |
+| Harkonnen Nexus Betrayal local preview | Fresh classic/base33/Nexus-only `harkonnen-betrayal` admits genuine personal/allied native matching calls. Native allied Karama/BG allowance comes first; a provisional uniform acknowledgement precedes the original outcome. Use returns the exact physical traitor immediately and preserves one automatic private actual Mentat replacement. The local ordering/privacy convention is not publisher/user priority and does not answer the previously asked universal reaction policy; public starts, old-game retrofit, arbitrary stacks and combined modules remain gated. Bounded native/private/recovery/CLI/phone verification is Partial development verified, not complete modes or deployment. | [Bounded source contract](NEXUS_HARKONNEN_RULES.md#bounded-betrayal-preview-contract--1-october-2026), [runtime limits](NEXUS_CARD_RUNTIME.md) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
 | Sapho movement | At a clean boundary, first reorders only remaining unstarted turns; completed turns stay completed. Advanced Guild must have finished or be absent. Last retains existing protection after Guild. | [Existing source contract](JUICE_OF_SAPHO_SOURCE_UPDATE.md#movement-firstlast), [runtime](JUICE_OF_SAPHO_RUNTIME.md) |
 | Basic CHOAM / Leader Skills | Compose existing ordinary skills with native sales and own-leader Ghola revival. Finish the private optional replacement before the exact suspended sale resumes. The free revival remains completed if the resumed sale is canceled. Basic uses five ordinary leaders and 35 Treachery Cards; Auditor remains Advanced and ineligible for skills. | [Integration and source contracts](CHOAM_LEADER_SKILLS.md) |