Add reusable base game samples across player counts

The existing offline faction runner now selects genuine Basic and Advanced base games with two through six players. Original six expansion defaults and seed offsets remain stable; player-count filters require the explicit base profile. Saved AI profiles choose every setup and game action. This replaces repeated private harness copies while preserving source-bound private reports, failed traces and explicit snapshot resume.

Shared custody checks include every physical Treachery zone, nonnegative integer resources, twenty-force totals, the distinct Emperor/Fremen/Ixian elite totals and subsets, and canonical base Traitor identities after dealing. Rejected actions must leave their input unchanged; periodic JSON restoration compares all private views and excludes rival private hand/spice/Traitor/Face Dancer fields. Optional modules and separate private previews cannot be resumed as ordinary fixed scenarios. Resume still requires checking original setup provenance and intentionally restarts the selected random stream.

Independent review caught and corrected seven-cyborg accounting, save-derived Traitor expectations, missing elite records and private-preview classification. Meaningful regressions cover those failures plus strict filters, original names/seeds, failed subprocess reporting, source stability and resume. Types, lint and 4823 offline tests pass. No application, dependency, HTTP or database code changed, so build/HTTP suites were not repeated.

All ten base and six existing expansion samples completed on the final unchanged source: 6746 accepted actions, 175 periodic restores, 82 rejected candidates retained in traces. The expansion guarded-arrival fallbacks remain visible; these samples do not certify every faction, optional module, player-count rule or difficulty ordering. Exact expansion Traitor/Face Dancer custody still needs its own adapter. The earlier pilot/source-changed report remains private; the required check was repeated after the late review correction rather than accepting results from changing source.

All 1038 opening games and original seat/recovery records are unchanged; 1038 rooms remain. SQLite integrity and foreign keys pass. The existing QA table restored its saved seat and fulfilled shipment after browser refresh. The healthy server was reused without reset or restart.

The rules register now explicitly records the Moritani Secret Ally after-loss privacy blocker. A holder-only pause exposes its hidden Nexus; the existing alliance-retention helper does not resolve the shared pending response UX decision. No duplicate user question, new house rule or mode/publication gate change was introduced.

Verified source tree: 85d5a53fa72efb9704c1828526aaccba1554670307ce476f729eae9c5c4abff9

docs/NEXUS_CARD_RULES.md

@@ -77,3 +77,19 @@ Later focused source contracts cover [Emperor strength, purchases and revival](N
 - A complete twelve-card reference/inventory and common lifecycle are substantial first work, but do not alone make all thirty-six panels playable. Keep the public module release gated until every face's supported timing, secrecy, custody, bots, UI, rejection, multiplayer CAS and saved continuation paths are verified. If development supports only Atreides' family first, other faces must remain accurately represented and explicitly unavailable in the audit mode; they must not silently act as blanks in a released module.
 
 No user question was sent during this audit. No tournament rule, fan effect, public predeal reveal, extra Nexus identity or Discoveries prerequisite has been adopted.
+
+## Moritani Secret Ally retention timing
+
+14 September follow-up. The recorded physical card permits retaining one
+otherwise retainable played Treachery Card after losing a battle with a winner;
+mandatory discards stay excluded. The existing Moritani alliance retention
+quote, card selection and saved discard continuation can supply the physical
+operation, but do not supply a private opportunity to use a hidden Nexus card.
+
+Automatically continuing a loser without the card while pausing a holder
+reveals custody through the table's progress. Calling both paths the same
+cleanup boundary does not hide that difference. Committing before the result
+moves the printed after-loss choice earlier. A universal loser confirmation
+requires the same pending product exception as other hidden optional reactions.
+Keep this effect unavailable until that shared response policy is resolved;
+no new outcome ruling or duplicate user question is introduced by this audit.