Prototype Moritani Assassinate Leaders with saved Mentat replacement

Connect a qualifying native Advanced Moritani battle loss to private reveal/continue controls, live or already-dead opposing-faction targets, printed-strength bank bounty, and automatic Mentat replacement. Keep the revealed physical card held until Mentat, then set it aside as a public per-faction use marker and draw one private card. All four AI profiles use the owner-only legal quote. New local preview profile supports genuine setup without opening public starts.

Keep unresolved normal traitor-call duration and uniform private no-choice UX explicit. Record normal calls and guard later use without claiming a settled permanent loss. Exclude exceptional captured/foreign leader custody, other expansion factions and combined optional modules from this bounded preview. No mode or publication gate opens.

Independent source/privacy/persistence review and 32 focused cases pass. Battle obligations independently bind cleanup, sealed normal-call logs wait for public revelation, physical replacement custody rejects missing cards and forged same-turn chains, and invalid actions remain immutable. Five authenticated SQLite cases cover pending/resolved restoration, Truthtrance interruption, competing submissions, stale/duplicate actions and corrupt saves. The local writer preserves seats and unrelated rooms.

Validation: types, lint, 4690 offline tests, production build and 43 HTTP tests passed with unchanged source. Two genuine Advanced four-profile games finish in 296 and 101 actions with zero rejected candidates, ten periodic JSON rounds and eight restored final seat views. All physical cards, forces and elites remain conserved. Two observed assassination opportunities are declined; these complete games do not establish natural reveal/replacement use.

The separate browser exercise explicitly stages conserved battle forces and one physical traitor swap after genuine setup. Actual battle actions open the choice. Master Bewt dies once and pays three spice; the card remains held through cleanup and is automatically replaced at Mentat with a public set-aside marker. Pending and resolved refresh, readable context-correct inspectors, physical custody and private projection pass. Guild independently collects two spice from Arrakeen. The saved QA game remains at human Terror placement.

After the reported outage, all 801 opening games and original seat/recovery records are preserved (835 after HTTP checks). All 802 rooms and original records immediately before verification also remain unchanged. Database integrity and foreign keys pass. The healthy server was reused without restart, reset or recurring automation.

Verified source tree: ad64f6775fb4c481002cc5eccf6d31e490085d11e10b7b19fb7df4947bcf0ccd

docs/CURRENT_STATUS.md

@@ -6,10 +6,10 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest verified checkpoint: `8e1cd7b`, Emperor Nexus extra revival.
-Types, lint, **4,649 offline tests**, build and **43 HTTP tests** passed.
-All 733 opening rooms and original seat/recovery records were preserved
-(767 after HTTP checks); all 734 present immediately before verification also
+Latest verified checkpoint: `8906b41`, Truthtrance recorded knowledge.
+Types, lint, **4,662 offline tests**, build and **43 HTTP tests** passed.
+All 767 opening rooms and original seat/recovery records were preserved
+(801 after HTTP checks); all 768 present immediately before verification also
 remained unchanged. The healthy server was reused.
 
 [Mentat](MENTAT_QUESTION.md) connects private naming/disclosure before posture
@@ -43,7 +43,7 @@ forced spice payments. No answer or purchase policy is assumed. All 733 opening
 rooms and seat/recovery records survived the latest outage unchanged; a new snapshot
 protects all 734 rooms before final verification. The healthy server is reused.
 
-Current checkpoint: [Truthtrance recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), connecting
+Completed prototype: [Truthtrance recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), connecting
 stored BG prediction faction/turn, submitted current Storm dials and actually known
 Fremen forecasts. The same private verified answer drives controls, all four bots
 and saved continuation. Independent source/privacy review and 44 focused cases pass,
@@ -56,6 +56,20 @@ the healthy server is reused. A new snapshot protects all 768 rooms before broad
 verification. Final checks, preservation totals and Git delivery are recorded in
 the checkpoint commit and private report; full mode/publication gates remain.
 
+Current checkpoint: [Moritani Assassinate Leaders](MORITANI_ASSASSINATE_LEADERS.md)
+connects a qualifying battle loss to a private reveal/continue choice, living/dead
+targets, bank bounty, public markers and automatic Mentat replacement. All four
+AI profiles and saved continuation are connected in the bounded Advanced preview.
+Independent source/privacy/persistence review and 32 focused cases pass. Two genuine
+four-profile games finish in 296/101 actions with no rejections; both observed
+opportunities are declined. A separate conserved, staged browser battle verifies
+the reveal, three-spice payment, automatic physical replacement, readable inspectors
+and pending/resolved refresh. Normal-traitor-call duration and the uniform private
+UX question remain pending; exceptional custody and combined modules stay gated.
+All 801 opening games remain unchanged after the reported outage; the healthy
+server is reused. Required broad checks, source fingerprint, final preservation
+and Git delivery are recorded in the checkpoint commit and private report.
+
 ## Authoritative navigation
 
 - [Rules checklist](../game/reference.ts), topic `implementation-checklist` and

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,39 @@
 # Dune implementation status
 
+## 14 September 2026 — Moritani Assassinate Leaders prototype and outage preservation
+
+[Assassinate Leaders](MORITANI_ASSASSINATE_LEADERS.md) connects native Advanced
+Moritani's qualifying battle loss to private reveal/continue controls, a different
+opposing-faction Traitor Card, live-target death and bank bounty, and automatic
+Mentat replacement with a public set-aside marker. Dead targets remain legal with
+zero bounty. All four AI profiles use the owner's legal choices; one use per
+faction and physical held/reserve/retired custody persist across saves.
+
+The explicit local preview excludes exceptional captured/foreign leaders and
+combined modules. A uniform private step prevents hidden eligibility leaks but
+awaits the user's UX decision. Normal traitor-call duration also remains unresolved;
+a recorded call guards later use without declaring a publisher ruling. No ordinary
+start or publication gate opens. The checklist records the bounded prototype.
+
+Independent source/privacy/persistence review and 32 focused cases pass. Separate
+battle obligations bind cleanup, normal-call logs wait for public revelation, and
+replacement custody rejects missing cards and forged same-turn consumption chains.
+Five SQLite cases cover authenticated pending/resolved restoration, Truthtrance
+interruption, competing writes, stale/duplicate actions and corrupt saved receipts.
+
+Two genuine Advanced four-profile games finish in 296/101 accepted actions, with
+zero rejected candidates, ten periodic JSON rounds and all eight final seat views
+restored. Exact physical custody holds. Two opportunities are declined; these
+samples do not exercise an assassination reveal. A separate conserved, staged
+browser battle verifies Master Bewt's death, three-spice bounty, retained card,
+automatic Mentat replacement, public marker, context-correct readable inspection,
+and pending/resolved refresh. The QA game remains at human Terror placement.
+
+After the reported power failure, all 801 opening games remain unchanged and the
+healthy server is reused. Final types/lint/offline/build/HTTP results, source
+fingerprint, preservation of room and seat/recovery records, and Git delivery are
+recorded in the verified commit and private report. The full goal remains unfinished.
+
 ## 14 September 2026 — Truthtrance recorded knowledge and outage preservation
 
 [Truthtrance knowledge](TRUTHTRANCE_KNOWLEDGE.md) connects stored Bene Gesserit

docs/MORITANI_ASSASSINATE_LEADERS.md

@@ -0,0 +1,122 @@
+# Moritani: Advanced Assassinate Leaders preview
+
+14 September 2026. **Prototyped / Partial**, in an explicitly opted-in local
+preview. Normal game-start and publication gates remain closed. This is the
+battle-loss ability, separate from the random Assassination Terror token.
+
+## Authority and unresolved interpretation
+
+The [GF9 Ecaz & Moritani rulebook](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf),
+pp. 6, 14 and 16, supplies the ability, captured-own-leader answer and Karama table.
+Independent source review found no official clarification of the disputed duration
+below. The runtime uses the following undisputed sequence:
+
+1. Native Advanced Moritani loses a normal battle against a surviving opposing
+   leader disc, with no traitor called.
+2. Moritani may reveal a held Traitor Card of the opposing player's printed
+   faction, naming a different leader from the disc just opposed.
+3. A living named leader goes to the Tanks and pays its printed strength from
+   the Bank. An already-dead named leader remains a legal reveal: no repeated
+   death or spice, but the faction use and replacement still occur.
+4. Keep the revealed physical card through battle cleanup. During Mentat Pause,
+   set it aside face up as that faction's permanent use marker and draw one
+   private physical replacement. Use the advantage once per opposing faction.
+   Karama has no effect on this ability.
+
+The printed statement that a normal traitor reveal loses this advantage does not
+specify a battle, faction or game duration. The prototype records the normal call
+and explicitly guards further use; it does not label that guard as a settled
+permanent forfeiture. The user has been asked whether to keep that interaction
+gated or choose a duration. Previously normally revealed cards and exceptional
+leader custody also remain outside this first runtime contract.
+
+The captured-own-leader answer preserves original faction identity: a Moritani
+leader used by Harkonnen does not become a Harkonnen-faction assassination card.
+It does not define every other captured or foreign-ghola target interaction.
+
+## Connected scope and private information
+
+The preview supports native Moritani with Atreides, Bene Gesserit, Emperor,
+Fremen and Guild opponents, Advanced rules and the Ecaz faction expansion, without
+optional modules. Harkonnen presence is excluded uniformly from public configuration
+so candidate availability cannot reveal secret captures. Other expansion factions,
+Nexus, Leader Skills, Stronghold Cards, Homeworlds and Discoveries require further
+custody, ordering and integration work. A first-version scope is not a printed
+restriction on those combinations.
+
+Every publicly qualifying loss gets the same private reveal-or-continue opportunity,
+regardless of the hidden eligible card. Only Moritani sees its candidate identities
+and blocked reason; rivals see the same decision and no private options. This
+requires Continue even for an ineligible hand, conflicting with the user's usual
+automatic-action preference. A uniform-private-step UX question is pending, shared
+with Mentat. Until resolved, activation requires an explicit development preview;
+no ordinary action or room API enables it. A publicly spent faction or prior
+normal traitor call can be skipped without consulting hidden eligibility.
+
+All four AI profiles use the same owner-only quote. They choose a legal card or
+decline and do not inspect rival hidden state. The public history shows only
+revealed cards and face-up set-aside markers; replacement identities remain private.
+Dead-target inspection retains the printed leader strength despite its zero bounty.
+
+## Save and physical custody
+
+The resolved battle binds the opportunity's event, opposing faction and surviving
+leader. Its saved continuation is also bound to a separate battle obligation before
+the decision opens. Reveal/decline resumes that exact cleanup once. A normal
+traitor call has a separate event ledger; its explanatory log waits until the
+normal public reveal, preserving sealed submissions.
+
+A physical Traitor Card belongs to one of three zones: reserve deck, player hands,
+or this ability's public set-aside markers. Revealed cards stay held until Mentat;
+retired cards never return to the deck in this profile. A replacement remains with
+Moritani or becomes the card consumed by a later-turn assassination against another
+faction. Cross-zone duplication, missing replacements, duplicate draws, forged
+same-turn chains and altered continuation receipts fail validation.
+
+Replacement runs automatically when Mentat begins. In this bounded profile it does
+not compete with other traitor draws, and Terror placement does not alter traitor
+custody. Ordering with Face Dancers, Nexus/Rihani draws, Extortion and other modules
+remains an explicit integration boundary, not an inferred universal ordering.
+
+## Reproduction and evidence
+
+Use the existing private backup/CAS workflow with a fresh ready lobby:
+
+```sh
+node --import tsx tools/start-prototype.ts --profile moritani-assassinate --db /absolute/games.sqlite --room ABCDEFGH --version 1 --out /private/new-checkpoint
+npm test -- moritani-assassinate prototype-room
+```
+
+Rules and engine tests use genuine Advanced setup followed by explicitly staged,
+conserved forces and physical traitor swaps. They cover living and dead targets,
+no-use paths, all four profiles, private indistinguishability, sealed normal calls,
+per-faction limits, a real later-turn replacement chain, rejected-action immutability
+and corrupt saves. Authenticated SQLite tests exercise pending restoration,
+Truthtrance interruption, competing submissions and the actual Mentat replacement.
+The local writer test preserves seats and unrelated rooms and rejects repeat starts.
+
+Independent rules/privacy/persistence review and the 32-case focused union pass:
+eight pure quote cases, eleven engine cases, three controls cases, five authenticated
+SQLite cases and five prototype-writer cases (one added for this profile).
+
+Two genuine Advanced four-player samples, with all four AI profiles rotated, finish
+in 296 and 101 accepted actions with no rejected candidates. Neither sample stages
+hands, decks, forces or phases. Ten periodic JSON rounds and all eight final seat
+views restore; physical Treachery, Traitor, force and elite custody hold throughout.
+The first game offers two assassination opportunities, both declined; the second
+offers none. These samples prove continuation, not natural reveal/replacement use.
+
+A separate browser exercise starts from genuine setup with explicitly staged,
+conserved battle forces and one physical traitor swap. Real battle actions produce
+the pending choice. Revealing Master Bewt kills that live leader and pays three
+spice once; the card stays held until automatic Mentat replacement, then becomes
+a public set-aside marker. Pending and resolved refresh preserve the human seat.
+Choice and retired-card inspectors show readable, context-correct guidance. Exact
+card/force custody and private projections pass; Guild separately collects two
+spice from Arrakeen. The game remains saved at human Terror placement.
+
+All 801 opening games remain unchanged after the reported power failure. The healthy
+server is reused. Broad checks, source fingerprint, final saved-game preservation
+and Git delivery are recorded with the checkpoint. Focused and staged evidence
+does not certify a complete faction, all combinations or public
+Advanced readiness.

docs/RULE_DECISIONS.md

@@ -20,6 +20,7 @@ Updated 14 September 2026. This is the authoritative navigation index for existi
 | Guild payment | Rate, transport permission and income are distinct; power owner, shipper, contributors and independent rate-card beneficiary remain distinct. | [Rate/cancellation sources](GUILD_RATE_KARAMA_RULES.md), [implemented payment routing](GUILD_SHIPMENT_PAYMENTS.md) |
 | Truthtrance | Current facts are boolean disclosures, not promises to preserve resources. Structured Basic and base Advanced active-opportunity shipment promises bind within their documented scope (Advanced excludes Guild and optional modules); prose is not automatically enforced. | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card facts](TRUTHTRANCE_CARD_COUNT.md), [shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md), [remaining audit](TRUTHTRANCE_NONBATTLE_READINESS_20260907.md) |
 | Truthtrance hand categories | Count current physical hand custody by explicitly named primary role; alternate battle slots and faction powers do not reclassify cards. Only an aggregate answer is disclosed. | [Hand inventory](TRUTHTRANCE_HAND_INVENTORY.md) |
+| Moritani Advanced assassination preview | After an eligible battle loss, a different opposing-faction Traitor Card may be revealed even if its leader is already dead (zero bounty). Face-up set-aside and one private replacement occur during Mentat; one use per faction. Normal-call duration, uniform hidden-eligibility UX and exceptional combinations remain explicit. | [Runtime/source contract](MORITANI_ASSASSINATE_LEADERS.md) |
 | Truthtrance recorded knowledge | Questions compare an already recorded BG prediction, active submitted storm dial or actually known native Fremen forecast. Missing knowledge is unknown; only the aggregate answer is published. No future promise or unknown deck peek is created. | [Connected predicates and evidence](TRUTHTRANCE_KNOWLEDGE.md) |
 | Nexus lifecycle | Twelve physical cards, phase draw/replacement and alliance forfeiture; native Cunning, absent-faction Secret Ally and Betrayal have separate effects. No blanket Karama immunity. | [Common source contract](NEXUS_CARD_RULES.md), [lifecycle runtime](NEXUS_CARD_RUNTIME.md) |
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |