Integrate full funded Guild Nexus Betrayal

docs/CURRENT_STATUS.md

@@ -4,8 +4,42 @@ Updated 1 October 2026. **The full twelve-faction goal is unfinished. Basic
 is playable and the six classic factions have a user-authorized Advanced preview.
 Expansion starts and full rules/publication acceptance remain gated.**
 
+The user-supplied `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf` is now
+an [authorized Advanced source of truth](RULE_DECISIONS.md#authorized-source-amendment--1-october-2026),
+including its identified unofficial rulings. The 44-page file has 2.3
+metadata but a visibly retained 2.2 editorial heading; the index records its
+SHA-256 and physical-page citations. Current Guild payment/source passages
+were compared with the wave. Wider Advanced reconciliation is not yet
+implemented, and adoption does not reset games, convert Basic, republish
+the local PDF or open mode gates.
+
+
 ## Current checkpoint and work
 
+Five implementation lanes connected [Guild Nexus Betrayal](NEXUS_GUILD_RULES.md#nexus-guild-betrayal):
+full funded shipment-payment replacement, including own upfront payment
+and the explicit occupied-Junction override. Fresh `guild-betrayal` admits
+classic/native-Guild plus base decks/Nexus, optionally genuine lobby-enabled
+Homeworlds; no in-play retrofit or public start. Four typed native source
+adapters retain exact payer/escrow, force custody and one shipment suffix.
+Neutral public acknowledgements reveal no otherwise private fee/routes;
+only own canonical eligibility exposes Use. Both scoped final reviews have
+no finding after fixing precommitted Richese parents and independently
+revalidating the native transport grant. Unsupported Cunning/Richese producer
+overlays block before spending; outside-profile behavior stays unchanged.
+Current-quote fixture progression, durable SQL rejection and same-source
+private-face comparisons replace random-route/SQL-text/independent-seed pins.
+Types, lint, **6,114 offline tests**, build and **147 selected cases** pass.
+Eighteen standalone Basic/Advanced paid/free scenarios, eight exact-version
+backed-up real CLI entries, 390-pixel Use/Pass/inspector/context-link/refresh
+and read-only saved-state checks prove exact native forces, whole-fee ledger,
+single donor escrow consumption and physical cards. Original authenticated
+seats and all unrelated games remain preserved.
+Local built-worker HTTP is **48/55**, five POST 503s plus two timeouts,
+not green. Current immutable-code container verification/push are pending;
+prior workflows and the last live footer do not verify this new code.
+Full modes, strategic AI, public starts and live deployment stay gated.
+
 Five implementation lanes connect [CHOAM Nexus Cunning Kull](NEXUS_CHOAM_RUNTIME.md#bounded-nexus-kull-profile)
 through the new fresh `nexus-kull` profile. Actual canonical Treachery fuel
 and physical Nexus are distinct costs: Nexus spends at accepted declaration,

docs/DEVELOPMENT.md

@@ -15,6 +15,16 @@ The [expansion-faction profile](EXPANSION_FACTIONS_PROTOTYPE.md) extends genuine
 setup to selected faction sets without optional modules, including Ecaz starting
 placement. Remaining combined-play guards still apply.
 
+For rules work, use the [authorized source amendment](RULE_DECISIONS.md#authorized-source-amendment--1-october-2026).
+The user-supplied root PDF `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf`
+is now an authorized Advanced source of truth, including identified
+unofficial rulings. Cite physical pages and distinguish its rulings from
+publisher provenance; retain explicit user decisions and use components/GF9
+for omitted details. Its metadata says 2.3 while its editorial heading says
+2.2; the decision index binds the exact supplied file by SHA-256.
+Do not silently change Basic, enable unfinished modes, reset games or
+republish the local PDF merely because a new reference is available.
+
 ## OMP harness workflow
 
 When continuing the full project goal, explicitly read `GOAL.local.md` if it is

docs/HOMEWORLD_PAYMENT_INCOME_RULES.md

@@ -59,6 +59,12 @@ The unoccupied calculation leaves the missing half in the bank. An occupied face
 
 Future integration must preserve the original eligible receipt, present force state and qualification history separately. Ordinary income cancellation, retained low effects, occupied percentage income and immediate ally sharing must compose from their own rules; the current unoccupied branch is not authority for a future occupied Karama outcome.
 
+### Guild Nexus Betrayal is a full-fee exception
+
+The [original Guild Nexus face and bounded payment contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal) expressly take one whole shipment payment, including one's own, and override occupied Junction income. For an accepted use, preserve the original **charged total**, not only this document's eligible `gross` or `ceil(gross / 2)`: the holder receives all of that fee once, and ordinary Guild/bank/occupier settlement for this invoice is suppressed. A four-spice fee yields four to the holder, not two plus two to an occupier. The original payer and authorized escrow still fund it once before any own-payment refund; future receipt is not upfront funding.
+
+This exception does not resolve ordinary two-odd-contributor rounding, occupation owner/expiry or retained penalties. All-pass/no-use settlement retains its native routing and guards; no hypothetical card play may admit an otherwise unresolved ordinary invoice. Free or stopped transport has no positive fee to redirect. The explicit fresh classic/Guild/Nexus profile uses genuinely seeded Homeworld custody and existing legal shipment/Junction adapters; it grants no new route or sponsorship. Its [direct bounded local verification](NEXUS_GUILD_RULES.md#verification-and-release-boundary) includes full occupied low-Junction fees, independently of this document's historical unoccupied-income evidence and broader Homeworld gates.
+
 ## Required verification before a runtime claim
 
 Meaningful regressions cover odd/even and zero receipts, rejection of two eligible odd contributions before declaration or payment, coincident 2 + 1 rounding, both contributor identities, protected original contribution evidence, module-off parity, current 4-to-5 and 5-to-4 changes across legal Ghola interruptions, cancellation without refund, all listed Emperor sources, all admitted shipment adapters and exact parent restoration. Save/recovery tests should prove no repeat debit, card acquisition, force move or faction credit, and reject altered gross/source/owner binding without persistence. Public previews may show the current numeric split but must not expose the purchased card's private face.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,65 @@
 # Dune implementation status
 
+## 1 October 2026 — full funded Guild Nexus Betrayal payment
+
+Five implementation lanes integrated engine, pure funding/custody/history,
+actual controls and four minimal legal bots, authenticated SQLite recovery
+and source guidance. Fresh exact-version/private-backup `guild-betrayal`
+entry supports classic 2..6-seat Basic/Advanced with native Guild, base decks
+and Nexus, optionally genuine lobby-enabled Homeworlds; no retrofit/public gate.
+
+Typed reserve, native Guild transport, Homeworld and Junction adapters pause
+before the original fee/force commit. Actual eligible singleton Guild Nexus
+spends once; the same payer/authorized escrow funds the full original amount
+and the holder replaces bank/Guild/occupied-Junction income. Own payment
+requires existing funds before the later refund; it is not free financing.
+All-pass leaves native routing unchanged, while free/stopped transport
+creates no award or Nexus spend. Public possible held-card presence controls
+neutral acknowledgements, not secret identity; event-only private Use adds
+no otherwise private price/source or inspector entitlement.
+
+Independent review found an accepted Advanced Richese Secret Ally parent
+whose resumed shipment failed. Actual reproduction proved spent Nexus and
+undelivered source; its unsupported offer now blocks before card/parent
+commitment. A shared native Guild/reciprocal-ally grant is independently
+revalidated on declaration, restore and commit, separate from purchased
+rates and protected returns. Both final scoped re-reviews have no finding.
+Fixture current quotes/native turn progression preserve actual storm rules;
+real SQLite total_changes excludes durable rejection writes while permitting
+credential-fenced zero-row CAS. Same-source private-face swaps and existing
+physical-card allocation repair randomized fixture assumptions.
+
+Final `npm run check`: types, lint and **6,114 offline tests** pass;
+production build passes. Selected related checks pass **147/147** in nine
+files. Eighteen standalone Basic/Advanced paid/free cases prove full fee,
+upfront own refund, donor escrow once, exact native forces and JSON repeat
+rejection. Authenticated SQL covers all adapters, self-re-signed revoked
+native grants, corrupt/orphan receipts, privacy, races and later recycling.
+
+Eight actual ready QA rooms were privately backed up and entered once by
+CLI, retaining the same authenticated seats and admitted code/roster/setup.
+Real setup/native phases and source declarations preceded 390-pixel controls:
+Basic own refund, occupied low-Junction whole fee, Guild return and all-pass;
+Advanced Homeworld bank fee, donor escrow, native Junction and free Fremen.
+Non-holder Pass has no private Guild inspector/Use. Own inspector, actual
+contextual guide link and refresh pass. Read-only database proof matches all
+eight original native force suffixes, exact spice/escrow/card ledger and
+closed receipt. No existing human games or credentials were reset.
+
+The user supplied the root unofficial Advanced 2.3 PDF as a source of truth.
+Its 44-page metadata says 2.3 while the rendered editorial heading still
+says 2.2; exact SHA/physical-page authority and material future Advanced
+reconciliation targets are recorded in RULE_DECISIONS/DEVELOPMENT and local
+goal guidance. Relevant Guild/payment/Homeworld/Nexus clauses were compared;
+this does not certify that all Advanced differences are implemented.
+The user-owned local PDF is preserved, not republished as an app asset.
+
+Local built-worker HTTP is **48/55**, five POST 503s and two timeouts:
+known Wrangler-dev limitation, not green acceptance. Current code still
+needs exact immutable-container publication proof; prior CI and live
+deployment are separate. Full Guild/Nexus/Homeworld, wider combinations,
+AI calibration and public/live release remain open.
+
 ## 1 October 2026 — source-aware CHOAM Nexus Cunning Kull
 
 Five implementation lanes connected runtime, canonical fuel/receipt policy,

docs/NEXUS_CARD_RULES.md

@@ -61,7 +61,7 @@ The private holder offer contains CHOAM's name; it includes the hand count only
 
 ## Effect integration boundaries
 
-Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; the current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). The bounded Richese Betrayal wave retains its own **Planned** verification rather than inheriting earlier auction or shipment evidence.
+Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). Bounded Richese auction and Guild shipment Betrayal checkpoints have their own direct local verification below; neither inherits certification of its complete faction, Nexus family or live deployment from earlier evidence.
 
 **Atreides is the first complete effect family to implement.** It has independent rulebook and physical-face evidence, and the engine already has private plan-element inspection. The Nexus effect needs its own cause and receipt rather than temporarily changing the inspecting faction. The second element must differ from the already inspected element. Preserve the original disclosed value if an allowed later battle edit occurs; follow the existing plan commitment rules instead of refreshing an old observation. The card specifies an element, not the entire hand or battle plan. A weapon/defense request uses actual played-card classification, including the published Reinforcements/Harass exclusions, rather than leaking a card merely because it occupies that slot.
 
@@ -114,3 +114,17 @@ To avoid identifying a secret card through timing, every unallied non-Richese se
 The reaction projects only public target/buyer/source/price/event plus own pass/use eligibility. Existing public cache inspection does not entitle anyone to the concealed Black Market face or to the Richese-family identity of a normal hidden lot; claims and printed catalog faces are not custody disclosures. Normal-deck self-purchases, special-Karama veto, unsupported counter/any-time overlays and broader modules remain outside this connected boundary. The private receipt owns exact source, invoice and continuation; independent pending/completed cursor evidence must reject missing/orphaned frames before read or SQL rather than auto-settling.
 
 The profile is explicit, fresh Basic/Advanced CHOAM/Richese plus classic seats, Nexus and the physical CHOAM deck only; it does not upgrade earlier games or open ordinary expansion starts. The dedicated internal `nexus-richese-betrayal` checklist records bounded engine, authenticated SQLite, bot, real controls and refreshed phone-browser evidence, with broader verification **Partial**. Shipment Cunning, ordinary auction, native special-Karama and a complete twelve-face catalog are not substitute verification. Full-family, combined-module and deployed acceptance remain open.
+
+## Guild Betrayal funded-payment protocol
+
+The [printed Guild face and bounded contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal) take one **full original positive shipment payment**, including the holder's own payment, and expressly override occupied Junction income. Use requires the actual singleton Guild Nexus held by an unallied non-Guild seat while native Guild is seated. The physical Nexus is the only activation cost: no Treachery slot/card or extra spice is spent.
+
+Redirect the already quoted fee once, not reduced Guild income or an additional bank award. Preserve the original payer, own remainder and authorized donor escrow; `pledgeAid` has already debited the donor, so settlement consumes escrow rather than debiting it again. Own-payment use must be fully funded before the later refund. Zero/free, declined or stopped shipments create no fee to take and keep Nexus held. Native applicable stop/rate responses precede this bounded payment gate; no new universal priority or immunity follows.
+
+The original `reserve`, `guildTransport`, `homeworld` or `junction` continuation preserves physical force/source/destination custody, tariff, shipment-used state and applicable native response/arrival suffixes once. Full occupied-Junction replacement suppresses the ordinary Guild/bank/occupier receipt for that invoice; it does not resolve ordinary contribution rounding or occupation entitlement/expiry. No extra shipment, movement, route or sponsor is granted.
+
+All publicly possible unallied non-Guild held-Nexus seats acknowledge the same event and shipper, even with irrelevant hidden faces; only canonical private eligibility exposes Use or an own blocked reason. Pass keeps the card; all required passes settle the original payment unchanged once. Projection is exactly `{event, shipper, canPass, hasPassed, canUse, blocked}` and Pass/Use actions carry event only. Unlike the public auction fields in the Richese protocol, this gate adds no fee, source/family/world, destination, forces, donor, resources or saved-receipt disclosure. Neutral acknowledgement adds no secret-price/source log or new inspection entitlement. This is an application privacy protocol, not publisher-prescribed timing.
+
+The fresh `guild-betrayal` profile is classic Basic/Advanced with native Guild, physical base decks and Nexus, optionally with genuinely seeded Homeworlds. Wider overlays and in-play retrofit are excluded. Typed producer/invoice ownership and independent pending/completed cursor evidence preserve authenticated restart and reject stale, foreign, malformed or orphaned continuations without a repeat payment, donor debit, force move or card spend. The dedicated internal `nexus-guild-betrayal` guide now records bounded local verification: 147 selected cases, 6,114 offline checks, build, actual backed-up CLI/phone actions and exact saved custody. Local HTTP 48/55 retains five 503s and two timeouts. Broad faction/module/full-game, calibrated AI, public-start and live-release gates remain closed; container publication and live deployment require separate current-revision evidence.
+
+This profile admits original native shipment producers, not Guild Cunning's second shipment or Richese Secret Ally's discounted shipment: both offers are blocked before Nexus spending or a native parent is committed, while those effects outside this profile remain unchanged. Guild Secret Ally is unavailable under the existing native-Guild-seated mode test; no new printed-effect restriction is inferred.

docs/NEXUS_GUILD_RULES.md

@@ -1,6 +1,6 @@
 # Spacing Guild Nexus: shipment source contract
 
-**Later runtime checkpoints:** [Guild Cunning](NEXUS_GUILD_CUNNING_RUNTIME.md) implements the extra-shipment continuation. [Guild Secret Ally](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) implements supported paid routes using the [focused source resolution](NEXUS_GUILD_SECRET_ALLY_RULES.md). The original audit below remains historical source evidence; its Homeworld-return question has now been sent to the user.
+**Later runtime checkpoints:** [Guild Cunning](NEXUS_GUILD_CUNNING_RUNTIME.md) implements the extra-shipment continuation. [Guild Secret Ally](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) implements supported paid routes using the [focused source resolution](NEXUS_GUILD_SECRET_ALLY_RULES.md). The [bounded Betrayal checkpoint](#nexus-guild-betrayal) below records direct local full-payment verification, separately from wider and deployed acceptance. The original audit remains historical source evidence; revisit its Secret Ally Homeworld-return question against the newly authorized Advanced reference before reopening research.
 
 Source audit, 10 September 2026. This documents the three printed panels and their integration boundaries. It does not implement them or certify complete Guild, Homeworld, Nexus or expansion compliance. [Common Nexus lifecycle](NEXUS_CARD_RULES.md) and existing release gates continue to apply. No user question was sent during this audit.
 
@@ -50,7 +50,7 @@ Bind one actual shipment payment and redirect that payment in full to the Nexus
 
 The face expressly supersedes occupied Junction collection for that payment. Preserve the original charged amount before any native low-Junction division; do not hand the card holder only the Guild's reduced half while paying the remainder to an occupier. This follows the component's full-payment override, not the [unoccupied low-Junction runtime quote](HOMEWORLD_PAYMENT_INCOME_RULES.md). The existing contributor-rounding and occupation-lifecycle questions are not resolved generally by this one card.
 
-An implementation needs an original payment identity, exact charged contributions and a committed replacement recipient before ordinary Guild/bank/occupier settlement. Preserve hidden held Nexus identities until an actual play. The already pending private-reaction timing policy applies; this audit does not invent another pause, automatic response reveal, or duplicate user question. A zero-cost Guild Ambassador shipment cannot manufacture a Betrayal award.
+An implementation needs an original payment identity, exact charged contributions and a committed replacement recipient before ordinary Guild/bank/occupier settlement. Preserve hidden held Nexus identities until an actual play. The [bounded protocol below](#nexus-guild-betrayal) is an application privacy choice, not a resolution of the publisher timing gap. A zero-cost Guild Ambassador shipment cannot manufacture a Betrayal award.
 
 ## Existing integration points and required state
 
@@ -63,3 +63,60 @@ The pure [Cunning receipt module](../game/nexus-guild-cunning.ts) records the or
 `nexusGuildCunningMoves(receipt, currentHajrUsed, movesAfterSecond)` returns only the remaining Hajr extra allowance. Ending ordinary movement forgoes at least one ordinary slot, so original movement counts zero and one both permit at most one Hajr move; an original count of two permits none. A newly played Hajr supplies that same one extra slot, while losing a previously recorded Hajr or claiming more moves than that allowance rejects. This bounded helper excludes the separate physical Ornithopter-card composition; it does not reset or mutate the original movement counter. Its [pure tests](../tests/nexus-guild-cunning.test.ts) cover declined and used first actions, Hajr before and after, spent allowances, native ownership, exact signatures, JSON restoration and private-field getter traps.
 
 Integrated verification should exercise first shipment followed by moved/declined ordinary movement, all three second-shipment forms, Hajr before/after and already consumed, cancellation of only the selected native advantage, paid BG/entry continuations, native Homeworld routes, private offers, stale requests and actual SQLite restoration. Passing the pure receipt tests does not establish those engine or persistence behaviors.
+
+## Nexus Guild Betrayal
+
+1 October 2026 bounded prototype contract. The authority for the effect is the [original printed Guild face](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), transcribed in [nexus-card-reference.ts](../game/nexus-card-reference.ts). The internal player guide is `/rules?topic=nexus-guild-betrayal#nexus-guild-betrayal`; source links stay in developer documentation, not the player-facing guide.
+
+### Entry, physical cost and funding
+
+The explicit fresh `guild-betrayal` development profile admits two to six ready classic-faction seats in Basic or Advanced, including native Guild and at least one other faction. It uses physical base decks and Nexus; Homeworlds are optional only when genuinely enabled and seeded during setup. It does not retrofit games, silently add Homeworlds, admit other expansion factions/decks or combine Leader Skills, Discoveries, Tech Tokens, Stronghold Cards, Semuta, Kull or Richese previews.
+
+Only original native shipment producers are admitted here. Native Guild Nexus Cunning's second shipment and Richese Nexus Secret Ally's discounted shipment are blocked in this profile **before** spending either singleton or creating a native parent. Those effects outside this profile remain unchanged. Guild Secret Ally is already unavailable because native Guild is seated, not because this preview establishes a new prohibition on its printed panel.
+
+Use requires an unallied non-Guild player holding the actual singleton Guild Nexus while another seated player is native Guild. The accepted Use discards that physical Nexus once. It spends no Treachery Card, Treachery hand slot or extra activation spice. Cunning and Secret Ally remain distinct modes; temporary leader control, a borrowed price or an empty Guild board does not change native roster identity.
+
+Bind the **full original positive charged fee**, its payer, authorized contributions and exact source quote before settlement. Redirect that one fee to the holder instead of any ordinary Guild, bank or occupied-Junction receipt. Do not reduce the award to `guildIncome`, add a bank award alongside normal income, or charge a second invoice.
+
+Own payment must already be affordable from personal spice and any actually authorized ally funding. Pay the original cost first, then receive the entire redirected fee; a solely self-funded holder has net zero spice change, not a free declaration financed by future income. `pledgeAid` has already removed the donor's spice into escrow: settlement consumes the original `g.aid` contribution once rather than debiting the donor again. The payer's own remainder and original donor allocation do not change because the recipient changes. Current voluntary-spend promises and committed-resource restrictions still apply.
+
+### Original native shipment adapters
+
+| Saved producer | Original adapter and facts to retain |
+| --- | --- |
+| `reserve` | `commitShipment`: ordinary physical reserves onto Arrakis, including native elite/advisor classification and valid explicitly selected native Homeworld reserve sources; original destination, tariff and own/authorized-ally contributions. |
+| `guildTransport` | `commitGuildTransport`: the exact native Guild cross-planet or return group, typed force identities, tariff and contributions. |
+| `homeworld` | `commitHomeworldShipment`: an already legal native Homeworld route, its exact source custody, destination, physical groups and paid quote. This grants no foreign route or Secret Ally Homeworld-return permission. |
+| `junction` | `performJunctionTransport`: the original accepted Junction sponsor/offer, route, physical sources, quote and contributions. Replacement does not create another sponsor or transport opportunity. |
+
+Source feasibility and full funding are rechecked before the gate. Existing native special-stop and applicable native rate responses occur first; a stopped, declined, invalid or zero-cost declaration supplies no positive payment and cannot spend Nexus or create an award. Ordinary free Fremen reinforcement and free Guild Ambassador transport stay free. This sequencing is the bounded application's settlement boundary, not a new general Nexus/Karama priority or immunity ruling.
+
+For every admitted producer, the original native payment and physical shipment complete once. Preserve reserve withdrawal, elite/advisor classification, source and destination custody, storm/entry checks, shipment-used flag and applicable arrival/response suffixes. Ordinary movement afterward remains the shipper's own opportunity; Betrayal grants no extra shipment, no extra move, no altered rate and no rerouted force.
+
+### Occupied Junction: full-payment override only
+
+The printed face expressly overrides income for occupying Junction. On accepted Use, deliver **all** of the original charged payment to the holder and suppress the ordinary Guild/bank/occupier allocation for that invoice. A four-spice fee produces four spice for the holder, not two while an occupier receives the other two. Preserve the full fee before any low-Junction division; neither an ordinary eligible Guild subtotal nor its rounded half is the card's award.
+
+This source-clear exception does not decide first-versus-current occupier entitlement, departure/replacement/contest expiry, retained occupation penalties or ordinary contributor rounding. Existing [Homeworld payment](HOMEWORLD_PAYMENT_INCOME_RULES.md) and [occupation](HOMEWORLD_OCCUPATION_RULES.md) restrictions remain for non-overridden settlement. Passing does not select a disputed owner or arithmetic interpretation; any source that cannot settle unchanged must retain its native pre-offer guard rather than use a hypothetical Betrayal play to bypass it.
+
+### Neutral acknowledgement, private Use and saved continuation
+
+Every publicly possible responder sees the same event and shipper: unallied non-Guild seats with public held-Nexus presence, including the shipper when eligible. A seat with an irrelevant secret face still acknowledges with Pass; only the privately eligible Guild-card holder sees Use and its own unavailable reason. Public membership never depends on the hidden face. No publicly possible responders means automatic ordinary settlement. This is an **application privacy protocol**, not printed timing authority, a new user ruling or blanket Karama immunity.
+
+The fixed projection is `{event, shipper, canPass, hasPassed, canUse, blocked}`. It reveals no new price, force count, route, source family/world, destination, donor, balances, recipient, raw signature or private receipt. Existing own-source and public inspection entitlements remain unchanged. The neutral wait/acknowledgement log does not disclose secret fee or source; only actual Use and the source's normal committed-result logging may report information already appropriate after shipment. A printed reference inspector is not evidence of anybody's held face.
+
+`guildBetrayalPass` and `guildBetrayalUse` carry only the offered event. The server binds the payment and recipient; a client cannot choose them. Pass keeps Nexus and spends nothing; a recorded pass cannot be undone for that event. Every required pass resumes the original settlement once with its original receiver. Accepted Use closes the gate, spends one physical Nexus and resumes the same native delivery with the fee receiver replaced. Underlying shipping, movement, pledging, cards and other decisions remain suspended until resolution.
+
+Save the typed producer continuation, original private invoice, pass set and independent pending/completed cursor/receipt. Restore must authenticate the acting seat and retain the same source, event and once-only outcome; never replay a raw shipment Action or infer permission from a missing frame. Stale/foreign events, malformed or orphaned ownership, competing Use/final-Pass and historical card recycling require unchanged rejection or one authenticated committed winner, not a repeat payment, donor debit, Nexus spend or force move.
+
+### Verification and release boundary
+
+**Bounded verification: locally verified; broader acceptance Partial.** `npm run check` passes types, lint and **6,114 offline tests**; the production build passes. The selected Guild/profile/turn/control and related Kull recovery set passes **147/147** across nine files. Engine and authenticated SQLite cases exercise all four native adapters, source-consistent revoked-grant rejection, own pre-funded refund, other/escrow payment, all-pass, occupied low Junction, singleton/force custody, neutral projections, JSON/restart, races and stale/orphan rejection. Source feasibility uses actual current native quotes rather than fixed storm-sensitive routes; durable rejection checks real SQLite changes, not attempted SQL text.
+
+Independent review and actual before/after reproduction repaired an accepted Advanced Richese Secret Ally parent that could not resume: the bounded profile now blocks that unsupported offer before card expenditure. Native transport permission is revalidated independently at declaration, restore and commit; a purchased rate is not a transport grant. Final scoped rules/persistence re-reviews report no actionable finding. Unrelated native Cunning/Secret Ally behavior remains outside this profile's guard.
+
+Eight actual ready QA lobbies entered via exact-version `guild-betrayal` CLI with private backups and their original authenticated seats. Preparation reused each admitted setup/code/roster, completed genuine native setup/phases and source actions, and arranged conserved pre-action resources; no saved room was replaced by a separately constructed game. At 390 pixels, actual controls and own printed-card inspector prove Basic own refund, occupied low-Junction full fee, native Guild return and all-pass; Advanced Homeworld bank fee, authorized escrow, native Junction and free Fremen; irrelevant-face Pass, private Use, source locking, contextual rules navigation and refresh. Read-only saved-state verification matches the original native force suffix, exact whole-fee money ledger, authorized escrow, physical Treachery/Nexus inventory and closed receipt across all eight rooms.
+
+Local built-worker HTTP is **48/55**: five POST 503 responses and two timeouts retain the known Wrangler-dev limitation, not green HTTP acceptance. The exact immutable code checkpoint still needs its mandatory isolated container verifier and separate live deployment evidence; earlier successful workflows do not verify this new source.
+
+The new preview does not inherit verification from Guild Cunning/Secret Ally, ordinary shipment tests or the twelve-face catalog. Complete Guild/Nexus/Homeworld families, wider factions/modules, strategic AI and difficulty calibration, full games, public starts and live deployment remain gated.

docs/RULE_DECISIONS.md

@@ -1,6 +1,42 @@
 # Rule decision index
 
-Updated 30 September 2026. This is the authoritative navigation index for existing decisions, not a replacement rulebook or a new ruling. Detailed linked contracts retain their source citations and exact supported boundaries. Runtime follow-ups supersede historical absence claims; passing tests establish software behavior, not publisher authority.
+Updated 1 October 2026. This is the authoritative navigation index for existing decisions, not a replacement rulebook or a new ruling. Detailed linked contracts retain their source citations and exact supported boundaries. Runtime follow-ups supersede historical absence claims; passing tests establish software behavior, not publisher authority.
+
+## Authorized source amendment — 1 October 2026
+
+The user added `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf` at the
+checkout root and authorized it as a source of truth going forward.
+Use this supplied revision for Advanced rules and clarifications, including
+its explicitly identified unofficial rulings; the former publisher-only
+restriction does not exclude this document. Preserve specific recorded user
+decisions unless changed, and use printed components and GF9 material for
+details the supplied revision does not cover. Record material differences
+and their implementation cutovers explicitly rather than silently blending
+editions or describing unofficial rulings as publisher rulings.
+
+Source identity: 44 physical PDF pages; metadata title
+`UNOFFICIAL Revised Dune Rulebook v.2.3.pages`; the visible editorial heading
+on physical page 3 still says **Version 2.2**. Cite the supplied filename and
+physical PDF page, not an assumed corrected heading.
+SHA-256: `7077aa87a973221d86d4bd2da945b40c4dec3d371caa6a68cb209758ddf1e516`.
+The user-owned local PDF is preserved, not republished as an application asset.
+
+The current Guild Betrayal wave was compared with shipment/payment rules
+(physical page 10), separate Guild Karama targets (19), Homeworld transport
+and occupation (22), Nexus lifecycle/modes (23), and native Guild tariffs
+and special stop (37). Those passages do not replace the specific printed
+Guild Nexus full-payment/own-payment/Junction override or supply a new
+response order; its bounded prepayment contract remains source-consistent.
+This is a source comparison, not runtime verification.
+
+Future Advanced reconciliation must distinguish the revision's Storm Deck
+simplification even without native Fremen (6), its explicitly revised
+alliance-constraint timing and advisor coexistence (15, 40), secrecy of
+spice/discards and hand counts outside Bidding (16), and Duke Vidal's
+Tleilaxu-ghola exception (30). These are source-led reconciliation targets,
+not claims that existing behavior has already changed. Optional variants
+remain optional, Basic is not silently converted to Advanced, and no saved
+game is reset or redealt by adopting a source.
 
 ## Recorded contracts and implementation boundaries
 
@@ -36,6 +72,7 @@ Updated 30 September 2026. This is the authoritative navigation index for existi
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |
 | Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
 | Richese Nexus Betrayal auctions | Pause at a valid original prepayment quote. Public self-cache veto discards the exact card without debit/acquisition; another buyer's positive cache/Black Market invoice keeps price/contributions/delivery and earned Harkonnen bonus while overriding the recipient to bank. All publicly possible unallied other-faction held-Nexus seats acknowledge uniformly; private identity controls only own Use. This neutral protocol is an application choice, not publisher timing. Normal hidden-family self-purchases, special-Karama veto and unsupported overlays remain excluded; no native Karama exception certifies them. Bounded engine/SQL/bot/phone scenarios are verified locally; broader verification remains Partial and public starts/full Nexus gates stay closed. | [Printed face, profile, API and saved continuation](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026), [common privacy protocol](NEXUS_CARD_RULES.md#richese-betrayal-prepayment-protocol), [auction source boundaries](RICHESE_AUCTION_RULES.md) |
+| Guild Nexus Betrayal shipment payment | Replace one original funded positive fee in full, including own pre-funded payment and the printed full occupied-Junction override; preserve original payer/contributions, consume already-debited donor escrow once and deliver the original physical shipment once. Native applicable stop/rate responses precede the bounded gate; zero/stopped shipments supply no award or Nexus cost. Public possible held-Nexus seats acknowledge uniformly; private Use changes no public price/source disclosure. Fresh classic/native-Guild/Nexus with optional genuinely seeded Homeworlds only; unsupported native Cunning/Richese shipment overlays block before card/parent commitment, and restored transport independently requires the native Guild grant. Bounded engine/SQL/bot/CLI/phone custody and refresh are locally verified; no new priority/immunity, ordinary occupation/rounding ruling or extra shipment. Broad/public/live gates remain closed. | [Printed source and bounded contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal), [common protocol](NEXUS_CARD_RULES.md#guild-betrayal-funded-payment-protocol), [internal checklist](../game/reference.ts) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
 | Sapho movement | At a clean boundary, first reorders only remaining unstarted turns; completed turns stay completed. Advanced Guild must have finished or be absent. Last retains existing protection after Guild. | [Existing source contract](JUICE_OF_SAPHO_SOURCE_UPDATE.md#movement-firstlast), [runtime](JUICE_OF_SAPHO_RUNTIME.md) |
 | Basic CHOAM / Leader Skills | Compose existing ordinary skills with native sales and own-leader Ghola revival. Finish the private optional replacement before the exact suspended sale resumes. The free revival remains completed if the resumed sale is canceled. Basic uses five ordinary leaders and 35 Treachery Cards; Auditor remains Advanced and ineligible for skills. | [Integration and source contracts](CHOAM_LEADER_SKILLS.md) |