Connect Emperor Nexus extra revival with private saved continuation

Add the absent-Emperor Secret Ally alternative returning exactly three eligible forces free in Basic/Advanced base-faction Nexus games. Preserve ordinary force/free-revival allowances and the shared Advanced Fedaykin cap. Keep the action optional and private, consume the physical Nexus once, and validate durable source receipts through later ordinary revival and Ghola. Purchase timing remains pending the earlier uniform winner-payment UX question; partial returns and combined-module interactions remain guarded. No mode or publication gate opens.

Connect private controls, explicit physical elite selection, all four legal AI profiles and a dedicated rules checklist entry. Extend the reusable local prototype writer with genuine twelve-card Nexus setup. Independent review covers rules timing, private projection, physical custody, JSON and production SQLite restore, lost-response replay and competing requests. Seventeen focused effect cases and four prototype-writer cases pass.

Validation: typecheck, lint, 4649 offline tests, production build and 43 HTTP tests passed with unchanged source. Genuine-start Basic and Advanced samples completed in 715 and 263 actions with 19 and 7 periodic JSON restores, respectively, and no Emperor uses. Two explicitly staged continuations completed in 18 and 17 actions with one normal-force Emperor return each. All four had zero rejections and preserved exact Treachery, force, elite and Nexus custody; all fourteen final seat views restored unchanged. They are bounded continuation evidence, not natural full-game acceptance of the effect or AI calibration.

In the conserved staged browser scenario, Advanced Fremen returned three forces including one Fedaykin using the Nexus, then three normal forces using the ordinary allowance. Reserves rose from three to nine, Tanks fell from seven to one, spice stayed three and the physical Nexus was spent once. The inspector was readable, the action notice displayed, and pending/resolved refresh restoration, physical custody and private projection passed.

After the reported power outage, all 733 opening games and original seat/recovery records were preserved (767 after HTTP checks); database integrity and foreign keys passed. All 734 rooms immediately before broad verification remained unchanged. Reused the healthy server without restart, reset or recurring automation.

Verified source tree: fd09a4bc71018cb7ef98c7e25c25dacc495ffed304dbd0cdfa223e539e8fa5e1

docs/CURRENT_STATUS.md

@@ -6,19 +6,18 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest verified checkpoint: `9f1f783`, private Mentat question preview.
-Types, lint, **4,605 offline tests**, build and **43 HTTP tests** passed.
-All 665 opening rooms and original seat/recovery records were preserved
-(699 after HTTP checks). The existing server was reused after the outage;
-Ecaz, Ixian and Mentat browser seats restored their private state and decisions.
-The only post-verification edit removed an extra newline in a developer document.
+Previous verified checkpoint: `d0dc700`, Bureaucrat payment redirection.
+Types, lint, **4,631 offline tests**, build and **43 HTTP tests** passed.
+All 699 opening rooms and original seat/recovery records were preserved
+(733 after HTTP checks). All 700 rooms present immediately before verification
+also remained unchanged. The healthy server was reused after the outage.
 
 [Mentat](MENTAT_QUESTION.md) connects private naming/disclosure before posture
 and faction powers, all four AI profiles and saved continuation in explicitly
 opted-in previews. Two controlled-shuffle genuine-setup samples finish. Ordinary
 activation still awaits the uniform private response UX decision.
 
-The current milestone connects [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md):
+[Bureaucrat payments](BUREAUCRAT_PAYMENTS.md) connect
 ordinary auctions, shipment income, Richese sale proceeds and actual bribe
 transfers, with a once-per-phase optional redirection and preserved continuation.
 Qualifying allied funding, other payment families and combined-module acceptance
@@ -29,6 +28,21 @@ All 699 opening rooms and original seat/recovery records survived the reported
 outage. The healthy server was reused. The completed checkpoint's Git record
 contains final broad verification and post-HTTP preservation totals.
 
+Current checkpoint: [Emperor Nexus Secret Ally revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md).
+Exactly three free returns, independent ordinary allowances, shared Fedaykin caps,
+private controls, four AI profiles and saved continuation are connected. Independent
+review and 17 focused effect tests pass. Two genuine-start and two explicitly staged
+samples finish with zero rejections; only the staged pair uses this effect. A staged
+browser exercise verifies a Fedaykin return, three ordinary returns and refresh.
+Final broad checks, preservation counts and Git delivery are recorded in the
+checkpoint commit and private report before handoff.
+
+The purchase alternative still needs a private post-win payment choice. The earlier
+question asks whether to allow a uniform winner payment step, including otherwise
+forced spice payments. No answer or purchase policy is assumed. All 733 opening
+rooms and seat/recovery records survived the latest outage unchanged; a new snapshot
+protects all 734 rooms before final verification. The healthy server is reused.
+
 ## Authoritative navigation
 
 - [Rules checklist](../game/reference.ts), topic `implementation-checklist` and
@@ -56,7 +70,7 @@ These links define bounded working behavior, not complete module certification.
 | Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement, separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
 | Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md) and [No-Field](SMUGGLER_NO_FIELD.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Jacurutu income, Testing Station and Shrine. Orgiz and contested/mixed cases remain pending. |
-| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) is connected; its after-victory inspection remains pending. A source audit or helper alone is not a completed effect. |
+| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected; CHOAM inspection and Emperor purchase remain pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |
 | Other cards | [Sapho runtime](JUICE_OF_SAPHO_RUNTIME.md) includes first among remaining unstarted movement turns after Advanced Guild has finished. Richese card contracts and the checklist identify the other connected effects and explicit gaps. |
 | Multiplayer | Saved rooms/seats, [recovery](../README.md#saved-seats-and-reconnecting), uncertain-request retry, [own-seat AI](AUTOPILOT.md), and [voluntary seat handover](SEAT_HANDOVER.md) have connected controls and recovery evidence. |

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,32 @@
 # Dune implementation status
 
+
+## 14 September 2026 — Emperor Nexus revival prototype and outage recovery
+
+[Emperor Secret Ally](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) now connects exactly
+three additional free force returns in Basic/Advanced base-faction Nexus games.
+It preserves ordinary force/free allowances, shared Advanced Fedaykin caps and
+physical card custody, without a public pause or forced pass. Private legal
+controls, four AI profiles, JSON continuation and production SQLite recovery are
+connected. Independent review validates phase-wide timing and private receipts;
+17 focused effect tests cover illegal/stale/competing requests and later Ghola.
+The separate purchase alternative remains pending its uniform payment UX question.
+
+Two genuine-start samples finish (Basic 715 actions/19 periodic JSON rounds;
+Advanced 263/7), with no Emperor use. Two explicitly staged continuations finish
+in 18 and 17 actions with one normal-force return each. All candidates are legal;
+exact Treachery, force, elite and Nexus custody holds, and all 14 final seat views
+restore unchanged. These samples retain their setup and coverage limitations.
+The separate staged browser game exercises a Fedaykin return, then three ordinary
+revivals, unchanged spice, readable inspection and refresh recovery. The reusable
+local prototype writer adds genuine Nexus setup without opening public starts.
+
+All 733 opening games and original seat/recovery records survived the reported
+power failure unchanged. Integrity/foreign keys pass and the healthy server is
+reused. A new snapshot protects all 734 rooms before final checks. The verified
+commit and private report record required broad checks, source fingerprint,
+post-HTTP preservation and Git delivery. Full module and publication gates remain.
+
 ## 14 September 2026 — Bureaucrat payment prototype and outage preservation
 
 [Bureaucrat](BUREAUCRAT_PAYMENTS.md) now connects optional two-spice redirection

docs/NEXUS_CARD_RUNTIME.md

@@ -1,5 +1,7 @@
 # Nexus cards: common lifecycle checkpoint
 
+The later [Emperor Secret Ally revival prototype](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) adds exactly three additional free force returns, separate ordinary allowances, private controls and saved continuation. Its purchase alternative and full module acceptance remain pending.
+
 **Later Guild Secret Ally runtime:** [NEXUS_GUILD_SECRET_ALLY_RUNTIME.md](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) records explicitly selected Guild prices, cross/return routes, typed Homeworld sources, paid Fremen reinforcement and committed shipment history. The card changes one shipment, without creating a native Guild or a real alliance. The Homeworld-return ruling and full module completion remain pending.
 
 The later [Richese Secret Ally checkpoint](NEXUS_RICHESE_RUNTIME.md) adds an ordinary physical reserve shipment priced as one force; its other effects and complete module acceptance remain gated.

docs/NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md

@@ -0,0 +1,97 @@
+# Emperor Nexus Secret Ally revival
+
+14 September 2026. **Prototyped**, with **Partial** rules coverage. This connects
+the separate three-force revival alternative in Basic and Advanced base-faction
+games with Nexus alone. Public module starts and publication remain gated.
+
+## Rules and connected behavior
+
+The printed Emperor Nexus has an alternative Secret Ally grant during Revival:
+three additional forces return free, beyond ordinary revival limits. Emperor
+must be absent and the holder unallied. The grant does not revive leaders, spend
+spice, or consume ordinary force/free-revival allowances. It can precede or follow
+ordinary returns while Revival remains open. Submitting the interface's ready
+action does not itself end that phase or invent a new card deadline.
+[Printed cards](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani),
+[source audit](NEXUS_EMPEROR_RULES.md#secret-ally-three-additional-free-revivals)
+
+The ordinary Advanced one-per-turn special-force revival cap remains in force.
+For this roster, that means Fedaykin. The holder chooses among legal normal/elite
+groups totaling exactly three; one printed counter cannot become two forces.
+Fewer than three eligible counters remains a recorded source gap, not an implicit
+up-to-three option. Recruits, Tleilaxu income/prevention, CHOAM suppression,
+Homeworld deployment and other combined-module producers remain outside this
+batch. A different player's ordinary Fremen ally grant does not block the holder.
+[November FAQ, p. 2](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=2)
+
+The engine consumes the physical Nexus and moves the exact force group in one
+action. A private receipt records the original pools, mode and conserved delta;
+independent event markers reject missing, duplicated or reordered history.
+Historical pools are not compared with all later current pools: ordinary revivals,
+Ghola and later battles can legitimately change them. The current card and event
+must still authorize a fresh use. Saved views never expose that receipt or rival
+hands/spice. The private offer creates no table-wide decision or forced pass.
+
+All four AI profiles use the same projected legal choices. The UI supplies a
+physical elite selector only when it offers a real choice, shows unavailability
+reasons, and disables submission while busy. The existing Nexus inspector retains
+all three printed panels. This is legal functional support, not calibrated strategy.
+
+## Purchase alternative: pending interface decision
+
+The printed purchase option preserves the actual buyer's spice after proving
+the price is held. It supplies a choice when buying. A pause only for the hidden
+holder would disclose eligibility; a per-bid instruction would commit earlier,
+before opponents finish passing or bidding. Neither is silently substituted.
+
+The user has been asked whether to permit a uniform winner payment step,
+including otherwise forced spice payments, as an exception to the preference
+against forced confirmations. The answer is pending. The purchase effect is
+unimplemented; its source-specific seller-payment and non-Bidding boundaries also
+remain in the [source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price).
+
+## Prototype entry and evidence
+
+A fresh ready local lobby can use the existing reusable writer:
+
+```sh
+node --import tsx tools/start-prototype.ts --profile nexus \
+  --db PATH_TO_LOCAL_D1_SQLITE --room EIGHT_CHARACTER_CODE \
+  --version CURRENT_LOBBY_VERSION --out /private/new-prototype-checkpoint
+```
+
+It enables the real twelve-card Nexus setup, backs up saved games, compares the
+original room/version atomically, preserves seats and other rooms, and rejects
+redealing a started game. The Nexus is drawn through the ordinary closing-phase
+opportunity; the writer does not deal a chosen card directly to a player.
+
+Focused tests exercise ordinary-first and Nexus-first returns, zero-spice use,
+Fedaykin caps, later Ghola, native/Betrayal exclusion, private controls and bots,
+JSON recovery, corruption, SQLite restart, lost-response replay and competing
+normal/elite choices. The fixture executes the real setup, alliance and Nexus
+draw actions but controls starting hands, deck order and the later loss topology.
+It is a targeted scenario, not an untouched complete game.
+
+Independent source/privacy review and 17 focused effect tests pass; four prototype
+writer tests also pass. Two genuine-start samples with all four AI profiles finish:
+Basic 715 actions/19 periodic JSON restores and Advanced 263/7, both with zero
+rejected candidates and no Emperor use. Two explicitly staged continuations finish
+in 18 Basic and 17 Advanced actions, with one normal-force Nexus return each and no
+rejections. All samples preserve exact Treachery, force, elite and Nexus custody;
+all 14 final seat views also survive restoration. These are bounded continuation
+checks, not natural full-game acceptance of the Emperor effect or AI calibration.
+
+A separate staged Advanced Fremen browser game spends the Nexus on three forces,
+including one Fedaykin, then revives three ordinary normal forces. Reserves rise
+from three to nine, Tanks fall from seven to one, spice remains three and the
+ordinary free allowance is used only by the second return. One Fedaykin remains
+in Tanks under the shared elite cap; the card is discarded exactly once. The full
+inspector is readable, the action notice appears, and pending/resolved states
+restore through refresh. Private projections and unchanged physical totals pass.
+
+After the power outage, all 733 opening rooms and original seat/recovery records
+match the private backup; database integrity and foreign keys pass. The healthy
+server is reused without restart. A separate pre-verification snapshot protects
+all 734 rooms, including the new QA game. Required broad results, final
+preservation totals, source fingerprint and push confirmation are recorded in the
+checkpoint commit and private report.

docs/RULE_DECISIONS.md

@@ -52,6 +52,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Jacurutu physical dial | The user question asks whether the losing player should choose the physical normal/elite forces represented by its dial. When legal Advanced allocations produce different rewards, income remains explicitly unpaid; numeric wheel subtraction is not a ruling. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Testing Station contest/timing | Only sole non-advisor occupation is prototyped. Two-occupant priority/stacking remains unresolved; opening after the ordinary storm-card window is an explicit source-timing inference. Weather Control is excluded by the printed text. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | CHOAM Secret Ally battle timing | The printed after-victory inspection is optional and the Nexus identity stays secret. No existing postbattle choice covers every winner: a pause only for a holder leaks ownership, precommitment removes the after-win choice, and a universal window makes nonholders pass. The product-exception question has been sent; no timing policy is implemented pending the answer. Ordinary Karama cancellation is also not established by the retrieved sources. | [After-victory inspection audit](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) |
+| Emperor Secret Ally purchase timing | The purchase choice follows winning the bid. A holder-only payment pause exposes concealed card eligibility, while per-bid preauthorization moves the choice earlier. The user has been asked whether to permit a uniform winner payment confirmation, including sole spice payments, or retain the purchase gate. No answer is assumed; the independent three-force revival grant can proceed. | [Purchase source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price) |
 | Discovery prototype inferences | Free entry uses storm order and ordinary source-storm restrictions; these are general-rule inferences. Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |