Offer Semuta before private Ixian ally replacement

docs/CURRENT_STATUS.md

@@ -9,14 +9,15 @@ Expansion starts and full rules/publication acceptance remain gated.**
 The explicit [Semuta development preview](SEMUTA_SOURCE_UPDATE_20260907.md#30-september-2026--bounded-clean-discard-runtime)
 accepts a fresh Richese roster with CHOAM & Richese and optionally
 the physical Ix deck. Clean public ordinary-card, paid Box, retired
-Ornithopter, private Distrans, final Truthtrance, Once Around,
-movement-order, between-battles chooser or pre-plan aggressor Sapho,
-clean pre-leader Residual Poison, printed Karama canceling clean
-CHOAM Charity, Inflation or Bene Gesserit Charity or using a clean
-normal-auction lot for a free purchase or winning-bid payment,
-battle-card and Ix-deck Thumper/Amal discards open the same neutral
-offer regardless of hidden Semuta custody. Karama waits after its
-public cost but before cancellation or the reserved lot settles.
+Ornithopter, used Distrans, final Truthtrance, four bounded Sapho,
+pre-leader Residual Poison, printed Karama canceling clean CHOAM
+Charity, Inflation or Bene Gesserit Charity or settling a clean
+normal-auction lot, battle-card and Ix-deck Thumper/Amal discards
+open the same neutral offer regardless of hidden Semuta custody.
+A clean **private** normal-auction Ixian ally replacement discard
+also pauses before its draw; no unknown face is shown before a
+holder commits. Karama waits after its public cost but before
+cancellation or the reserved lot settles.
 Residual Poison commits one random death before the offer; only an
 uninspected battle with nobody ready qualifies. Once Around commits
 bidder order and frees a slot; other Sapho scopes commit chooser or
@@ -32,19 +33,26 @@ full-hand ordering, normal Richese starts and deployed acceptance
 remain unfinished. Neutral passes and free-slot guard are product
 choices.
 
-Clean printed Karama normal-auction purchase and winning-bid payment
-passed engine and authenticated SQLite checks. `npm run check` passed
-types, lint and 5,837 offline tests; the build and phone-width guide
-inspection passed. A focused built-worker Advanced-lobby HTTP test
-timed out at its 15-second request limit; direct QA-room create/join
-and two authenticated reads passed. The previous purchase build's
-full HTTP suite passed 51/55 cases; four origin/malformed-request
-cases returned 503 instead of 403/400. The full HTTP gate remains open.
+The private normal-auction Ixian ally reaction passed genuine-setup
+engine, authenticated SQLite and direct engine smoke checks. The full
+`npm run check` passed types, lint and 5,839 offline tests; build and
+phone-width guide inspection passed. The isolated built-worker HTTP
+suite passed 49/55 tests: five returned 503 instead of expected
+authorization/validation/success statuses, and one Advanced-lobby
+request exceeded its 15-second limit. Full HTTP acceptance remains open.
+
+The previous printed Karama purchase/payment checkpoints passed
+engine and authenticated SQLite checks; their local HTTP caveats
+are recorded in the implementation log.
 
 The previous purchase revision `eede77a` passed container workflow
 `36664985601`, including its isolated storage/HTTP gate, and published
 an image. This does not deploy it to the live NAS.
 
+The following paid Karama revision `8f6b1c8` also passed container
+workflow `36665999972` through isolated storage/HTTP verification
+and published its image. Neither checkpoint has been deployed to the NAS.
+
 Container workflow `36656043783` built `32d9ef4` but failed
 isolated storage/HTTP verification; that image was not published and
 the public job exposes no assertion log. The next checkpoint

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,35 @@
 # Dune implementation status
 
+## 30 September 2026 — Semuta before private Ixian ally replacement
+
+The explicit Richese preview with the Ix expansion now interrupts a
+clean normal-auction Ixian ally card replacement at its original
+private discard, before the replacement draw. The buyer paid for the
+lot and accepted the alliance; every seat sees the same neutral
+Semuta offer without its card face or a named claimant. A committed
+holder can take the exact fresh card; claim or all-seat decline
+then draws one replacement for the buyer and finishes the saved
+sale/Richese cache continuation. The original buyer is the
+discarder, not the Ixians. Cache and Black Market sales, nested
+interactions and other private discard producers remain guarded.
+
+An engine scenario through genuine three-seat setup checked hidden
+Semuta-holder parity in both outsider views, unspent deck order,
+physical custody, one replacement and legal AI claim. An authenticated
+SQLite scenario checked restart, owner-only controls, stale retry and
+the owed Richese cache choice. A separate direct engine smoke
+exercised a paid lot, one private reaction and the replacement.
+Normal expansion starts and full Semuta acceptance remain gated.
+
+`npm run check` passed types, lint and 5,839 offline tests, and the
+production build passed. A phone-width browser view of the built
+worker showed the private-discard timing in the rules guide.
+Independent review found no scoped defect. The isolated built-worker
+HTTP suite passed 49/55; five origin/validation or ordinary-success
+requests returned 503 and one Advanced-lobby request timed out at
+15 seconds. Full HTTP acceptance remains open. This code was not
+deployed to the NAS and no production game was modified.
+
 ## 30 September 2026 — Semuta after printed Karama winning-bid payment
 
 The explicit Richese preview now stages a second normal-auction

docs/SEMUTA_DISCARD_CONTINUATIONS.md

@@ -64,6 +64,15 @@ a neutral claim or decline completes the same free settlement once.
 Richese lots, Worthless conversion and nested responses retain their
 previous automatic paths.
 
+A clean private normal-auction Ixian ally replacement now stages the
+existing `ixAllyCard` continuation as a neutral Semuta offer before
+`draw(g)`. The original buyer owns the discarded card. Its face stays
+unknown to rivals and uncommitted holders; a sole committed claim
+moves that exact card before one saved replacement draw and ordinary
+sale continuation. Richese cache and Black Market sales retain the
+automatic path until their distinct custody and offer windows are
+integrated.
+
 Completed Ornithopter movement now offers the same retired public card
 before its already committed arrival suffix only in a roster without
 Bene Gesserit intrusion, Ecaz Ambassador or Moritani Terror response

docs/SEMUTA_SOURCE_UPDATE_20260907.md

@@ -67,12 +67,21 @@ opening public expansion starts. It interrupts **clean public
 ordinary-card, paid Box, retired Ornithopter, used Distrans, final
 Truthtrance, four bounded Sapho scopes, pre-leader Residual Poison,
 printed Karama canceling clean CHOAM Charity, Inflation or Bene
-Gesserit Charity or settling a clean normal-auction purchase or
-winning bid, battle and Ix-deck Thumper/Amal discards**. Other
+Gesserit Charity or settling a clean normal-auction lot, battle and
+Ix-deck Thumper/Amal discards**, plus a clean **private** normal-auction
+Ixian ally replacement discard before its draw. Other
 than the one explicitly suspended charity/Inflation response, the
 parent transaction has no competing response. Every seat sees the
 same neutral fresh-discard opportunity
 regardless of hidden Semuta custody.
+
+The Ixian ally discard belongs to the original buyer, not the Ixians.
+Every seat sees the neutral offer without its face or a named claimant;
+only a committed eligible holder takes the exact fresh card. A claim
+removes it before the saved single replacement draw and subsequent
+normal-auction settlement. Richese cache and Black Market replacement
+discards, competing parents and other private producers remain separate.
+
 An early-ended Ornithopter advances the saved queue; a completed
 flight resumes one committed arrival only without BG, Ecaz or
 Moritani entry reactions. Distrans's gift remains private with its