Implement bounded Richese Nexus Betrayal auctions

docs/CURRENT_STATUS.md

@@ -6,6 +6,24 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
+Five implementation lanes now connect the bounded
+[Richese Nexus Betrayal](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026)
+preview: original public self-cache purchase veto without payment,
+and another buyer's cache/Black Market sale diversion to bank with
+unchanged price, contributions, physical delivery and earned Harkonnen
+bonus. Fresh `richese-betrayal` CLI entry requires paired CHOAM/Richese,
+classic remaining seats, the CHOAM deck and Nexus alone. Public possible
+responders acknowledge uniformly; only own canonical eligibility shows Use.
+Independent review repaired escrow double-counting and post-bonus
+exhausted-cache preflight. Types, lint, 5,953 offline tests, build and
+80 focused cases pass. Genuine local CLI/runtime and phone controls prove
+Basic veto, Advanced all-pass and Basic cache/Advanced Black Market
+diversion, exact custody and refresh. Local Wrangler HTTP is **51/55**:
+three POST 503s and one Advanced timeout, not green HTTP acceptance.
+Proxy-free CI and live deployment are separate. Normal hidden self-buys,
+private special acquisition, wider compositions and full-family completion
+remain open; no public start or live deployment is claimed.
+
 The explicit `kull` development profile now connects printed Kull
 Wahad interception in Basic/Advanced CHOAM-plus-classic rosters
 with the physical CHOAM/Ix deck. Five implementation lanes delivered

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,52 @@
 # Dune implementation status
 
+## 30 September 2026 — bounded Richese Nexus Betrayal auction integration
+
+Five implementation lanes delivered pure source/invoice/custody policy,
+typed prepayment engine continuation, human controls and minimal legal bots,
+authenticated SQLite recovery, and source-bound internal guidance.
+Fresh `richese-betrayal` entry supports Basic/Advanced paired CHOAM/Richese
+plus classic seats, the physical CHOAM deck and Nexus alone.
+
+A public cache auction won by native Richese may be vetoed before payment:
+the exact intended card enters ordinary discard, nobody pays or acquires,
+and the original lot retires once. Another buyer's positive cache or
+concealed Black Market sale keeps the original price, authorized escrow
+split, physical delivery and earned Harkonnen bonus; only its recipient
+changes from Richese to bank. All-pass keeps the Nexus and settles the
+unchanged original purchase. Public held-Nexus presence determines neutral
+acknowledgement membership; actual identity affects only own private Use.
+Independent pending/completed cursor history binds saved source ownership
+and rejects orphaned frames before disclosure or SQL writes.
+
+Independent review found and repaired donor escrow double-counting and a
+Harkonnen bonus path that skipped exhausted-cache preflight. Regressions
+cover a seller funding its buyer with zero unpledged spice and rejection
+of an unfinishable closing bid before any receipt, payment or delivery.
+Existing wording/incidental assertions were removed rather than re-pinned.
+
+Verification: `npm run check` passes types, lint and **5,953 offline tests**;
+`npm run build` passes. Eight focused files pass **80 cases**, including
+both alternatives/all-pass, private timing parity, actual table controls,
+four legal bot profiles, JSON/production SQLite restart, competing Use/Pass,
+no-write rejections and later recyclable physical custody. Final independent
+economy and persistence re-reviews found no remaining scoped defect.
+
+Actual prototype CLI started four owned disposable rooms from version 5
+to setup 6. Genuine setup/bids created typed opportunities; a separate
+runtime smoke proves Basic/Advanced veto and cache/Black Market diversion.
+At 390 pixels, real controls prove Basic veto, Advanced all-pass, Basic
+cache diversion and refreshed Advanced Black Market diversion without an
+unknown-face inspector. Saved outcomes retain the original completed event,
+exact card custody and buyer/seller balances. No human games or seats were
+reset or modified.
+
+Current built-worker local HTTP is **51/55**, with three POST 503s and one
+Advanced-preview timeout; it is not green acceptance. Proxy-free container
+CI and publication are recorded separately after the push. Full Richese
+games, hidden normal-deck self-purchases, private special-Karama veto,
+broader modules and live NAS acceptance remain open; no public gate changes.
+
 ## 30 September 2026 — opt-in printed Kull Wahad integration
 
 Five implementation lanes supplied validated activation frames,

docs/NEXUS_CARD_RULES.md

@@ -61,7 +61,7 @@ The private holder offer contains CHOAM's name; it includes the hand count only
 
 ## Effect integration boundaries
 
-Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), and [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md). These audits distinguish implemented work from remaining source/timing questions; the current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md).
+Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; the current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). The bounded Richese Betrayal wave retains its own **Planned** verification rather than inheriting earlier auction or shipment evidence.
 
 **Atreides is the first complete effect family to implement.** It has independent rulebook and physical-face evidence, and the engine already has private plan-element inspection. The Nexus effect needs its own cause and receipt rather than temporarily changing the inspecting faction. The second element must differ from the already inspected element. Preserve the original disclosed value if an allowed later battle edit occurs; follow the existing plan commitment rules instead of refreshing an old observation. The card specifies an element, not the entire hand or battle plan. A weapon/defense request uses actual played-card classification, including the published Reinforcements/Harass exclusions, rather than leaking a card merely because it occupies that slot.
 
@@ -79,7 +79,7 @@ Later focused source contracts cover [Emperor strength, purchases and revival](N
 - No retrieved card or E3 FAQ gives a general rule that every Nexus effect is Karama-immune, or that playing one suspends all ordinary responses. Homeworld immunity on the preceding page is limited to Homeworld advantages/penalties. Audit cancellation of an underlying native advantage separately from cancellation of the Nexus card before enabling each family.
 - Duration is explicit for several panels but not all. Ixian Betrayal's scope over multiple auction lots, the optional continuation after canceling native Prescience, and exact multi-party cancellation priority require the corresponding existing faction timing contract. Do not make an entire-phase cancellation merely from the word “advantage.”
 - Emperor forced ally payment needs a precise invoice allocation when the ally has some funds and Emperor is short. Its own purchase-refund alternative also needs original payer contributions. Tleilaxu's combined leader/force revival requires an audit of partial selection and interaction with ordinary free rates; the card does not say that all five force revivals are free.
-- Richese's two-No-Field effect needs its own physical counter and immediate-reveal transaction; the normal single-marker action cannot represent it by adding private values. Ecaz's Duke override needs explicit restoration/end-turn handling across capture, death and Ghola records. These are material implementation tasks, not reasons to invent substitute effects.
+- Richese's two-No-Field effect has a bounded native Cunning shipment follow-up, but wider marker/module compositions remain separate. Its [bounded Betrayal auction contract](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026) connects public self-cache veto and other-buyer sale diversion, not normal-deck hidden-family self-purchases or private special-Karama acquisition. Ecaz's Duke override needs explicit restoration/end-turn handling across capture, death and Ghola records. These are material implementation tasks, not reasons to invent substitute effects.
 - A complete twelve-card reference/inventory and common lifecycle are substantial first work, but do not alone make all thirty-six panels playable. Keep the public module release gated until every face's supported timing, secrecy, custody, bots, UI, rejection, multiplayer CAS and saved continuation paths are verified. If development supports only Atreides' family first, other faces must remain accurately represented and explicitly unavailable in the audit mode; they must not silently act as blanks in a released module.
 
 No user question was sent during this audit. No tournament rule, fan effect, public predeal reveal, extra Nexus identity or Discoveries prerequisite has been adopted.
@@ -102,3 +102,15 @@ precommitment would remove the printed after-loss choice. The sources do not
 establish a generic Karama response to this borrowed Secret Ally effect, so
 none is invented. The native Moritani alliance retention response remains a
 separate power.
+
+## Richese Betrayal prepayment protocol
+
+The [printed Richese panel and bounded auction contract](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026) distinguish two outcomes, not two costs. An unallied non-Richese holder spends the actual singleton Richese Nexus card while native Richese is seated. No Treachery slot/card or extra activation spice is spent.
+
+The public-cache self-purchase alternative discards the exact intended card **before** payment/delivery: nobody pays and no purchase bonus is fabricated. The other-buyer cache or Black Market sale alternative changes only the original positive invoice's recipient from Richese to bank: the original price/contributions, delivery and earned Harkonnen consequence remain once. Passing keeps the Nexus card; all required passes settle the unchanged original purchase once. Neither alternative refunds a completed sale or replays a raw purchase Action.
+
+To avoid identifying a secret card through timing, every unallied non-Richese seat with publicly held-Nexus presence acknowledges the same before-payment boundary. Required/pass membership derives from public roster/alliance/presence only. Only each privately eligible holder sees Use or its own blocked reason; irrelevant hidden identities do not change public event/auction fields. With no publicly possible responder, continuation is automatic. This is an **explicit application protocol**, not publisher timing authority or blanket Karama immunity.
+
+The reaction projects only public target/buyer/source/price/event plus own pass/use eligibility. Existing public cache inspection does not entitle anyone to the concealed Black Market face or to the Richese-family identity of a normal hidden lot; claims and printed catalog faces are not custody disclosures. Normal-deck self-purchases, special-Karama veto, unsupported counter/any-time overlays and broader modules remain outside this connected boundary. The private receipt owns exact source, invoice and continuation; independent pending/completed cursor evidence must reject missing/orphaned frames before read or SQL rather than auto-settling.
+
+The profile is explicit, fresh Basic/Advanced CHOAM/Richese plus classic seats, Nexus and the physical CHOAM deck only; it does not upgrade earlier games or open ordinary expansion starts. The dedicated internal `nexus-richese-betrayal` checklist records bounded engine, authenticated SQLite, bot, real controls and refreshed phone-browser evidence, with broader verification **Partial**. Shipment Cunning, ordinary auction, native special-Karama and a complete twelve-face catalog are not substitute verification. Full-family, combined-module and deployed acceptance remain open.

docs/NEXUS_RICHESE_RULES.md

@@ -1,6 +1,6 @@
 # Richese Nexus source contract
 
-Audited 10 September 2026. This separates the ordinary Secret Ally shipment from native Cunning's two-marker operation. It does not certify either implementation or open the Nexus release gate. See [common Nexus rules](NEXUS_CARD_RULES.md), [No-Field custody](RICHESE_NO_FIELD_RULES.md), and [allied No-Field distinctions](RICHESE_ALLIED_SHIPMENT_AUDIT.md).
+Audited 10 September 2026, with a bounded Betrayal implementation contract added 30 September. This separates the ordinary Secret Ally shipment, native Cunning's two-marker operation and Betrayal's two auction outcomes. It does not certify full-family implementation or open the Nexus release gate. See [common Nexus rules](NEXUS_CARD_RULES.md), [auction custody and source boundaries](RICHESE_AUCTION_RULES.md), [No-Field custody](RICHESE_NO_FIELD_RULES.md), and [allied No-Field distinctions](RICHESE_ALLIED_SHIPMENT_AUDIT.md).
 
 ## Printed effects and source status
 
@@ -8,6 +8,8 @@ The Richese panel was freshly read from the [original photographed GF9 cards](ht
 
 Common eligibility requires **Richese absent**, not Guild absent, for Secret Ally. A native Guild player may hold it. A holder cannot retain a Nexus card when entering an alliance, and play consumes the card. E3 contains no Richese-specific Nexus FAQ. [GF9 E3 p.11 and p.16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11)
 
+The photographed Betrayal panel has two alternatives: stop Richese buying a Richese Treachery Card by discarding that intended card without payment, **or** redirect the payment for a card Richese sells to the Spice Bank. Both spend the same physical Richese Nexus card; they are not two uses or a generic cancellation of Richese income. The panel's source is the [original GF9 component photograph](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), semantically transcribed in `game/nexus-card-reference.ts`. Auction origin, payment routing and still-earned purchase consequences compose with [GF9 E2 pp.4–6 and 10–12](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf), as audited in the auction contract; no tournament amendment supplies authority.
+
 Official indexed excerpts, the original component photograph, and cached E3 publisher-authored text were inspected. Direct retrieval of the official base/November FAQ PDFs returned 403. The older local base/E2 cache paths named by historical documents are no longer present in this workspace; those historical claims were checked against fresh publisher excerpts where used below.
 
 ## Secret Ally: ordinary shipment composition
@@ -66,7 +68,7 @@ The connected path is deliberately narrower than every possible E2 composition:
 
 The card is discarded at declaration. The native No-Field Karama cancellation precedes settlement and preserves the two tokens, reserves, spice and ordinary shipment allowance but not the card. Advanced Guild special prevention also leaves the physical shipment unpaid and unplaced while consuming the attempted shipment allowance and the card. Otherwise the pair is one arrival, costs the ordinary one-marker price, immediately reveals one chosen denomination and places up to that value of actual normal forces from current reserves in the destination. Only the other token remains concealed, publicly counting as one force; it draws from then-current reserves on its later native reveal. The immediate group plus the concealed marker count as actual presence for subsequent territory-entry and board logic, not two independent shipments.
 
-An owner-only control distinguishes ordinary No-Field, Smuggler and Nexus pair choices. All four bot profiles have a minimal legal pair candidate. The pending frame binds both physical identities, owner, token event, destination and one-marker price through JSON and in-memory SQLite CAS recovery. Public logs disclose the immediate faceup value/actual force count after settlement; the rival projection contains no concealed token identity or owner-only offer. Signatures detect partial saved-frame corruption, not arbitrary save forgery. Combined modules, allied No-Fields, high-Richese additional-force effects, Betrayal, later faceup display mechanics and full Nexus acceptance remain open.
+An owner-only control distinguishes ordinary No-Field, Smuggler and Nexus pair choices. All four bot profiles have a minimal legal pair candidate. The pending frame binds both physical identities, owner, token event, destination and one-marker price through JSON and in-memory SQLite CAS recovery. Public logs disclose the immediate faceup value/actual force count after settlement; the rival projection contains no concealed token identity or owner-only offer. Signatures detect partial saved-frame corruption, not arbitrary save forgery. Combined modules, allied No-Fields, high-Richese additional-force effects, later faceup display mechanics and full Nexus acceptance remain open. Betrayal now has its separate bounded auction contract below; the Cunning evidence does not verify that path.
 
 ## Existing integration points and verification
 
@@ -75,3 +77,50 @@ An owner-only control distinguishes ordinary No-Field, Smuggler and Nexus pair c
 `game/homeworld-shipment.ts` and the Guild Homeworld adapter own non-Arrakis routes; they should not be bypassed with a forged static board destination. `game/richese-no-field.ts` owns physical markers and should not be initialized for absent-faction Secret Ally.
 
 Required focused evidence: 1/5 actual-force shipments with unchanged price; normal/elite mixtures; Guild present/absent/native-holder and active bank-rate payment; Fremen retained geography/free price; native Homeworld source custody; occupancy/storm rejection before costs; Guild allowance/prevention; real BG/Terror/Ambassador continuations using actual counts; all-seat projections; and persisted pending/complete/stopped histories with concurrent and rejected-action immutability. Complete Cunning and broader module acceptance remain separate work.
+
+## Bounded Betrayal auction contract — 30 September 2026
+
+### Entry and actual cost
+
+The explicit local `richese-betrayal` profile is for genuine fresh Basic or Advanced games with CHOAM and Richese, two to six seats, and otherwise classic factions. It selects the physical CHOAM Treachery deck and Nexus module, with no other optional modules; Ixians, Tleilaxu, Ecaz, Moritani, Semuta and Kull previews are outside this boundary. `initializeRicheseBetrayalGameForAudit(state: Game): Game` is the engine admission seam. Existing games and other preview profiles do not silently gain this behavior. Ordinary public expansion starts and full Nexus/Richese certification remain closed.
+
+Use requires an **unallied** holder whose actual native faction is not Richese, native Richese seated, and the one physical Richese Nexus card in that holder's separate custody. Spending it moves that singleton to Nexus discard once. No ordinary Treachery card, Karama, hand slot or extra spice is the activation cost. Current own-card promises and committed-resource legality still apply before acceptance; merely possessing the face is not sufficient. Passing keeps the Nexus card and spends nothing.
+
+### Prepayment veto versus recipient override
+
+| Alternative | Connected trigger | Physical card and spice result |
+| --- | --- | --- |
+| Purchase veto | Richese wins its own **public cache** lot through Once Around or Silent bidding, before debit or acquisition | Move the exact selected cache card to ordinary Treachery discard, not Richese's hand, cache return or out-of-game removal. Do not debit the buyer or ally, and do not pay Richese, Emperor or bank. No purchase was made, so no Harkonnen purchase bonus is created. Retire the original lot/round continuation once. |
+| Sale diversion | Another buyer wins a cache lot or concealed Advanced Black Market lot (normal, Once Around or Silent), with a positive payment otherwise due to Richese | Keep the original winner, price, own/authorized-ally contributions and physical delivery. Route that same payment to the bank instead of Richese; Richese receives zero sale income. The buyer is charged only once, not a second bank fee. Existing earned buyer consequences, including the Harkonnen bonus when applicable, continue once. |
+
+Richese buying its own cache normally pays Emperor/bank. That invoice is the purchase-veto alternative, **not** a sale payment owed to Richese. A zero result/free cache keep or unsold Black Market retention is not a positive sale. Existing exhausted-cache/ordering guards, positive Black Market seller-bid guards and special-acquisition guards remain; this panel does not settle their source questions.
+
+Normal-deck Richese self-purchases can conceal whether the physical card belongs to the Richese family. They are **not connected** by this first boundary. The private advanced special-Karama cache acquisition has a separate activating card and once-per-game ordering and is also **not a connected veto trigger**. Native statements about whether Karama can cancel that special power do not establish whether Nexus Betrayal applies to it. Do not certify either producer by borrowing an unrelated native exception.
+
+The interruption belongs inside `settleRicheseLot`, after native responses and any entitled Atreides peek have finished and the sold quote is valid, but before `payWithAlly`, source removal or hand delivery. Source/recipient facts come from that original quote, not a client-selected target, card, amount or recipient. Unsupported counter overlays or any-time effects that the receipt cannot resume must be prevented before entry, not suppressed after money moves. A diversion is a recipient override, not a refund, re-purchase or replay of bidding.
+
+The current preflight requires a playing Bidding-stage Richese lot with no ordinary auction/sale, response, decision, phase opening, active Truthtrance, Karama, Nullentropy/discard, Kull/CHOAM conversion or market, Ixian allied replacement, Richese gift/purchase-income/Technology, or pending Nexus traitor exchange overlay. The original quote proves exact budget, representable sale/bonus continuation, exhausted-cache guards and binding shipment-completion feasibility before the pause. While pending, only the exact reaction choices and bot advancement are admitted; another any-time effect cannot mutate the reserved transaction. Spending the holder's Nexus must preserve that holder's own binding shipment promises. An involuntary purchase veto does not assume the target acquired the card or spent the price; opponent promises made impossible by that prevention use existing native reconciliation/release. These are bounded continuation guards, not blanket publisher immunity. The cache veto is a direct ordinary discard; the profile does not compose it with Semuta.
+
+### Neutral application protocol and privacy
+
+The pause is uniform for all **publicly possible** responders: other-faction unallied seats with publicly visible held-Nexus presence. Required/pass IDs depend only on roster, alliances and that presence, never on a secret held identity. If no seat is publicly possible, the original purchase automatically continues. Otherwise each required seat may pass, including a holder of an irrelevant Nexus card. Only the privately eligible Richese-card holder sees Use. Once all required seats pass, settle the original quoted purchase once; an accepted Use commits its one alternative and closes that opportunity.
+
+This neutral acknowledgement is an explicit application protocol to preserve concealed custody, **not** printed publisher timing or a general ruling about simultaneous Nexus/Karama priority. A holder-only pause would reveal a secret card. Replacing a relevant hidden card with an irrelevant hidden card must not change the public pause, event or auction terms.
+
+`GameView.richeseBetrayalPreview` identifies the opt-in profile. `GameView.richeseBetrayalReaction` is null or `{ event, kind, target, buyer, source, price, canPass, hasPassed, canUse, blocked }`, with `kind: 'purchase' | 'sale'` and `source: 'cache' | 'blackMarket'`. Every seat sees the same public event, kind, Richese target, original buyer, source and price. Purchase requires cache and buyer equal to target; sale requires another buyer. `canPass` and `hasPassed` concern only the viewer's public acknowledgement; `canUse` and `blocked` concern only that viewer's actual private eligibility.
+
+The reaction contains no target physical card, hidden Black Market face, payer spice, ally balances, opponent hand, private Nexus identity, raw source frame, signature or deck order. Public cache faces remain available through existing entitled inspectors. A Black Market claim is not the unknown face; the new reaction grants no new inspection permission. Existing Atreides or owner entitlement remains separate. Public Nexus face reference is a catalog, not proof that anyone holds that face.
+
+Clients submit exactly `{ type: 'richeseBetrayalPass', event }` or `{ type: 'richeseBetrayalUse', event }`. The server checks actor/event and exact keys and supplies the original target/card/price/recipient from private state. Human controls and all four minimal legal bot policies consume the same projected eligibility; no consumer guesses Use from physical custody alone. Pending acknowledgement replaces underlying auction actions rather than letting them charge or advance the lot early.
+
+### Saved continuation and verification status
+
+A typed private frame/receipt binds the original round, lot, physical card, Richese owner, buyer, price/funding, source custody and continuation ownership. Independent pending/completed cursor evidence prevents deletion or orphaning of that frame from automatically settling a purchase. Reconnect resumes the exact opportunity, recorded passes and committed outcome without rerolling, replaying a raw Action, rolling back a full Game or echoing payment. Intrinsic committed history must remain valid after the Nexus or purchased/discarded Treachery card subsequently moves; it must not require an old card to stay in discard forever.
+
+The implemented state names are `Game.pendingRicheseBetrayal` for `{ receipt, lot, quote, signature }` and independent `Game.richeseBetrayal` for `{ sequence, current, completed }`. The receipt carries event/turn/sequence, original round/lot, private invoice, public-required IDs, recorded passes, `pending | passed | used` stage, actor and Nexus-discard index. Its invoice includes the original recipient, price, own/ally contribution split, donor and private physical card. The source signature binds live original custody/funding/continuation; historical completed receipts keep intrinsic evidence rather than asserting present discard location. These deterministic signatures detect inconsistency, not arbitrary save forgery, and are never part of the player reaction projection.
+
+Implementation responsibilities are `game/nexus-richese-betrayal.ts` for pure invoice/source/eligibility and receipt invariants; `game/engine.ts` and `game/auction-continuation-quote.ts` for settlement, projection and finalizer fences; `components/nexus-richese-betrayal.tsx` and `game/bot-nexus-richese-betrayal.ts` for real private Use/public pass/wait consumers. The internal player topic is `nexus-richese-betrayal` in `game/reference.ts`; player navigation remains internal-only.
+
+**Verification: Partial, with the bounded runtime verified locally.** TypeScript, lint, all 5,953 offline tests and the app build pass; eight focused files pass 80 cases. The five dedicated suites cover purchase veto/all-pass, cache and concealed Black Market diversion, exact Nexus/card/spice/escrow custody, native Harkonnen bonus and cancellation, private identity parity, rejected-action immutability, all four legal bot profiles, real table controls and authenticated SQLite restart/concurrency/orphan rejection. Independent economy and persistence reviews exposed an erroneous second donor debit and a post-bonus exhausted-cache deadlock; both are fixed with regressions. Preflight consumes already pledged escrow and validates the deterministic next boundary before reserving an opportunity.
+
+Actual `richese-betrayal` CLI entry, source runtime settlement and 390-pixel browser controls were exercised in disposable QA rooms: Basic purchase Use discards without debit/delivery; Advanced purchase Pass preserves the Nexus and performs the original purchase; Basic cache and Advanced Black Market Use send the six-spice payment to bank once while delivering the exact card. Refresh retains each completed event and physical custody; the Black Market holder sees no unknown face inspector. No existing human game or seat was changed. Local Wrangler HTTP passes 51/55: three POST 503s and one Advanced-preview timeout prevent a green local HTTP claim. Proxy-free container CI and live NAS evidence are separate; no deployed acceptance or full Richese/Nexus completion is claimed.

docs/RULE_DECISIONS.md

@@ -35,6 +35,7 @@ Updated 30 September 2026. This is the authoritative navigation index for existi
 | Nexus lifecycle | Twelve physical cards, phase draw/replacement and alliance forfeiture; native Cunning, absent-faction Secret Ally and Betrayal have separate effects. No blanket Karama immunity. | [Common source contract](NEXUS_CARD_RULES.md), [lifecycle runtime](NEXUS_CARD_RUNTIME.md) |
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |
 | Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
+| Richese Nexus Betrayal auctions | Pause at a valid original prepayment quote. Public self-cache veto discards the exact card without debit/acquisition; another buyer's positive cache/Black Market invoice keeps price/contributions/delivery and earned Harkonnen bonus while overriding the recipient to bank. All publicly possible unallied other-faction held-Nexus seats acknowledge uniformly; private identity controls only own Use. This neutral protocol is an application choice, not publisher timing. Normal hidden-family self-purchases, special-Karama veto and unsupported overlays remain excluded; no native Karama exception certifies them. Bounded engine/SQL/bot/phone scenarios are verified locally; broader verification remains Partial and public starts/full Nexus gates stay closed. | [Printed face, profile, API and saved continuation](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026), [common privacy protocol](NEXUS_CARD_RULES.md#richese-betrayal-prepayment-protocol), [auction source boundaries](RICHESE_AUCTION_RULES.md) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
 | Sapho movement | At a clean boundary, first reorders only remaining unstarted turns; completed turns stay completed. Advanced Guild must have finished or be absent. Last retains existing protection after Guild. | [Existing source contract](JUICE_OF_SAPHO_SOURCE_UPDATE.md#movement-firstlast), [runtime](JUICE_OF_SAPHO_RUNTIME.md) |
 | Basic CHOAM / Leader Skills | Compose existing ordinary skills with native sales and own-leader Ghola revival. Finish the private optional replacement before the exact suspended sale resumes. The free revival remains completed if the resumed sale is canceled. Basic uses five ordinary leaders and 35 Treachery Cards; Auditor remains Advanced and ineligible for skills. | [Integration and source contracts](CHOAM_LEADER_SKILLS.md) |