Prototype private Mentat questions behind explicit preview opt-in

Connect the optional named-weapon question before skill posture and faction powers. Every accepted question waits for the same target-owned private card-show action, preserving held/absent privacy; matching cards are compulsory, otherwise the owner selects a fallback. Keep cards in hand and retain historical observations only for the questioner and target, without binding later plans. Support actual controls, inspectors, all four AI profiles and saved JSON/SQLite continuation.

Normal activation remains disabled pending the user's uniform-response UX exception. The private flag is neither projected nor writable through actions. Legacy battles remain unchanged. Empty hands skip with an explicit unavailable receipt and no invented answer. Source and unresolved boundaries are documented, with a compact current-status dashboard preserving all goal, Git, subagent, usage and saved-game requirements.

Independent review passed privacy, custody, sequencing and preview gating. Twenty-two focused tests cover canonical card roles, exact-match/fallback symmetry, target-only controls, captured lower-only behavior, stale/duplicate requests and concurrent SQLite writes. Typecheck, lint, 4605 offline tests, production build and 43 HTTP tests passed with stable source. The first broad run retained one outdated Mentat card-copy assertion; update it to verify private disclosure, custody, optional question and subsequent concealment. Gameplay source was unchanged by that test-only correction.

Two genuine-setup sample games deliberately deal Mentat via a controlled initial skill shuffle. Basic: 100 actions, 3 JSON restores, turn-one Harkonnen win. Advanced: 507 actions, 14 restores, turn-five Harkonnen win. Each has one private observation, subsequent Atreides Prescience and no rejected candidate. These bounded force/skill custody samples do not establish general card-custody coverage, calibration or full module acceptance.

After the reported outage all 665 opening rooms and original seat/recovery/receipt records were preserved (699 after integration). A fresh 666-room backup preceded checks; database integrity and foreign keys pass. The existing localhost server was reused; its live lock prevented a duplicate start. Existing Ecaz and Ixian browser seats restored their same hands and pending choices. A separate conserved staged Mentat preview restored its private history and posture, then legally concealed its leader before subsequent faction powers. Human/browser paths are distinguished from genuine-setup simulations. No database reset, recurring automation, public activation or publication.

Verified source tree: 297ae06e0764d7cad525a802fe383a84971c3e9c5d6362c8cd0b79c5c3977caf
Final source tree: 177c98415098ea42174a860d8b1fac4f7c7dd6c3e67c93b18330d1d0fc4edf0e
The only post-verification edit removed one surplus newline at the end of the new developer document; its exact before/after content and fingerprints are retained privately. Staged diff checking caught this whitespace issue before commit. No application or test code changed.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,32 @@
 # Dune implementation status
 
+## 13 September 2026 — Private Mentat question preview and outage recovery
+
+[Mentat](MENTAT_QUESTION.md) has a connected private pre-plan question preview:
+canonical named weapons, a uniform target-owned card-show step, owner/target-only
+historical observations and subsequent leader concealment before faction powers.
+The shown card stays in hand and does not bind a plan. The private opt-in is absent
+from player views and cannot be enabled through actions. Ordinary Leader Skills
+games remain unchanged pending the user's forced-response UX exception decision;
+empty hands skip with an explicit unavailable receipt and no fabricated answer.
+
+Independent review and 22 focused tests cover legality, custody, sequencing,
+private controls, all four AI profiles, JSON/SQLite restoration and stale/competing
+writes. Two complete genuine-setup samples deliberately deal Mentat through a
+controlled initial skill shuffle: Basic 100 actions/3 JSON restores, Advanced
+507/14, each with one private observation and no rejected candidate. These are
+bounded preview paths, not complete skill or expansion acceptance. The separate
+browser QA uses a staged conserved battle and verifies private disclosure, a
+readable inspector, refresh recovery and the right to conceal after asking.
+
+After another reported power failure, all 665 opening rooms and original seat,
+recovery and receipt rows matched the backup. A fresh backup captured 666 rooms,
+including the isolated preview; database integrity and foreign keys passed. The
+existing server responded at localhost:3000, and its lock prevented a duplicate
+start. The saved Mentat browser seat restored its hand, resources, observation and
+pending posture. No reset, recurring automation or publication was introduced.
+The verified Git checkpoint records final broad results and preservation counts.
+
 ## 13 September 2026 — Deferred movement arrival safety and reusable samples
 
 [Deferred movement](DEFERRED_MOVEMENT_ARRIVAL.md) fixes the combined Advanced