Integrate exact Ixian Nexus purchased-card replacement

docs/CURRENT_STATUS.md

@@ -16,15 +16,28 @@ open mode gates.
 
 ## Current checkpoint and work
 
-Five implementation lanes now connect the missing Ixian Nexus Secret Ally
-purchased-card replacement in a fresh local `ixian-replacement` prototype:
-exact paid normal-auction source, private neutral buyer controls, pure
-physical custody/history, legal bots, authenticated recovery/CLI entry and
-existing source guidance. Original fees and native auction continuation
-must complete once. Richese-origin and Harkonnen-buyer priority questions
-remain gated; no public start, existing-game retrofit or full-card claim.
-The parent retains actual runtime/UI, frozen checks/review and shipping.
-This next wave is **in progress**, not exercised or completed evidence.
+Five implementation lanes connected the missing Ixian Nexus Secret Ally
+purchased-card replacement through fresh local `ixian-replacement`: exact
+normal paid/printed-Karama source, own private controls, native discard/draw
+and original fee/income/auction suffix once. Full hands and genuinely
+depleted-pool same-card redraw are supported. Native Nexus still requires
+a settled alliance and has no initial deal; actual effects need three seats.
+Richese origins, Harkonnen buyers, wider modules and public starts stay gated.
+Independent review repaired recursive saved-history growth and silently
+dropped seat-control actions. Nine Pass records now serialize to 134,145
+bytes rather than 7,030,825; nonrecursive links retain source/replay checks.
+Actual pending-choice Take back control now sends one 200 and preserves
+the same source. Both final scoped rules/privacy reviews have no finding.
+Types, lint, **6,227 offline tests**, **73 selected cases** and build pass.
+Fourteen standalone native scenarios retain exact original ledger/custody,
+including captured legal six-seat depletion with four reserved lots.
+Three privately backed-up same-setup CLI/390-pixel QA rooms prove Basic
+paid Use, Advanced printed free Use, irrelevant-face Keep, inspection,
+takeback and refresh. Saved proof preserves Treachery/Nexus/forces/elites
+and eleven prior QA rooms; all **42 original seats in fourteen rooms**
+reauthenticate after isolated build reload. Actual expanded guide shows
+Partial / Development Verified. Local HTTP is **51/55**, four POST 503s,
+not green. Full families, modes, strategy and live acceptance remain open.
 
 Five implementation lanes reconciled two source-clear Advanced defaults
 from the authorized revised rulebook: all new post-first Storm openings

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,81 @@
 # Dune implementation status
 
+## 1 October 2026 — exact Ixian Nexus purchased-card replacement
+
+Five implementation lanes integrated runtime, pure source/custody/history,
+actual controls/four minimal legal bots, authenticated SQLite/CLI entry and
+existing source guidance. Fresh `ixian-replacement` admits unique classic
+2..6-seat Basic/Advanced with base Treachery/Nexus alone; no public start,
+existing-game retrofit or wider-module activation. Normal paid and actual
+printed Karama purchases, including direct zero-bid free acquisition, are
+connected. Harkonnen buyers and Richese/special origins remain guarded by
+their material priority/source questions. Native Ixian allied replacement
+remains a separate ability, not an alias or a Nexus Karama response.
+
+The typed source binds the exact canonical purchased physical ID, original
+normal lot/payment and independently progressed cursor before Nexus cost
+or draw. A publicly possible unallied held-Nexus buyer receives a uniform
+neutral choice, regardless of private face. Only that buyer receives its
+owned purchase and canonical eligibility; rivals get no face, private price,
+deck, receipt or blocked reason. Use spends one physical Ixian Nexus,
+discards that purchase first, draws the actual deck top and continues the
+native sale once; Keep retains both cards. No refund, extra fee or re-auction.
+Full hands and recycled same-card draw remain legal. Own-seat control is
+independent of the pending gameplay lock.
+
+Initial fixture failures assumed a Nexus draw without an alliance. Native
+publisher semantics were preserved: no initial deal or automatic empty-hand
+draw, and a qualifying closing phase requires a settled alliance. Genuine
+nonrecipient allies now open the draw. Original rosters are selected before
+creation, not added to an admitted game: effect scenarios need three seats,
+or four for simultaneous unallied recipients. The initializer still admits
+two-seat base continuation without inventing an unreachable Secret Ally.
+CLI-produced undealt native setup continues without reinitializing/redealing.
+
+Independent review found recursive history and an enabled-but-dropped
+Take back control action. Actual nine-Pass reproduction grew to 7,030,825
+bytes; bounded nonrecursive event/outcome/replacement head links now use
+134,145, with a permanent linear-history/corruption regression. Actual
+390-pixel before-fix Take back control sent no POST and retained Easy;
+after-fix it sends one 200, restores the same seat controller and retains
+the same paid event. Both final source/persistence/privacy rereviews are clean.
+Exhaustive decision dispatch/shape consumers are migrated, and incidental
+attribute-order/attempted-SQL-write pins are removed rather than re-pinned.
+
+Counterfeit depleted tests inflated the allocated row. Those were replaced
+with a captured native six-seat seed-11 turn-five payment source reached by
+real auctions, legal Battle Plans and winner discards: seventeen held cards,
+twelve discards, four reserved lots, empty draw deck, exactly all 33 cards.
+Actual payment plus controlled native shuffle proves original-card redraw
+and existing-discard draw while keeping unsold lots and force stock intact.
+The permanent JSON fixture is synthetic QA source, not human game data.
+
+Final broad check passes types, lint and **6,227 offline cases**. The six-file
+selected union passes **73/73**; final reference check **10/10** and build
+pass. Fourteen actual standalone native Basic/Advanced paid/free Use/Keep,
+wrong-face, full-hand and two legal depletion outcomes preserve original
+ledger, Treachery/forces/elites, Nexus cost, JSON and repeat rejection.
+Authenticated SQLite covers original payment through restart, Pass/Use CAS,
+foreign/revoked credentials, private-face parity, source/cursor corruption,
+zero durable rejection and later physical recycling.
+
+Actual ready rooms `GTCHEGKU`, `JUXLJXHC` and `HJ5Q64T5` entered once by
+exact-version CLI with private consistent backups, then continued the same
+native setup/IDs/circles before real API payment and phone choices.
+Basic paid Use changes buyer 10->8 and Emperor 10->12 exactly once;
+Advanced printed free Use keeps buyer 12 and skips purchase income;
+irrelevant-face Keep retains its original physical purchase and Richese Nexus,
+with no Use or Ixian inspector. Inspection, native income and refresh work.
+Read-only saved proof conserves original native Treachery/Nexus/force/elite
+inventories and eleven prior QA rooms. All 42 original seats in fourteen
+rooms authenticate after required isolated build reloads. Actual expanded
+internal guidance retains Partial / Development Verified boundaries.
+
+Local built-worker HTTP is **51/55**, four known POST 503s, not green.
+No unsafe retries, authorization weakening, database reset or deployed
+acceptance is inferred. Broader Ixian/Nexus effects, special origins,
+Harkonnen priority, combined games, strategy and public/live gates remain open.
+
 ## 1 October 2026 — authorized Advanced Storm and allied separation defaults
 
 Five implementation lanes connected the user-supplied revised Advanced

docs/NEXUS_CARD_RULES.md

@@ -63,6 +63,8 @@ The private holder offer contains CHOAM's name; it includes the hand count only
 
 Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). Bounded Richese auction and Guild shipment Betrayal checkpoints have their own direct local verification below; neither inherits certification of its complete faction, Nexus family or live deployment from earlier evidence.
 
+The [bounded Ixian Secret Ally replacement integration](NEXUS_IXIAN_REPLACEMENT_RULES.md#bounded-local-runtime-contract) now connects genuine normal paid and printed Karama-paid purchases in a fresh classic/base-deck/Nexus-only local profile. It replaces exactly the purchased physical card, keeps the original settlement once and permits full-hand and genuinely depleted-deck same-card redraw. Harkonnen buyers, cache/Black Market/special origins and combined modules remain guarded. Neutral buyer acknowledgement is an inferred development privacy convention, not publisher policy. Bounded native, private, authenticated recovery, CLI and phone verification is Partial; full-module and deployed acceptance remain open. The adopted unofficial Advanced core PDF contains no Nexus face and settles none of these pending Nexus boundaries.
+
 **Atreides is the first complete effect family to implement.** It has independent rulebook and physical-face evidence, and the engine already has private plan-element inspection. The Nexus effect needs its own cause and receipt rather than temporarily changing the inspecting faction. The second element must differ from the already inspected element. Preserve the original disclosed value if an allowed later battle edit occurs; follow the existing plan commitment rules instead of refreshing an old observation. The card specifies an element, not the entire hand or battle plan. A weapon/defense request uses actual played-card classification, including the published Reinforcements/Harass exclusions, rather than leaking a card merely because it occupies that slot.
 
 **Cancellation needs the original attempted effect.** Betrayal is not a blanket Karama flag. For Atreides, identify the inspection attempt being prevented; for Voice, the command; for a traitor/Face Dancer, the actual revealed identity; for economy, the original invoice and settlement. Do not refund or replay a completed payment merely because the next input happens to be a Nexus play. Effects with no printed phase still need a safe explicit action boundary and cannot bypass another player's committed private choice.

docs/NEXUS_CARD_RUNTIME.md

@@ -1,5 +1,7 @@
 # Nexus cards: common lifecycle checkpoint
 
+**Later Ixian Secret Ally replacement prototype:** [NEXUS_IXIAN_REPLACEMENT_RULES.md](NEXUS_IXIAN_REPLACEMENT_RULES.md#bounded-local-runtime-contract) records the fresh local `ixian-replacement` profile: exact just-purchased normal paid/printed Karama card, discard before private deck draw, full-hand and genuinely depleted-deck same-card behavior, unchanged original payment and native sale continuation once. Harkonnen buyers, cache/Black Market/special origins and combined modules remain guarded. The neutral buyer choice is an inferred development privacy convention, not publisher timing. Its bounded native/SQLite/four-bot/CLI/phone evidence is **Partial development verified**; this historical lifecycle checkpoint does not certify full effects or enable public/module starts.
+
 The later [Emperor Secret Ally revival prototype](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) adds exactly three additional free force returns, separate ordinary allowances, private controls and saved continuation. Its purchase alternative and full module acceptance remain pending.
 
 **Later Guild Secret Ally runtime:** [NEXUS_GUILD_SECRET_ALLY_RUNTIME.md](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) records explicitly selected Guild prices, cross/return routes, typed Homeworld sources, paid Fremen reinforcement and committed shipment history. The card changes one shipment, without creating a native Guild or a real alliance. The Homeworld-return ruling and full module completion remain pending.

docs/NEXUS_IXIAN_REPLACEMENT_RULES.md

@@ -1,6 +1,6 @@
 # Ixian Nexus Secret Ally: purchased-card replacement
 
-Source audit: 2026-09-10. This is a source contract and proposed implementation boundary, not a runtime or expansion-completion claim. Existing [Nexus release gates](NEXUS_CARD_RUNTIME.md) remain in force.
+Source audit: 2026-09-10. Bounded local prototype integration and verification: 2026-10-01. **Partial development verified**, not complete Ixian/Nexus family or expansion acceptance. This document records the source and runtime boundary of the fresh `ixian-replacement` profile. Existing [Nexus release gates](NEXUS_CARD_RUNTIME.md) remain in force.
 
 ## Primary evidence
 
@@ -13,6 +13,8 @@ Source audit: 2026-09-10. This is a source contract and proposed implementation
 
 Direct official PDF retrieval returned 403. Several older temporary `.pdf` paths contain HTML error pages; they were not treated as readable PDFs. No tournament rewrite or community compilation supplies a ruling here.
 
+The user-supplied `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf` is the adopted source for relevant Advanced core rules, including later Storm determination. It does not contain the Nexus Cards or this face. It therefore supplies no new Ixian replacement, cache-scope, bonus-order or Nexus-cancellation ruling; the photographed publisher card and cited publisher rules remain this feature's evidence.
+
 ## Printed operation
 
 The face permits the holder, when Ixians are absent, to discard the Treachery Card just purchased during Bidding and then draw the top Treachery Deck card. This identifies one particular purchase, not an arbitrary held card. The replacement is optional, but playing it spends the Nexus Card. No spice refund, extra payment, free choice from the deck, or second replacement is printed. The panel has no Advanced-only qualification. [Face](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani)
@@ -48,16 +50,81 @@ November's Karama table expressly permits stopping the native Ixian ally from di
 
 **Nullentropy and custody interruptions:** a paid Box search freezes the searched pile in the existing subsystem. The replacement cannot draw or reshuffle that pile while browsing. Conversely, playing or transferring the just-purchased card cannot leave a live replacement offer pointing at custody it no longer owns. Preserve or settle the exact purchase continuation; do not reopen an expired purchase from an arbitrary historical card ID. Whether a player can interleave a particular anytime power before exercising an immediate purchase right needs an explicit sequencing policy, not an invisible loss of the right. See the [Box audit](NULLENTROPY_BOX_ENGINE_AUDIT.md).
 
-**Private opportunity timing:** a pause offered only to the holder may reveal possession of a specific secret Nexus identity. Reuse the project's existing unresolved private-response timing policy rather than inventing compulsory confirmations or claiming every buyer has an actual choice. No duplicate user question was sent by this audit.
+**Private opportunity timing:** a pause offered only to the eligible Ixian-card holder may reveal the secret identity. This bounded prototype instead gives every publicly unallied supported buyer with public held-Nexus presence the same neutral **Purchased card choice**, independently of its hidden face. An irrelevant-face buyer can Pass but cannot Use. This is an inferred development privacy convention, not publisher-prescribed timing, a ruling on all anytime interleavings or approval of every unresolved private-response design. The Harkonnen-buyer and unsupported-origin guards depend on public faction/origin, not secret face.
 
-## Proposed pure and engine contract
+## Bounded local runtime contract
 
-The following is an implementation design, not additional rule text. It deliberately keeps purchase eligibility separate from physical replacement so unresolved origin or ordering policy does not contaminate custody.
+The fresh `ixian-replacement` profile is a working development integration of the independently printed Secret Ally grant. It admits two through six unique classic factions in Basic or Advanced with the base Treachery deck and Nexus alone. Native Ixians, expansion factions/decks, Leader Skills, Homeworlds, Semuta, Discoveries, Ecaz variants and other module overlays are excluded. It does not retrofit an in-play game, enable a public start, reset a saved room or change existing native Ixian allied replacement.
 
-1. Create an immutable purchase receipt from the real completed acquisition: version, event, buyer, turn, phase, sale origin, sale event/lot, purchased physical ID, original paid amount and contribution/recipient evidence. Record the original Harkonnen-bonus entitlement separately. Never reconstruct the target from the last card in the current hand.
-2. A pure replacement helper accepts an already authorized receipt, exact canonical hand/deck/discard, the exact purchased ID and a shuffle function. Reject duplicate physical custody and wrong target before RNG. Remove that held card, append its discard, recycle only if necessary, transfer exactly the top card, and return immutable resulting custody plus a private outcome receipt. If discard reactions suspend the operation, split disposal and draw with an independently bound pending stage.
-3. The engine owns common Nexus eligibility, sale-origin policy, immediate opportunity lifetime, response/decision preservation, Nexus-card disposal, normal discard hooks, bonus ordering and payment continuation. A declined opportunity closes for that purchase without spending the Nexus card. An accepted play cannot reopen after receipt deletion, replay, a later purchase or JSON reload.
-4. Bind latest progress independently of the detailed receipt. Historical outcomes must survive later transfers and deck recycling without requiring the old card to remain in discard. Signatures are consistency evidence, not cryptographic protection against arbitrary rewritten saves.
-5. Project the purchased face and replacement result only to entitled owners. A public discarded identity does not authorize exporting replacement identity, deck order, private receipt signatures or old hand contents. Other seats may receive ordinary counts and a played-Nexus event. Do not grant Atreides automatic inspection of a card drawn outside its auction inspection opportunity.
+There is no starting Nexus deal. Native draws require a qualifying closing
+Nexus with a settled alliance, so a two-seat profile can continue its base
+game but cannot naturally produce an unallied Secret Ally holder. Actual
+replacement scenarios need at least three seats; two simultaneous unallied
+recipients need at least four. Fixtures form genuine nonrecipient alliances
+and never add seats to an admitted game or fabricate Nexus hands.
 
-Meaningful verification should include genuine ordinary and Karama purchases, both source-supported Richese origins once policy is settled, Harkonnen bonus/cancellation/cap sequencing, empty deck with same-card redraw, canonical expansion cards, poison discard hooks, reserved-card interruption, all-seat privacy, replay/stale rejection without mutation, JSON recovery and production SQLite races. This audit implements none of those paths and does not certify their integration.
+### Connected purchase and choice
+
+1. Only an actual normal-auction purchase is connected: paid spice or a genuine printed Karama-paid purchase, including direct printed Karama acquisition before a positive bid is recorded. The free purchase must originate from the actual printed Karama; native Bene Gesserit Worthless/Truthtrance substitutions continue unchanged without this new offer. This is a bounded producer restriction, not a ruling that those acquisitions cease to be purchases. The original source, purchased physical card and native sale continuation are bound after the genuine acquisition. Gifts, bonus draws, Technology swaps, old hand cards and historical purchase IDs cannot create an opportunity.
+2. A Harkonnen **buyer** and Richese cache, Black Market or special-acquisition origins are guarded, not adjudicated. A Harkonnen rival is allowed and retains its ordinary native play outside this offer. These bounds preserve the unresolved independent Nexus cache scope and Harkonnen bonus priority above; they are not printed prohibitions or imports of the native `ixAllyCard` origin filter.
+3. Every publicly possible supported buyer receives the same event and public buyer identity, regardless of its secret Nexus face. Only that buyer receives Pass and the exact already-owned purchased card for inspection; only a truly eligible unallied holder of the physical Ixian Nexus receives Use. Opponents receive neither the purchased/replacement face nor private price, receipt, deck order or eligibility reason. The buyer may inspect its own actually held Nexus through the existing authorized inspector; the neutral prompt grants no rival entitlement.
+4. **Pass** retains the purchased card and Nexus, closes this opportunity and continues the original sale once. **Use** spends that singleton Nexus once, discards exactly the just-purchased physical Treachery Card, then draws the actual next deck card privately. There is no card selector, arbitrary hand exchange, new Karama counter, refund, repayment or re-auction.
+5. The discard opens a full legal hand's slot before the draw. An exhausted deck recycles eligible Treachery discards, including that just-discarded card; drawing the same physical card again is legal. The unsold auction row is not the draw deck. Earlier Atreides auction inspection does not grant a new peek of this replacement.
+6. The original funded amount, own/authorized-ally contribution and recorded free/paid source are preserved. Already completed payment is not repeated, and original income and native auction suffix run once through their genuine continuation. Other response/decision priorities remain native: finish the source-bound choice before another payment, lot, transfer or card effect can change its reserved source. No expiry bypass or raw-action replay is added.
+7. Refresh restores the same pending event or closed outcome without another payment, shuffle, draw or Nexus spend. Closed, stale, foreign or malformed events cannot reopen that purchase. Historical receipts remain valid after later transfers, reshuffles and same-card recycling; they do not require an old purchased card to stay in discard forever. Cursor/descriptor consistency is not authentication against arbitrary rewritten saves; authenticated sessions and production compare-and-swap remain required.
+
+### Public APIs and ownership
+
+- `initializeIxianNexusReplacementGameForAudit(state: Game): Game` in `game/engine.ts` is the fresh-only initializer; `Game.nexusIxianReplacementPreview?: true` marks the admitted profile. Genuine setup and Nexus dealing remain native.
+- `GameView.nexusIxianReplacementPreview` reports the profile. `GameView.nexusIxianReplacement` is the neutral event/buyer view with `canPass`, `canUse`, `blocked` and `purchased`; rivals have no face or private blocked reason.
+- `{ type: 'nexusIxianReplacementPass', event }` and `{ type: 'nexusIxianReplacementUse', event }` accept only that event-bound shape. There is no client-chosen purchased ID, replacement, recipient, price or Nexus identity.
+- `game/nexus-ixian-replacement.ts` owns canonical physical/source/custody/history validation through `createIxianReplacementSource`, `validateIxianReplacementSource`, `closeIxianReplacementSource` and `validateIxianReplacementHistory`, with `initialIxianReplacementCursor` and `ixianReplacementEvent` for bounded progress. The source snapshots the exact purchased descriptor, not a whole-Game undo or payment replay. Canonical descriptor, original parent, owned exact target, legal hand cap and single physical custody are validated before Nexus cost or randomness. The closed receipt chain and independent cursor do not require an old discard to remain in its historical location. The engine alone owns purchase authorization, original payment and native discard/draw/sale continuation. Existing native Ixian ally response remains a distinct cancelable ability, not an alias or fallback for the absent-faction Nexus grant.
+- `components/nexus-ixian-replacement.tsx` and `components/game-table.tsx` own the private inspector and neutral controls; `game/bots.ts` consumes each bot's own legal projection. Easy, Medium, Hard and Brutal have minimal legal Use/Pass policies, not calibrated Nexus strategy.
+- The local CLI entry is `node --import tsx tools/start-prototype.ts --profile ixian-replacement --db PATH --room CODE --version NUMBER --out /private/new-directory`. It requires the exact current room version, a fresh supported setup and a private new backup/kit directory; it preserves room/seat/setup identity and existing saves rather than replacing or resetting a game. `tools/prototype-room.ts` owns admission and the private backup transaction.
+
+## Verification and retained release gates
+
+**Partial development verified.** Types, lint, 6,227 offline cases and the
+73-case selected six-file union pass. Actual standalone native execution
+covers fourteen Basic/Advanced paid/printed-Karama Use/Pass, wrong-face
+Keep, full-hand and depleted-source outcomes with exact original ledger,
+physical Treachery/Nexus/force/elite custody and replay rejection.
+
+The depleted source is captured from genuine six-seat play, seed 11:
+turn five, native `auctionPayment`, seventeen held cards, twelve actual
+discards, four native reserved lots and an empty draw deck. All 33 cards
+are present. Legal purchases, Battle Plans and winner discards produced
+it; no row inflation, stock deletion or phase rewrite was used.
+`tests/fixtures/nexus-ixian-native-depleted.json` then exercises the actual
+payment and native replenishment shuffle, including exact same-card redraw.
+
+Independent rules/privacy rereviews have no finding after two actual fixes.
+Nine retained purchase records grew to 7,030,825 bytes under recursive
+signature nesting; nonrecursive result-head links reduce them to 134,145
+bytes. A permanent linear-history regression retains corruption/replay
+checks without a cryptographic-authentication claim.
+Actual phone Take back control previously sent no POST during a pending
+choice; it now sends one 200, restores the original seat controller and
+retains that same paid-source event. Gameplay locks still protect the offer.
+Incidental disabled-attribute-order and attempted-SQL-write pins were removed;
+actual room/eligibility locks, durable `total_changes()` and credential CAS
+remain checked.
+
+Three same-admitted setup/seat/circle QA rooms were privately backed up and
+entered by exact-version CLI: `GTCHEGKU` Basic paid Use plus independent
+takeback, `JUXLJXHC` Advanced printed free Use, and `HJ5Q64T5` Basic
+irrelevant-face Keep. Actual 390-pixel inspection, actions, native income
+and refresh retain the source. The wrong-face owner receives no Use or
+Ixian inspector. Read-only saved proof conserves original native inventories,
+exact spice and one closed outcome; all eleven previous QA rooms are unchanged.
+
+Repository evidence: `tests/nexus-ixian-replacement.test.ts` (pure source,
+custody/history), `tests/nexus-ixian-replacement-engine.test.ts` and genuine
+`tests/fixture-nexus-ixian-replacement.ts` (native acquisition/continuation),
+`tests/nexus-ixian-replacement-controls.test.tsx` (private controls),
+`tests/bot-nexus-ixian-replacement.test.ts` (four legal policies),
+`tests/nexus-ixian-replacement-recovery.test.ts` (authenticated SQLite) and
+`tests/prototype-room.test.ts` (fresh profile and exact-version backed-up CLI).
+This evidence is not complete family/module or deployed acceptance.
+
+Native Harkonnen-buyer bonus/cancellation/cap sequencing, independent Richese cache/Black Market/special scope, expansion-card discard reactions, Semuta/Ecaz priority and anytime interleaving remain pending outside this profile. Full Ixian/Nexus families, combined modules, public starts, complete games and live release acceptance remain separate gates.

docs/RULE_DECISIONS.md

@@ -65,9 +65,11 @@ reevaluated. The own-turn warning exposes only affected public territory
 names through `GameView.advancedAllySeparation`; the ordinary `endMovement`
 action stays unchanged, with no confirmation for mandatory losses.
 
-Verification of this cutover is **Planned** pending the coordinator's
-frozen native, authenticated SQLite and phone/browser evidence. Existing
-focused tests and old calibration counts do not verify these new defaults.
+Verification of this cutover is **Partial development verified**: genuine
+native, authenticated SQLite, private/control/bot and phone evidence is
+recorded in [the checkpoint log](IMPLEMENTATION_STATUS.md#1-october-2026--authorized-advanced-storm-and-allied-separation-defaults).
+Code `e1056a4` has exact-source successful isolated container verification
+and publication; that does not update the last observed live revision.
 Public, faction, optional-module and full-mode readiness gates are unchanged.
 Secrecy (physical page 16), Duke Vidal's ghola exception (30), Kull and other
 independent decisions are not reconciled by this cutover.
@@ -107,6 +109,7 @@ independent decisions are not reconciled by this cutover.
 | Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
 | Richese Nexus Betrayal auctions | Pause at a valid original prepayment quote. Public self-cache veto discards the exact card without debit/acquisition; another buyer's positive cache/Black Market invoice keeps price/contributions/delivery and earned Harkonnen bonus while overriding the recipient to bank. All publicly possible unallied other-faction held-Nexus seats acknowledge uniformly; private identity controls only own Use. This neutral protocol is an application choice, not publisher timing. Normal hidden-family self-purchases, special-Karama veto and unsupported overlays remain excluded; no native Karama exception certifies them. Bounded engine/SQL/bot/phone scenarios are verified locally; broader verification remains Partial and public starts/full Nexus gates stay closed. | [Printed face, profile, API and saved continuation](NEXUS_RICHESE_RULES.md#bounded-betrayal-auction-contract--30-september-2026), [common privacy protocol](NEXUS_CARD_RULES.md#richese-betrayal-prepayment-protocol), [auction source boundaries](RICHESE_AUCTION_RULES.md) |
 | Guild Nexus Betrayal shipment payment | Replace one original funded positive fee in full, including own pre-funded payment and the printed full occupied-Junction override; preserve original payer/contributions, consume already-debited donor escrow once and deliver the original physical shipment once. Native applicable stop/rate responses precede the bounded gate; zero/stopped shipments supply no award or Nexus cost. Public possible held-Nexus seats acknowledge uniformly; private Use changes no public price/source disclosure. Fresh classic/native-Guild/Nexus with optional genuinely seeded Homeworlds only; unsupported native Cunning/Richese shipment overlays block before card/parent commitment, and restored transport independently requires the native Guild grant. Bounded engine/SQL/bot/CLI/phone custody and refresh are locally verified; no new priority/immunity, ordinary occupation/rounding ruling or extra shipment. Broad/public/live gates remain closed. | [Printed source and bounded contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal), [common protocol](NEXUS_CARD_RULES.md#guild-betrayal-funded-payment-protocol), [internal checklist](../game/reference.ts) |
+| Ixian Nexus Secret Ally replacement | Fresh classic/base-deck/Nexus-only Basic or Advanced local `ixian-replacement` profile binds one genuine normal paid/printed Karama purchase. Discard exactly that purchased physical card before privately drawing the actual deck top; full-hand and exhausted-deck same-card redraw are legal. Keep original payment, income and native auction suffix once; no refund, re-auction or new native Ixian Karama response. Every publicly possible supported unallied held-Nexus buyer gets the same neutral choice irrespective of hidden face; only the owner has Pass/entitled inspection and private eligible Use. This is an inferred development privacy convention, not publisher timing. Harkonnen buyers, Richese cache/Black Market/special origins, anytime overlays and combined modules stay guarded pending their independent source/priority questions. Existing native Ixian ally replacement is distinct. Verification Planned; no retrofit, public start or full-family certification. | [Photographed face and bounded runtime contract](NEXUS_IXIAN_REPLACEMENT_RULES.md#bounded-local-runtime-contract) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
 | Sapho movement | At a clean boundary, first reorders only remaining unstarted turns; completed turns stay completed. Advanced Guild must have finished or be absent. Last retains existing protection after Guild. | [Existing source contract](JUICE_OF_SAPHO_SOURCE_UPDATE.md#movement-firstlast), [runtime](JUICE_OF_SAPHO_RUNTIME.md) |
 | Basic CHOAM / Leader Skills | Compose existing ordinary skills with native sales and own-leader Ghola revival. Finish the private optional replacement before the exact suspended sale resumes. The free revival remains completed if the resumed sale is canceled. Basic uses five ordinary leaders and 35 Treachery Cards; Auditor remains Advanced and ineligible for skills. | [Integration and source contracts](CHOAM_LEADER_SKILLS.md) |