Fix Grumman stack placement cancellation and inventory validation

docs/GRUMMAN_PLACEMENT_CANCELLATION.md

@@ -0,0 +1,25 @@
+# Grumman stacks and Mentat placement cancellation
+
+10 September 2026. This checkpoint fixes an interaction between the implemented [Grumman Collection addition](GRUMMAN_STACKED_TERROR_RUNTIME.md) and the ordinary [Moritani placement cancellation](PLACEMENT_CANCELLATION_RECOVERY.md). It does not introduce new placement permissions or resolve the remaining Nexus interpretations.
+
+## Reproduced defect and final behavior
+
+A real high-Grumman Collection addition creates two hidden Terror tokens in Arrakeen and pays four spice. Moritani then reaches its separate Mentat opportunity and declares an available token for empty Carthag. Before this fix, an opponent's printed Karama fails because the cancellation validator requires every already-placed Terror token to have a different stronghold. That assumption predates the supported Grumman stacks. The regression reproduced the failure in Basic and Advanced play and after Grumman later falls below high population.
+
+Cancellation now preserves the entire physical inventory, including the legal stack and the proposed token's original position. It consumes the Mentat opportunity and the one Karama as before. The Collection payment is neither repeated nor refunded, and no hidden Terror face is revealed.
+
+The established denial contract remains unchanged: canceling a previously declared operation does not execute it or require its current source and destination still to make the placement useful. An initially considered replay of `placeTerror` was removed because it would change that existing contract. Allowance still uses the ordinary placement helper and its current legality checks. Neither path grants another placement or moves every member of a stack.
+
+An independent production SQLite corruption test found a second defect: an unrelated duplicate physical token ID rejected on cancellation but could be persisted by allowing the placement. Both outcomes now validate the same complete physical inventory and declared source before resolving. The allowance then performs its separate placement validation. The regression retains the unrelated duplicate as well as a duplicate of the selected token, rather than narrowing away the original failure.
+
+## Evidence
+
+- [Three engine/quote cases](../tests/grumman-placement-cancellation.test.ts): genuine Basic/Advanced Collection-to-Mentat cancellation, later low-population and turn handling, unchanged hidden inventory and income, prior denial semantics, and malformed inventory/source rejection without mutation.
+- [Three production SQLite cases](../tests/grumman-placement-cancellation-recovery.test.ts): restored private seats, cancellation versus final allowance with exactly one successful write, lost-response/replay behavior, and zero-write rejection of unknown IDs, invalid territory, both duplicate-ID variants and stale turn.
+- The focused selection passes **31 cases**, including historical placement cancellation and Grumman Collection behavior. Full-project check, build and final preservation totals are recorded in the opening implementation checkpoint after verification.
+- A new three-seat browser room reaches the real Mentat opportunity after Collection, declares Carthag through the phone controls and cancels through the opponent's Karama control. The two-token Arrakeen stack, available proposed token and four-spice Collection income survive. Desktop/390-pixel phone screenshots were inspected, with no horizontal overflow or page errors. All three private seats restore after refresh; opponents see placed counts without hidden faces or the private declaration.
+- The scheduled controlled restart preceded this fix. All **3,453** then-existing games retained their exact versions and state hashes, and twelve private seats from the preceding Emperor/Bene Gesserit checkpoints reconnected successfully. The new cancellation room separately passes refresh recovery; its new behavior is covered by production-module reload tests, rather than being claimed as played before that earlier restart.
+
+## Remaining work
+
+[Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md) and [Fremen worm/revival effects](NEXUS_FREMEN_RULES.md) now have new primary-source and integration audits. They remain unimplemented; the purchase privacy preference is pending, and the audits distinguish unresolved timing, scope and accounting questions from established mechanics. The Moritani Cunning audit also identified the need to adapt placement, entry and saved-state validators together before non-stronghold Terror can work. No Nexus effect, expansion or public mode was enabled by this fix. No recurring automation was recreated.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Grumman stack cancellation checkpoint, 10 September 2026:** [GRUMMAN_PLACEMENT_CANCELLATION.md](GRUMMAN_PLACEMENT_CANCELLATION.md) records the reproduced failure of printed Karama against a native Mentat placement after a legal Collection stack. Cancellation now preserves the existing stack without requiring distinct occupied locations. Independent SQL review also fixed allowance accepting unrelated duplicate physical token IDs; both outcomes validate the same inventory. Existing denial semantics remain unchanged. **Types, lint, all 4,012 offline cases, production build and 40 HTTP/session cases pass.** Six new cases cover Basic/Advanced, low population, unchanged income, competing cancellation/allowance, private restoration and malformed records. Browser phone declaration, desktop/phone cancellation and three-seat refresh pass. The hourly restart preserved all **3,453** opening games and restored twelve earlier private seats; final comparison leaves those same versions/hashes unchanged, with one new browser room and thirty HTTP rooms added. New [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md) and [Fremen Nexus](NEXUS_FREMEN_RULES.md) audits record remaining source and privacy boundaries. No new Nexus effect or release gate was enabled; automation stays removed.
+
 **Emperor Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_SARDAUKAR_RUNTIME.md](NEXUS_SARDAUKAR_RUNTIME.md) records five ordinary counters temporarily using Sardaukar strength and support in one Advanced battle. Physical counters, starred reserves and ordinary losses remain distinct. Shared editor and bot calculations handle the Fremen exception and Salusa support. Review fixed a canceled-enhancement Prescience deadlock and retained durable winner casualty choices across competing SQLite requests. **Types, lint, all 4,006 offline tests, production build and 40 HTTP/session tests pass.** Thirty-five new cases cover independent counter arithmetic, real Homeworld thresholds, future commitments, hidden information and recovery. Two three-seat browser rooms passed desktop/phone allowance, cancellation, reanswer, sealed planning and private refresh. All **3,421** opening room versions/hashes remain unchanged; only thirty HTTP rooms and two browser rooms were added. Fewer-than-five interpretation, Emperor Secret Ally, Betrayal and complete module acceptance remain gated. No release gate opened; no restart was due, and automation remains removed.
 
 **Bene Gesserit Nexus advisor checkpoint, 10 September 2026:** [NEXUS_ADVISOR_RUNTIME.md](NEXUS_ADVISOR_RUNTIME.md) records whole-territory, multi-sector Cunning conversion during the native owner’s Advanced Shipment and Movement action. One Karama cancels the entire declared batch; source positions, counts and action allowances are preserved. Saved responses survive Truthtrance, Harkonnen exchanges and paid Nullentropy. Shared controls and all four bot profiles consume the public legality quote. **Types, lint, all 3,971 offline tests, production build and 40 HTTP/session tests pass.** Thirty-five new cases include pending-parent corruption, physical custody and concurrent production SQLite recovery. Two three-seat browser rooms passed desktop/phone selection, allowance/cancellation and private refresh; review also fixed checkbox spacing, accessible SVG titles and stale Nexus guidance. All **3,389** opening saved rooms retain their versions/hashes; only two isolated browser rooms and thirty HTTP-test rooms were added. Fresh advisor/storm rulings, borrowed Voice, Betrayal and complete module acceptance remain gated. The Emperor source audit prepares the next family. No release gate opened; no restart was due, and automation remains removed.

docs/NEXUS_CARD_RULES.md

@@ -55,6 +55,8 @@ Source for the entire table: [the twelve original printed components](https://bo
 
 ## Effect integration boundaries
 
+Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), and [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md). These audits distinguish implemented work from remaining source/timing questions; the current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md).
+
 **Atreides is the first complete effect family to implement.** It has independent rulebook and physical-face evidence, and the engine already has private plan-element inspection. The Nexus effect needs its own cause and receipt rather than temporarily changing the inspecting faction. The second element must differ from the already inspected element. Preserve the original disclosed value if an allowed later battle edit occurs; follow the existing plan commitment rules instead of refreshing an old observation. The card specifies an element, not the entire hand or battle plan. A weapon/defense request uses actual played-card classification, including the published Reinforcements/Harass exclusions, rather than leaking a card merely because it occupies that slot.
 
 **Cancellation needs the original attempted effect.** Betrayal is not a blanket Karama flag. For Atreides, identify the inspection attempt being prevented; for Voice, the command; for a traitor/Face Dancer, the actual revealed identity; for economy, the original invoice and settlement. Do not refund or replay a completed payment merely because the next input happens to be a Nexus play. Effects with no printed phase still need a safe explicit action boundary and cannot bypass another player's committed private choice.

docs/NEXUS_FREMEN_RULES.md

@@ -0,0 +1,58 @@
+# Fremen Nexus: worm and revival contract
+
+Primary-source and integration audit, 10 September 2026. This document does not implement an effect or open a release gate. The [common Nexus rules](NEXUS_CARD_RULES.md) apply. No new user question was sent.
+
+## Evidence
+
+The Fremen panel was freshly read from the [photograph of the printed GF9 cards](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), cached as `/tmp/dune-nexus-cards.jpg`. Cunning permits a remote ride when a sandworm appears in a territory containing no forces: the player may take forces from one desert territory to a destination respecting storm and occupancy rules. Secret Ally offers either protection against a sandworm or a total of three free force revivals during Revival. The latter does **not** use Emperor's additional/beyond-limits wording. Neither option grants the absent faction's other advantages.
+
+The [base Fremen sheet, printed p.16](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=16) supplies ordinary riding after the Nexus, from some or all forces at the worm's territory, and Advanced placement of additional worms in sand. The [base Spice Blow rules, p.8](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=8) ignore first-turn worm cards and associate later natural worms with the applicable discard territory. These are separate from a worm's destination after riding.
+
+The [November 2020 FAQ, pp.2–3](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=3) preserves the one-per-turn Advanced Fedaykin/Sardaukar revival cap through other revival producers. It also expressly makes the Fremen special Karama summon a Spice Blow/Nexus event with a Nexus and normal destruction/ride consequences. This supersedes the older contradictory no-Nexus answer in the base book. Publisher-indexed text was retrieved; direct PDF access returned 403, and two older locally named base/FAQ PDFs proved to be HTML rather than readable PDFs.
+
+The [E1 FAQ, p.11](https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf#page=11) describes Sandtrout's anti-Nexus and immediate replacement-card behavior. Its Karama table distinguishes destroying Fremen at a worm from stopping additional-worm placement. The [E3 rules, pp.11–12 and 16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=12), reread in the cached publisher-authored PDF text and fresh publisher-indexed excerpts, give common Nexus timing and distinguish Great Maker's reserve ride from ordinary board-origin riding. Great Maker remains a separate integration boundary.
+
+## Cunning: source-backed scope and implementation composition
+
+The following are implementation consequences of the inspected text, not additional quoted rules:
+
+- **Empty means no faction's forces, at the actual appearance.** Capture this fact before `devour`; a worm that eliminates an enemy army must not retroactively qualify. Count all sectors, normal/starred counters, BG advisors, and a public No-Field marker as one. Use `presenceAt` from `game/force-presence.ts`; never inspect its hidden denomination or infer emptiness from the forces left after destruction. Spice, Terror and Ambassador tokens alone are not forces.
+- **Only the source must be desert.** Use board territory type `sand` for one chosen source; allow a subset and multiple sectors within that single territory, retaining exact starred counts. Strongholds, rock, Polar Sink, native reserves and Homeworlds are not desert source groups. Natural worm appearances can follow a printed spice card in rock territory: do not incorrectly require every triggering territory to be sand. Existing `disaster-preflight.ts` deliberately supports that distinction.
+- **Destinations reuse ordinary riding.** This is not a two-territory move or a reserve shipment. Reuse valid Arrakis locations, storm exclusion, ally/stronghold capacity, sector checks and typed removal. Do not impose the source's desert restriction on destinations. Keep the existing Homeworld/discovery/HMS boundaries unless their own adapters explicitly support the move.
+- **One use must bind one actual appearance.** Both Advanced spice piles and allowed additional-worm placements can produce separate events. A second-pile event must not borrow the first pile's discard territory, and identical territories do not identify identical worms. First-turn ignored cards and the current Sandtrout-suppressed branch do not call `beginWorm`; creating Cunning merely when a worm-shaped card is drawn would bypass those existing rules.
+- **Special summons are real worm appearances.** The later FAQ supports applying the trigger to an empty-territory summon. Preserve its separately saved parent and after-blow Nexus ordering. A player cannot manufacture the trigger by choosing a source group first and treating that group as already at the empty worm territory.
+
+Great Maker expressly replaces normal board-origin riding with reserve riding. Do not automatically add another board ride or allow Cunning to choose between both sources. This combination needs a separate resolution when Discovery is implemented. Likewise, Sandtrout handling should remain at the existing appearance boundary; this audit does not independently change its suppression algorithm.
+
+## Engine contract and timing hazards
+
+`beginWorm` → `wormSurvival` → `devour` → `afterWorm`/`continueSpice` is the current resolution path. `devour` only pushes a territory into `wormRides` when Fremen already occupy it. `nextWormRide` additionally requires surviving Fremen there. Therefore adding the empty territory to that string queue cannot implement Cunning: it will be discarded, or will incorrectly demand a source at the empty location.
+
+Recommended focused contracts:
+
+1. Create an immutable worm occurrence before destruction, recording event, turn, phase, source (`natural`, `additional`, `summoned`), target, applicable pile/parent identity and original public force presence. Only accepted additional placement creates an occurrence. Never regenerate the original emptiness fact from current forces on read.
+2. Quote Cunning from that occurrence and public board groups, plus the owner's actual card entitlement. Return eligible single-desert sources with typed per-sector counts and ordinary destination legality. Validate the selected subset again when committing; no hidden opponent hand or marker size enters the quote.
+3. Spend the unique Nexus card once and persist a signed result/ride obligation bound to the occurrence. Keep its source selection separate from the worm's appearance territory. Preserve the existing post-Nexus ride scheduling, including further summoned worms and both spice piles. Record progress independently enough to reject deleted decisions, source edits and replayed completed rides.
+4. On movement, reuse the existing worm-ride arrival chain: `intrusion` and `openTerritoryEntry(..., 'wormRide', 'wormRide')`, followed by `nextWormRide` only after all Ambassador/Terror/BG children finish. Do not rerun devouring, spice draws, negotiations, shipment, or normal movement usage.
+
+Two interactions need a concrete decision before treating this as a complete feature. The card triggers at appearance while ordinary riding follows negotiations: a just-drawn card must not automatically buy a retrospective ride for an earlier empty worm. Also, ordinary Karama's printed Shai-Hulud result destroys forces at the worm, whereas the remote source is elsewhere. Do not destroy that remote source, or invent a global loss of all riding, as a shortcut for cancellation. A bounded enhanced-native cancellation policy must preserve the original empty occurrence and unrelated rides.
+
+## Secret Ally protection
+
+With Fremen absent, `wormSurvival` currently proceeds directly to destruction. The protection must be committed before that destruction; it cannot revive already devoured troops, prevent removal of spice, or grant a ride. Bind it to one worm occurrence and the holder's affected physical group, including the existing No-Field reveal/capped-materialization path. Other factions remain vulnerable.
+
+A pause offered only when the threatened player secretly holds this card would disclose possession. Do not add a holder-dependent automatic stop or an unsolicited confirmation for every victim. This intersects the existing unanswered reaction/automatic-pass policy. A saved public occurrence may support a future permitted response design, but it is not authorization to pick that design here. No source found gives the absent-faction card blanket Karama susceptibility; do not reuse a native Fremen cancellation response without establishing its classification.
+
+## Secret Ally revival
+
+The card's total-of-three wording and the native alliance's ordinary free-three benefit support a **free-rate interpretation within ordinary revival accounting**, rather than three additional counters beyond the usual allowance. This is source composition, not an explicit Nexus FAQ. Preserve it as the proposed contract; do not silently apply Emperor's separate extra-return producer.
+
+`game/revival.ts` already computes free rate/remaining from `p.revived`, typed prices and ordinary limits. Engine `beginRevival`/`finishRevival` retains pending requests and Tleilaxu prevention/income continuations. The likely narrow adapter is an explicit source-labelled, phase-bound free-rate entitlement consumed by an actual normal revival request, retaining previous returns and exact free/paid normal/starred allocation. Never refund earlier paid revivals or reset `revived`/elite counters on card play or reload.
+
+Keep these questions visible: how the three-total interacts with a higher native free rate, prior paid/free returns, low-Homeworld bonus and Recruits; whether a partial group below three is permitted when Tanks cannot supply three; and whether the benefit survives La La La or Tleilaxu prevention. The [existing revival audit](FREMEN_REVIVAL_AUDIT.md) and [Homeworld benefit audit](HOMEWORLD_BENEFITS_RULES.md) do not by themselves answer differently worded Nexus composition.
+
+Tleilaxu may be present even though Fremen is absent. `collectRevivalIncome` uses a per-player/turn free-income marker and a separate Ghola path; do not create another payment merely because a Nexus card was played. Axlotl activation and any eligible Homeworld deployment must follow the actual returned batch. Preserve the existing [revival-accounting questions](TLEILAXU_AMBASSADOR_RULES.md), exact typed caps, and signed return/arrival continuations. No leader, Cheap Hero or foreign leader revival is printed here.
+
+## Verification required for the next package
+
+Start with genuine unallied Fremen Cunning and natural empty appearances in both modes: compare initially empty against enemies devoured to empty, BG advisors, hidden zero/three/five markers, and multi-sector source groups. Verify rock-spice triggering territories, storm-blocked sources/destinations, occupied strongholds, typed movement and no normal movement charge. Extend to both Advanced piles, additional placement, summoned-parent recovery, canceled appearances, Sandtrout suppression, post-Nexus timing and nested arrival effects. Compare every seat's view and prove lost acknowledgments and concurrent requests cannot duplicate a ride. Secret Ally protection and revival require the specific policy/accounting boundaries above before broader integration is certified.

docs/NEXUS_IXIAN_REPLACEMENT_RULES.md

@@ -0,0 +1,63 @@
+# Ixian Nexus Secret Ally: purchased-card replacement
+
+Source audit: 2026-09-10. This is a source contract and proposed implementation boundary, not a runtime or expansion-completion claim. Existing [Nexus release gates](NEXUS_CARD_RUNTIME.md) remain in force.
+
+## Primary evidence
+
+- **Face:** [photograph of the twelve original GF9 Nexus Cards](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), independently inspected again at `/tmp/dune-nexus-cards.jpg`. The photographed publisher text is the authority, not commentary by its uploader.
+- **E3:** [GF9 Ecaz & Moritani rules, pp.11,16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11), indexed publisher text and the previously retrieved [publisher-authored mirror](https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf), `/tmp/dune-e3-nexus-rules.pdf` and `.txt`.
+- **Base:** [GF9 base rules, pp.6,8,17](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=6), freshly retrieved publisher-indexed setup, bidding and Harkonnen text.
+- **E1:** [GF9 Ixian & Tleilaxu rules, p.9](https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf#page=9), freshly retrieved publisher-indexed alliance paragraph.
+- **FAQ:** [GF9 November 2020 FAQ, pp.6–7](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=6), freshly retrieved publisher-indexed inspection and Karama rulings.
+- **E2:** [GF9 CHOAM & Richese rules, pp.4,10–11](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf#page=10), freshly retrieved publisher-indexed discard secrecy and purchase FAQ.
+
+Direct official PDF retrieval returned 403. Several older temporary `.pdf` paths contain HTML error pages; they were not treated as readable PDFs. No tournament rewrite or community compilation supplies a ruling here.
+
+## Printed operation
+
+The face permits the holder, when Ixians are absent, to discard the Treachery Card just purchased during Bidding and then draw the top Treachery Deck card. This identifies one particular purchase, not an arbitrary held card. The replacement is optional, but playing it spends the Nexus Card. No spice refund, extra payment, free choice from the deck, or second replacement is printed. The panel has no Advanced-only qualification. [Face](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani)
+
+Common Nexus rules require an unallied holder; joining an alliance discards the held Nexus Card. Secret Ally applies when the represented faction is absent, distinct from native Cunning or Betrayal. The E3 FAQ contains no Ixian replacement clarification. [E3](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11)
+
+The buyer takes the purchased card after payment. The native Ixian allied replacement explicitly occurs immediately after purchasing; November's FAQ permits viewing that purchased card before choosing. Applying the same inspection entitlement to this independently printed just-purchased replacement is ordinary composition, not a Nexus-specific FAQ. [Base p.8](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=8), [E1 p.9](https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf#page=9), [FAQ p.6](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=6)
+
+## Custody, deck and purchase consequences
+
+- Discard first, then draw. A full but legal hand is supported: the discard opens the slot before replacement; neither transient overcapacity nor a full-hand exception is needed.
+- Base setup requires discard reshuffling to replenish an exhausted Treachery Deck. Therefore an empty deck is not a reason to disallow this effect: its own preceding discard supplies a card. That physical identity can be drawn again. Do not exclude it or promise a different card.
+- The already dealt auction row is distinct from the remaining deck. Draw the actual deck top, not the next unsold auction lot. Do not rebuild the auction pool.
+- Harkonnen retains the bonus earned by the original purchase, subject to its ordinary hand cap and cancellation. Replacement is a draw, not another purchase, so it earns no second bonus. At seven cards before purchase, the purchase fills the eighth slot; a one-for-one replacement does not create bonus capacity.
+
+These are compositions of the printed discard-then-draw operation with [base pp.6,8,17](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=17). Preserve the original paid price and recipient exactly once; this card contains no reversal instruction.
+
+An ordinary Karama acquisition is described by November's FAQ as purchasing without spice, so zero payment alone does not exclude a genuine Bidding purchase. Gifts, bonus draws, Ambassador draws, Nullentropy retrieval and Technology swaps are not purchases merely because they occur in Bidding. [FAQ p.7](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=7)
+
+## Richese and cancellation: distinguish source scope
+
+E2 explicitly excludes a direct Richese cache purchase from the **Ixian ally** replacement, while allowing Black Market purchases, including a Richese-family card. It also awards Harkonnen's normal bonus for both sale kinds. The restriction follows purchase origin, not card family. [E2 pp.10–11](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf#page=10)
+
+That question names an ally of Ixians. The later Nexus face independently grants the operation when Ixians are absent and does not name the native alliance advantage or repeat the cache exclusion. The literal independent-grant reading includes genuine cache purchases during Bidding. Extending the older exception to the new card is an alternative interpretation; no retrieved primary clarification selects it. Do not silently reuse an existing native `ixAllyCard` origin filter as though it settled this distinction. The same analysis matters for Richese's genuine special-Karama cache purchase during Bidding; its other timing and hand-cap boundaries remain in the [acquisition audit](RICHESE_ACQUISITION_RULES.md).
+
+November's Karama table expressly permits stopping the native Ixian ally from discarding a purchased card. For this separately worded Nexus grant, Ixians are absent and the holder is not using a present faction's native or actual alliance advantage. Treating it as a direct card effect without that native cancellation window is the supported category composition used for Atreides Secret Ally; it is not an express general Nexus-immunity ruling. Unlike Bene Gesserit Secret Ally, this face does not say to use a named faction advantage. [FAQ p.7](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=7), [Face](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani)
+
+## Ordering and unresolved boundaries
+
+**Harkonnen draw order:** the purchase earns its bonus, and Nexus applies to the just-purchased card. Neither inspected paragraph explicitly orders these two post-purchase draws. Choosing replacement after viewing the bonus can change the informed decision; bonus cancellation can also affect the deck. Preserve separate purchased, replacement and bonus identities and report the priority gap before selecting a fixed order. Owner-selected ordering is a possible implementation proposal, not a retrieved official ruling. The free bonus itself is never an eligible purchased target.
+
+**Other immediate disposal effects:** use the ordinary physical-discard pipeline. Applicable Ecaz poison income and Semuta reactions must neither duplicate the discarded card nor cause a second replacement. Precise competing immediate-effect priority is not supplied by this Nexus face. Existing Semuta and occupation source gaps remain separate.
+
+**Nullentropy and custody interruptions:** a paid Box search freezes the searched pile in the existing subsystem. The replacement cannot draw or reshuffle that pile while browsing. Conversely, playing or transferring the just-purchased card cannot leave a live replacement offer pointing at custody it no longer owns. Preserve or settle the exact purchase continuation; do not reopen an expired purchase from an arbitrary historical card ID. Whether a player can interleave a particular anytime power before exercising an immediate purchase right needs an explicit sequencing policy, not an invisible loss of the right. See the [Box audit](NULLENTROPY_BOX_ENGINE_AUDIT.md).
+
+**Private opportunity timing:** a pause offered only to the holder may reveal possession of a specific secret Nexus identity. Reuse the project's existing unresolved private-response timing policy rather than inventing compulsory confirmations or claiming every buyer has an actual choice. No duplicate user question was sent by this audit.
+
+## Proposed pure and engine contract
+
+The following is an implementation design, not additional rule text. It deliberately keeps purchase eligibility separate from physical replacement so unresolved origin or ordering policy does not contaminate custody.
+
+1. Create an immutable purchase receipt from the real completed acquisition: version, event, buyer, turn, phase, sale origin, sale event/lot, purchased physical ID, original paid amount and contribution/recipient evidence. Record the original Harkonnen-bonus entitlement separately. Never reconstruct the target from the last card in the current hand.
+2. A pure replacement helper accepts an already authorized receipt, exact canonical hand/deck/discard, the exact purchased ID and a shuffle function. Reject duplicate physical custody and wrong target before RNG. Remove that held card, append its discard, recycle only if necessary, transfer exactly the top card, and return immutable resulting custody plus a private outcome receipt. If discard reactions suspend the operation, split disposal and draw with an independently bound pending stage.
+3. The engine owns common Nexus eligibility, sale-origin policy, immediate opportunity lifetime, response/decision preservation, Nexus-card disposal, normal discard hooks, bonus ordering and payment continuation. A declined opportunity closes for that purchase without spending the Nexus card. An accepted play cannot reopen after receipt deletion, replay, a later purchase or JSON reload.
+4. Bind latest progress independently of the detailed receipt. Historical outcomes must survive later transfers and deck recycling without requiring the old card to remain in discard. Signatures are consistency evidence, not cryptographic protection against arbitrary rewritten saves.
+5. Project the purchased face and replacement result only to entitled owners. A public discarded identity does not authorize exporting replacement identity, deck order, private receipt signatures or old hand contents. Other seats may receive ordinary counts and a played-Nexus event. Do not grant Atreides automatic inspection of a card drawn outside its auction inspection opportunity.
+
+Meaningful verification should include genuine ordinary and Karama purchases, both source-supported Richese origins once policy is settled, Harkonnen bonus/cancellation/cap sequencing, empty deck with same-card redraw, canonical expansion cards, poison discard hooks, reserved-card interruption, all-seat privacy, replay/stale rejection without mutation, JSON recovery and production SQLite races. This audit implements none of those paths and does not certify their integration.