Prototype CHOAM Nexus after-victory inspection

docs/CURRENT_STATUS.md

@@ -26,6 +26,12 @@ checkpoint is in [Discovery prototype](DISCOVERY_PROTOTYPE.md); this code is
 not yet in the live `c9a3625` image. Contested/shared transfers and full
 Discovery release acceptance remain gated.
 
+Checkpoint `209fb18` was pushed and its matching container workflow
+`36359970371` completed successfully. The dedicated deployment agent could not
+enter TrueNAS Apps because the host desktop was OS-locked; it made no NAS change,
+backup or post-rollout claim. Production remains at the last verified `c9a3625`
+image until the Apps session is unlocked and this exact image is deployed.
+
 The bounded [Fremen Nexus Cunning](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
 prototype connects an initially empty worm's public offer, one spent private
 card, a Karama response, a typed remote ride after the Nexus, human controls
@@ -252,7 +258,7 @@ These links define bounded working behavior, not complete module certification.
 | Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement and [Advanced Loyalty](ECAZ_LOYALTY.md), separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
 | Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md), [No-Field](SMUGGLER_NO_FIELD.md) and [battle collection](SMUGGLER_BATTLE.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md) and [worm rides](SANDMASTER_WORM.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md) and [bounded retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Orgiz transfers, Jacurutu income, Testing Station and Shrine. Orgiz's per-deposit interpretation, contested/shared benefits and mixed physical allocation remain provisional or pending. The Orgiz path in current source is not yet deployed. |
-| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected; CHOAM inspection and Emperor purchase remain pending. A source audit or helper alone is not a completed effect. |
+| Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Secret Ally trade and bounded after-victory inspection](NEXUS_CHOAM_SECRET_ALLY.md) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected; the CHOAM universal winner window is a privacy-preserving product inference, not publisher text, and Emperor purchase remains pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), [recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |
 | Other cards | [Sapho runtime](JUICE_OF_SAPHO_RUNTIME.md) includes first among remaining unstarted movement turns after Advanced Guild has finished. [Recruits](RECRUITS_RUNTIME.md) connects clean Revival play; [Harass & Withdraw](HARASS_WITHDRAW_RUNTIME.md) connects the bounded battle return in the same independent three-card preview. Richese card contracts and the checklist identify other connected effects and explicit gaps. |
 | Multiplayer | [Public and private discussion](TABLE_DISCUSSION.md), saved rooms/seats, [recovery](../README.md#saved-seats-and-reconnecting), uncertain-request retry, [own-seat AI](AUTOPILOT.md), [named-player AI permission](SEAT_AI_PERMISSION.md) and [voluntary seat handover](SEAT_HANDOVER.md) have connected controls and recovery evidence. |

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,11 @@
 # Dune implementation status
 
+## 27 September 2026 — Bounded CHOAM Nexus after-victory inspection
+
+The [Secret Ally prototype](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) now preserves the losing combatant's physically used-card IDs and offers every Nexus winner the same post-cleanup decision when CHOAM is absent, without revealing who holds its card. An eligible unallied holder may spend the physical CHOAM Nexus card to sample exactly one unused opposing hand card; only that seat receives the card snapshot, while the public log omits its face. Basic/Advanced real battles, all four AI profiles, signed receipt recovery, paid Nullentropy interruption, subsequent battle/turn expiry, rejected-action immutability and concurrent in-memory SQLite commits passed focused cases. A local browser with a read-only intercepted room view displayed the live table decision and private inspector; no saved room was changed. This is a product privacy interpretation, not a publisher ruling or complete Nexus certification.
+
+The complete offline suite passed 5,558 tests across 697 files, and the app build and scoped lint passed. `npm run check` still stops at the unrelated in-progress Nexus/Fremen `Player.fremenNexusMovementBlockedTurn` type error; the CHOAM type error found on the first pass was corrected, and a second full TypeScript run reported only that unrelated diagnostic. The live image has not yet received this checkpoint.
+
 ## 27 September 2026 — Bounded Orgiz Processing Station Collection
 
 The [Discovery prototype](DISCOVERY_PROTOTYPE.md#connected-behavior) now composes a sole Orgiz occupant's one-spice transfer over ordinary Collection: one uniquely collected board deposit is one observable blow, even when older blows stacked there. Separate deposits pay separately; contested Orgiz occupancy and unresolved Ecaz shared lots withhold their uncertain transfers without blocking ordinary collection. Advisor releases follow the ordinary Collection quote. This is a documented inference from the *Ecaz & Moritani* rulebook, not a publisher ruling. Basic/Advanced engine, JSON restoration, simultaneous in-memory SQLite CAS, conserved spice, rejected-action custody and player-visible log are covered by 20 focused Discovery cases. An actual staged engine continuation reached Collection and credited the Orgiz owner; an isolated local browser table rendered its token guidance and chronicle log without writing a room. The broader Discovery, combined-expansion and publication gates remain closed; this source is not yet the live `c9a3625` image.

docs/NEXUS_CHOAM_SECRET_ALLY.md

@@ -1,7 +1,7 @@
 # CHOAM Nexus Secret Ally prototype
 
-13 September 2026. The Spice Collection trade is **Prototyped** in the development
-Nexus module. Its battle inspection alternative is still missing. This checkpoint
+27 September 2026. The Spice Collection trade and a bounded after-victory
+inspection are **Prototyped** in the development Nexus module. This checkpoint
 does not enable normal Nexus starts, certify the full card family, or open a
 publication gate.
 
@@ -51,32 +51,34 @@ the opponent, including a Cheap Hero, cards played in weapon or defense slots
 and a late Portable Snooper. A used card remains excluded if another effect
 later retains it. The effect neither transfers nor discards the inspected card.
 
-The battle engine must preserve the opposing used-card IDs with the resolved
-battle event before mandatory loser disposal. The existing Auditor candidate
-filter is reusable because it removes exact physical used IDs from the current
-opposing hand. The Nexus effect still needs its own one-card sampler and receipt;
-it must not borrow Auditor survival, payment or cancellation behavior. A
-successful use discards the held CHOAM Nexus card once, records the sampled
-snapshot once and projects the face only to its holder. The public chronicle may
-name the use, winner and opponent, but not the inspected face.
+The battle engine records the opposing used-card IDs with the resolved battle
+event before mandatory loser disposal. The existing Auditor exclusion contract
+is reused for physical IDs, but the Secret Ally has its own one-card sampler
+and receipt. It does not borrow Auditor survival, payment or cancellation.
+Winning normally or by a single traitor qualifies; no-winner explosion and
+mutual-traitor outcomes do not. The physical CHOAM Nexus card is spent once.
+Only the holder sees the sampled card snapshot. The public chronicle names the
+use and opponent without naming the face.
 
-The safe continuation point is the existing final `finishBattle` board boundary:
-after mandatory and optional battle-card cleanup, Moritani retention, battle
-income, technology, capture, Auditor, Face Dance and Caladan reinforcement, and
-before another battle or phase begins. No existing choice occurs at that point
-for every possible winner. Opening a pause only when the winner secretly holds
-the CHOAM Nexus card would reveal that hidden identity. Precommitting a
-conditional use before the result would remove the printed after-victory choice.
-A universal use-or-pass window would preserve secrecy and the full choice, but
-would also ask winners without the card to pass. The user has been asked which
-product exception to adopt; no timing policy is implemented while that answer
-is pending.
+After compulsory and optional card cleanup, battle income, technology, capture,
+Auditor, Face Dance and Caladan reinforcement, the final `finishBattle` board
+boundary opens the same use-or-continue window for **every winner** when Nexus
+is enabled and CHOAM is absent. This is a privacy-preserving product
+interpretation, not a printed requirement: nonholders and ineligible allied
+holders continue without use. Opening only for a secret holder would expose
+card custody; precommitting before the result would remove the printed
+after-victory choice. All four AI levels use the same private offer and can
+legally continue. Legacy battle cleanup saves without a physical used-card
+receipt do not infer one and continue through their existing path.
+The saved winner choice survives a paid Nullentropy Box search or another
+interruption without exposing the held Nexus card. Only the active decision
+projects its private offer; suspended frames retain their signed battle receipt.
+The private sampled-card snapshot expires at the next battle or Storm.
 
 The retrieved Nexus sources neither establish an ordinary Karama response to
-this Secret Ally play nor grant blanket Nexus immunity. The Collection trade is
-currently direct and this inspection must not inherit the native Auditor's
-Karama/payment window by analogy. Cancellation remains an explicit later audit
-boundary rather than an invented prototype rule.
+this Secret Ally play nor grant blanket Nexus immunity. The current inspection
+is direct, as with the Collection trade. Cancellation remains an explicit
+later source-audit boundary rather than an invented prototype rule.
 
 ## Focused evidence and remaining scope
 
@@ -86,8 +88,10 @@ stale action rejection, Truthtrance locking, damaged saved receipts and JSON
 continuation. Production SQLite tests exercise competing trades, seat restoration,
 replay rejection and an already-paid discard resume.
 
-The after-victory inspection still needs an original battle receipt, exclusion of
-the opponent's used cards, a private one-card sample and composition with winner
-cleanup. Complete Nexus games, broader Homeworld interactions, strategic choice
-between the two Secret Ally uses and visual acceptance of that full family remain
+Run `npm test -- nexus-choam-inspection` for real Basic/Advanced battles,
+private controls, physical used-card exclusion, JSON continuation, paid-search
+interruption, snapshot expiry and competing in-memory SQLite cases. The
+Collection trade retains its separate focused and production SQLite evidence
+above. Complete Nexus games, broader Homeworld interactions, strategic choice
+between the two Secret Ally uses and visual acceptance of the full family remain
 unfinished. Prototype evidence is deliberately narrower than complete compliance.

docs/RULE_DECISIONS.md

@@ -82,7 +82,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Orgiz collection | The [publisher rulebook, page 13](https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf) says an occupant steals one spice of each collected blow, but its Q&A and searched designer/community sources do not define stacked board piles. Choose one transfer per positive collected board deposit as the observable first version, from its unique rival collector; this is an inference, not a publisher ruling. Contested Orgiz occupancy and Ecaz shared lots withhold only the uncertain transfer while ordinary collection continues. | [Discovery interpretation](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Jacurutu physical dial | The user question asks whether the losing player should choose the physical normal/elite forces represented by its dial. When legal Advanced allocations produce different rewards, income remains explicitly unpaid; numeric wheel subtraction is not a ruling. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Testing Station contest/timing | Only sole non-advisor occupation is prototyped. Two-occupant priority/stacking remains unresolved; opening after the ordinary storm-card window is an explicit source-timing inference. Weather Control is excluded by the printed text. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
-| CHOAM Secret Ally battle timing | The printed after-victory inspection is optional and the Nexus identity stays secret. No existing postbattle choice covers every winner: a pause only for a holder leaks ownership, precommitment removes the after-win choice, and a universal window makes nonholders pass. The product-exception question has been sent; no timing policy is implemented pending the answer. Ordinary Karama cancellation is also not established by the retrieved sources. | [After-victory inspection audit](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) |
+| CHOAM Secret Ally battle timing | The printed after-victory inspection is optional and the Nexus identity stays secret. The connected prototype chooses a uniform use-or-continue window for every winner when Nexus is enabled and CHOAM absent; nonholders pass, while a holder may decide after the result. This privacy-preserving prompt is a product inference, not publisher text. A holder-only pause would reveal custody and a precommitment would remove the printed choice. Ordinary Karama cancellation remains unestablished by retrieved sources; no response is invented. | [After-victory inspection boundary](NEXUS_CHOAM_SECRET_ALLY.md#after-victory-inspection-audit) |
 | Moritani Secret Ally battle timing | The optional retention choice follows a battle loss while the Nexus remains secret until use. Automatically continuing nonholders but pausing holders exposes custody; earlier precommitment removes the after-loss choice. A universal loser confirmation needs the same pending UX exception as other hidden reactive cards. The existing alliance retention/cleanup code does not resolve this timing problem; no duplicate user question has been sent. | [Nexus retention boundary](NEXUS_CARD_RULES.md#moritani-secret-ally-retention-timing) |
 | Emperor Secret Ally purchase timing | The purchase choice follows winning the bid. A holder-only payment pause exposes concealed card eligibility, while per-bid preauthorization moves the choice earlier. The user has been asked whether to permit a uniform winner payment confirmation, including sole spice payments, or retain the purchase gate. No answer is assumed; the independent three-force revival grant can proceed. | [Purchase source contract](NEXUS_EMPEROR_RULES.md#secret-ally-retain-the-actual-purchase-price) |
 | Discovery prototype inferences | Free entry uses storm order and ordinary source-storm restrictions; these are general-rule inferences. Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |