Connect Bureaucrat payment redirection and saved continuation

Add an optional owner-controlled two-spice diversion from eligible single-payer ordinary auctions, Guild shipment income, Richese auction proceeds and actual bribes in the bounded base/CHOAM Leader Skills profile. Debit the payer once, credit the recipient once, retain bribes until Mentat Pause and restore the original response/auction/advisor callback. Decline preserves later phase opportunities; successful physical-card usage persists ownership changes. Keep qualifying allied funding and unfinished payment families explicitly guarded or outside the connected batch. Record source authority and the out-of-battle Karama composition and physical-card usage inferences; no public mode or publication gate opens.

Connect readable owner controls and all four AI profiles using public payment/alliance information. Independent review found and fixed duplicate usage-event aliases and an overbroad guard on Bank-bound independent Karama shipments. Focused tests cover native/hidden/captured/dead eligibility, unchanged costs and card/force custody, normal and Richese auction callbacks, real Bene Gesserit advisor continuation, private views, JSON and production SQLite restore, stale/duplicate rejection and same-version competing writes.

Validation: typecheck, lint, 4631 offline tests, production build and 43 HTTP tests passed with unchanged source. Four controlled-shuffle genuine-setup samples completed: base Basic 718 actions/20 restores, base Advanced 551/15, CHOAM Basic 681/19 and CHOAM Advanced 174/5. All had zero rejected candidates and preserved full physical Treachery, force and skill custody. None reached a Bureaucrat payment decision; these are regression-continuation samples, not natural full-game redirection acceptance. The separate conserved staged browser exercise allowed one five-spice bribe and redirected two from a second; the payer spent ten, the payee retained eight deferred spice, and one skill use was recorded. Pending and resolved states survived refresh with unchanged physical custody and private projection.

After the reported outage, all 699 opening games and original seat/recovery records were preserved (733 after HTTP checks); database integrity and foreign keys passed. Reused the healthy server without restart, reset or recurring automation.

Verified source tree: a30615deed306e06ab4c153b9a7eabdc92d646ed79474e348a3500d525bcb8c8

docs/BUREAUCRAT_PAYMENTS.md

@@ -0,0 +1,100 @@
+# Bureaucrat payment redirection
+
+14 September 2026. This connected development prototype extends the existing
+Bureaucrat battle penalty with optional payment redirection. Leader Skills,
+expansion combinations and public starts remain partially implemented. This is
+not complete economic-rule acceptance.
+
+## Source and payment identity
+
+The physical card permits one use per phase when another player pays at least
+five spice to a player other than the skill owner. Exactly two spice from that
+payment go to the Bank if the owner elects to use the skill. The payer's cost
+stays the same; the recipient receives two less. Declining leaves the opportunity
+available for a later qualifying payment in the same phase.
+[Physical card](https://cdn.anyfinder.eu/assets/NQOmfvkJitFsQncGJ73kLzv7aC1w7Jp1kQAyy5CJ0pOoj8RlSEN3veAO6wBnw8wV?height=768)
+
+The designer names Emperor, Guild and Tleilaxu receipts as intended targets.
+[Jack Reda, 15:01–15:28](https://www.youtube.com/watch?v=XT_azRVLq_0&t=901s)
+A payment made by the owner, made to the owner, or made to the Bank fails the
+printed third-party condition. Evaluate the actual amount paid rather than a
+nominal price or free acquisition. Use the native living face-up assignment;
+a captured card supplies only its battle band.
+[GF9 CHOAM & Richese, pp. 9 and 12](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf)
+
+Actual bribe transfers qualify: the official FAQs describe spice paid as bribes
+being placed before the recipient's shield. Spendability waits until the next
+Mentat Pause, but the payment occurs when those counters transfer. Bureaucrat
+therefore diverts two from the transfer and leaves the remainder in bribe escrow.
+Collecting that escrow later is not another payment and must not trigger again.
+A verbal promise alone transfers no spice.
+[April FAQ, p. 1](https://www.gf9games.com/dune/wp-content/uploads/2020/04/Dune-FAQ.pdf#page=1),
+[November FAQ, p. 9](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=9)
+
+## Connected boundary and explicit interpretations
+
+The target paths are ordinary paid auctions, Guild shipment income, direct
+Richese auction proceeds and actual bribe transfers in the existing base or
+CHOAM-only skill profile. Other optional modules retain their existing gates.
+Tleilaxu revival, other expansion payment sources and direct gifts remain outside
+this connected batch. Their absence does not establish a rule prohibition.
+
+For native income, the prototype resolves the existing Karama income window
+first, then offers Bureaucrat before crediting the eligible recipient and
+continuing the original auction or shipment. A canceled income payment goes to
+the Bank, so creates no player-directed trigger. This is an outcome-based
+composition inference. The rulebook's skill-before-faction sentence occurs in
+its battle paragraph and does not expressly order this economic reaction.
+The implementation does not settle Bureaucrat-before-Karama consumption.
+
+Qualifying single-payer payments have a public amount. Qualifying allied funding,
+including an aggregate such as three plus three and a payment funded entirely by
+the ally, is guarded before costs or commitment. It needs separate payment-unit
+and privacy work, as does split-recipient Homeworld income. Independent Karama
+shipments paid entirely to the Bank bypass this player-income guard. Do not infer
+eligibility from an aggregate that silently combines payers or reveals concealed
+funding. A successful use is retained for the physical
+card's turn and phase, including a same-phase ownership change. That physical
+card accounting is an explicit implementation inference.
+
+## Saved choices and verification
+
+Only the skill owner may redirect or allow the current payment. The saved event
+binds the payer, payee, amount, skill, phase and original continuation. It must
+retain any prior decision and response without showing their private contents.
+The payer is charged once; the original purchase, shipment or bribe remains
+intact. Decline restores the full recipient share without consuming the skill.
+
+Controls explain both possible recipient amounts and the deferred nature of
+bribes. AI uses public payment and alliance information. Focused checks cover
+ownership, successful-use limits, custody, private projection, stale requests,
+JSON/SQLite restoration and competing writes. Final evidence and limitations
+are recorded with the verified checkpoint; narrow prototype paths do not open
+mode or publication gates.
+
+Four source-stable genuine-setup samples completed with all four AI profiles,
+full physical Treachery/force/skill custody checks and periodic JSON/private-view
+restoration. The initial skill shuffle deliberately offered Bureaucrat, which the
+Atreides AI selected. No hands, forces or phases were staged in these samples.
+
+| Profile | Seed | Actions | JSON restores | Finish turn |
+| --- | --- | --- | --- | --- |
+| Base Basic | 20260940 | 718 | 20 | 9 |
+| Base Advanced | 20260941 | 551 | 15 | 6 |
+| CHOAM/Richese Basic | 20260942 | 681 | 19 | 8 |
+| CHOAM/Richese Advanced | 20260943 | 174 | 5 | 2 |
+
+All four had zero rejected candidates, but none reached a Bureaucrat payment
+decision. They establish regression continuation for these paths, not natural
+full-game redirection coverage. Focused tests and the targeted browser exercise
+cover the payment choices directly; broader integrated acceptance remains open.
+
+The separate browser QA uses a conserved staged shipment-phase position after
+genuine skill setup. It allows one actual five-spice bribe, then redirects two
+from a second actual five-spice bribe in the same phase. The second choice and
+its resolved movement controls survive refresh. The payer spends ten total,
+the recipient retains eight in deferred bribe escrow, physical custody stays
+unchanged, and only the redirection consumes the skill. This is explicitly staged
+UI evidence. After the reported outage, all 699 opening rooms and their original
+seat/recovery records matched the private backup; database integrity and foreign
+keys passed. The healthy server was reused.

docs/CURRENT_STATUS.md

@@ -1,37 +1,33 @@
 # Current development status
 
-Updated 13 September 2026. **The full twelve-faction goal is unfinished. Basic
+Updated 14 September 2026. **The full twelve-faction goal is unfinished. Basic
 is playable; public Advanced and unfinished expansion/module starts remain
 gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest verified checkpoint: `903d861`, deferred movement arrival safety.
-Types, lint, **4,583 offline tests**, build and **43 HTTP tests** passed.
-All **632 opening games** and original seat/recovery records were preserved
-(665 after HTTP checks). The healthy server was reused; both existing Ecaz and
-Ixian browser QA seats restored their private hands and pending decisions.
+Latest verified checkpoint: `9f1f783`, private Mentat question preview.
+Types, lint, **4,605 offline tests**, build and **43 HTTP tests** passed.
+All 665 opening rooms and original seat/recovery records were preserved
+(699 after HTTP checks). The existing server was reused after the outage;
+Ecaz, Ixian and Mentat browser seats restored their private state and decisions.
+The only post-verification edit removed an extra newline in a developer document.
 
-[Deferred movement](DEFERRED_MOVEMENT_ARRIVAL.md) now rejects unsupported arrivals
-before prevention windows or new card commitment. A legacy CHOAM decline returns
-an uncommitted move for another choice while preserving reserved Ornithopter
-custody. All six genuine faction sample games finish; combined Advanced completes
-1,303 actions and 35 JSON restorations. Guarded arrival candidates still occur.
-The exact prior failed save also finishes. Simultaneous Ambassador/Terror priority
-remains unresolved, so these paths do not prove complete combined rules support.
+[Mentat](MENTAT_QUESTION.md) connects private naming/disclosure before posture
+and faction powers, all four AI profiles and saved continuation in explicitly
+opted-in previews. Two controlled-shuffle genuine-setup samples finish. Ordinary
+activation still awaits the uniform private response UX decision.
 
-The [Mentat question preview](MENTAT_QUESTION.md) now connects private naming and
-card disclosure before leader posture and faction powers, with human controls,
-all four AI profiles and saved continuation. Independent review and 22 focused
-tests pass; two controlled-shuffle genuine-setup samples finish. Ordinary games
-remain unactivated while the uniform private response UX question is pending.
-Final broad results and Git delivery are recorded with the verified checkpoint.
-
-After the latest power failure, all 665 opening rooms and original seat/recovery
-records matched the backup; the new Mentat QA room brings the total to 666 before
-HTTP checks. Database integrity and foreign keys passed. The existing server
-responds at localhost:3000 and is reused; its lock prevented a duplicate start.
-The Mentat browser seat restored its private history and pending leader choice.
+The current milestone connects [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md):
+ordinary auctions, shipment income, Richese sale proceeds and actual bribe
+transfers, with a once-per-phase optional redirection and preserved continuation.
+Qualifying allied funding, other payment families and combined-module acceptance
+stay explicit. Independent review and focused controls/AI/recovery checks pass.
+Four genuine-setup games finish without rejected candidates, but contain no payment
+choice; a separate staged browser exercise verifies both choices and refresh.
+All 699 opening rooms and original seat/recovery records survived the reported
+outage. The healthy server was reused. The completed checkpoint's Git record
+contains final broad verification and post-HTTP preservation totals.
 
 ## Authoritative navigation
 
@@ -58,7 +54,7 @@ These links define bounded working behavior, not complete module certification.
 | --- | --- |
 | Base/Advanced setup | [Genuine setup](ADVANCED_SETUP_TEST_SEAM.md), [Advanced study](AI_ADVANCED_SETUP_CALIBRATION_20260907.md), [Fremen cancellation](FREMEN_MOVEMENT_KARAMA_RULES.md), [Atreides full-plan audit](ATREIDES_FULL_PLAN_TIMING.md). Earlier Basic-then-flip fixtures do not establish current setup coverage. |
 | Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement, separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
-| Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md) and [No-Field](SMUGGLER_NO_FIELD.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md). Remaining bands and combinations are explicit in those contracts. |
+| Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md) and [No-Field](SMUGGLER_NO_FIELD.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Jacurutu income, Testing Station and Shrine. Orgiz and contested/mixed cases remain pending. |
 | Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) is connected; its after-victory inspection remains pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,38 @@
 # Dune implementation status
 
+## 14 September 2026 — Bureaucrat payment prototype and outage preservation
+
+[Bureaucrat](BUREAUCRAT_PAYMENTS.md) now connects optional two-spice redirection
+for ordinary auction, Guild shipment, Richese auction and actual bribe payments
+in the bounded base/CHOAM Leader Skills profile. Native income cancellation
+resolves before the offer; the payer is charged once and the original callback
+resumes once. Decline leaves later opportunities available, and bribe proceeds
+remain unspendable until Mentat Pause. The physical-card use ledger survives
+ownership changes. Payment-unit guards, composition inferences and missing
+families remain explicit; no public mode or publication gate is opened.
+
+Owner controls and all four AI profiles use public payment information. Independent
+review covers saved receipts, private projection, costs, custody and callback
+ordering. Review found and fixed duplicate use-event corruption and an overly
+broad guard on Bank-bound independent Karama shipments. Focused regressions
+cover those defects, auction/card delivery, real Bene Gesserit advisor continuation,
+bribe escrow, private SQLite restoration and competing version writes.
+
+Four controlled-shuffle genuine-setup games complete with zero rejected actions:
+base Basic 718 actions/20 JSON restores, base Advanced 551/15, CHOAM Basic 681/19,
+and CHOAM Advanced 174/5. Full physical card, force and skill custody is checked.
+None reaches a Bureaucrat payment decision, so those samples establish bounded
+regression continuation only. A separate conserved staged browser game allows
+one five-spice bribe and redirects two from a second: ten is paid, eight stays in
+bribe escrow, and only one skill use is recorded. Both pending and resolved states
+restore after refresh with unchanged physical custody and private projections.
+
+After the reported power failure, all 699 opening games and original seat/recovery
+records matched the private backup. The database passed integrity and foreign-key
+checks and the server remained healthy. No restart or reset was needed. Final
+broad results, source fingerprint, Git delivery and post-HTTP preservation totals
+are recorded in the checkpoint commit and private verification report.
+
 ## 13 September 2026 — Private Mentat question preview and outage recovery
 
 [Mentat](MENTAT_QUESTION.md) has a connected private pre-plan question preview:

docs/LEADER_SKILLS_RUNTIME.md

@@ -56,7 +56,10 @@ and the lower Mentat, Bureaucrat and Sandmaster effects. A separate
 [Mentat question preview](MENTAT_QUESTION.md) connects private naming/disclosure,
 posture and saved history under an explicit private opt-in. The uniform mandatory
 response step awaits the user's UX decision; ordinary activation remains disabled.
-Bureaucrat payment redirection and Spice Banker income remain missing. [Banker battle spending](SPICE_BANKER_RUNTIME.md)
+[Bureaucrat payment redirection](BUREAUCRAT_PAYMENTS.md) connects the ordinary
+auction, shipment, Richese sale and paid-bribe families within its recorded
+boundary. Other payments and split funding remain incomplete. Spice Banker
+income remains missing. [Banker battle spending](SPICE_BANKER_RUNTIME.md)
 now connects its lower band with separate sealed funds and survivor strength. [Smuggler shipping](SMUGGLER_SHIPMENT.md)
 connects its optional normal reserve bonus and the [owned No-Field companion](SMUGGLER_NO_FIELD.md).
 [Diplomat defense](DIPLOMAT_DEFENSE.md) connects its normal band for a physical

docs/RULE_DECISIONS.md

@@ -1,6 +1,6 @@
 # Rule decision index
 
-Updated 13 September 2026. This is the authoritative navigation index for existing decisions, not a replacement rulebook or a new ruling. Detailed linked contracts retain their source citations and exact supported boundaries. Runtime follow-ups supersede historical absence claims; passing tests establish software behavior, not publisher authority.
+Updated 14 September 2026. This is the authoritative navigation index for existing decisions, not a replacement rulebook or a new ruling. Detailed linked contracts retain their source citations and exact supported boundaries. Runtime follow-ups supersede historical absence claims; passing tests establish software behavior, not publisher authority.
 
 ## Recorded contracts and implementation boundaries
 
@@ -12,6 +12,7 @@ Updated 13 September 2026. This is the authoritative navigation index for existi
 | Smuggler shipping | Optional free companion is included in the actual total; apply Guild rounding to the reduced priced count. Ordinary Fremen reserves are on planet. The officially permitted owned No-Field plus a separate free force is now prototyped at the unchanged one-marker price. Legacy unstamped ordinary declarations keep their quoted full price. | [Ordinary contract](SMUGGLER_SHIPMENT.md), [No-Field combination](SMUGGLER_NO_FIELD.md) |
 | Sandmaster movement | One optional board spice per distinct entered territory on an explicit legal route; source-only repositioning earns none. Per-movement Hajr reset is a documented grammatical inference. Canceled moves earn nothing; multiple-pile collection remains guarded. | [Source and connected prototype](SANDMASTER_MOVEMENT.md) |
 | Diplomat defense | With no actual defense, one physical Worthless card in either Battle Plan slot may copy the opponent's canonical base Shield or Snooper. The same native trained disc may protect itself. The public after-reveal/before-traitor choice and mandatory discard after traitor preemption are documented implementation inferences. Lower retreat and modified or multirole defenses remain guarded. | [Source and connected prototype](DIPLOMAT_DEFENSE.md) |
+| Bureaucrat payments | Once per phase, optionally divert two from an actual third-party payment of at least five; payer cost is unchanged. Bribes trigger at transfer to the recipient's shield, not later collection. Native income is offered after Karama allowance as an explicit outcome-based inference; split contributions, split recipients and remaining payment families need further integration. | [Source and connected boundary](BUREAUCRAT_PAYMENTS.md) |
 | Mentat question preview | The physical card says to show the card to the questioner, privately; it stays in hand and does not bind a plan. Ask before posture/faction powers. A uniform target response protects held/absent privacy but awaits approval as an exception to skipping forced confirmations; standard activation stays disabled. Empty hands skip with no fabricated answer. | [Source and preview](MENTAT_QUESTION.md) |
 | Leader battle effects | Rihani normal peek and reshuffle precede a separate committed optional draw; ordering is an explicit printed-order inference. Unused excludes actual calls, not mere disclosure. Mentat/Bureaucrat change scores; Sandmaster adds board spice. Multiple piles and Face Dancer composition stay guarded. | [Source contract and prototype](LEADER_BATTLE_EFFECTS.md) |
 | Source and readiness | Separate published rules, explicit implementation choices and unfinished interpretations; Advanced/expansion gates stay closed. | [Base/Advanced audit](BASE_ADVANCED_READINESS_20260907.md), [checklist](../game/reference.ts) |