Connect Bureaucrat payment redirection and saved continuation

Add an optional owner-controlled two-spice diversion from eligible single-payer ordinary auctions, Guild shipment income, Richese auction proceeds and actual bribes in the bounded base/CHOAM Leader Skills profile. Debit the payer once, credit the recipient once, retain bribes until Mentat Pause and restore the original response/auction/advisor callback. Decline preserves later phase opportunities; successful physical-card usage persists ownership changes. Keep qualifying allied funding and unfinished payment families explicitly guarded or outside the connected batch. Record source authority and the out-of-battle Karama composition and physical-card usage inferences; no public mode or publication gate opens.

Connect readable owner controls and all four AI profiles using public payment/alliance information. Independent review found and fixed duplicate usage-event aliases and an overbroad guard on Bank-bound independent Karama shipments. Focused tests cover native/hidden/captured/dead eligibility, unchanged costs and card/force custody, normal and Richese auction callbacks, real Bene Gesserit advisor continuation, private views, JSON and production SQLite restore, stale/duplicate rejection and same-version competing writes.

Validation: typecheck, lint, 4631 offline tests, production build and 43 HTTP tests passed with unchanged source. Four controlled-shuffle genuine-setup samples completed: base Basic 718 actions/20 restores, base Advanced 551/15, CHOAM Basic 681/19 and CHOAM Advanced 174/5. All had zero rejected candidates and preserved full physical Treachery, force and skill custody. None reached a Bureaucrat payment decision; these are regression-continuation samples, not natural full-game redirection acceptance. The separate conserved staged browser exercise allowed one five-spice bribe and redirected two from a second; the payer spent ten, the payee retained eight deferred spice, and one skill use was recorded. Pending and resolved states survived refresh with unchanged physical custody and private projection.

After the reported outage, all 699 opening games and original seat/recovery records were preserved (733 after HTTP checks); database integrity and foreign keys passed. Reused the healthy server without restart, reset or recurring automation.

Verified source tree: a30615deed306e06ab4c153b9a7eabdc92d646ed79474e348a3500d525bcb8c8

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,38 @@
 # Dune implementation status
 
+## 14 September 2026 — Bureaucrat payment prototype and outage preservation
+
+[Bureaucrat](BUREAUCRAT_PAYMENTS.md) now connects optional two-spice redirection
+for ordinary auction, Guild shipment, Richese auction and actual bribe payments
+in the bounded base/CHOAM Leader Skills profile. Native income cancellation
+resolves before the offer; the payer is charged once and the original callback
+resumes once. Decline leaves later opportunities available, and bribe proceeds
+remain unspendable until Mentat Pause. The physical-card use ledger survives
+ownership changes. Payment-unit guards, composition inferences and missing
+families remain explicit; no public mode or publication gate is opened.
+
+Owner controls and all four AI profiles use public payment information. Independent
+review covers saved receipts, private projection, costs, custody and callback
+ordering. Review found and fixed duplicate use-event corruption and an overly
+broad guard on Bank-bound independent Karama shipments. Focused regressions
+cover those defects, auction/card delivery, real Bene Gesserit advisor continuation,
+bribe escrow, private SQLite restoration and competing version writes.
+
+Four controlled-shuffle genuine-setup games complete with zero rejected actions:
+base Basic 718 actions/20 JSON restores, base Advanced 551/15, CHOAM Basic 681/19,
+and CHOAM Advanced 174/5. Full physical card, force and skill custody is checked.
+None reaches a Bureaucrat payment decision, so those samples establish bounded
+regression continuation only. A separate conserved staged browser game allows
+one five-spice bribe and redirects two from a second: ten is paid, eight stays in
+bribe escrow, and only one skill use is recorded. Both pending and resolved states
+restore after refresh with unchanged physical custody and private projections.
+
+After the reported power failure, all 699 opening games and original seat/recovery
+records matched the private backup. The database passed integrity and foreign-key
+checks and the server remained healthy. No restart or reset was needed. Final
+broad results, source fingerprint, Git delivery and post-HTTP preservation totals
+are recorded in the checkpoint commit and private verification report.
+
 ## 13 September 2026 — Private Mentat question preview and outage recovery
 
 [Mentat](MENTAT_QUESTION.md) has a connected private pre-plan question preview: