Report database size and make four genuine suites reproducible

Operations now report the SQLite database size and page count, read through
PRAGMA page_count/page_size in the same authority-checked batch as the
lifecycle counters with non-numeric values clamped to zero; the page renders
both and states that free disk space is still unknown.

replaceMoritaniAssassinationTraitors draws the first distinct physical Traitor
Card from the reserve instead of the reserve's first entry, because the face-up
set-aside card can still sit in that list: re-drawing it produced a receipt
whose replacement equalled the revealed card, which the assassination integrity
check rejects mid-Mentat. With no distinct card left the step is blocked with an
explicit reason instead of committing an invalid receipt.

Four tests were made reproducible after measuring their real failure rates,
because a suite that fails for random reasons cannot act as a checkpoint gate:
the Discovery typed Spice Blow test now removes other cards for the same
territory so one blow deposits the printed amount (0/20 after, ~20% before); the
Discovery E2 skills deal is pinned with the new shared
tests/deterministic-random.ts helper so a Lasgun-shield explosion cannot
pre-empt its skill consumer (0/12 after, ~20% before); the Ecaz Occupy Ix/CHOAM
policy check accepts any legal continuation and still asserts the phase it
reaches (0/30 after, ~10% before); and the mixed-E3 Moritani Cunning test keeps
the random storm off red_chasm's single sector (0/25 after, ~20% before).

Offline suite 7,801/7,801 with typecheck and lint clean. No game, seat, saved
state or deployment changes.

docs/ADMIN_PANEL.md

@@ -15,7 +15,7 @@ recovery and persistence systems where suitable.
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | [Participant AI](ADMIN_PARTICIPANT_AI.md) enables an existing difficulty on an eligible human seat in a paused game, retaining access/takeback and private custody. [Discussion controls](ADMIN_DISCUSSION.md) mute/unmute new sends while retaining history and gameplay. Participant removal, access revocation, assisted recovery and further replacement remain. Existing lobby controls can reassign the host. | Prototyped, partial |
 | Saved-game operations | [Owner-only room backups](ADMIN_BACKUPS.md) capture/list/download a size-limited, version-fenced room snapshot without changing play or access; import validation, safe checkpoint restore and interrupted-work diagnosis/resume remain missing. | Prototyped, partial |
-| Operations and audit | [Action history](ADMIN_ACTION_HISTORY.md) searches existing durable operations with safe settings and role-limited reasons. The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. [Stalled-decision diagnosis](ADMIN_STALLED_DECISIONS.md) adds a bounded, read-only sample of live rooms whose public pending interaction has been idle longest, with aggregate counters. An explicit owner action runs read-only SQLite quick/foreign-key checks and returns only pass/fail, never corrupt row details. [Failed-attempt history](ADMIN_ATTEMPTS.md) records rejected authentication and authorization attempts with a fixed reason, the attempted role and an already-known account id — never a key, token, body or address — and exposes seven-day counters plus a bounded recent sample to the owner. Disk capacity and maintenance controls remain. | Prototyped, partial |
+| Operations and audit | [Action history](ADMIN_ACTION_HISTORY.md) searches existing durable operations with safe settings and role-limited reasons. The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. [Stalled-decision diagnosis](ADMIN_STALLED_DECISIONS.md) adds a bounded, read-only sample of live rooms whose public pending interaction has been idle longest, with aggregate counters. An explicit owner action runs read-only SQLite quick/foreign-key checks and returns only pass/fail, never corrupt row details. [Failed-attempt history](ADMIN_ATTEMPTS.md) records rejected authentication and authorization attempts with a fixed reason, the attempted role and an already-known account id — never a key, token, body or address — and exposes seven-day counters plus a bounded recent sample to the owner. The aggregate sample also reports the SQLite database size and page count; free disk space and maintenance controls remain. | Prototyped, partial |
 
 Track each area through Missing, Prototyped, Integrated, Verified and Polished.
 As implementation begins, link its controls, server actions, persistence,
@@ -75,7 +75,8 @@ game state and hashed seat/recovery credentials. Import/restore are not availabl
 
 The owner-only [operations page](../app/admin/operations/page.tsx) provides
 manual read-only samples of room lifecycle counts, active seat credentials,
-invalid JSON saves, latest room write, backup payload usage and export receipts.
+invalid JSON saves, latest room write, backup payload usage, export receipts,
+and the SQLite database size and page count.
 The database query repeats current owner authority. **Run integrity check** is
 a separate, explicit read-only D1 quick check and foreign-key check. It repeats
 owner authority inside the query batch and returns only pass/fail and sample

docs/CURRENT_STATUS.md

@@ -90,8 +90,10 @@ decision, response, Truthtrance or phase opening — has been idle longest, plus
 `stalledRooms` and `oldestStalledChange` counters in the aggregate sample.
 Paused, closed, removed and archived rooms are excluded and no private game
 content is selected; `GET /api/admin/operations?stalled=1` stays owner-only,
-`no-store` and read-only, and it repairs nothing. Failed-attempt records, disk
-Disk capacity and maintenance controls remain.
+`no-store` and read-only, and it repairs nothing. Failed-attempt records and
+disk capacity were the remaining operations gaps; the aggregate sample now also
+reports the SQLite database size and page count, while free disk space and
+maintenance controls remain.
 
 
 **Mixed E1/E2 and paired E3 Nexus — bounded Development Verified.**

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,49 @@
 # Dune implementation status
 
+## 7 October 2026 — distinct Mentat replacement and reproducible suites
+
+`replaceMoritaniAssassinationTraitors` now draws the first **distinct** physical
+Traitor Card from the reserve instead of the reserve's first entry, because the
+face-up set-aside card can still sit in that list: re-drawing it produced a
+receipt whose replacement equalled the revealed card, which the assassination
+integrity check rejects mid-Mentat. When no distinct card remains the step is
+blocked with an explicit reason rather than committing an invalid receipt.
+
+Four genuine tests were also made reproducible after measuring their real
+failure rates; a suite that fails for random reasons cannot act as a checkpoint
+gate:
+- `discovery-native-typed-runtime` (~15–25%): the chosen Discovery Spice Blow
+  card now has every other card for the same territory removed from the deck, so
+  one blow deposits the printed amount instead of stacking a second deposit.
+  Measured 0/20 after the change.
+- `discovery-native-e2-skills-runtime` (~20%): the deal is pinned with the new
+  shared `tests/deterministic-random.ts` helper, because an unseeded
+  Lasgun-shield pair explodes and legitimately leaves no winner, which would
+  pre-empt the casualty and skill consumer the test exists to exercise. Measured
+  0/12 after the change.
+- `ecaz-occupy-ix-choam-runtime` (~10%): a random deal can leave the actor
+  already in Collection with only an optional card play, so the policy check
+  accepts any legal action and still asserts the phase the continuation reaches.
+  Measured 0/30 after the change.
+- `mixed-e3-moritani-nexus-runtime` (~20%): `red_chasm` has one sector, so a
+  random storm could cover the committed shipment; the test now keeps the storm
+  off that destination. Measured 0/25 after the change.
+
+No product behaviour changed for the three test-only repairs. Full offline
+suite, typecheck and lint are green at this checkpoint.
+
+## 7 October 2026 — operations report the database size
+
+The owner aggregate sample now also reports the SQLite database size and page
+count, read through `PRAGMA page_count`/`PRAGMA page_size` in the same
+authority-checked batch as the lifecycle counters, with non-numeric or negative
+values clamped to zero. The operations page renders both, and the page text now
+states that free disk space is still unknown. Evidence:
+`tests/admin-operations.test.ts` asserts the new fields, that the page count is
+positive, and that the byte total equals pages times the database's own page
+size rather than echoing the returned value. No game, seat, saved state or
+deployment changes.
+
 ## 7 October 2026 — administrator failed-attempt history
 
 Rejected administrator authentication and authorization attempts are now

docs/MORITANI_ASSASSINATE_LEADERS.md

@@ -84,6 +84,12 @@ normal traitor call can be skipped without consulting hidden eligibility.
 All four AI profiles use the same owner-only quote. They choose a legal card or
 decline and do not inspect rival hidden state. The public history shows only
 revealed cards and face-up set-aside markers; replacement identities remain private.
+
+The Mentat replacement now draws the first **distinct** physical Traitor Card in
+the reserve rather than the reserve's first entry: the set-aside card can still
+sit in that list, and re-drawing it would duplicate a card instead of replacing
+it. When no distinct card remains, the replacement is blocked with an explicit
+reason instead of committing an invalid receipt. (7 October 2026)
 Dead-target inspection retains the printed leader strength despite its zero bounty.
 
 ## Save and physical custody