Dune/docs/NEXUS_IXIAN_REPLACEMENT_RULES.md

Ixian Nexus Secret Ally: purchased-card replacement

Source audit: 2026-09-10. Bounded local prototype integration and verification: 2026-10-01. Partial development verified, not complete Ixian/Nexus family or expansion acceptance. This document records the source and runtime boundary of the fresh ixian-replacement profile. Existing Nexus release gates remain in force.

Harkonnen purchase and bonus composition — 16 October 2026

Harkonnen buyers now receive the same neutral purchased-card choice in the existing original classic Basic/Advanced or Basic Tleilaxu profile. The printed one-for-one replacement preserves the purchase-earned bonus, its original hand cap and native Karama cancellation; it is not a second purchase and earns no extra bonus. The bonus itself is never a replacement target.

Selected provisional ordering: under the standing choose-recommended instruction, preserve the existing native Ixian ally sale pipeline: replacement choice → original income response → original Harkonnen bonus response → next lot. The Nexus face does not explicitly order these two draws; this is conservative product composition, not a publisher ruling or an explicit user-selected ordering. The actual table labels it provisional. No owner-selected ordering control or bonus-first inspection is introduced.

After Use, the actual next deck card is the replacement; any allowed bonus then draws the following card. After Keep, the next card is the bonus. Canceling that later bonus cannot undo replacement, restore Nexus, refund the purchase or repeat income. At eight held cards after purchase, replacing one-for-one still leaves eight and creates no bonus slot.

Three new behavior cases and the affected seven-file union pass 64/64. Eight original-action runtime paths cover both modes, Use/Keep and native bonus allow/cancel; eight legal policy actions pass. Genuine setup, actual worm/alliance and two Nexus draws, original Atreides purchase/Keep and the paid Harkonnen second lot precede every original source. The eight-card boundary separately controls only conserved undealt hand acquisition.

Two actual styled390×844 journeys pass. Basic replaces purchased Snooper16 with Shield11, allows Emperor12→14 and cancels only the bonus: Harkonnen keeps three cards/spice8 and spent Nexus. Advanced keeps purchased Chaumas4, allows original income and one Snooper16 bonus, retaining four cards/spice10 and Nexus. Both advance the original lot once. Width/scroll390; no browser/ application errors. Only an owned memory-only loopback host ran; no human server, D1, saved room, deployment or public start changed. Proof is outside Git: /tmp/dune-harkonnen-replacement-runtime.json, /tmp/dune-harkonnen-replacement-ui-proof.json. Special origins, other modules and final assurance remain separate; all five checklist facets stay Partial. Final types/lint and production build pass, retaining module-register, large-chunk and Unknown-route warnings. Current source anchor and19 topic evidence paths resolve with no reference parse diagnostics; all five facets remain Partial. No broad suite or HTTP assurance run.

Native BG converted purchases — 16 October 2026

Original normal-auction purchases now offer the same independent Ixian replacement after native Advanced BG Worthless-as-Karama succeeds, for both direct acquisition and winning-bid payment. The original native counter resolves first; a converted card is not a printed Karama, but its successful purchase is still a purchase under the existing source analysis below. The engine no longer carries a printed-cost-only settlement flag.

Canceling direct acquisition leaves the lot unpurchased and offers no Nexus replacement. Canceling winning payment preserves native payment recovery: when the original bid is funded, ordinary automatic spice payment buys the lot and earns a paid, not free, replacement opportunity. Original payment/income and Nexus discard/draw each finish once. No new cancellation, refund, bonus priority, profile or module combination is introduced.

Four new behavior cases and the affected nine-file union pass 74/74. The obsolete guard-pinning substitution test was removed, not re-pinned. Four original-action Use/Pass runtime paths and eight legal policy actions pass. Genuine setup, actual worm alliance/Nexus deal, paid Worthless purchase and first-lot Keep precede the second-lot conversion; no played state is staged. Two additional cancellation cases explicitly conserve the unused starting Karama into Emperor custody to isolate the native counter.

Two actual styled390×844 original-source table journeys pass. Direct free acquisition replaces Hajr with the actual next Ghola, spends Ixian Nexus and retains BG spice5/Emperor12. Winning free payment keeps the actual Shield and Ixian Nexus, also retaining5/12. Both advance the original auction once, with width/scroll390 and no browser/application error. Only an owned memory-only loopback host ran; no human server, D1, saved room, deployment or public gate changed. Proof remains outside Git: /tmp/dune-bg-ixian-runtime.json, /tmp/dune-bg-ixian-ui-proof.json. Broader profiles, special sale origins and final assurance remain separate; the later provisional Harkonnen composition is recorded above. All five checklist facets remain Partial. Final npm run check:quick passes; the current source anchor and17 topic evidence paths resolve, with no reference parse diagnostics. No production build, broad suite or HTTP assurance was run for this bounded rule slice.

Primary evidence

• Face: photograph of the twelve original GF9 Nexus Cards, independently inspected again at /tmp/dune-nexus-cards.jpg. The photographed publisher text is the authority, not commentary by its uploader.
• E3: GF9 Ecaz & Moritani rules, pp.11,16, indexed publisher text and the previously retrieved publisher-authored mirror, /tmp/dune-e3-nexus-rules.pdf and .txt.
• Base: GF9 base rules, pp.6,8,17, freshly retrieved publisher-indexed setup, bidding and Harkonnen text.
• E1: GF9 Ixian & Tleilaxu rules, p.9, freshly retrieved publisher-indexed alliance paragraph.
• FAQ: GF9 November 2020 FAQ, pp.6–7, freshly retrieved publisher-indexed inspection and Karama rulings.
• E2: GF9 CHOAM & Richese rules, pp.4,10–11, freshly retrieved publisher-indexed discard secrecy and purchase FAQ.

Direct official PDF retrieval returned 403. Several older temporary .pdf paths contain HTML error pages; they were not treated as readable PDFs. No tournament rewrite or community compilation supplies a ruling here.

The user-supplied UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf is the adopted source for relevant Advanced core rules, including later Storm determination. It does not contain the Nexus Cards or this face. It therefore supplies no new Ixian replacement, cache-scope, bonus-order or Nexus-cancellation ruling; the photographed publisher card and cited publisher rules remain this feature's evidence.

Printed operation

The face permits the holder, when Ixians are absent, to discard the Treachery Card just purchased during Bidding and then draw the top Treachery Deck card. This identifies one particular purchase, not an arbitrary held card. The replacement is optional, but playing it spends the Nexus Card. No spice refund, extra payment, free choice from the deck, or second replacement is printed. The panel has no Advanced-only qualification. Face

Common Nexus rules require an unallied holder; joining an alliance discards the held Nexus Card. Secret Ally applies when the represented faction is absent, distinct from native Cunning or Betrayal. The E3 FAQ contains no Ixian replacement clarification. E3

The buyer takes the purchased card after payment. The native Ixian allied replacement explicitly occurs immediately after purchasing; November's FAQ permits viewing that purchased card before choosing. Applying the same inspection entitlement to this independently printed just-purchased replacement is ordinary composition, not a Nexus-specific FAQ. Base p.8, E1 p.9, FAQ p.6

Custody, deck and purchase consequences

• Discard first, then draw. A full but legal hand is supported: the discard opens the slot before replacement; neither transient overcapacity nor a full-hand exception is needed.
• Base setup requires discard reshuffling to replenish an exhausted Treachery Deck. Therefore an empty deck is not a reason to disallow this effect: its own preceding discard supplies a card. That physical identity can be drawn again. Do not exclude it or promise a different card.
• The already dealt auction row is distinct from the remaining deck. Draw the actual deck top, not the next unsold auction lot. Do not rebuild the auction pool.
• Harkonnen retains the bonus earned by the original purchase, subject to its ordinary hand cap and cancellation. Replacement is a draw, not another purchase, so it earns no second bonus. At seven cards before purchase, the purchase fills the eighth slot; a one-for-one replacement does not create bonus capacity.

These are compositions of the printed discard-then-draw operation with base pp.6,8,17. Preserve the original paid price and recipient exactly once; this card contains no reversal instruction.

An ordinary Karama acquisition is described by November's FAQ as purchasing without spice, so zero payment alone does not exclude a genuine Bidding purchase. Gifts, bonus draws, Ambassador draws, Nullentropy retrieval and Technology swaps are not purchases merely because they occur in Bidding. FAQ p.7

Richese and cancellation: distinguish source scope

E2 explicitly excludes a direct Richese cache purchase from the Ixian ally replacement, while allowing Black Market purchases, including a Richese-family card. It also awards Harkonnen's normal bonus for both sale kinds. The restriction follows purchase origin, not card family. E2 pp.10–11

That question names an ally of Ixians. The later Nexus face independently grants the operation when Ixians are absent and does not name the native alliance advantage or repeat the cache exclusion. The literal independent-grant reading includes genuine cache purchases during Bidding. Extending the older exception to the new card is an alternative interpretation; no retrieved primary clarification selects it. Do not silently reuse an existing native ixAllyCard origin filter as though it settled this distinction. The same analysis matters for Richese's genuine special-Karama cache purchase during Bidding; its other timing and hand-cap boundaries remain in the acquisition audit.

November's Karama table expressly permits stopping the native Ixian ally from discarding a purchased card. For this separately worded Nexus grant, Ixians are absent and the holder is not using a present faction's native or actual alliance advantage. Treating it as a direct card effect without that native cancellation window is the supported category composition used for Atreides Secret Ally; it is not an express general Nexus-immunity ruling. Unlike Bene Gesserit Secret Ally, this face does not say to use a named faction advantage. FAQ p.7, Face

Ordering and unresolved boundaries

Harkonnen draw order: the purchase earns its original bonus, while Nexus applies only to the purchased card. The inspected source does not explicitly order these draws. Under the standing choose-recommended instruction, the selected provisional composition reuses native Ixian ally ordering: replacement first, then original income and bonus responses. The table labels this policy; it is not publisher timing or an explicit user-selected sequence. Replacement grants no second bonus or extra capacity, and the free bonus is never the purchased target.

Other immediate disposal effects: use the ordinary physical-discard pipeline. Applicable Ecaz poison income and Semuta reactions must neither duplicate the discarded card nor cause a second replacement. Precise competing immediate-effect priority is not supplied by this Nexus face. Existing Semuta and occupation source gaps remain separate.

Nullentropy and custody interruptions: a paid Box search freezes the searched pile in the existing subsystem. The replacement cannot draw or reshuffle that pile while browsing. Conversely, playing or transferring the just-purchased card cannot leave a live replacement offer pointing at custody it no longer owns. Preserve or settle the exact purchase continuation; do not reopen an expired purchase from an arbitrary historical card ID. Whether a player can interleave a particular anytime power before exercising an immediate purchase right needs an explicit sequencing policy, not an invisible loss of the right. See the Box audit.

Private opportunity timing: a pause offered only to the eligible Ixian-card holder may reveal the secret identity. This bounded prototype instead gives every publicly unallied supported buyer with public held-Nexus presence the same neutral Purchased card choice, independently of its hidden face. An irrelevant-face buyer can Pass but cannot Use. This is an inferred development privacy convention, not publisher-prescribed timing, a ruling on all anytime interleavings or approval of every unresolved private-response design. Unsupported-origin guards depend on public origin, not secret face.

Bounded local runtime contract

The original classic branch of the fresh ixian-replacement profile admits two through six unique classic factions in Basic or Advanced with base Treachery and Nexus alone. The native section below adds Basic Tleilaxu/classic Ix47. Native Ixians, other expansion families, Leader Skills, Homeworlds, Semuta, Discoveries, Ecaz variants and other overlays remain excluded. Neither branch retrofits an in-play game, enables a public start, resets a saved room or changes existing native Ixian allied replacement.

There is no starting Nexus deal. Native draws require a qualifying closing Nexus with a settled alliance, so a two-seat profile can continue its base game but cannot naturally produce an unallied Secret Ally holder. Actual replacement scenarios need at least three seats; two simultaneous unallied recipients need at least four. Fixtures form genuine nonrecipient alliances and never add seats to an admitted game or fabricate Nexus hands.

Connected purchase and choice

1. Only an actual normal-auction purchase is connected: paid spice or genuine Karama acquisition/payment, including direct acquisition before a positive bid. Native Advanced BG Worthless conversion must first complete its existing response; successful free purchases then get the same replacement choice. A canceled direct conversion makes no purchase; canceled winning payment follows its original funded spice-payment recovery and, if purchased, supplies a paid receipt. The original source, purchased physical card and native sale continuation remain bound after genuine acquisition. Gifts, bonus draws, Technology swaps, old hand cards and historical purchase IDs cannot create an opportunity.
2. Harkonnen buyers use the visibly provisional replacement-before-income/bonus order above, preserving the original cancelable bonus and eight-card limit. Richese cache, Black Market and special-acquisition origins remain guarded under their separate independent Nexus scope; the native ixAllyCard origin filter is not imported as authority.
3. Every publicly possible supported buyer receives the same event and public buyer identity, regardless of its secret Nexus face. Only that buyer receives Pass and the exact already-owned purchased card for inspection; only a truly eligible unallied holder of the physical Ixian Nexus receives Use. Opponents receive neither the purchased/replacement face nor private price, receipt, deck order or eligibility reason. The buyer may inspect its own actually held Nexus through the existing authorized inspector; the neutral prompt grants no rival entitlement.
4. Pass retains the purchased card and Nexus, closes this opportunity and continues the original sale once. Use spends that singleton Nexus once, discards exactly the just-purchased physical Treachery Card, then draws the actual next deck card privately. There is no card selector, arbitrary hand exchange, new Karama counter, refund, repayment or re-auction.
5. The discard opens a full legal hand's slot before the draw. An exhausted deck recycles eligible Treachery discards, including that just-discarded card; drawing the same physical card again is legal. The unsold auction row is not the draw deck. Earlier Atreides auction inspection does not grant a new peek of this replacement.
6. The original funded amount, own/authorized-ally contribution and recorded free/paid source are preserved. Already completed payment is not repeated, and original income and native auction suffix run once through their genuine continuation. Other response/decision priorities remain native: finish the source-bound choice before another payment, lot, transfer or card effect can change its reserved source. No expiry bypass or raw-action replay is added.
7. Refresh restores the same pending event or closed outcome without another payment, shuffle, draw or Nexus spend. Closed, stale, foreign or malformed events cannot reopen that purchase. Historical receipts remain valid after later transfers, reshuffles and same-card recycling; they do not require an old purchased card to stay in discard forever. Cursor/descriptor consistency is not authentication against arbitrary rewritten saves; authenticated sessions and production compare-and-swap remain required.

Public APIs and ownership

• initializeIxianNexusReplacementGameForAudit(state: Game): Game in game/engine.ts is the fresh-only initializer; Game.nexusIxianReplacementPreview?: true marks the admitted profile. Genuine setup and Nexus dealing remain native.
• GameView.nexusIxianReplacementPreview reports the profile. GameView.nexusIxianReplacement is the neutral event/buyer view with canPass, canUse, blocked and purchased; rivals have no face or private blocked reason.
• { type: 'nexusIxianReplacementPass', event } and { type: 'nexusIxianReplacementUse', event } accept only that event-bound shape. There is no client-chosen purchased ID, replacement, recipient, price or Nexus identity.
• game/nexus-ixian-replacement.ts owns canonical physical/source/custody/history validation through createIxianReplacementSource, validateIxianReplacementSource, closeIxianReplacementSource and validateIxianReplacementHistory, with initialIxianReplacementCursor and ixianReplacementEvent for bounded progress. The source snapshots the exact purchased descriptor, not a whole-Game undo or payment replay. Canonical descriptor, original parent, owned exact target, legal hand cap and single physical custody are validated before Nexus cost or randomness. The closed receipt chain and independent cursor do not require an old discard to remain in its historical location. The engine alone owns purchase authorization, original payment and native discard/draw/sale continuation. Existing native Ixian ally response remains a distinct cancelable ability, not an alias or fallback for the absent-faction Nexus grant.
• components/nexus-ixian-replacement.tsx and components/game-table.tsx own the private inspector and neutral controls; game/bots.ts consumes each bot's own legal projection. Easy, Medium, Hard and Brutal have minimal legal Use/Pass policies, not calibrated Nexus strategy.
• The local CLI entry is node --import tsx tools/start-prototype.ts --profile ixian-replacement --db PATH --room CODE --version NUMBER --out /private/new-directory. It requires the exact current room version, a fresh supported setup and a private new backup/kit directory; it preserves room/seat/setup identity and existing saves rather than replacing or resetting a game. tools/prototype-room.ts owns admission and the private backup transaction.

Native Basic Tleilaxu integration — 2 October 2026

The additional fresh admission is Basic Tleilaxu plus unique classic opponents, exactly the original Ix47 Treachery Deck, and Nexus alone. Ixians are absent. This adds to the classic base33 Basic/Advanced profile above; it does not admit Advanced Tleilaxu, native CHOAM/Richese, mixed expansions or other overlays. Its fresh setup omits the optional physical Sandtrout Spice Card, following the existing bounded Ixian Betrayal setup convention; existing games and their cards are not changed.

game/nexus-ixian-replacement.ts uses the original treacheryDeck(['ix']) catalogue for exact descriptors. Original base33 identities remain valid alongside the fourteen original Ix cards; a matching ID or generic special kind cannot authorize a different name, kind, effect or extra field, and unrelated Richese faces do not enter this catalogue. The existing source, event, cursor and history APIs remain the only receipt path. In particular, buying an Ix special does not replay its payment or turn the replacement draw into another purchase.

tests/fixture-native-ixian-replacement.ts exports createNativeIxianReplacementFixture and assertNativeIxianReplacementInventory. The fixture accepts a fresh native lobby or its undealt admitted setup, completes native setup and turn one, forms an actual nonrecipient alliance during the next qualifying Nexus, and draws the Ixian Nexus through the native lifecycle. It then buys an original physical card in a normal auction for two spice. Its default purchase is Thumper and its ordered remaining-deck top is Amal; options also allow an actual Tleilaxu buyer and the final native auction lot. Only conserved undealt cards are reordered; no held Nexus, acquired Treachery face, paid-source receipt or continuation is manufactured.

tests/native-ixian-replacement.test.ts covers the native special-card Use and Pass outcomes, exact discard/top draw, preserved original payment and income, native next-lot/final-lot continuation, single Nexus/Treachery custody, replay rejection, and forged/unrelated descriptor rejection. Existing base-profile full-hand and genuinely depleted-deck regressions already exercise the same discard-first/replenishment path and are retained rather than duplicated with an artificially emptied native deck.

This is ordinary composition of printed replacement and existing native setup/auction lifecycle, not a new Nexus ruling or completed family claim. Special sale origins, private opportunity timing, cache scope and combined modules keep their bounds above. This earlier deck/faction integration did not choose Harkonnen ordering; the later explicit provisional composition is recorded at the opening of this document. Native verification below belongs to the frozen native payment wave, not the newer Harkonnen proof.

Bounded native verification passes four meaningful regressions in the shared 110-case affected batch; final native/guide26/26, types/lint and build pass. Twelve actual native programs cover four original Ix purchase/draw pairs, Atreides/Tleilaxu buyers, next/final lots and all four legal policies. Genuine CLI XLFRHKPF v6 reaches original native setup. Human390px NMFTVV6N v8 inspects Thumper, spends the original Ixian Nexus, draws Amal, keeps the buyer's already-paid wallet3, and permits Emperor's original income10→12 once before the next phase's ordinary Amal window. Full-family games, other modules, pending rulings and deployment remain open.

Verification and retained release gates

Partial development verified. Types, lint, 6,227 offline cases and the 73-case selected six-file union pass. Actual standalone native execution covers fourteen Basic/Advanced paid/printed-Karama Use/Pass, wrong-face Keep, full-hand and depleted-source outcomes with exact original ledger, physical Treachery/Nexus/force/elite custody and replay rejection.

The depleted source is captured from genuine six-seat play, seed 11: turn five, native auctionPayment, seventeen held cards, twelve actual discards, four native reserved lots and an empty draw deck. All 33 cards are present. Legal purchases, Battle Plans and winner discards produced it; no row inflation, stock deletion or phase rewrite was used. tests/fixtures/nexus-ixian-native-depleted.json then exercises the actual payment and native replenishment shuffle, including exact same-card redraw.

Independent rules/privacy rereviews have no finding after two actual fixes. Nine retained purchase records grew to 7,030,825 bytes under recursive signature nesting; nonrecursive result-head links reduce them to 134,145 bytes. A permanent linear-history regression retains corruption/replay checks without a cryptographic-authentication claim. Actual phone Take back control previously sent no POST during a pending choice; it now sends one 200, restores the original seat controller and retains that same paid-source event. Gameplay locks still protect the offer. Incidental disabled-attribute-order and attempted-SQL-write pins were removed; actual room/eligibility locks, durable total_changes() and credential CAS remain checked.

Three same-admitted setup/seat/circle QA rooms were privately backed up and entered by exact-version CLI: GTCHEGKU Basic paid Use plus independent takeback, JUXLJXHC Advanced printed free Use, and HJ5Q64T5 Basic irrelevant-face Keep. Actual 390-pixel inspection, actions, native income and refresh retain the source. The wrong-face owner receives no Use or Ixian inspector. Read-only saved proof conserves original native inventories, exact spice and one closed outcome; all eleven previous QA rooms are unchanged.

Repository evidence: tests/nexus-ixian-replacement.test.ts (pure source, custody/history), tests/nexus-ixian-replacement-engine.test.ts and genuine tests/fixture-nexus-ixian-replacement.ts (native acquisition/continuation), tests/nexus-ixian-replacement-controls.test.tsx (private controls), tests/bot-nexus-ixian-replacement.test.ts (four legal policies), tests/nexus-ixian-replacement-recovery.test.ts (authenticated SQLite) and tests/prototype-room.test.ts (fresh profile and exact-version backed-up CLI). This evidence is not complete family/module or deployed acceptance.

Independent Richese cache/Black Market/special scope, expansion-card discard reactions, Semuta/Ecaz priority and anytime interleaving remain outside this profile. Harkonnen's connected replacement-before-bonus sequence is explicitly provisional, not a settled publisher priority. Full Ixian/Nexus families, combined modules, public starts, complete games and live release acceptance remain separate gates.