What to build: Implement System Gateway's remaining missing cards — agenda 3, program 2, operation 2, upgrade 2, hardware 1, resource 1, asset 1 — minus any the audit flagged as vanilla. Per-card tickets are generated inside this directory when this ticket starts. Follow docs/adding-a-card.md (post-rewrite) for the definition of done. Completing this finishes the sg pack: imports of sg decks never warn.
Blocked by: 02 — vanilla audit sg; 05, 06, 07, 08 — sg backfill.
Status: fixed
2026-08-01: The sg vanilla audit (ticket 02) flagged only the two starter identities, so all 12 remaining cards needed real hooks: 30003 Carnivore, 30007 Fermenter, 30009 Cookbook, 30017 Tranquilizer, 30044 Longevity Serum, 30048 Hansei Review, 30049 Neurospike, 30050 Anoetic Void, 30052 Tomorrow's Headline, 30060 Above the Law, 30061 Clearinghouse, 30066 Malapert Data Vault. Each landed as one contiguous hook block in rust/netrunner-core/src/cards/sg.rs with a card_<code>_* test and implemented/has_tests flipped in game/cards_impl/sg.json. Per-card tickets generated as 17–28 (11–16 were ticket 09's).
Three new registries carry windows the engine had no hook for (51 → 54 registries, 140 → 159 registrations, 78 → 90 cards): access_actions (hardware's paid abilities during an access — Carnivore), approach_offers_corp (the corp-side twin of server_gate, for its own approach-server window — Anoetic Void), and on_score_in_server (cards left in the root of the server an agenda was scored from — Malapert Data Vault). Five new actions (use_carnivore, use_anoetic_void, above_the_law_target, use_clearinghouse, decline_clearinghouse) and two new decisions (above_the_law, clearinghouse) with legal-action options, snapshot shapes, action labels and static/game.js prompts. Malapert reuses the existing card-search decision through a new "malapert" arm.
Engine changes behind them: two new turn flags (carnivore_used; scored_agenda_points, accumulated in score_agenda and deliberately surviving the CORP_TURN_START reset so Neurospike counts agendas scored in the corp's opening paid-ability window), a "program" slot for use_resource (Fermenter is the first program with a click ability), and Botulus' install counter changed from = 1 to += 1 so Cookbook's counter is not overwritten. server/serialize.py now shows a pending card search only to the side deciding it — otherwise Malapert's R&D dig would have rendered on the runner's screen (which also closes the same leak for Mutual Favor's stack search).
Four cards carry documented engine approximations where a corp choice has no window: Longevity Serum trashes zero cards from HQ and recycles the first 3 Archives cards; Hansei Review and Anoetic Void trash off the top of HQ; Carnivore pays with the top 2 grip cards.
cargo test --workspace green at 133 (128 core + 5 ai-invariants; was 121) and .venv/bin/pytest green at 109. cargo fmt --check and cargo clippy --workspace --all-targets clean. Twelve self-played games on a deck pair built from the new cards ran to completion with the rule-based AI (no deadlocks, every action legal), and MO-ISMCTS reported no root-illegal children on the same decks.
System Gateway is complete: every one of its 77 manifest entries is implemented (75 with hooks, 2 explicitly vanilla), so importing an sg deck can no longer warn.
2026-08-01: Review of commit e194ac6 completed. Ticket 39 tracks the four choice-selection approximations; ticket 40 tracks the remaining optional-trigger gaps. This implementation ticket remains fixed.