Connect Ecaz Betrayal and Fremen worm Cunning with build revision

docs/CURRENT_STATUS.md

@@ -6,6 +6,30 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
+The bounded [Fremen Nexus Cunning](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
+prototype connects an initially empty worm's public offer, one spent private
+card, a Karama response, a typed remote ride after the Nexus, human controls
+and minimal legal AI in classic-faction Nexus-only games. Basic/Advanced
+natural continuation, an additional-worm placement and an actual Advanced
+special-Karama summon retain their physical parent, response and native-then-
+remote ride order across JSON/isolated SQLite recovery and duplicate CAS.
+Natural and summoned offer/ride browser surfaces were exercised. Review found
+and fixed an inherited-key force-custody bypass. A second Cunning offer
+inside an interrupted control, Great Maker, combined modules, Secret Ally
+protection and complete Nexus games remain gated.
+
+The bounded [Ecaz Nexus Betrayal](NEXUS_ECAZ_RULES.md#bounded-betrayal-runtime)
+path lets a card holder select one public territory shared by Ecaz and its
+ally before the first Shipment and Movement turn advances. One spent card,
+a provisional Karama response and exact typed ally-force return are wired
+through human controls, legal bot action, JSON and in-memory SQL continuation,
+and focused gameplay, race and restart tests. A local browser fixture rendered
+the holder-only offer and rival Karama notice without writing a room. Secret
+Ally inquiry, Duke Cunning and combined modes remain gated. The main page
+labels its build's Git commit in the lobby and active-table masthead; local
+Git HEAD does not represent uncommitted work. The main-branch container
+workflow publishes an image but does not deploy the live site automatically.
+
 Current work adds [discussion moderation](ADMIN_DISCUSSION.md): owners/operators
 can mute or unmute new public/private messages from a human seat. History,
 incoming messages, game state and credentials remain saved; the setting follows

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,47 @@
 # Dune implementation status
 
+## 26 September 2026 — Bounded Ecaz Nexus Betrayal and build revision
+
+The [Ecaz source contract](NEXUS_ECAZ_RULES.md#bounded-betrayal-runtime)
+now has a narrow Betrayal path at the opening of Shipment and Movement.
+The unallied card holder chooses a public territory shared by Ecaz and its
+reciprocal ally. One physical Ecaz card is spent before a provisional Karama
+response; allowance returns the ally's entire typed group from all sectors
+to reserves, while cancellation preserves its board forces. The native
+shipment and movement queue is unchanged. Pure quote, real turn-two Nexus,
+bot ordering, privacy, rejection, JSON continuation and in-memory SQL
+duplicate-CAS/restart regressions exercise this bounded path. A local browser
+fixture rendered the owner-only shared-territory selector and rival public
+Karama notice; no room was written. The homepage revision was visually
+verified on local desktop and mobile. Broader combined-module acceptance and
+other Ecaz Nexus panels remain separate.
+
+The landing lobby and active-table masthead now show the build's Git commit.
+Vite bakes a checkout HEAD or validated `BUILD_REVISION`; the container
+workflow passes its GitHub commit to Docker before building. A source tree
+with uncommitted edits still displays its committed HEAD, not those edits.
+
+## 26 September 2026 — Bounded Fremen Nexus Cunning prototype
+
+The [Fremen Nexus source contract](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
+now has a native Basic/Advanced path for initially empty natural and accepted
+additional worm appearances, plus an Advanced Fremen special-Karama summoned
+appearance in classic-faction Nexus-only games. A uniform public offer does
+not disclose the privately held Fremen card. Accepted use spends it once,
+preserves the original worm and permits
+one source-labelled desert ride after its Nexus, moves exact normal/Fedaykin
+counters, and resumes native arrival children. Summons keep a separate
+server-issued parent event through the saved original Spice Blow. A Karama
+response provisionally cancels only the remote ride. JSON and in-memory
+SQLite continuations, duplicate-offer CAS races for natural and summoned
+appearances, owner-only controls, minimal legal bot participation and focused
+checks cover this bounded path. Independent review exposed an inherited-key
+force creation bug that was reproduced and fixed. Browser QA exercised natural
+and summoned offer/response/ride controls from genuine projected views with
+isolated GET interception and blocked POST; no room was mutated. Full module
+games, second Cunning offers during interrupted controls and Great Maker,
+combined modules and the absent-faction protection remain gated.
+
 ## 26 September 2026 — Administrative discussion moderation prototype
 
 [Discussion controls](ADMIN_DISCUSSION.md) connect human-seat mute/unmute to the

docs/NEXUS_ECAZ_RULES.md

@@ -47,3 +47,36 @@ Read the target's completed current hand. Finish an already pending Harkonnen dr
 Implement the common, source-clear contract as a pure boolean intersection of **explicitly supplied queried leader IDs** with an ordinary held-traitor snapshot. Let the engine select the agreed leader scope and audience. Bind the accepted event, original seats/factions, turn/phase, chosen target, scope and boolean in a completed receipt; keep private source evidence server-side if retained. Discard the one real Ecaz Nexus card in the same accepted transaction. Validate current global custody separately from historical answers. Public offers can be built entirely from roster, timing/continuation state and the owner's card, without reading target secrets.
 
 Meaningful regressions should cover positive and negative answers with equal public hand sizes; dead/revived native leaders; native captive versus foreign captive/Ghola cases for the explicitly selected scope; Duke and Hero identities; Tleilaxu role separation; Harkonnen exchange before/after inquiry; stale/replayed/concurrent play; JSON/SQL historical persistence; and exact audience projection without counts or matching identities. Until scope and audience are selected, those unresolved branches must not be presented as fully source-verified behavior.
+
+## Bounded Betrayal runtime
+
+The printed Betrayal is a **separate panel** from the Secret Ally inquiry above.
+With Ecaz seated, an unallied holder of the one physical Ecaz Nexus card may
+choose one printed Arrakis territory occupied by both Ecaz and its reciprocal
+ally. The ally returns its **entire** normal/starred group from every sector of
+that territory to reserves; Ecaz's forces and the ally's other territories stay.
+This is not a shipment, movement, combat loss or revival. The holder's private
+offer contains only public positions and typed public force counts; rivals do
+not see the held card. Acceptance spends the card once and opens a public
+Karama response. Allowance returns the quoted group; cancellation leaves all
+board forces unchanged and the Nexus card spent. This response classification
+is an explicit **provisional composition**, not a GF9 ruling granting Karama
+blanket jurisdiction over Nexus effects.
+
+The first implementation window is deliberately narrow: phase 5 while its
+first active player is still current, the original movement queue is intact,
+no pending decision/response and no shipment or movement has been used. It does
+not assert that this is the only possible reading of “before Shipment and
+Movement.” The physical Ecaz alliance and co-occupation must be current.
+An automated eligible holder is scheduled before an earlier-seated movement
+bot closes this opening; a human holder must declare before that first turn
+advances. The game does not pause all seats to reveal a hidden card.
+Only the classic factions plus Ecaz/Moritani and the Nexus module are
+admitted; advisors, hidden No-Fields, Homeworlds, Discoveries, Leader Skills,
+Tech, Stronghold Cards and other combined modules remain gated. A saved
+pending snapshot binds the card's discard position, ally and exact typed board
+group through the Karama window, even if another Nexus card is discarded
+during that response. The ally's reserve counters are validated before any
+board return. Saved receipts reject replay but are not cryptographic proof of
+historical save authenticity. Ecaz Cunning's Duke override and the Secret
+Ally identity/audience questions above remain unimplemented.

docs/NEXUS_FREMEN_RULES.md

@@ -1,6 +1,6 @@
 # Fremen Nexus: worm and revival contract
 
-Primary-source and integration audit, 10 September 2026; narrow Secret Ally Revival prototype integrated later. This document does not certify the other two Fremen effects or open a release gate. The [common Nexus rules](NEXUS_CARD_RULES.md) apply. No new user question was sent.
+Primary-source and integration audit, 10 September 2026; narrow Secret Ally Revival and native Cunning prototypes integrated later. This document does not certify Fremen protection, combined-module Cunning or complete Fremen effects, and does not open a release gate. The [common Nexus rules](NEXUS_CARD_RULES.md) apply. No new user question was sent.
 
 ## Evidence
 
@@ -37,6 +37,19 @@ Recommended focused contracts:
 
 Two interactions need a concrete decision before treating this as a complete feature. The card triggers at appearance while ordinary riding follows negotiations: a just-drawn card must not automatically buy a retrospective ride for an earlier empty worm. Also, ordinary Karama's printed Shai-Hulud result destroys forces at the worm, whereas the remote source is elsewhere. Do not destroy that remote source, or invent a global loss of all riding, as a shortcut for cancellation. A bounded enhanced-native cancellation policy must preserve the original empty occurrence and unrelated rides.
 
+### Connected native Cunning path
+
+`game/nexus-fremen-cunning.ts` captures `{event, turn, territory, origin, pile?, parent?, initiallyEmpty}` at the accepted appearance before destruction, using public `presenceAt` across players. Advisers and public No-Field markers count without revealing marker denomination. `beginWorm` offers the same Fremen decision for an initially empty appearance whether or not that seat holds its own card; the owner-only card view controls the spend button. The server, not the client, issues the event and later `{event, turn, owner}` ride authorization. The actual Fremen card moves to the Nexus discard on acceptance.
+
+The current runtime path covers natural and accepted additional worms in Basic/Advanced, plus Fremen special-Karama summoned worms in Advanced, with seated classic factions, Nexus alone and no other optional modules. The summon mints a separate server-side parent event when its physical Karama is spent; a new empty appearance binds the Cunning occurrence to that parent before devouring. A saved offer or pending ride must still belong to the active summon. A summon occurring inside another unresolved Cunning offer or ride retains its ordinary worm path without a second Cunning offer. Great Maker is not enabled for this Cunning path; Sandtrout-suppressed and first-turn ignored *drawn* worms never call the appearance hook, while a real special summon still does. `quoteFremenCunning` checks native unallied entitlement and lists typed forces in each occupied sand territory. After spending, `quoteFremenCunningRide` requires the saved event authorization and spent physical card; `validateFremenCunningSelection` requotes one source and a subset of normal/Fedaykin counters immediately before moving. The destination uses Arrakis entry, storm and occupation rules, not the desert-only source restriction. Ordinary worm destruction and the applicable Nexus happen first; `nextWormRide` schedules native rides before the remote ride afterward, without consuming normal movement. BG intrusion and territory-entry continuations use the native worm-ride path. JSON normalization and rejected-action checks cover a live offer, a spent response and the post-Nexus selection.
+
+A special summon during an existing Cunning offer or Karama response saves and
+restores that original control. When it interrupts a selected remote ride, the
+unfinished ride returns to its queue so the new Nexus and ordinary worm rides
+resolve first; no second Cunning offer is opened for that nested appearance.
+
+One Karama response may cancel only this additional remote ride after the Nexus card is spent. The originally empty appearance still destroys/places spice as usual; the remote source is not destroyed, and unrelated native rides continue. This is a **provisional enhanced-native cancellation composition**, not an explicit publisher ruling about Nexus/Karama classification. Games requiring other modules, a second Cunning offer inside an already pending Cunning control, Great Maker reserve replacement or Sandmaster collection stay gated until their own adapters/rulings are verified. The accepted receipt is server-issued but not cryptographically signed; this path does not claim malicious-save authentication.
+
 ## Secret Ally protection
 
 With Fremen absent, `wormSurvival` currently proceeds directly to destruction. The protection must be committed before that destruction; it cannot revive already devoured troops, prevent removal of spice, or grant a ride. Bind it to one worm occurrence and the holder's affected physical group, including the existing No-Field reveal/capped-materialization path. Other factions remain vulnerable.
@@ -48,7 +61,7 @@ A pause offered only when the threatened player secretly holds this card would d
 The card's total-of-three wording and the native alliance's ordinary free-three benefit support a **free-rate interpretation within ordinary revival accounting**, rather than three additional counters beyond the usual allowance. This is source composition, not an explicit Nexus FAQ. Preserve it as the proposed contract; do not silently apply Emperor's separate extra-return producer.
 The current first path is a deliberate subset of that proposed contract: with Fremen absent, an unallied base-faction holder in Basic or Advanced Revival may spend the physical Nexus card to transfer exactly three eligible forces from Tanks to reserves at zero spice cost. It is available before any ordinary force return, with no competing expansion/module revival modifier, pending response or decision. The three returned forces consume the ordinary allowance and free-force ledger; they are **not** Emperor-style extra returns. The Advanced one-elite-per-turn cap and physical elite census apply. The server's private offer provides the eligible elite counts; the action validates its current turn and group. A signed before/after receipt and independent event markers persist through JSON saves.
 
-This direct transfer is safe only because the scoped seats exclude Tleilaxu income/Axlotl and Homeworld arrival continuations. It must not be generalized to those modes without using the native pending-revival pipeline. If fewer than three forces are in Tanks, if a force return already occurred, or if a higher free rate or modifier applies, the option stays unavailable rather than guessing a ruling. Protection and Cunning remain unimplemented.
+This direct transfer is safe only because the scoped seats exclude Tleilaxu income/Axlotl and Homeworld arrival continuations. It must not be generalized to those modes without using the native pending-revival pipeline. If fewer than three forces are in Tanks, if a force return already occurred, or if a higher free rate or modifier applies, the option stays unavailable rather than guessing a ruling. Protection remains unimplemented; Cunning's bounded native path above is separate.
 
 `game/revival.ts` already computes free rate/remaining from `p.revived`, typed prices and ordinary limits. Engine `beginRevival`/`finishRevival` retains pending requests and Tleilaxu prevention/income continuations. The future combined-mode adapter should be an explicit source-labelled, phase-bound free-rate entitlement consumed by an actual normal revival request, retaining previous returns and exact free/paid normal/starred allocation. Never refund earlier paid revivals or reset `revived`/elite counters on card play or reload.
 
@@ -56,6 +69,8 @@ Keep these questions visible: how the three-total interacts with a higher native
 
 Tleilaxu may be present even though Fremen is absent. `collectRevivalIncome` uses a per-player/turn free-income marker and a separate Ghola path; do not create another payment merely because a Nexus card was played. Axlotl activation and any eligible Homeworld deployment must follow the actual returned batch. Preserve the existing [revival-accounting questions](TLEILAXU_AMBASSADOR_RULES.md), exact typed caps, and signed return/arrival continuations. No leader, Cheap Hero or foreign leader revival is printed here.
 
-## Verification required for the next package
+## Verification and remaining boundaries
 
-Start with genuine unallied Fremen Cunning and natural empty appearances in both modes: compare initially empty against enemies devoured to empty, BG advisors, hidden zero/three/five markers, and multi-sector source groups. Verify rock-spice triggering territories, storm-blocked sources/destinations, occupied strongholds, typed movement and no normal movement charge. Extend to both Advanced piles, additional placement, summoned-parent recovery, canceled appearances, Sandtrout suppression, post-Nexus timing and nested arrival effects. Compare every seat's view and prove lost acknowledgments and concurrent requests cannot duplicate a ride. Secret Ally protection and revival require the specific policy/accounting boundaries above before broader integration is certified.
+Focused pure and engine checks exercise Basic and Advanced real second-turn empty natural appearances, accepted Advanced additional placement and an actual special-Karama summon, a public offer with and without the private card, card spend, Karama allowance/cancellation, post-Nexus ride, typed source custody, owner-only card view, rejected actions, legal bot movement and JSON normalization before/after the response. Pure quotes cover originally occupied appearances that later empty, advisors/No-Fields as presence, multi-sector starred sources, storm and occupied destinations, and inherited-object-key rejection. Isolated in-memory SQLite room tests race duplicate accepted natural and summoned offers, restore private seats and parent Spice Blow context through fresh room instances and prove a canceled or completed ride settles once. Local browser fixtures rendered both natural and summoned owner/non-holder offers, Karama waiting and remote source/force/destination controls from genuine engine views; intercepted GETs and blocked POSTs did not mutate a room.
+
+Still verify both Advanced pile identities end to end, Sandtrout suppression, nested arrival effects, wider reconnect scenarios and complete games. Great Maker, nested Cunning summons and combined optional modules are intentionally unavailable for this Cunning prototype. Fremen Secret Ally protection and the broader revival accounting above remain separate. These checks do not certify a complete Nexus module.

docs/VERIFICATION_WORKFLOW.md

@@ -29,6 +29,13 @@ occurred, what revision actually ran, the routes/actions exercised, results and
 remaining limitations. If the deployed revision is older, label the results for
 that older revision; do not claim that new source passed deployed acceptance.
 If access or deployment is unavailable, report the gap and keep acceptance open.
+Each pushed application checkpoint also needs a separate live deployment; a
+successful GitHub container publication alone is not a deployment. Follow
+[the manual TrueNAS update](TRUENAS.md#applying-an-update) only after the image
+passes CI, the persistent volume is backed up and play reaches a safe point.
+If access, the backup or a safe point is missing, report the push as **not
+deployed** and keep its production verification open rather than claiming the
+Git revision label matches the pushed commit.
 
 Use the production browser flow to verify relevant navigation and deep links,
 bundled assets and rendering, HTTPS/proxy behavior, cookies and authentication,