Connect Ecaz Betrayal and Fremen worm Cunning with build revision

docs/NEXUS_FREMEN_RULES.md

@@ -1,6 +1,6 @@
 # Fremen Nexus: worm and revival contract
 
-Primary-source and integration audit, 10 September 2026; narrow Secret Ally Revival prototype integrated later. This document does not certify the other two Fremen effects or open a release gate. The [common Nexus rules](NEXUS_CARD_RULES.md) apply. No new user question was sent.
+Primary-source and integration audit, 10 September 2026; narrow Secret Ally Revival and native Cunning prototypes integrated later. This document does not certify Fremen protection, combined-module Cunning or complete Fremen effects, and does not open a release gate. The [common Nexus rules](NEXUS_CARD_RULES.md) apply. No new user question was sent.
 
 ## Evidence
 
@@ -37,6 +37,19 @@ Recommended focused contracts:
 
 Two interactions need a concrete decision before treating this as a complete feature. The card triggers at appearance while ordinary riding follows negotiations: a just-drawn card must not automatically buy a retrospective ride for an earlier empty worm. Also, ordinary Karama's printed Shai-Hulud result destroys forces at the worm, whereas the remote source is elsewhere. Do not destroy that remote source, or invent a global loss of all riding, as a shortcut for cancellation. A bounded enhanced-native cancellation policy must preserve the original empty occurrence and unrelated rides.
 
+### Connected native Cunning path
+
+`game/nexus-fremen-cunning.ts` captures `{event, turn, territory, origin, pile?, parent?, initiallyEmpty}` at the accepted appearance before destruction, using public `presenceAt` across players. Advisers and public No-Field markers count without revealing marker denomination. `beginWorm` offers the same Fremen decision for an initially empty appearance whether or not that seat holds its own card; the owner-only card view controls the spend button. The server, not the client, issues the event and later `{event, turn, owner}` ride authorization. The actual Fremen card moves to the Nexus discard on acceptance.
+
+The current runtime path covers natural and accepted additional worms in Basic/Advanced, plus Fremen special-Karama summoned worms in Advanced, with seated classic factions, Nexus alone and no other optional modules. The summon mints a separate server-side parent event when its physical Karama is spent; a new empty appearance binds the Cunning occurrence to that parent before devouring. A saved offer or pending ride must still belong to the active summon. A summon occurring inside another unresolved Cunning offer or ride retains its ordinary worm path without a second Cunning offer. Great Maker is not enabled for this Cunning path; Sandtrout-suppressed and first-turn ignored *drawn* worms never call the appearance hook, while a real special summon still does. `quoteFremenCunning` checks native unallied entitlement and lists typed forces in each occupied sand territory. After spending, `quoteFremenCunningRide` requires the saved event authorization and spent physical card; `validateFremenCunningSelection` requotes one source and a subset of normal/Fedaykin counters immediately before moving. The destination uses Arrakis entry, storm and occupation rules, not the desert-only source restriction. Ordinary worm destruction and the applicable Nexus happen first; `nextWormRide` schedules native rides before the remote ride afterward, without consuming normal movement. BG intrusion and territory-entry continuations use the native worm-ride path. JSON normalization and rejected-action checks cover a live offer, a spent response and the post-Nexus selection.
+
+A special summon during an existing Cunning offer or Karama response saves and
+restores that original control. When it interrupts a selected remote ride, the
+unfinished ride returns to its queue so the new Nexus and ordinary worm rides
+resolve first; no second Cunning offer is opened for that nested appearance.
+
+One Karama response may cancel only this additional remote ride after the Nexus card is spent. The originally empty appearance still destroys/places spice as usual; the remote source is not destroyed, and unrelated native rides continue. This is a **provisional enhanced-native cancellation composition**, not an explicit publisher ruling about Nexus/Karama classification. Games requiring other modules, a second Cunning offer inside an already pending Cunning control, Great Maker reserve replacement or Sandmaster collection stay gated until their own adapters/rulings are verified. The accepted receipt is server-issued but not cryptographically signed; this path does not claim malicious-save authentication.
+
 ## Secret Ally protection
 
 With Fremen absent, `wormSurvival` currently proceeds directly to destruction. The protection must be committed before that destruction; it cannot revive already devoured troops, prevent removal of spice, or grant a ride. Bind it to one worm occurrence and the holder's affected physical group, including the existing No-Field reveal/capped-materialization path. Other factions remain vulnerable.
@@ -48,7 +61,7 @@ A pause offered only when the threatened player secretly holds this card would d
 The card's total-of-three wording and the native alliance's ordinary free-three benefit support a **free-rate interpretation within ordinary revival accounting**, rather than three additional counters beyond the usual allowance. This is source composition, not an explicit Nexus FAQ. Preserve it as the proposed contract; do not silently apply Emperor's separate extra-return producer.
 The current first path is a deliberate subset of that proposed contract: with Fremen absent, an unallied base-faction holder in Basic or Advanced Revival may spend the physical Nexus card to transfer exactly three eligible forces from Tanks to reserves at zero spice cost. It is available before any ordinary force return, with no competing expansion/module revival modifier, pending response or decision. The three returned forces consume the ordinary allowance and free-force ledger; they are **not** Emperor-style extra returns. The Advanced one-elite-per-turn cap and physical elite census apply. The server's private offer provides the eligible elite counts; the action validates its current turn and group. A signed before/after receipt and independent event markers persist through JSON saves.
 
-This direct transfer is safe only because the scoped seats exclude Tleilaxu income/Axlotl and Homeworld arrival continuations. It must not be generalized to those modes without using the native pending-revival pipeline. If fewer than three forces are in Tanks, if a force return already occurred, or if a higher free rate or modifier applies, the option stays unavailable rather than guessing a ruling. Protection and Cunning remain unimplemented.
+This direct transfer is safe only because the scoped seats exclude Tleilaxu income/Axlotl and Homeworld arrival continuations. It must not be generalized to those modes without using the native pending-revival pipeline. If fewer than three forces are in Tanks, if a force return already occurred, or if a higher free rate or modifier applies, the option stays unavailable rather than guessing a ruling. Protection remains unimplemented; Cunning's bounded native path above is separate.
 
 `game/revival.ts` already computes free rate/remaining from `p.revived`, typed prices and ordinary limits. Engine `beginRevival`/`finishRevival` retains pending requests and Tleilaxu prevention/income continuations. The future combined-mode adapter should be an explicit source-labelled, phase-bound free-rate entitlement consumed by an actual normal revival request, retaining previous returns and exact free/paid normal/starred allocation. Never refund earlier paid revivals or reset `revived`/elite counters on card play or reload.
 
@@ -56,6 +69,8 @@ Keep these questions visible: how the three-total interacts with a higher native
 
 Tleilaxu may be present even though Fremen is absent. `collectRevivalIncome` uses a per-player/turn free-income marker and a separate Ghola path; do not create another payment merely because a Nexus card was played. Axlotl activation and any eligible Homeworld deployment must follow the actual returned batch. Preserve the existing [revival-accounting questions](TLEILAXU_AMBASSADOR_RULES.md), exact typed caps, and signed return/arrival continuations. No leader, Cheap Hero or foreign leader revival is printed here.
 
-## Verification required for the next package
+## Verification and remaining boundaries
 
-Start with genuine unallied Fremen Cunning and natural empty appearances in both modes: compare initially empty against enemies devoured to empty, BG advisors, hidden zero/three/five markers, and multi-sector source groups. Verify rock-spice triggering territories, storm-blocked sources/destinations, occupied strongholds, typed movement and no normal movement charge. Extend to both Advanced piles, additional placement, summoned-parent recovery, canceled appearances, Sandtrout suppression, post-Nexus timing and nested arrival effects. Compare every seat's view and prove lost acknowledgments and concurrent requests cannot duplicate a ride. Secret Ally protection and revival require the specific policy/accounting boundaries above before broader integration is certified.
+Focused pure and engine checks exercise Basic and Advanced real second-turn empty natural appearances, accepted Advanced additional placement and an actual special-Karama summon, a public offer with and without the private card, card spend, Karama allowance/cancellation, post-Nexus ride, typed source custody, owner-only card view, rejected actions, legal bot movement and JSON normalization before/after the response. Pure quotes cover originally occupied appearances that later empty, advisors/No-Fields as presence, multi-sector starred sources, storm and occupied destinations, and inherited-object-key rejection. Isolated in-memory SQLite room tests race duplicate accepted natural and summoned offers, restore private seats and parent Spice Blow context through fresh room instances and prove a canceled or completed ride settles once. Local browser fixtures rendered both natural and summoned owner/non-holder offers, Karama waiting and remote source/force/destination controls from genuine engine views; intercepted GETs and blocked POSTs did not mutate a room.
+
+Still verify both Advanced pile identities end to end, Sandtrout suppression, nested arrival effects, wider reconnect scenarios and complete games. Great Maker, nested Cunning summons and combined optional modules are intentionally unavailable for this Cunning prototype. Fremen Secret Ally protection and the broader revival accounting above remain separate. These checks do not certify a complete Nexus module.