Connect bounded Richese Nexus Cunning No-Field pair

docs/CURRENT_STATUS.md

@@ -67,6 +67,9 @@ access revocation, participant removal, assisted recovery, permanent deletion,
 bulk actions and backup/operations tools remain unfinished.
 
 [Participant AI](ADMIN_PARTICIPANT_AI.md) checkpoint `2cddf03` is pushed. Types/lint,
+
+The bounded [native Richese Nexus Cunning shipment](NEXUS_RICHESE_RULES.md#bounded-native-cunning-prototype-27-september-2026) now uses two distinct physical No-Field tokens in one priced shipment in genuine Richese/CHOAM paired Nexus games. One token immediately reveals a reserve-capped public force group; the other remains concealed. Owner-only controls, four legal AI profiles, Karama/Guild responses, signed saved receipts and concurrent in-memory SQLite settlement are connected in Basic/Advanced. A read-only local browser fixture displayed the owner selector and no rival private panel. Same-shipment nonrepeat is a documented product interpretation; faceup-component artwork, combined modules, Betrayal and full Nexus acceptance remain gated. This code is local and not in the last verified production image.
+
 5,408 offline tests, 52 HTTP tests, build, twenty-two administrator HTTP groups
 and desktop/mobile browser acceptance passed. Deployment delivery was
 unconfirmed at that checkpoint; the current production revision is recorded

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,11 @@
 # Dune implementation status
 
+## 27 September 2026 — Bounded native Richese Nexus Cunning pair
+
+The [Richese source contract](NEXUS_RICHESE_RULES.md#bounded-native-cunning-prototype-27-september-2026) now has one usable two-No-Field shipment in genuine Richese/CHOAM paired Nexus games without other optional modules. Two distinct nonrepeating physical tokens ship at the one-marker price; one immediately reveals into reserve-capped public normal forces and the other remains the sole concealed marker. The native Karama cancellation leaves resources, tokens and shipment allowance untouched while spending the card; Advanced Guild special prevention spends the attempted allowance without placing tokens or charging spice. Owner-only controls, four minimal legal bot paths, public value/force log and private concealed custody are connected. A read-only local browser fixture displayed the owner pair selector; the rival view had no private panel. Same-shipment `lastShipped` handling is a product interpretation, not a published FAQ answer.
+
+Pure custody, Basic/Advanced engine, canceled/allowed responses, malformed intent, all AI profiles and concurrent in-memory SQLite CAS/reload/replay cases passed 60 focused tests after independent review fixed orphaned pending continuation and nullable bot-offer filtering. The final frozen full offline suite passed 5,581/5,581 cases across 700 files after the allocation-only validation refactor. Isolated project TypeScript excluding only the unrelated Fremen draft, scoped lint and app build also passed. `npm run check` still stops at the unrelated `Player.fremenNexusMovementBlockedTurn` draft error. Persistent faceup-component artwork, allied and optional-module combinations, Richese Betrayal and complete Nexus/public starts remain gated. This checkpoint is not yet in the live image.
+
 ## 27 September 2026 — Bounded Ecaz Nexus Secret Ally traitor inquiry
 
 The [Secret Ally prototype](NEXUS_ECAZ_RULES.md#bounded-secret-ally-traitor-inquiry-runtime) lets an unallied holder spend the physical Ecaz Nexus card at a quiet boundary when Ecaz is absent and ask any seated player, including themself, whether that player holds one of the holder's native leaders as an ordinary Traitor Card. The public action names the target but discloses no answer or matching identity; the holder alone can revisit the signed historical yes/no after the target's hand changes and the Nexus discard recycles. Native printed leader scope and holder-only audience are privacy-preserving product interpretations, not publisher rulings. Basic/Advanced real actions, four AI profiles, owner/rival projections, malformed and interrupted requests, JSON recovery and concurrent in-memory SQLite CAS passed six focused cases. A local read-only browser fixture showed the holder's target control and subsequent private answer, while a rival saw neither; no room write occurred. An independent rules/privacy/persistence review found no actionable defect.

docs/NEXUS_RICHESE_RULES.md

@@ -60,6 +60,14 @@ A reveal is not another arrival; E3 explicitly distinguishes No-Field entry from
 
 Concrete Cunning boundaries requiring design or a selected interpretation are: how two same-shipment uses update the shared last-used history; whether an already deployed marker must reveal before the pair; how the immediate faceup component and the still-concealed one affect the next prohibited denomination; and composition with native high-Richese extra ordinary forces or an allied shipment. The present `RicheseNoField` shape has only `lastShipped` and one `deployed` record, so it cannot simply represent an atomic pair by calling single-deploy twice. These are Cunning custody issues, not reasons to withhold Secret Ally's ordinary actual-force shipment.
 
+## Bounded native Cunning prototype (27 September 2026)
+
+The connected path is deliberately narrower than every possible E2 composition: a genuine Richese/CHOAM paired Nexus game with only Richese, CHOAM and classic factions, Basic or Advanced, no Homeworlds, Leader Skills, Discoveries, Sandtrout or Ecaz module. An unallied native Richese holder with an unused native shipment and no deployed marker chooses two distinct available physical tokens. Neither token may equal the previous shipment's `lastShipped`; the remaining concealed token becomes the next `lastShipped`. A previously deployed marker must be resolved through native reveal/movement first. This same-shipment nonrepeat convention is a product interpretation of the one-record E2 custody model, not a published FAQ ruling.
+
+The card is discarded at declaration. The native No-Field Karama cancellation precedes settlement and preserves the two tokens, reserves, spice and ordinary shipment allowance but not the card. Advanced Guild special prevention also leaves the physical shipment unpaid and unplaced while consuming the attempted shipment allowance and the card. Otherwise the pair is one arrival, costs the ordinary one-marker price, immediately reveals one chosen denomination and places up to that value of actual normal forces from current reserves in the destination. Only the other token remains concealed, publicly counting as one force; it draws from then-current reserves on its later native reveal. The immediate group plus the concealed marker count as actual presence for subsequent territory-entry and board logic, not two independent shipments.
+
+An owner-only control distinguishes ordinary No-Field, Smuggler and Nexus pair choices. All four bot profiles have a minimal legal pair candidate. The pending frame binds both physical identities, owner, token event, destination and one-marker price through JSON and in-memory SQLite CAS recovery. Public logs disclose the immediate faceup value/actual force count after settlement; the rival projection contains no concealed token identity or owner-only offer. Signatures detect partial saved-frame corruption, not arbitrary save forgery. Combined modules, allied No-Fields, high-Richese additional-force effects, Betrayal, later faceup display mechanics and full Nexus acceptance remain open.
+
 ## Existing integration points and verification
 
 `game/shipment-price.ts` already separates ordinary reserve prices, Guild cross-shipment prices and contributor-filtered Guild income. The ordinary engine chain is `validatePhysicalShipment` → `offerShipment` → `commitShipment`; its checks use native reserve withdrawal, typed counters, arrival stance, actual geography and shipment promises. Introduce a validated charged-count basis without replacing the physical amount. Keep current low-Junction income and occupied-payment routing after the reduced gross is computed.

docs/NEXUS_RICHESE_RUNTIME.md

@@ -41,3 +41,11 @@ Two fresh three-human-seat rooms used final session IDs before genuine fixture s
 In 3C2N43XF, the five-force declaration reached the Guild at version 3. The Guild used its actual special Karama control; version 4 retained all twenty shipper reserves and its one spice, consumed the shipment, and left the Nexus spent. No phantom physical marker appeared.
 
 Desktop 1440-pixel and phone 390-pixel screenshots were captured and visually inspected, including the typed source selection, price breakdown and Guild stop controls. Phone checks found no horizontal overflow. All six private sessions refreshed successfully with no page errors; opponents lacked the shipper's private hand, traitors and spice, and no internal shipment/history record was projected. The read-only restoration script is `/tmp/dune-richese-nexus-restore.cjs`. Staging the first room preserved all 3,548 other room states and versions; staging the second preserved all 3,549 other rooms. Final comparison after both browser rooms and thirty isolated HTTP rooms retained every version/hash of all 3,548 opening rooms; 3,580 rooms now persist. The 02:48 UTC controlled restart used a database backup, preserved all opening games and restored twelve earlier Moritani/CHOAM private sessions. Six new Richese private sessions subsequently restored. No publication or full module gate opened; the maintenance automation remains removed.
+
+## 27 September 2026 — bounded native Cunning shipment
+
+In a genuine paired Richese/CHOAM Nexus game with classic factions and no other optional modules, an unallied Richese holder can spend the native Richese Nexus card on one shipment of two distinct available No-Field tokens. One is immediately revealed into up to its printed value of actual normal forces from current reserves; the other remains the sole concealed marker. The pair costs one ordinary marker shipment. Neither token can match the prior shipped marker, and the concealed token becomes the next `lastShipped`. This same-shipment history choice is a documented product interpretation, not a retrieved publisher answer. A previously deployed marker blocks another shipment until its ordinary native resolution.
+
+The declaration binds both token IDs, the native event, destination, sector and price to a saved receipt. Native Karama cancellation spends the card but leaves tokens, spice, reserves and the ordinary shipment available; Advanced Guild special prevention spends the card and shipping allowance without moving either token or charging spice. Accepted arrival publicly logs the revealed denomination, reserve-capped actual force count and concealed one-force marker without revealing the other denomination. Owner-only selectors and all four minimal bot profiles share the supported route. The owner/rival read-only browser fixture showed the separate two-token selector and no rival private panel; no room was written. A concurrent in-memory SQLite CAS case restored the pending native/Guild continuation, settled one pair and rejected replay. Focused No-Field/Cunning/recovery verification passed 60 cases after the continuation-integrity and allocation-only validation fixes; the final frozen complete suite passed 5,581/5,581 cases across 700 files.
+
+Persistent faceup-component artwork, high-Richese extra ordinary forces, allied No-Field combinations, Homeworld/Leader Skills/Discovery/Sandtrout/Ecaz interactions, Richese Betrayal and complete Nexus acceptance remain separate. The earlier Secret Ally checkpoint above is historical evidence; it is not a claim that the native Cunning or live production image was deployed at that time.