Integrate full funded Guild Nexus Betrayal

docs/NEXUS_CARD_RULES.md

@@ -61,7 +61,7 @@ The private holder offer contains CHOAM's name; it includes the hand count only
 
 ## Effect integration boundaries
 
-Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; the current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). The bounded Richese Betrayal wave retains its own **Planned** verification rather than inheriting earlier auction or shipment evidence.
+Later focused source contracts cover [Emperor strength, purchases and revival](NEXUS_EMPEROR_RULES.md), [Ixian purchased-card replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Fremen worm and revival effects](NEXUS_FREMEN_RULES.md), and [Richese's separate shipment and auction panels](NEXUS_RICHESE_RULES.md). These audits distinguish implemented work from remaining source/timing questions; current runtime evidence is tracked in [implementation status](IMPLEMENTATION_STATUS.md). Bounded Richese auction and Guild shipment Betrayal checkpoints have their own direct local verification below; neither inherits certification of its complete faction, Nexus family or live deployment from earlier evidence.
 
 **Atreides is the first complete effect family to implement.** It has independent rulebook and physical-face evidence, and the engine already has private plan-element inspection. The Nexus effect needs its own cause and receipt rather than temporarily changing the inspecting faction. The second element must differ from the already inspected element. Preserve the original disclosed value if an allowed later battle edit occurs; follow the existing plan commitment rules instead of refreshing an old observation. The card specifies an element, not the entire hand or battle plan. A weapon/defense request uses actual played-card classification, including the published Reinforcements/Harass exclusions, rather than leaking a card merely because it occupies that slot.
 
@@ -114,3 +114,17 @@ To avoid identifying a secret card through timing, every unallied non-Richese se
 The reaction projects only public target/buyer/source/price/event plus own pass/use eligibility. Existing public cache inspection does not entitle anyone to the concealed Black Market face or to the Richese-family identity of a normal hidden lot; claims and printed catalog faces are not custody disclosures. Normal-deck self-purchases, special-Karama veto, unsupported counter/any-time overlays and broader modules remain outside this connected boundary. The private receipt owns exact source, invoice and continuation; independent pending/completed cursor evidence must reject missing/orphaned frames before read or SQL rather than auto-settling.
 
 The profile is explicit, fresh Basic/Advanced CHOAM/Richese plus classic seats, Nexus and the physical CHOAM deck only; it does not upgrade earlier games or open ordinary expansion starts. The dedicated internal `nexus-richese-betrayal` checklist records bounded engine, authenticated SQLite, bot, real controls and refreshed phone-browser evidence, with broader verification **Partial**. Shipment Cunning, ordinary auction, native special-Karama and a complete twelve-face catalog are not substitute verification. Full-family, combined-module and deployed acceptance remain open.
+
+## Guild Betrayal funded-payment protocol
+
+The [printed Guild face and bounded contract](NEXUS_GUILD_RULES.md#nexus-guild-betrayal) take one **full original positive shipment payment**, including the holder's own payment, and expressly override occupied Junction income. Use requires the actual singleton Guild Nexus held by an unallied non-Guild seat while native Guild is seated. The physical Nexus is the only activation cost: no Treachery slot/card or extra spice is spent.
+
+Redirect the already quoted fee once, not reduced Guild income or an additional bank award. Preserve the original payer, own remainder and authorized donor escrow; `pledgeAid` has already debited the donor, so settlement consumes escrow rather than debiting it again. Own-payment use must be fully funded before the later refund. Zero/free, declined or stopped shipments create no fee to take and keep Nexus held. Native applicable stop/rate responses precede this bounded payment gate; no new universal priority or immunity follows.
+
+The original `reserve`, `guildTransport`, `homeworld` or `junction` continuation preserves physical force/source/destination custody, tariff, shipment-used state and applicable native response/arrival suffixes once. Full occupied-Junction replacement suppresses the ordinary Guild/bank/occupier receipt for that invoice; it does not resolve ordinary contribution rounding or occupation entitlement/expiry. No extra shipment, movement, route or sponsor is granted.
+
+All publicly possible unallied non-Guild held-Nexus seats acknowledge the same event and shipper, even with irrelevant hidden faces; only canonical private eligibility exposes Use or an own blocked reason. Pass keeps the card; all required passes settle the original payment unchanged once. Projection is exactly `{event, shipper, canPass, hasPassed, canUse, blocked}` and Pass/Use actions carry event only. Unlike the public auction fields in the Richese protocol, this gate adds no fee, source/family/world, destination, forces, donor, resources or saved-receipt disclosure. Neutral acknowledgement adds no secret-price/source log or new inspection entitlement. This is an application privacy protocol, not publisher-prescribed timing.
+
+The fresh `guild-betrayal` profile is classic Basic/Advanced with native Guild, physical base decks and Nexus, optionally with genuinely seeded Homeworlds. Wider overlays and in-play retrofit are excluded. Typed producer/invoice ownership and independent pending/completed cursor evidence preserve authenticated restart and reject stale, foreign, malformed or orphaned continuations without a repeat payment, donor debit, force move or card spend. The dedicated internal `nexus-guild-betrayal` guide now records bounded local verification: 147 selected cases, 6,114 offline checks, build, actual backed-up CLI/phone actions and exact saved custody. Local HTTP 48/55 retains five 503s and two timeouts. Broad faction/module/full-game, calibrated AI, public-start and live-release gates remain closed; container publication and live deployment require separate current-revision evidence.
+
+This profile admits original native shipment producers, not Guild Cunning's second shipment or Richese Secret Ally's discounted shipment: both offers are blocked before Nexus spending or a native parent is committed, while those effects outside this profile remain unchanged. Guild Secret Ally is unavailable under the existing native-Guild-seated mode test; no new printed-effect restriction is inferred.