Implement Guild Nexus Cunning second shipment and recovery

docs/COMPONENT_INVENTORY.md

@@ -1,5 +1,7 @@
 # Component inventory and verification ledger
 
+**Guild Nexus Cunning update, 10 September 2026:** the existing native card now offers an immediate second paid shipment after the original combined turn. No new forces, markers or cards are created; the normal physical reserve, cross/return and Homeworld controls retain their source counts and price. A separate skip choice and unused Hajr control preserve actual movement history. [NEXUS_GUILD_CUNNING_RUNTIME.md](NEXUS_GUILD_CUNNING_RUNTIME.md) records runtime, interruption and recovery evidence. Guild Secret Ally, Betrayal, physical Ornithopter combinations and full module acceptance remain unfinished.
+
 **Richese Nexus Secret Ally update, 10 September 2026:** the existing held card now has a shipment choice that moves up to five actual counters at the one-counter price. It creates no No-Field marker, changes no component identity and retains typed Homeworld reserves and native Ixian direct HMS entry. Controls distinguish physical forces from charged forces, with the original card inspector unchanged. [NEXUS_RICHESE_RUNTIME.md](NEXUS_RICHESE_RUNTIME.md) records scope, recovery and verification; native two-marker Cunning, Betrayal and complete module acceptance remain unfinished.
 
 **Moritani Nexus Cunning update, 10 September 2026:** existing supply tokens now have an explicit Cunning choice for placement on the ordinary Arrakis map, including existing stacks. The physical token inspector and hidden public map marker remain shared; no extra token or artwork is created. Separate current and historical placement evidence supports later entry, revelation and discard recovery without exposing faces. [NEXUS_MORITANI_RUNTIME.md](NEXUS_MORITANI_RUNTIME.md) records 27 new regressions and desktop/phone verification. Enhanced relocation, mobile-stronghold placement, Grumman combinations and complete faction/module acceptance remain unresolved.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Guild Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_GUILD_CUNNING_RUNTIME.md](NEXUS_GUILD_CUNNING_RUNTIME.md) records a second paid native Guild shipment within the original combined turn, followed only by unused Hajr movement. Original shipment/movement history, typed Homeworld sources, cross/return routes, interception and later entry effects retain their rules. Private controls and all four bot profiles share availability; new binding shipment promises recognize the extra opportunity. Native Karama and paid BG conversion preserve the original source, and countering conversion restores it. Independent review fixed a later Moritani alliance freezing the remaining Hajr continuation; transport validation also rejects a same-territory cross-shipment. **Final types, lint, all 4,136 offline tests, production build and 40 HTTP/session tests pass.** Thirty-seven new cases include genuine nested interruptions, pending-frame corruption and competing production SQLite requests. Two three-seat browser rooms passed second shipment/Hajr and cancellation, desktop/phone controls and six private refreshes. A raw internal event notice found visually was corrected and verified by final rendering tests; earlier pending screenshots precede that text correction. All **3,580** opening room versions/hashes remain unchanged, with two browser and thirty HTTP rooms added. Guild Secret Ally/Betrayal, the physical Ornithopter combination, remaining native cancellation/arrival gaps and complete module/mode acceptance remain gated. Existing server reused, no restart due; automation remains removed.
+
 **Richese Nexus Secret Ally checkpoint, 10 September 2026:** [NEXUS_RICHESE_RUNTIME.md](NEXUS_RICHESE_RUNTIME.md) records one-to-five actual reserve forces at the one-force price in the ordinary shipment pipeline. Native Guild/Fremen pricing, typed Homeworld reserves, native Ixian HMS entry, Guild prevention, BG accompaniment and real Terror entry retain their own rules. Private controls and all four bot levels share the quote; binding shipment promises recognize the affordable discounted source. Exact saved declarations and independent outcome markers protect pending and terminal history through corruption checks, competing SQL requests, Truthtrance and later turns. Review fixed the consumer's omitted native HMS destination. **Types, lint, all 4,099 offline tests, production build and 40 HTTP/session tests pass.** Thirty new cases and two three-seat browser rooms cover allowance/prevention, typed Emperor sources, desktop/phone controls and six private refreshes. The 02:48 UTC backed-up restart preserved all **3,548** opening games and restored twelve earlier private sessions. Final comparison leaves all opening versions/hashes unchanged, with two browser and thirty HTTP rooms added. Native Richese Cunning, Betrayal, foreign-Homeworld tariff integration and complete module/mode acceptance remain gated. The [Guild source audit](NEXUS_GUILD_RULES.md) prepares its distinct extra-shipment, borrowed-route and payment effects without claiming runtime completion. Automation remains removed.
 
 **Moritani Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_MORITANI_RUNTIME.md](NEXUS_MORITANI_RUNTIME.md) records Basic/Advanced supply placement throughout the printed Arrakis map, including existing Terror stacks. Shared controls and all four bot profiles use the private offer; ordinary relocation stays unchanged. Native Karama cancellation preserves the token and spends the opportunity/Nexus. Independent review fixed arrival-signature downgrade, stale former-location reuse and physical-face rebinding; current placement permission and historical entry evidence remain separate. **Types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests pass.** Twenty-seven new cases include real later shipments, Robbery/Sabotage/Sneak Attack, Truthtrance, prior Grumman outcomes and concurrent SQLite recovery. Two three-seat browser rooms passed phone placement, allowance/cancellation, map markers and all six private refreshes. All **3,516** opening room versions/hashes remain unchanged; two browser and thirty HTTP rooms were added. Relocation/HMS/Grumman interpretations, other unfinished Terror/Nexus effects and full module acceptance remain gated. The new [Ecaz source audit](NEXUS_ECAZ_RULES.md) records its leader-scope and disclosure boundaries. Existing server reused, no restart due; automation remains removed.

docs/NEXUS_CARD_RUNTIME.md

@@ -2,6 +2,8 @@
 
 The later [Richese Secret Ally checkpoint](NEXUS_RICHESE_RUNTIME.md) adds an ordinary physical reserve shipment priced as one force; its other effects and complete module acceptance remain gated.
 
+The later [Guild Cunning checkpoint](NEXUS_GUILD_CUNNING_RUNTIME.md) adds a separately recorded second shipment and remaining Hajr movement within the native Guild turn. Secret Ally, Betrayal and complete module acceptance remain unfinished.
+
 **Historical foundation checkpoint.** Subsequent Atreides inspection integration is recorded in [Atreides runtime](NEXUS_ATREIDES_RUNTIME.md). The counts and effect limitations below describe the original lifecycle checkpoint.
 
 Integration record, 10 September 2026. **Types, lint, all 3,795 offline tests, the production build and 40 HTTP/session tests pass.** This checkpoint implements the optional Nexus card inventory and common draw/keep/replace lifecycle, plus a complete inspectable reference. It does **not** implement the thirty-six card effects, enable a complete public Nexus module, or certify Ecaz & Moritani or all expansions. Source facts, photographed component faces, and unresolved effect interactions are in [NEXUS_CARD_RULES.md](NEXUS_CARD_RULES.md).

docs/NEXUS_GUILD_CUNNING_RUNTIME.md

@@ -0,0 +1,49 @@
+# Guild Nexus Cunning runtime
+
+This checkpoint follows the [Guild source contract](NEXUS_GUILD_RULES.md): native Guild can spend Cunning when finishing its ordinary Shipment and Movement turn to obtain one second shipment. It preserves one combined turn and the actual history of the first shipment and movement. It does not implement Guild Secret Ally, Betrayal or complete Nexus play.
+
+## Opportunity and controls
+
+The [shared consumer helper](../game/nexus-guild-cunning-options.ts) binds the private native holder, unallied card, current turn, actor and projected event. The [table](../components/game-table.tsx) offers an explicit “Finish ordinary turn and declare Guild Cunning” action alongside ordinary finishing. It spends the card and opens the existing Karama response mechanism. A cancellation ends the original turn without undoing its committed shipment or movement; allowance offers the separate shipment.
+
+The original player's `shipped` flag remains unchanged. Source-aware availability recognizes only the current signed second-shipment stage, and the existing [reserve](../game/homeworld-shipment-options.ts), [Guild Homeworld](../game/guild-homeworld-shipment-options.ts) and [cross-shipment](../game/transport-quote.ts) consumer quotes use that shared availability. They retain their physical source, price, typed-counter, storm and destination checks. The native cross-shipment validator and preview now also reject returning to the same territory, a pre-existing mismatch that bots already avoided. The extra shipment uses ordinary action fields; the engine associates them with the durable grant. No consumer clears flags or invents custody.
+
+The player can skip only the second shipment and retain the separate unused Hajr choice, or decline the shipment and finish the whole turn. Existing responses and decisions block a new shipment even while its original stage remains active for restoration. Opponents receive no private offer or actionable owner descriptor. Public entry, payment and cancellation controls preserve their existing information boundaries.
+
+## Saved state and authoritative settlement
+
+A signed original receipt records the native owner, turn, roster and first shipment/movement/Hajr status. A separate lifecycle record keeps the original combined-turn queue, stage, consumed extra movement, and exact second-shipment frame. The latest-outcome marker prevents partial deletion from reopening a used grant. These are consistency checks, not cryptographic authentication of arbitrary replacement saves.
+
+The original counters remain history. A shared server shipment-opportunity helper allows only the signed second-shipment stage; the normal reserve, cross/return and typed Homeworld adapters still perform custody, legality and payment. Pending reserve or Homeworld shipment binds its actual Guild interception decision. Completing or stopping that shipment reaches the Hajr step without restoring another shipping right. Declining only the second shipment records a distinct nonphysical outcome and preserves the original counters.
+
+Being unallied is required when declaring Cunning. An alliance legally formed by a later shipment-entry effect does not revoke the played card’s remaining continuation. A real Moritani placement, next-turn second shipment, saved alliance reply and subsequent Hajr movement verify that distinction.
+
+A completed lifecycle no longer pins later funds, forces, alliances or turn order. A live lifecycle retains the exact original owner and combined-turn queue, including Advanced out-of-order Guild timing. Printed Karama cancellation and paid BG Worthless conversion both preserve this source; countering the conversion restores the original Cunning response.
+
+Truthtrance questions and fulfillment searches recognize the second shipment as the current unused opportunity. A previously fulfilled first-shipment answer remains fulfilled. A new accepted answer binds the actual second shipment and cannot be evaded by skipping it or moving first. Private completion witnesses reach only the respondent and support all four bot profiles.
+
+## Hajr and bot policy
+
+No ordinary movement follows the extra shipment. Only an unused Hajr move is available, and a Hajr move already consumed cannot create a third move. The source's exception retains the same active Guild player through the optional extra move. Native city ornithopter range still applies normally; combining this with the separate physical Ornithopter Treachery Card remains unavailable.
+
+The server supplies `hajrAvailable` independently of the displayed movement ceiling. [Ordinary card availability](../game/card-availability.ts) uses this permission during the Cunning continuation, avoiding a false second Hajr offer when a derived ceiling happens to equal one. Controls disable movement during the second-shipment step and explain the remaining Hajr allowance afterward.
+
+All four [bot profiles](../game/bots.ts) keep their existing first-shipment and movement candidates, then consider declaring Cunning at the turn's end. They use the shared second-shipment availability and may play an owned Hajr only when the explicit extra-move permission allows it. This extends legal policy; it does not certify complete Guild strategy or calibration.
+
+## Verification
+
+Nine new cases in [controls](../tests/nexus-guild-cunning-controls.test.ts) and [bots](../tests/nexus-guild-cunning-bots.test.ts) use the [genuine setup and first-turn fixture](../tests/fixture-nexus-guild-cunning.ts). Coverage includes Basic/Advanced declaration, owner/stale/privacy fences, unchanged first-turn flags, second cross-shipment and Homeworld routes, no ordinary movement, Hajr availability and all four profiles. The deliberate card alias in one consumer-only Hajr check is labeled and is never submitted to the engine.
+
+Focused verification passed **9/9 new consumer cases**. Existing shipment-budget, promise, Homeworld-control, Nexus, reference and ordinary-card compatibility passed **60/60 cases**. Type-aware lint passed. The final focused run includes immutable same-territory transport rejection in ordinary and Cunning routes, a new second-shipment Truthtrance promise, and a pending-response rendering check that excludes the internal event ID. Additional coverage includes seven pure receipt/movement cases, eleven authoritative engine cases, eight production SQLite recovery cases and two genuine nested cancellation cases: 37 new cases in total. The engine and recovery cases include competing replies, exact pending shipment custody, independent terminal markers and a later Moritani alliance. Existing native rate/route cancellation gaps and unsupported arrival combinations remain explicit; this addition does not claim to resolve them.
+
+Final `npm run check` passed types, lint and **4,136/4,136 offline cases** with no skipped tests after the response-text correction. The final production build also passed. These subsystem results do not certify complete Guild, Nexus, expansion or rules-mode play.
+
+## Isolated browser acceptance
+
+Two fresh three-human-seat rooms used actual session IDs before genuine fixture initialization and exact state/version staging. No existing game was staged or reset. In SUVRJJFK, Advanced Guild with Homeworlds shipped five forces to Arrakeen, moved them to Hagga Basin, declared Cunning, and received an actual opponent allowance. During the second-shipment step, ordinary movement was disabled and both reserve and cross/return choices remained visible despite the original shipment already being used. The player cross-shipped five forces to Carthag for three spice, played its held Hajr, moved two to Arrakeen and finished at version 11. Fifteen reserves and fourteen spice remained; only two movements had occurred in total.
+
+In T3YXXLKB, the Guild completed the same original shipment and movement. An opponent used the actual Karama cancellation button on Cunning. Version 7 retained the five forces at Hagga Basin, fifteen reserves and seventeen spice, and advanced to the next player's turn without an extra shipment. The Nexus remained spent.
+
+Desktop 1440-pixel and phone 390-pixel captures were visually inspected, including second-shipment quotes, separate skip/finish buttons, Hajr and cancellation controls. Phone views had no horizontal overflow. All six private sessions refreshed with no page errors; opponent views omitted private hand, traitors and spice and all views omitted internal grant history. The read-only restoration script is `/tmp/dune-guild-cunning-restore.cjs`. Exact staging preserved 3,580 and 3,581 other rooms respectively; the final preservation audit confirmed all 3,580 original room hashes and versions unchanged.
+
+Visual inspection found that the generic response notice exposed its internal event text. The current component replaces that text with the meaning of allowance/cancellation. The final pending-state rendering regression passed after the correction; the earlier live pending screenshots precede that small text change. The completed HTTP/session suite passed all 40 cases and added thirty isolated rooms. A subsequent read-only audit preserved all 3,580 opening room versions and state hashes; the database contains 3,612 rooms, including the two new browser rooms. All six Guild QA seats restored again at versions 11 and 7 without errors. The existing development server was reused; no hourly restart was due and no recurring automation was created.

docs/NEXUS_GUILD_RULES.md

@@ -56,6 +56,8 @@ An implementation needs an original payment identity, exact charged contribution
 
 Preserve distinct settlement adapters: ordinary reserve shipment, `guildShip`, native Homeworld shipment, concealed No-Field and Junction-sponsored transport. [shipment-price.ts](../game/shipment-price.ts) already separates reserve prices, Guild transport tariffs, contribution bounds and Guild income. [guild-homeworld-shipment.ts](../game/guild-homeworld-shipment.ts) explicitly requires native Guild and should not be broadened indiscriminately for Secret Ally. [shipment-promises.ts](../game/shipment-promises.ts) also requires review: a second shipping action must not erase an earlier committed Truthtrance answer or reapply one shipment's promise to the wrong action.
 
-Suggested saved Cunning frame: original combined-turn event/owner/turn, the completed or declined original shipment and movement status, Hajr's remaining allowance, stage (`declaration`, `shipping`, `arrival`, `extraMove`, terminal outcome), and a bound second-shipment intent/receipt. Actual shipment custody and payment remain in their existing continuations. Do not clear a shipped flag as the sole source of the extra right, and do not use current hand membership as proof after spending the Nexus. Reconnect and uncertain responses must preserve one debit, one arrival and one consumed allowance.
+The pure [Cunning receipt module](../game/nexus-guild-cunning.ts) records the original combined-turn event, native Guild owner, turn, canonical faction roster, original shipment flag, original movement count and whether Hajr had been played. `createNexusGuildCunning` checks the unallied owner's active phase-five turn. `validateNexusGuildCunning` checks historical facts without reading current hands, resources, alliances or force custody. The engine owns the independently bound mutable lifecycle and second-shipment intent/receipt. Actual shipment custody and payment remain in their existing continuations. Do not clear a shipped flag as the sole source of the extra right, and do not use current hand membership as proof after spending the Nexus. Reconnect and uncertain responses must preserve one debit, one arrival and one consumed allowance.
 
-Verification should exercise first shipment followed by moved/declined ordinary movement, all three second-shipment forms, Hajr before/after and already consumed, cancellation of only the selected native advantage, paid BG/entry continuations, native Homeworld routes, private offers, stale requests and actual SQLite restoration. This audit performed source/link and bounded code review only; no runtime file or test was changed.
+`nexusGuildCunningMoves(receipt, currentHajrUsed, movesAfterSecond)` returns only the remaining Hajr extra allowance. Ending ordinary movement forgoes at least one ordinary slot, so original movement counts zero and one both permit at most one Hajr move; an original count of two permits none. A newly played Hajr supplies that same one extra slot, while losing a previously recorded Hajr or claiming more moves than that allowance rejects. This bounded helper excludes the separate physical Ornithopter-card composition; it does not reset or mutate the original movement counter. Its [pure tests](../tests/nexus-guild-cunning.test.ts) cover declined and used first actions, Hajr before and after, spent allowances, native ownership, exact signatures, JSON restoration and private-field getter traps.
+
+Integrated verification should exercise first shipment followed by moved/declined ordinary movement, all three second-shipment forms, Hajr before/after and already consumed, cancellation of only the selected native advantage, paid BG/entry continuations, native Homeworld routes, private offers, stale requests and actual SQLite restoration. Passing the pure receipt tests does not establish those engine or persistence behaviors.