Implement Guild Nexus Cunning second shipment and recovery

docs/NEXUS_GUILD_RULES.md

@@ -56,6 +56,8 @@ An implementation needs an original payment identity, exact charged contribution
 
 Preserve distinct settlement adapters: ordinary reserve shipment, `guildShip`, native Homeworld shipment, concealed No-Field and Junction-sponsored transport. [shipment-price.ts](../game/shipment-price.ts) already separates reserve prices, Guild transport tariffs, contribution bounds and Guild income. [guild-homeworld-shipment.ts](../game/guild-homeworld-shipment.ts) explicitly requires native Guild and should not be broadened indiscriminately for Secret Ally. [shipment-promises.ts](../game/shipment-promises.ts) also requires review: a second shipping action must not erase an earlier committed Truthtrance answer or reapply one shipment's promise to the wrong action.
 
-Suggested saved Cunning frame: original combined-turn event/owner/turn, the completed or declined original shipment and movement status, Hajr's remaining allowance, stage (`declaration`, `shipping`, `arrival`, `extraMove`, terminal outcome), and a bound second-shipment intent/receipt. Actual shipment custody and payment remain in their existing continuations. Do not clear a shipped flag as the sole source of the extra right, and do not use current hand membership as proof after spending the Nexus. Reconnect and uncertain responses must preserve one debit, one arrival and one consumed allowance.
+The pure [Cunning receipt module](../game/nexus-guild-cunning.ts) records the original combined-turn event, native Guild owner, turn, canonical faction roster, original shipment flag, original movement count and whether Hajr had been played. `createNexusGuildCunning` checks the unallied owner's active phase-five turn. `validateNexusGuildCunning` checks historical facts without reading current hands, resources, alliances or force custody. The engine owns the independently bound mutable lifecycle and second-shipment intent/receipt. Actual shipment custody and payment remain in their existing continuations. Do not clear a shipped flag as the sole source of the extra right, and do not use current hand membership as proof after spending the Nexus. Reconnect and uncertain responses must preserve one debit, one arrival and one consumed allowance.
 
-Verification should exercise first shipment followed by moved/declined ordinary movement, all three second-shipment forms, Hajr before/after and already consumed, cancellation of only the selected native advantage, paid BG/entry continuations, native Homeworld routes, private offers, stale requests and actual SQLite restoration. This audit performed source/link and bounded code review only; no runtime file or test was changed.
+`nexusGuildCunningMoves(receipt, currentHajrUsed, movesAfterSecond)` returns only the remaining Hajr extra allowance. Ending ordinary movement forgoes at least one ordinary slot, so original movement counts zero and one both permit at most one Hajr move; an original count of two permits none. A newly played Hajr supplies that same one extra slot, while losing a previously recorded Hajr or claiming more moves than that allowance rejects. This bounded helper excludes the separate physical Ornithopter-card composition; it does not reset or mutate the original movement counter. Its [pure tests](../tests/nexus-guild-cunning.test.ts) cover declined and used first actions, Hajr before and after, spent allowances, native ownership, exact signatures, JSON restoration and private-field getter traps.
+
+Integrated verification should exercise first shipment followed by moved/declined ordinary movement, all three second-shipment forms, Hajr before/after and already consumed, cancellation of only the selected native advantage, paid BG/entry continuations, native Homeworld routes, private offers, stale requests and actual SQLite restoration. Passing the pure receipt tests does not establish those engine or persistence behaviors.