Implement Moritani Nexus placement and preserve later Terror custody

docs/COMPONENT_INVENTORY.md

@@ -1,5 +1,7 @@
 # Component inventory and verification ledger
 
+**Moritani Nexus Cunning update, 10 September 2026:** existing supply tokens now have an explicit Cunning choice for placement on the ordinary Arrakis map, including existing stacks. The physical token inspector and hidden public map marker remain shared; no extra token or artwork is created. Separate current and historical placement evidence supports later entry, revelation and discard recovery without exposing faces. [NEXUS_MORITANI_RUNTIME.md](NEXUS_MORITANI_RUNTIME.md) records 27 new regressions and desktop/phone verification. Enhanced relocation, mobile-stronghold placement, Grumman combinations and complete faction/module acceptance remain unresolved.
+
 **CHOAM Nexus Cunning update, 10 September 2026:** the existing physical Nexus can fund one of five supported Worthless effects with an actual held Treachery Card of any category. Shared controls show the cost card separately from the selected effect and retain its full inspector; the engine preserves its canonical identity through allowance, cancellation and legitimate payment loss. No duplicate Worthless piece or artwork is created. The printed family has six effects: Kull Wahad remains unavailable. [NEXUS_CHOAM_RUNTIME.md](NEXUS_CHOAM_RUNTIME.md) records thirty new regressions, browser inspection and private recovery; complete CHOAM and module acceptance remain gated.
 
 **Emperor Nexus Cunning update, 10 September 2026:** five existing ordinary counters can temporarily count as Sardaukar for one Advanced battle after the native Karama response allows the declared enhancement. No starred piece is created or transferred; casualties remain ordinary counters. Shared strength/support limits drive the editor and bots, and public notices distinguish pending versus active roles. This uses existing Nexus and force components without new artwork. Five-counter eligibility, existing commitments and all other Emperor mode gates remain explicit. [NEXUS_SARDAUKAR_RUNTIME.md](NEXUS_SARDAUKAR_RUNTIME.md) records 35 new cases, browser inspection, private recovery and the full-project checks; complete module acceptance remains pending.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Moritani Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_MORITANI_RUNTIME.md](NEXUS_MORITANI_RUNTIME.md) records Basic/Advanced supply placement throughout the printed Arrakis map, including existing Terror stacks. Shared controls and all four bot profiles use the private offer; ordinary relocation stays unchanged. Native Karama cancellation preserves the token and spends the opportunity/Nexus. Independent review fixed arrival-signature downgrade, stale former-location reuse and physical-face rebinding; current placement permission and historical entry evidence remain separate. **Types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests pass.** Twenty-seven new cases include real later shipments, Robbery/Sabotage/Sneak Attack, Truthtrance, prior Grumman outcomes and concurrent SQLite recovery. Two three-seat browser rooms passed phone placement, allowance/cancellation, map markers and all six private refreshes. All **3,516** opening room versions/hashes remain unchanged; two browser and thirty HTTP rooms were added. Relocation/HMS/Grumman interpretations, other unfinished Terror/Nexus effects and full module acceptance remain gated. The new [Ecaz source audit](NEXUS_ECAZ_RULES.md) records its leader-scope and disclosure boundaries. Existing server reused, no restart due; automation remains removed.
+
 **CHOAM Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_CHOAM_RUNTIME.md](NEXUS_CHOAM_RUNTIME.md) records five native effects using one actual Treachery Card in Basic and Advanced. Shared controls inspect the real cost independently of the selected effect; all four bots use projected legality. Karama retains the cost and spent Nexus; actual intervening cash-in fizzles and resumes the original operation. Independent review fixed saved movement, revival and storm orders accepting valid-looking replacements. **Types, lint, all 4,042 offline tests, production build and 40 HTTP/session tests pass.** Thirty new cases include real paid Nullentropy, private views, physical disposal and concurrent SQLite outcomes. Two three-seat browser rooms passed phone declarations, allowance/cancellation and all six private refreshes. All **3,484** opening room versions/hashes remain unchanged; only two browser and thirty HTTP rooms were added. The printed family has six effects: Kull Wahad remains unavailable, as do unfinished Secret Ally/Betrayal and full module starts. Existing server reused, no restart due, automation remains removed.
 
 **Grumman stack cancellation checkpoint, 10 September 2026:** [GRUMMAN_PLACEMENT_CANCELLATION.md](GRUMMAN_PLACEMENT_CANCELLATION.md) records the reproduced failure of printed Karama against a native Mentat placement after a legal Collection stack. Cancellation now preserves the existing stack without requiring distinct occupied locations. Independent SQL review also fixed allowance accepting unrelated duplicate physical token IDs; both outcomes validate the same inventory. Existing denial semantics remain unchanged. **Types, lint, all 4,012 offline cases, production build and 40 HTTP/session cases pass.** Six new cases cover Basic/Advanced, low population, unchanged income, competing cancellation/allowance, private restoration and malformed records. Browser phone declaration, desktop/phone cancellation and three-seat refresh pass. The hourly restart preserved all **3,453** opening games and restored twelve earlier private seats; final comparison leaves those same versions/hashes unchanged, with one new browser room and thirty HTTP rooms added. New [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md) and [Fremen Nexus](NEXUS_FREMEN_RULES.md) audits record remaining source and privacy boundaries. No new Nexus effect or release gate was enabled; automation stays removed.

docs/NEXUS_ECAZ_RULES.md

@@ -0,0 +1,49 @@
+# Ecaz Nexus source contract
+
+Audited 10 September 2026. This is a source and integration audit, not an implementation or release claim. The immediate scope is Secret Ally; the other two printed effects remain separate. See [common Nexus rules](NEXUS_CARD_RULES.md).
+
+## Primary evidence
+
+The Ecaz panel was freshly inspected in the [photograph of the original GF9 components](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), cached at `/tmp/dune-nexus-cards.jpg`. Secret Ally selects one player and requires a yes/no disclosure of whether that player holds any of the user's leaders as Traitors. It expressly withholds which leaders. It has no printed phase, battle, location, payment, live-leader or opponent-only condition. The face does not specify that this answer is secret or addressed only to the user. Its Cunning takes Duke Vidal for a turn despite capture, Tanks or Ghola custody; Betrayal concerns Ecaz's ally returning co-located forces before Shipment and Movement. Those are not Secret Ally prerequisites.
+
+The [GF9 E3 rulebook, pp.11 and 16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11) provides common mode eligibility, consumption and the Nexus FAQ. Secret Ally requires Ecaz absent from the seated faction roster and does not create a real alliance. The holder cannot retain the card through joining an alliance. Use consumes the physical Nexus card. There is no Ecaz-specific FAQ answer. The cached publisher-authored text at `/tmp/dune-e3-nexus-rules.txt` was inspected; fresh official-domain indexed excerpts confirm the two Nexus FAQ entries. A [publisher-authored mirror](https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf) supplied the previously cached PDF.
+
+## Leader identity and custody
+
+**Certain:** Duke Vidal cannot make the answer positive. E3 expressly gives him no Traitor Card, despite changes of controller. Its Moritani FAQ permits an ordinary traitor call against a native Moritani leader captured by Harkonnen, so capture does not erase that leader's printed identity. [E3, pp.3, 8 and 14](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=14)
+
+**Certain:** a leader's death does not remove an already held Traitor Card or make that identity cease to be a traitor. Revival preserves it. The effect supplies no alive-only filter. The later FAQ also distinguishes Tleilaxu's native leaders from foreign Ghola leaders and permits foreign Gholas to return through the Tanks. [GF9 FAQ, April 2020 p.1](https://www.gf9games.com/dune/wp-content/uploads/2020/04/Dune-FAQ.pdf#page=1), [GF9 FAQ, November 2020 p.6](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=6)
+
+**Not authoritatively settled by the inspected sources:** whether this card's possessive means native faction identity, the current controlled leader pool, or native leaders plus acquired foreign leaders. The [E1 Ghola advantage, p.7](https://www.gf9.com/Portals/0/Documents/GF9/IxianAndTleilaxuRulebook.pdf#page=7) explicitly adds foreign leaders to the Tleilaxu leader pool. It does not redefine the Ecaz card, which was published later. It is therefore unsafe to label either a native-only or current-control interpretation an explicit GF9 ruling.
+
+The ordinary uncontested case is an owner's native faction leader identities, including dead leaders, against a target's actual held traitors. Canonical faction matching avoids accidental dependence on whether a captured disc remains in its original owner's array. For a full implementation, keep the ownership scope explicit and resolve the exceptional scope before claiming captive/Ghola coverage. Do not silently use only currently battle-available leaders: that adds an unsupported live/used-at constraint. A native-only choice would include native leaders currently captured elsewhere; a current-control choice would instead include held foreign captives/Gholas. Those can produce opposite answers.
+
+The ordinary Cheap Hero/Heroine Treachery Cards are not faction leader discs and share a separate physical traitor identity. They must not silently become part of every faction's native leader set. Advanced CHOAM's Auditor is a real native leader with its own component identity; use the initialized canonical inventory rather than a hard-coded count of five. These are component/model observations, not a retrieved Ecaz-specific ruling about a controlled-pool interpretation.
+
+## Face Dancers and targets
+
+E1 makes Tleilaxu's drawn identities Face Dancers instead of ordinary selected traitors. The E3 Harkonnen Secret Ally FAQ expressly preserves that classification when Tleilaxu obtains another such card. [GF9 E1, pp.6–7](https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf#page=6), [GF9 E3, p.16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=16)
+
+A literal **traitors-only composition** therefore reads the target's ordinary traitors and answers false for Tleilaxu; it does not disclose either revealed or unrevealed Face Dancers. This is a defensible composition of the distinct card roles, not an explicit Ecaz-versus-Tleilaxu FAQ. Do not merge `faceDancers` into `traitors` merely because they share the physical Traitor Deck. Extending the question to Face Dancers would reveal additional information and needs an explicit selected interpretation.
+
+The card does not restrict the target to a combat opponent, an unallied player, a faction with a matching traitor, or a faction whose cards are still secret. Target availability must not depend on the answer. An allied target remains a player; the user's own alliance status is constrained by common Nexus custody. The wording does not explicitly exclude selecting oneself, although it reveals no new information to the user. Do not claim a self-target exclusion comes from the face.
+
+## Disclosure and transaction timing
+
+The phrase on the face is a disclosure requirement without an explicit audience qualifier. **The inspected GF9 sources do not settle private-only versus table-wide disclosure.** Atreides' nearby Cunning explicitly describes showing its user a plan element; this Ecaz effect does not. Existing private inspection code is an implementation precedent, not evidence that this different effect has the same audience. Preserve only the yes/no fact under whichever audience is selected, never a count, identity, faction breakdown, concealed captive status, or whole target hand. Do not use a tournament's added “publicly announce” wording as if printed on the GF9 component.
+
+There is no prescribed separate answer delay. An atomic accepted play can spend Nexus and record the current answer without asking the target to confirm a server-known fact. That avoids an avoidable interval in which a hand exchange changes what is being answered. This is an implementation sequencing recommendation, not an extra printed phase restriction.
+
+Read the target's completed current hand. Finish an already pending Harkonnen draw/return or Face Dancer replacement before a new inquiry: those operations expose an augmented intermediate pool and already have game-wide action locks. A later legal exchange can change the target's hand but must not rewrite the historical answer. Neither declared traitor-call history nor discarded/replaced identities substitute for what the player currently has. The answer cannot retroactively change an earlier battle call.
+
+## Current integration map and proposed boundary
+
+- `game/leader-control.ts` separates original faction identity from `capturedBy`, `gholaBy` and temporary `controller`; `engine.ts` keeps native leader records in their original seat arrays. Its `controlledLeaders` helper is a different query from native faction identity.
+- `projectLeader` hides appropriate capture/Tanks details. A new offer must not enumerate actual hidden foreign captives or vary availability with their presence. Any exceptional-custody gate must follow public configuration, not a secret `capturedBy` test.
+- `game/nexus-traitor-exchange.ts` validates the exact global physical census and requires Tleilaxu's ordinary `traitors` array to be empty. Pending exchanges are locked through `pendingNexusTraitors`; completed history deliberately survives later custody changes.
+- `game/traitors.ts` maps real leader identities and the separate Cheap Hero identity for battle use. It does not answer who owns a leader for this effect.
+- `game/tupile-intelligence-state.ts` is the closest stored-observation precedent: retain a signed, dated answer and validate its intrinsic receipt without recomputing against future hidden hands. `game/battle-inspections.ts` concerns commitments to a plan and its answer/reopen history; Ecaz's past fact should not become an ongoing commitment.
+
+Implement the common, source-clear contract as a pure boolean intersection of **explicitly supplied queried leader IDs** with an ordinary held-traitor snapshot. Let the engine select the agreed leader scope and audience. Bind the accepted event, original seats/factions, turn/phase, chosen target, scope and boolean in a completed receipt; keep private source evidence server-side if retained. Discard the one real Ecaz Nexus card in the same accepted transaction. Validate current global custody separately from historical answers. Public offers can be built entirely from roster, timing/continuation state and the owner's card, without reading target secrets.
+
+Meaningful regressions should cover positive and negative answers with equal public hand sizes; dead/revived native leaders; native captive versus foreign captive/Ghola cases for the explicitly selected scope; Duke and Hero identities; Tleilaxu role separation; Harkonnen exchange before/after inquiry; stale/replayed/concurrent play; JSON/SQL historical persistence; and exact audience projection without counts or matching identities. Until scope and audience are selected, those unresolved branches must not be presented as fully source-verified behavior.

docs/NEXUS_MORITANI_RULES.md

@@ -0,0 +1,54 @@
+# Moritani Nexus: placement source audit
+
+Source audit, 10 September 2026. This establishes the supported Cunning contract and remaining combinations; it does not certify runtime support, all Terror effects, or the complete Nexus module. See [common Nexus rules](NEXUS_CARD_RULES.md) and [Grumman stacking rules](GRUMMAN_STACKED_TERROR_RULES.md). The coordinator’s combined interpretation question is recorded below.
+
+## Authority
+
+The Moritani face was inspected again in the [photograph of the twelve publisher-authored Nexus cards](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani), using the original local inspection image `/tmp/dune-nexus-cards.jpg`. Cunning is native Moritani only. It modifies a Terror placement to permit any Arrakis territory, expressly including a territory already containing Terror. It does not print a phase restriction, grant another placement, or say that the modification lasts for the turn.
+
+The [GF9 Ecaz & Moritani rulebook](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf), printed pp.5–6, 11, 14 and 16, supplies the native placement, entry, Nexus and cancellation rules. The inspected local PDF/text came from a [mirror of the publisher-authored rulebook](https://gamers-hq.de/media/pdf/0f/7a/86/Dune_EcazMoritani_Rulebook_EN.pdf), not a successful official-domain download. Page 5 distinguishes placing a supply token from moving a board token during Mentat. Ordinary destinations are empty strongholds, with an express Hidden Mobile Stronghold exception; storm is permitted. Opposing shipment/movement, including advisors, can trigger Terror. Page 11 describes Cunning as a native advantage enhancement and requires discarding a used Nexus card. Page 14 preserves Terror through storms/explosions and distinguishes new concealed No-Field entry from later revelation. Page 16 prohibits Homeworld placement and permits Karama to prevent Terror placement or movement.
+
+The [Grumman component photograph](https://boardgamegeek.com/image/7767034/dune-ecaz-and-moritani) supplies its separate high-population Collection addition/removal and four-spice award. Its wording and unresolved removal custody are recorded in the linked Grumman audit. Bounded fresh publisher/designer searches found no additional authenticated clarification of Cunning relocation, Hidden Mobile Stronghold placement, or Cunning combined with Grumman. Search results from community discussions were not adopted as rulings.
+
+## Resolved effect and ordinary composition
+
+1. **One earned placement.** A native unallied Moritani holder can spend this card when making an otherwise earned placement. Ordinary Mentat supply placement is a concrete supported source in Basic and Advanced. The selected physical token must actually be available; no removed or front-of-shield Extortion token becomes supply. Spending the card neither creates a seventh token nor creates another Mentat action.
+2. **Static Arrakis destination override.** Every printed Arrakis territory is within the positive destination grant, including deserts, rock, Polar Sink, occupied territories and an existing Terror stack. Do not add a force-occupancy requirement or a storm exclusion. A Terror token is not a force and placing it neither enters forces nor triggers existing Terror, Ambassadors or advisors. Homeworlds remain excluded. The separate mobile-territory question is below.
+3. **One committed native attempt.** Bind the chosen token and destination to the original placement opportunity, spend the Nexus card once, and use the ordinary Terrorize cancellation response. If canceled, no physical token moves and the attempted Mentat opportunity is consumed. This is composition of the native cancellation and used-Nexus rules, not an additional printed Nexus cancellation rule. It does not imply that every borrowed Secret Ally effect can be canceled as a native advantage.
+4. **Placement does not expire.** Nothing instructs removal of the placed token at phase or turn end. Subsequent loss of Grumman's high population, an alliance change, or another Nexus draw cannot undo the physical placement. Native current-population and ally restrictions still apply when a later entry is evaluated.
+5. **Future entries must work at the broadened location.** Reading native entry language literally as strongholds only would make the added non-stronghold destinations unable to Terrorize. Apply the ordinary entry opportunity to a Cunning-authorized token in its actual Arrakis territory. This is necessary effect composition, not a separate FAQ sentence. Preserve original arrival counts and causes, current low-Grumman checks, own/ally exclusions, No-Field privacy, and the existing effect-specific guards.
+6. **Stacks use the existing single-entry choice.** The owner chooses one physical candidate for a given entry; resolving it does not invent another entry for its neighbor. Refusal, Enemy of My Enemy cancellation, accepted alliance supply return, and card-discard children must retain that chosen identity. Other tokens remain where they were. See the Grumman audit for the distinction between singular-trigger composition and an explicit stacking FAQ.
+
+Ordinary later relocation can move a Cunning-placed token out to a native-legal destination. Its unusual original location does not change its placed custody status or grant an enlarged destination for the later move. Returning a token to hidden supply ends that placement's custody interval; redeployment requires its own authorization and the existing supply-ID rotation.
+
+## Material boundaries
+
+**Relocation is not expressly placement.** The native rule deliberately offers placing a token or moving one, whereas Cunning names placement. Treating the card as a blanket modifier on the current combined place/move UI would silently include a second source category. No inspected primary clarification establishes that extension. Preserve ordinary relocation; do not present enhanced relocation as a settled printed right.
+
+**Hidden Mobile Stronghold has a named native exception.** Cunning's broad Arrakis language could be read to replace that destination restriction, while the native exception could be read as surviving the generic grant. Unlike Homeworlds, it is not settled by the explicit Homeworld FAQ. The physical mobile stronghold is also a distinct territory from its pointed-to Arrakis sector. Static Arrakis support must not claim to resolve placement on the mobile stronghold itself or move a token with the mobile counter by accident.
+
+**Grumman is a separate earned placement source.** Cunning has no Mentat-only wording, so a reusable source contract should represent Collection addition as well. A high-Grumman addition from supply is naturally a placement. The unresolved interaction is its destination condition: does Cunning replace Grumman's requirement for a stronghold already containing Terror, allowing an empty territory, or does that requirement establish an eligible addition before Cunning modifies the destination? The former follows a broad destination override; the latter follows an underlying-opportunity prerequisite. No inspected source explicitly chooses between them. Do not silently gate all Grumman use by inventing a Mentat restriction, or describe either destination composition as a publisher ruling. An enhanced Collection integration also needs to preserve its own once-only outcome and four-spice transaction, separate from Mentat usage and its cancellation source.
+
+The coordinator has now asked one combined question about enhanced relocation, the mobile stronghold and Grumman; its answer is pending. The already pending question about unrevealed Grumman removal custody remains unchanged. Cunning places a token; it does not answer removal custody. Other incomplete Terror effects and combined reaction boundaries remain independent release limitations.
+
+## Smallest complete integration for the resolved source
+
+Implement a full ordinary Mentat supply-placement path over static Arrakis territories, with saved cancellation and all supported later entry effects. Keep the unresolved source/destination combinations explicit; a destination-only UI patch is insufficient.
+
+Use a separate Cunning placement quote and receipt instead of widening ordinary [placeTerror](../game/moritani-terror.ts). Suggested original evidence: version, event, owner, turn, phase, source kind and source event, physical token, original custody, destination, roster, and original Terror-state commitment. Keep pending/completed/canceled stage evidence outside mutable current token custody. A completed placement authorizes the corresponding non-stronghold custody interval; a historical receipt alone must not authorize arbitrary later relocation, a returned token's new ID, or another token.
+
+Current adapters requiring coordinated review:
+
+- [grumman-collection.ts](../game/grumman-collection.ts) validates every placed token against the five ordinary strongholds even when merely quoting unrelated Collection choices. That registry validation must accept independently authorized Cunning custody without widening Grumman's ordinary addition quote.
+- [terror-entry-receipt.ts](../game/terror-entry-receipt.ts) and [moritani-alliance-cancellation.ts](../game/moritani-alliance-cancellation.ts) restrict entry territories to those same five locations. Broaden intrinsic territory validity and separately prove the live token's authorized location. Preserve candidate and selected-token signatures through all children.
+- [placement-cancellation.ts](../game/placement-cancellation.ts) likewise restricts both registry locations and the pending destination. Its current denial quote intentionally does not require that a placement can still succeed: cancellation moves no token. Preserve original declared-source proof and canceled-custody semantics when adding the modifier; do not weaken them into a successful-placement replay.
+- [engine.ts](../game/engine.ts) already finds all placed tokens matching an entry destination in `openTerrorEntry`; the downstream validators and effect continuations must accept the same authorized territory. Its Mentat declaration and allowed/canceled settlement currently use the ordinary source only.
+- [Moritani controls](../components/moritani-terror.tsx), bots and placement previews need a shared modifier-aware option quote. Board markers already group by territory. Public views may show location and stack size, but only Moritani receives token faces, selectable physical supply identities or a held-card-dependent action offer.
+
+Required integration evidence includes genuine Basic/Advanced placement, cancel/allow with unchanged token custody on denial, non-stronghold stacked entry, current low-Grumman entry thresholds, accepted-alliance return, cross-turn ordinary relocation, JSON/SQLite recovery and every-seat privacy. Deterministic saved-state signatures detect inconsistent records; they are not cryptographic protection against coordinated rewriting of all state and proofs. This source audit makes no runtime or verification claim.
+
+## Pure implementation checkpoint
+
+[nexus-moritani.ts](../game/nexus-moritani.ts) now provides the initial Mentat-only historical receipt and immutable supply-placement quote. Its receipt fixes source `mentat` and phase 8; it does not represent a Grumman grant. The quote admits static Arrakis destinations and stacks, validates the six physical faces and custody zones, and leaves ordinary `placeTerror` unchanged. Current source ownership, phase, held Nexus card, authorization of prior non-stronghold custody and allowed/canceled progress remain engine responsibilities.
+
+The five focused cases in [nexus-moritani.test.ts](../tests/nexus-moritani.test.ts) cover every static destination, stacks and later ordinary relocation, physical-inventory rejection, historical privacy and altered proof rejection. `npm test -- nexus-moritani` and focused type-aware lint passed. Local links and whitespace were checked. Full checks and integrated runtime verification remain the coordinator's pending work; this pure-module evidence does not lift release gates.

docs/NEXUS_MORITANI_RUNTIME.md

@@ -0,0 +1,39 @@
+# Moritani Nexus Cunning runtime
+
+This checkpoint integrates Cunning with native Moritani's Mentat placement, in Basic and Advanced. Its bounded scope follows the [source audit](NEXUS_MORITANI_RULES.md): one **available supply token** may be placed in a territory on the printed Arrakis board, including one already containing Terror. Homeworlds and the Hidden Mobile Stronghold are excluded. Cunning relocation and its combination with Grumman Collection remain unavailable pending their separate interpretation.
+
+The existing Mentat opportunity remains the action window. Cunning does not create another native placement, trigger an existing occupant, move forces, or remove a sibling token from a stack. Playing the Nexus spends it and opens the placement's ordinary Karama response. Allowance places the selected physical token; cancellation keeps the token in its original custody and consumes the placement opportunity while leaving the Nexus spent. Ordinary placement and relocation retain their original stronghold rules and action shape.
+
+## Private choices and controls
+
+The engine projects `nexusMoritani` only to the native holder. It contains the current event, a blocking reason, eligible physical supply tokens and authorized territory IDs. The [shared options helper](../game/nexus-moritani-options.ts) checks the current owner, held unallied Nexus, native Mentat decision, event, interruptions and projected membership. Cunning actions add `nexus: event` to the existing placement decision; ordinary actions remain unchanged.
+
+The [Moritani placement panel](../components/moritani-terror.tsx) starts with ordinary placement selected. Its explicit “Use Moritani Nexus Cunning” checkbox changes the token list to available supply and the destination list to the projected Arrakis choices. The checkbox uses the existing accessible label spacing; controls respect transport-busy state and display server blocking reasons. The physical token names and existing token inspectors remain intact. No client code invents a token face from its opaque ID.
+
+Opponents do not receive the private offer or supply faces. Public placed tokens retain only their visible location and stack count. Existing [Terror board markers](../components/terror-board-markers.tsx) group tokens by territory, and existing stack-entry controls choose one original token before revelation or an alliance offer. Broad placement does not implement a previously unavailable Terror effect.
+
+## Bot policy and preserved boundaries
+
+All four profiles consume the same private offer. The shared policy uses public opposing force positions to choose a territory or stack unavailable to ordinary placement; otherwise the existing native placement policy remains in charge. It prefers a supported Terror face from the owner's authorized supply when available. This is a legal policy extension, not evidence of calibrated Moritani strategy.
+
+The engine binds the original placement, physical face and native opportunity in a saved receipt. A separate current-placement map ends when the token relocates, reveals or returns to supply; historical evidence remains available to the already committed entry and discard children. This preserves legitimate continuation across later turns and population changes without letting an old receipt authorize a new relocation. Consumers neither reconstruct that history nor broaden ordinary Grumman addition rules. The [Grumman stacking source](GRUMMAN_STACKED_TERROR_RULES.md) and its separate removal boundary remain unchanged.
+
+Atomics and Extortion reactions, restricted Assassination leader pools, and existing Sneak Attack arrival combinations retain their explicit gates. No complete Moritani, Nexus or expansion-release claim follows from this checkpoint.
+
+## Independent recovery review
+
+The review found and fixed two source-consistency flaws: deleting a new arrival signature could downgrade it to the legacy path, and an old placement record could justify editing a later relocated token back to its previous desert. New Cunning entries require their arrival signature, and current custody now requires its live placement record. Rebinding the saved token face also rejects against the original inventory. The ordinary cancellation and card-discard paths use the same territory proof.
+
+The fixture completes real Nexus-enabled setup and real turn boundaries before placement and later arrivals. An older internal-sector movement test formerly injected a desert token without authorization; it now earns that position through actual Cunning and next-turn progression, retaining the same no-new-entry assertion.
+
+## Verification
+
+Five new consumer cases are provided in [controls](../tests/nexus-moritani-controls.test.ts) and [bots](../tests/nexus-moritani-bots.test.ts), using the [genuine setup and Mentat fixture](../tests/fixture-nexus-moritani.ts). They cover Basic/Advanced source actions, expanded versus native choices, supply-only membership, explicit unchecked controls, existing inspectors, busy/blocked state, stale events, private-view fences, all four profiles and native fallback. The expanded selection is exercised through the shared options and actual engine declaration; interactive checkbox browser verification is separate.
+
+Focused verification passed **42/42 tests** across the new consumer suites, existing Moritani placement, Grumman controls, Nexus controls and reference checks. Type-aware lint passed for the changed consumer files.
+
+Final integrated checks pass: **types, lint, all 4,069 offline tests, production build and 40 HTTP/session tests**. Twenty-seven new cases cover the pure quote/receipt, consumers, engine, production SQLite and independent review. The SQL cases include actual non-stronghold shipment, reveal and Robbery choice, competing pass/cancellation, repeated requests and malformed records. Logs are `/tmp/dune-moritani-{check,build,http}.log`.
+
+Two isolated three-seat browser rooms passed phone checkbox/selection/declaration, desktop response, allowance/cancellation and all six private refreshes. Advanced/Homeworld room `S7ANWNXF` version 4 placed Robbery in Red Chasm and preserved the ordinary Arrakeen token. Basic room `2K8RJCG2` version 4 canceled the same attempted destination, retaining its supply token and spent Nexus. Both retained Moritani's original 20 spice; placement earned no extra Grumman income. Opponents received no supply face or private offer. No page errors or phone overflow were observed. The public Red Chasm marker was inspected on desktop and phone. `/tmp/dune-moritani-nexus-restore.cjs` performs read-only private restoration checks.
+
+The opening backup and final comparison preserve all **3,516** older room versions/state hashes. Only two browser and thirty HTTP-test rooms were added, for 3,548 total. The existing server was reused; no hourly restart was due. Automation remains removed. These checks do not certify the unresolved Cunning combinations or full Moritani/expansion acceptance.