Implement Atreides Nexus inspections with durable battle commitments

docs/COMPONENT_INVENTORY.md

@@ -1,6 +1,6 @@
 # Component inventory and verification ledger
 
-**Nexus update, 10 September 2026:** all twelve physical Nexus identities and all thirty-six effect panels are verified against the original printed components. The separate inventory preserves one card per faction, independent of the selected roster; held cards remain private. The internal rules gallery and owner panel provide complete original-language effect text, existing bundled faction artwork and enlarged inspection. Common draws, replacement, preselected own-faction redraw, alliance forfeiture and saved phase progress are integrated. Individual effects and complete module games remain unfinished and gated. See [NEXUS_CARD_RULES.md](NEXUS_CARD_RULES.md) and [NEXUS_CARD_RUNTIME.md](NEXUS_CARD_RUNTIME.md) for current verification and limits.
+**Nexus update, 10 September 2026:** all twelve physical Nexus identities and all thirty-six effect panels are verified against the original printed components. The separate inventory preserves one card per faction, independent of the selected roster; held cards remain private. The internal rules gallery and owner panel provide complete original-language effect text, existing bundled faction artwork and enlarged inspection. Common draws, replacement, preselected own-faction redraw, alliance forfeiture and saved phase progress are integrated. Atreides Cunning and Secret Ally now have inspected battle controls and private history; Betrayal and the other effect families and complete module games remain unfinished and gated. See [NEXUS_ATREIDES_RUNTIME.md](NEXUS_ATREIDES_RUNTIME.md), [NEXUS_CARD_RULES.md](NEXUS_CARD_RULES.md) and [NEXUS_CARD_RUNTIME.md](NEXUS_CARD_RUNTIME.md) for current verification and limits.
 
 **Homeworld update, 9 September 2026:** all 13 cards and 26 physical faces are verified, including native population/battle values and occupied income symbols. The internal gallery supplies both faces, complete original gameplay prose, enlarged inspection and thirteen original bundled illustrations. Separate typed custody and population helpers are tested; actual Homeworld gameplay, occupation and effect integration remain unfinished and gated. See [HOMEWORLD_IMPLEMENTATION.md](HOMEWORLD_IMPLEMENTATION.md) and [HOMEWORLD_COMPONENT_AUDIT.md](HOMEWORLD_COMPONENT_AUDIT.md). Earlier missing-Homeworld statements below are historical.
 

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Atreides Nexus inspection checkpoint, 10 September 2026:** [NEXUS_ATREIDES_RUNTIME.md](NEXUS_ATREIDES_RUNTIME.md) records Cunning's distinct second commitment and absent-faction Secret Ally, physical card disposal, No-Field distinctions, private history, all four editor locks and bot handling. Independent review fixed lost-response bypass, first-answer drift and a sealed plan contradicting its signed observation; legitimate Residual reanswers preserve the first historical disclosure. **Types, lint, all 3,839 offline tests, production build and 40 HTTP/session tests pass.** Forty-four new cases include concurrent SQLite recovery and four independent corruption regressions. Three-seat keyboard play, answer, protected plan submission and desktop/phone refresh passed. All **3,234** preexisting room versions/hashes survived the scheduled backup/restart and final comparison. Betrayal response timing, Residual after two answered Cunning fields, other card families and complete module games remain explicitly unfinished; no release gate opened. Automation stays removed; verified checkpoints are authorized for push without another confirmation.
+
 **Nexus ownership and complete component reference checkpoint, 10 September 2026:** [NEXUS_CARD_RUNTIME.md](NEXUS_CARD_RUNTIME.md) records the twelve-card physical deck, whole-phase Basic/Advanced draw opportunity, private replacement policy, all three alliance-forfeiture paths and complete inspectable 36-panel reference. Review fixed real Storm-entry initialization, edited progress/replay acceptance, one-way alliances and the private redraw prompt's public timing leak. Pre-draw preferences resolve without extra confirmations. **Types, lint, all 3,795 offline tests, production build and 40 HTTP/session tests pass.** Three-seat keyboard draw/redraw/refresh and all twelve normal/enlarged desktop/phone cards passed; independent review inspected 48 renders. All **3,173** preexisting room versions/hashes remain unchanged. All individual Nexus effects, Discoveries and complete expansion games remain unfinished; no release gate opened. Existing server reused, no restart due, no automation recreated.
 
 **Tupile private intelligence and occupation evidence checkpoint, 10 September 2026:** [HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md](HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md) records current low-population contact checks, one historical spice/category answer per opposing faction, private controls and shared legal bot requests. Genuine setup binds qualification history and lifetime usage; legacy history stays unknown. Ordered battle observations retain brief sole occupation while simultaneous destruction does not invent it. Deterministic source identities make direct actions and restored continuations agree. **3,755 offline tests, types, lint, production build and 40 HTTP/session tests pass.** Three-seat desktop/mobile keyboard shipment, private disclosure, later balance change and refresh passed. The hourly restart and final comparison preserved all 3,112 preexisting room versions/hashes. Occupation entitlement/expiry/income, complete module games and the full expansion goal remain unfinished; no release gate opened. The removed automation stays removed.

docs/NEXUS_ATREIDES_RULES.md

@@ -0,0 +1,111 @@
+# Atreides Nexus: inspection and cancellation
+
+Primary-source audit, 10 September 2026. This is a rule contract and an explicit record of unresolved interactions, not a runtime or expansion-completion claim. The [common Nexus contract](NEXUS_CARD_RULES.md) supplies physical custody, mode selection and alliance disposal.
+
+## Authority
+
+- [GF9 Ecaz & Moritani rulebook, pp.11 and 16](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf#page=11): the illustrated Atreides face, common mode definitions, special battle-card exclusions and Nexus FAQ. Fresh publisher-indexed text was inspected, alongside the previously verified publisher-authored PDF mirror and [photograph of the printed cards](https://boardgamegeek.com/image/7767032/dune-ecaz-and-moritani).
+- [GF9 base rulebook, pp.17 and 23](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=17): native inspection, its alliance counterpart and Voice/Prescience/Truthtrance ordering. Fresh official-domain indexed page text was retrieved.
+- [GF9 November 2020 FAQ, pp.3, 7 and 8](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf#page=7): effective weapon/defense answers, single-use Karama cancellation, cancellation of alliance abilities and simultaneous Truthtrances. Fresh official-domain indexed page text was retrieved. Direct PDF requests returned HTML despite HTTP 200; those downloaded files were not treated as PDFs or evidence.
+- [GF9 CHOAM & Richese rulebook, p.6](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf#page=6): the exact No-Field restriction. Fresh official-domain indexed page text was retrieved.
+
+Tournament compilations surfaced in the search, including a longer battle sequence and broader post-Karama re-answer rules. Those are not adopted here as publisher rules. No newer designer clarification resolving the Nexus-specific cancellation questions below was retrieved.
+
+## Three printed effects
+
+| Mode | Native-faction condition | Effect and target |
+| --- | --- | --- |
+| Betrayal | Another seat is Atreides | Prevent its attempted battle-plan inspection. This is a reaction to the advantage being attempted. |
+| Cunning | Holder is Atreides | Inspect a second element of that holder's opponent's Battle Plan. |
+| Secret Ally | No Atreides seat | In the holder's battle, inspect one chosen opposing plan element: leader, weapon, defense or dial. |
+
+Each use consumes the held Nexus card. None of these panels creates a real alliance or grants all Atreides powers. The Cunning wording targets the holder's own opponent; it does not independently grant an extra inspection in an ally's battle. The common Betrayal definition acknowledges that some cards can cancel alliance advantages, but does not enumerate an Atreides alliance example.
+
+## Supported inspection composition
+
+**A completed ordinary answer supplies Cunning's first element.** The face calls for a second element and imposes no requirement to select it before hearing the first. Allowing the holder to choose a different element after the ordinary answer, before battle commitments close the opportunity, follows that wording. This is composition, not a printed worked sequence. An answer of no weapon or no defense is still an answered first element; the native rule forbids a free replacement question, while Cunning expressly purchases the additional element.
+
+**Keep inspection categories distinct from physical slots.** The November FAQ makes Weirding Way and Chemistry follow their role in the actual plan. E3 explicitly excludes Reinforcements and Harass & Withdraw from weapon/defense answers. Reuse the established role-aware answer and feasible-plan validation; do not reveal the entire plan, the player's hand, or an excluded special card merely because it occupies the requested slot.
+
+**Voice precedes inspection.** Base p.23 orders native Voice before native Prescience, allows Truthtrance during their interaction, and permits changes to unaffected plan elements. E3 p.16 expressly puts BG Secret Ally before Prescience. Applying the same ordering when the inspection comes from Atreides Secret Ally is consistent composition; the FAQ does not separately name that reversed native/card pairing. Do not let a later Voice evade an already disclosed element.
+
+**An attempted use needs a durable result.** Bind the requesting seat, opposing seat, battle, source mode and element. Cancellation must terminate that attempt without delivering its answer. Answer delivery must preserve its original value and corresponding commitment. Neither a read nor a retry creates another question. A later legal change requiring renewed disclosure is a continuation of the old commitment, not a new choice of element; the precise publisher basis for a blanket re-answer after every Karama was not established by this audit.
+
+## Cancellation: what is established and what remains open
+
+The November FAQ stops one use of a faction ability, using one battle's Voice as its example; it also permits cancellation of alliance abilities. Its Atreides entry blocks knowledge of one plan element. It does not cancel every inspection for the phase. This supports consuming the native opportunity when canceled rather than immediately offering the same ordinary request again. E3 Betrayal's instruction to prevent the attempted advantage supports the same outcome for its original attempt.
+
+There is no published permission in the inspected material to repeat the canceled ordinary request indefinitely in the same battle. Equally, this does not establish that every independent card-granted inspection in that battle is canceled. Keep sources separate instead of setting one blanket no-inspection flag.
+
+| Interaction | Evidence boundary |
+| --- | --- |
+| Native inspection canceled, then ordinary inspection redeclared in the same battle | Treat the original native use as spent; no retrieved rule grants a fresh ordinary use. |
+| Native inspection answered, then Cunning requests another element | Supported composition of the second-element wording; the second choice is distinct. |
+| Native inspection canceled by ordinary Karama, then Cunning played | Material unresolved case: does the enhanced advantage still supply one element after the first attempt failed, or require a first revealed element? No inspected FAQ answers this. A preceding Nexus Betrayal cannot create this sequence because it consumes the same unique card that native Atreides would need for Cunning, with no new draw during Battle. |
+| Karama used against a separately declared Cunning inspection | Selected composition: Cunning is explicitly an enhanced native advantage. Karama's one-use cancellation therefore targets the additional live attempt and preserves the already completed first answer. Do not combine both attempts into a new indivisible effect. No new ruling is needed for this sequential case. |
+| Karama used against Atreides Secret Ally | Selected composition: the card grants its effect to a non-Atreides seat with Atreides absent, so there is no native Atreides advantage owner for the ordinary cancellation target. Do not create that target. This follows source ownership; it is not a rule that all Nexus effects are immune to Karama. |
+| Atreides Betrayal used against Cunning | Unreachable with the one physical Atreides Nexus card: it cannot simultaneously be held by native Atreides for Cunning and another seat for Betrayal. Do not fabricate a second copy to test this interaction. |
+| Atreides Betrayal used against an allied native inspection | The cancellation panel names the Atreides battle advantage, and the common definition permits cancellation of some alliance advantages. Treating the ally's original native inspection as the named advantage is consistent composition; it does not turn Cunning into an ally effect. |
+| Multiple seats attempt Karama/Betrayal on the same inspection | No inspected primary rule specifies their relative priority. Only simultaneous Truthtrances explicitly use storm order. A general storm-order serializer is implementation composition, not a Nexus-specific publisher instruction. |
+
+Homeworld Karama immunity on E3 p.10 applies to Homeworld advantages and penalties. It supplies no Nexus immunity. Likewise, the separate protection of special faction Karama powers is not a general protection for Nexus cards.
+
+## No-Field is a named-faction restriction
+
+The exact publisher sentence is: “When you are in a Battle with a No-Field token, Atreides may not see your number dialed.” [CHOAM & Richese, p.6](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf#page=6)
+
+Native Atreides cannot evade this through Cunning. The sentence does not say every opponent, every inspection, or every Prescience effect. For Atreides Secret Ally, the later printed card explicitly offers the dial to a holder whose faction is not Atreides. Allowing that holder to request the dial is a defensible literal composition; no retrieved E3 rule expands the older named-faction prohibition. This distinction is not a claim that a card overrides every restriction. Keep the public No-Field token presence, exact hidden force availability and eventual reveal separate: seeing the number dialed does not reveal the token's denomination or the whole plan.
+
+## Private responses and automatic progression
+
+These are software requirements, not printed timing additions:
+
+- The original requested effect may be public; the unplayed identities and response options in other hands remain private. Cunning and Secret Ally are publicly identified only when the holder actually plays the card.
+- Validate a response against the exact still-live attempt before discarding either card or changing an answer. A second concurrent cancellation cannot spend another card against an already terminated attempt.
+- Show a pass/decline only when the seat has a meaningful choice. A private answer already fixed by the declared plan needs no acknowledgement. Preserve the user's requirement to advance automatically when there is no action.
+- Automatically removing seats without hidden responses while publishing the remaining waiting seats can disclose response availability. Hiding only card names does not prove timing privacy. Conversely, making every powerless seat acknowledge a window would violate the requested UX. The coordinator has asked the user about this privacy/progression tradeoff; the answer is pending. A private precommitted response policy could avoid a new hidden-hand-dependent pause, but must not invent or silently choose a player's optional card play.
+- Do not retroactively remove an answer already seen, infer hidden eligibility from opponent plans, or inspect other hands in a client/bot legality helper. Historical private observations and live legal commitments are separate data.
+
+The unresolved cases were reported to the coordinator before implementation decisions. This audit sent no user question and resolves none of the unrelated pending Homeworld rulings. Development may support verified common cases while retaining explicit guards, but must not label all three Atreides effects complete until their enabled cancellation and response combinations are decided and verified.
+
+## Residual Poison and two inspected commitments
+
+The following is a reasoned counterexample from the existing preparation rules,
+not a reported executed gameplay regression. In Advanced play, CHOAM has four
+ordinary forces in the battle, no spice, one living usable leader, a projectile,
+Ghola and a real Karama, and its cash-in power is unused. Suppose native
+Prescience fixed the dial at three and Cunning fixed the projectile. Before a
+leader death, both answers are reachable: cashing Ghola supplies three spice,
+enough to support the dial, while the living leader permits the projectile.
+
+If Residual Poison kills that last leader, each answer can remain feasible by
+itself. Keeping the projectile permits Ghola revival with a lower dial. Keeping
+the dial permits cash-in while omitting the weapon. Keeping both cannot spend
+the same Ghola both on revival and on funding, nor cash the committed projectile.
+There is therefore no generally valid assumption that an earlier answer, a later
+answer, or all individually feasible answers identify the uniquely correct
+surviving set. The retrieved publisher rules do not select between these sets.
+
+The coordinator has asked whether the affected player should choose the retained
+commitment, the earlier commitment should take priority, or this combination
+should await an official ruling. The answer is pending. No such priority is
+implemented by this document. Until resolved, the runtime uses an explicit
+development boundary: Residual Poison is unavailable after an answered Cunning
+inspection. This guard depends on the publicly played mode and completion stage,
+not the opponent's hidden cards, spice, or whether a private feasibility search
+happens to find a conflict. It is not a printed prohibition. The independent
+leader-commitment restriction still applies, and this boundary does not prohibit
+the single-element Secret Ally continuation.
+
+Any later implementation should test complete legal continuations with the
+proposed retired bindings removed on private copies. Testing one binding while
+another impossible binding remains can falsely release a valid dial. Likewise,
+reconciling Truthtrance before retiring an impossible inspection can wrongly
+release an otherwise feasible promise. Preserve historical disclosures and the
+consumed Nexus receipt separately from active bindings; a renewed answer is to
+the original field and does not consume another card. Multiple incomparable
+maximal surviving sets must not acquire an unexplained software tie-break.
+
+The focused [public-guard regression](../tests/nexus-residual-ambiguity.test.ts)
+covers the declared implementation boundary and hidden-state independence. It
+does not claim to execute or resolve the counterexample above.

docs/NEXUS_ATREIDES_RUNTIME.md

@@ -0,0 +1,37 @@
+# Atreides Nexus inspection checkpoint
+
+10 September 2026. This extends the [Nexus lifecycle](NEXUS_CARD_RUNTIME.md) with **Cunning and Secret Ally battle inspections**. It is a partial effect-family checkpoint: Betrayal response timing, one Residual Poison interaction, the other eleven card families, and complete module games remain unfinished. Public Nexus and other incomplete mode starts remain gated. [Source audit and unresolved rulings](NEXUS_ATREIDES_RULES.md) distinguish publisher text from composed interactions.
+
+## Rules and state
+
+- Native Prescience remains its original first observation. Cunning is a separate second, distinct field, requested by the actual Atreides combatant after the native answer and before its own plan is sealed. Zero and no-card answers count as completed observations.
+- Secret Ally requires Atreides absent from the genuine initialized roster. The actual holder must be a combatant; it receives one requested opposing field. An already sealed target supplies that field automatically without another acknowledgement or disclosure of the rest of its plan.
+- Cunning creates a separately bound ordinary Karama response. Cancellation spends only the accepted responder's physical card, cancels the extra attempt, and preserves the first binding answer. Secret Ally creates no fictitious native Atreides cancellation target.
+- No-Field's named-faction restriction blocks native Atreides and Cunning dial inspection. A non-Atreides Secret Ally holder can inspect the dial without receiving the hidden token value or full plan. The regression uses actual initialized Richese markers.
+- [battle-inspections.ts](../game/battle-inspections.ts) keeps the battle event, mode, source/target, field, original Cunning disclosure and append-only Nexus answer history. Current binding values are derived separately from historical observations. A consistency signature detects changed or omitted record fields; it is not authentication against an attacker able to fabricate an entire saved state.
+- Actual effect play discards the one physical Atreides card. The engine validates the current event, holder, mode, timing and exact action keys before mutation. A second declaration or response cannot reuse the consumed card or completed attempt.
+- All active inspections constrain authoritative plan validation and legal-completion search. Card transfer, ambassador disposal, CHOAM cash-in and Karama spending reserve both committed cards. The UI fixes every committed field in its editor, preview and submitted action. Bots use those same projected obligations and only authorized opposing observations.
+
+## Residual Poison and remaining boundaries
+
+Any answered leader inspection blocks Residual Poison. When a single nonleader inspection becomes impossible after a legal leader death, the same field reopens. Nexus history retains the former private observation and marks it inactive; the replacement answer appends without inventing a new inspection or spending another card. A surviving leader, Cheap Hero or reachable Ghola preparation can keep the original answer feasible. Inspection feasibility is checked before Truthtrance reconciliation so an obsolete weapon requirement cannot by itself release a still-feasible Truthtrance answer.
+
+Residual Poison after two completed Cunning inspections is guarded using public battle state, independent of opponent hands or spice. Two old choices can each remain feasible separately while becoming impossible together. No inspected official source selects which obligation should survive; the user ruling is pending. This is an explicit temporary limitation, not a house priority or complete interaction claim.
+
+Betrayal remains unavailable pending the private response timing decision. Existing automatic advancement would otherwise skip an opportunity held only in a secret Nexus hand; selectively waiting for the matching card would leak availability. Its printed reference and pure canceled-attempt record are present, but no enabled play or timing-completeness claim is made. Cunning after a canceled first native inspection also remains guarded pending its source interpretation.
+
+## Private views and recovery
+
+The public record identifies an already played effect, its owner, target, selected field and stage. Only owner and target receive answer values/history; outsiders receive neither. The unplayed card and legal offer belong only to its holder. Labels include ordinary/foreign leaders and Duke Vidal. An opponent's unseen hand and unrequested plan fields are absent from consumer inputs.
+
+Three production-room/SQLite regressions exercise real authentication, SQL and version fencing against disposable databases. Competing field requests commit one disclosure attempt; a lost answer response restores both fixed elements; concurrent Karamas charge one accepted responder. Stale, duplicate and corrupted requests do not write. Reloaded room modules recover identical private seat views. The automatic scheduler leaves ordinary owned decisions alone; authenticated reads and actions still validate their records.
+
+## Verification
+
+- **44 new cases:** 10 pure inspection, 13 actual-engine, 8 control/render, 5 bot/CHOAM reservation, 3 production SQLite recovery, 4 independent integrity regressions and 1 public Residual guard. Controls cover all four fixed fields and actual table rendering. Engine fixtures choose final faction identities before component setup; conserved battle/card acquisition seams are explicitly documented in the fixtures.
+- Types, lint and **3,839/3,839 offline tests** passed with no skipped or canceled cases. The production build and **40/40 HTTP/session cases** passed. The final offline suite took 95.7 seconds, with no skips or cancellations. Logs: `/tmp/dune-atreides-final-check.log`, `/tmp/dune-atreides-final-build.log` and `/tmp/dune-atreides-final-http.log`.
+- **Independent recovery review** reproduced a deleted Cunning response, an altered native first value and a sealed plan contradicting its inspected answer. The final receipt distinguishes pending response from allowed answer, signs the current native binding separately from its original snapshot, checks active/nested response identity and compares both sealed plans to every live inspection. Four direct regressions reject damaged state before every-seat projection, normalization or action; final independent review found no additional concrete defects. Legitimate native reanswers after canceled/pending Cunning remain covered.
+- **Three-seat browser:** isolated room `DFRSD7CM` used a genuine setup and conserved battle/card boundary. Atreides played Cunning with the keyboard, Harkonnen answered with Crysknife, and the editor fixed both weapon and native dial zero while leaving leader and defense editable. Harkonnen selected a leader and Shield and sealed; version 7 retains those two obligations and hides the unrequested defense and complete plan from the other seats. All three seats restored after refresh. Desktop and 390-pixel phone views had no page errors or overflow; screenshots of card controls, answer, history and fixed fields were visually inspected. An exact-label browser test exposed option text inside the wrapping answer label; the label now explicitly names only its control.
+- During development this isolated room's unpublished receipt format gained signed response/native progress. Its original version-4 state was backed up; the version-5 upgrade preserved the already spent card, selected field, original first answer and unanswered target. It did not replay the effect, reroll or alter any other room.
+- **Preservation:** the controlled hourly restart backed up all **3,234** preexisting rooms and restored three private Nexus seats. After browser work and two HTTP runs, all original versions and SHA-256 state hashes remain identical. There are 3,295 rooms: the original baseline, one isolated inspection room and 60 HTTP test rooms. Read-only final restoration also passed for Nexus `43U78HGQ` v4 and Tupile `ZMA84DY8` v7. The server remains running; no saved game was reset and the removed automation remains removed.
+- No complete-game or AI strength claim follows from these focused inspection checks.

docs/NEXUS_CARD_RUNTIME.md

@@ -1,5 +1,7 @@
 # Nexus cards: common lifecycle checkpoint
 
+**Historical foundation checkpoint.** Subsequent Atreides inspection integration is recorded in [Atreides runtime](NEXUS_ATREIDES_RUNTIME.md). The counts and effect limitations below describe the original lifecycle checkpoint.
+
 Integration record, 10 September 2026. **Types, lint, all 3,795 offline tests, the production build and 40 HTTP/session tests pass.** This checkpoint implements the optional Nexus card inventory and common draw/keep/replace lifecycle, plus a complete inspectable reference. It does **not** implement the thirty-six card effects, enable a complete public Nexus module, or certify Ecaz & Moritani or all expansions. Source facts, photographed component faces, and unresolved effect interactions are in [NEXUS_CARD_RULES.md](NEXUS_CARD_RULES.md).
 
 ## Implemented scope