Dune/docs/NEXUS_ATREIDES_RUNTIME.md

Atreides Nexus inspection checkpoint

10 September 2026. This extends the Nexus lifecycle with Cunning and Secret Ally battle inspections. It is a partial effect-family checkpoint: Betrayal response timing, one Residual Poison interaction, the other eleven card families, and complete module games remain unfinished. Public Nexus and other incomplete mode starts remain gated. Source audit and unresolved rulings distinguish publisher text from composed interactions.

Rules and state

• Native Prescience remains its original first observation. Cunning is a separate second, distinct field, requested by the actual Atreides combatant after the native answer and before its own plan is sealed. Zero and no-card answers count as completed observations.
• Secret Ally requires Atreides absent from the genuine initialized roster. The actual holder must be a combatant; it receives one requested opposing field. An already sealed target supplies that field automatically without another acknowledgement or disclosure of the rest of its plan.
• Cunning creates a separately bound ordinary Karama response. Cancellation spends only the accepted responder's physical card, cancels the extra attempt, and preserves the first binding answer. Secret Ally creates no fictitious native Atreides cancellation target.
• No-Field's named-faction restriction blocks native Atreides and Cunning dial inspection. A non-Atreides Secret Ally holder can inspect the dial without receiving the hidden token value or full plan. The regression uses actual initialized Richese markers.
• battle-inspections.ts keeps the battle event, mode, source/target, field, original Cunning disclosure and append-only Nexus answer history. Current binding values are derived separately from historical observations. A consistency signature detects changed or omitted record fields; it is not authentication against an attacker able to fabricate an entire saved state.
• Actual effect play discards the one physical Atreides card. The engine validates the current event, holder, mode, timing and exact action keys before mutation. A second declaration or response cannot reuse the consumed card or completed attempt.
• All active inspections constrain authoritative plan validation and legal-completion search. Card transfer, ambassador disposal, CHOAM cash-in and Karama spending reserve both committed cards. The UI fixes every committed field in its editor, preview and submitted action. Bots use those same projected obligations and only authorized opposing observations.

Residual Poison and remaining boundaries

Any answered leader inspection blocks Residual Poison. When a single nonleader inspection becomes impossible after a legal leader death, the same field reopens. Nexus history retains the former private observation and marks it inactive; the replacement answer appends without inventing a new inspection or spending another card. A surviving leader, Cheap Hero or reachable Ghola preparation can keep the original answer feasible. Inspection feasibility is checked before Truthtrance reconciliation so an obsolete weapon requirement cannot by itself release a still-feasible Truthtrance answer.

Residual Poison after two completed Cunning inspections is guarded using public battle state, independent of opponent hands or spice. Two old choices can each remain feasible separately while becoming impossible together. No inspected official source selects which obligation should survive; the user ruling is pending. This is an explicit temporary limitation, not a house priority or complete interaction claim.

Betrayal remains unavailable pending the private response timing decision. Existing automatic advancement would otherwise skip an opportunity held only in a secret Nexus hand; selectively waiting for the matching card would leak availability. Its printed reference and pure canceled-attempt record are present, but no enabled play or timing-completeness claim is made. Cunning after a canceled first native inspection also remains guarded pending its source interpretation.

Private views and recovery

The public record identifies an already played effect, its owner, target, selected field and stage. Only owner and target receive answer values/history; outsiders receive neither. The unplayed card and legal offer belong only to its holder. Labels include ordinary/foreign leaders and Duke Vidal. An opponent's unseen hand and unrequested plan fields are absent from consumer inputs.

Three production-room/SQLite regressions exercise real authentication, SQL and version fencing against disposable databases. Competing field requests commit one disclosure attempt; a lost answer response restores both fixed elements; concurrent Karamas charge one accepted responder. Stale, duplicate and corrupted requests do not write. Reloaded room modules recover identical private seat views. The automatic scheduler leaves ordinary owned decisions alone; authenticated reads and actions still validate their records.

Verification

• 44 new cases: 10 pure inspection, 13 actual-engine, 8 control/render, 5 bot/CHOAM reservation, 3 production SQLite recovery, 4 independent integrity regressions and 1 public Residual guard. Controls cover all four fixed fields and actual table rendering. Engine fixtures choose final faction identities before component setup; conserved battle/card acquisition seams are explicitly documented in the fixtures.
• Types, lint and 3,839/3,839 offline tests passed with no skipped or canceled cases. The production build and 40/40 HTTP/session cases passed. The final offline suite took 95.7 seconds, with no skips or cancellations. Logs: /tmp/dune-atreides-final-check.log, /tmp/dune-atreides-final-build.log and /tmp/dune-atreides-final-http.log.
• Independent recovery review reproduced a deleted Cunning response, an altered native first value and a sealed plan contradicting its inspected answer. The final receipt distinguishes pending response from allowed answer, signs the current native binding separately from its original snapshot, checks active/nested response identity and compares both sealed plans to every live inspection. Four direct regressions reject damaged state before every-seat projection, normalization or action; final independent review found no additional concrete defects. Legitimate native reanswers after canceled/pending Cunning remain covered.
• Three-seat browser: isolated room DFRSD7CM used a genuine setup and conserved battle/card boundary. Atreides played Cunning with the keyboard, Harkonnen answered with Crysknife, and the editor fixed both weapon and native dial zero while leaving leader and defense editable. Harkonnen selected a leader and Shield and sealed; version 7 retains those two obligations and hides the unrequested defense and complete plan from the other seats. All three seats restored after refresh. Desktop and 390-pixel phone views had no page errors or overflow; screenshots of card controls, answer, history and fixed fields were visually inspected. An exact-label browser test exposed option text inside the wrapping answer label; the label now explicitly names only its control.
• During development this isolated room's unpublished receipt format gained signed response/native progress. Its original version-4 state was backed up; the version-5 upgrade preserved the already spent card, selected field, original first answer and unanswered target. It did not replay the effect, reroll or alter any other room.
• Preservation: the controlled hourly restart backed up all 3,234 preexisting rooms and restored three private Nexus seats. After browser work and two HTTP runs, all original versions and SHA-256 state hashes remain identical. There are 3,295 rooms: the original baseline, one isolated inspection room and 60 HTTP test rooms. Read-only final restoration also passed for Nexus 43U78HGQ v4 and Tupile ZMA84DY8 v7. The server remains running; no saved game was reset and the removed automation remains removed.
• No complete-game or AI strength claim follows from these focused inspection checks.