Merge nucleic/zesty-river-wren into dev

NucleicRemote/NucleicRemote/Models/HostConnection.swift

@@ -640,6 +640,12 @@ final class HostConnection {
         case .macPairResolved(let deviceID, _):
             // Answered on this Mac or another device (or timed out) — dismiss the prompt.
             callbacks.macPairResolved(deviceID)
+        case .intelligenceRequest, .credentialNeeded, .credentialUpdate:
+            // Antimatter runner verbs (docs/ANTIMATTER_RUNNER.md §5–6): a runner host delegating
+            // intelligence work or asking for / mirroring sealed credentials. Inert here until the
+            // phone-side executor/vault land — and a host only sends these to clients that
+            // advertised the matching `WireClientCapabilities`, which this app doesn't yet.
+            break
         case .wireError(let error):
             if error.code == .channelMismatch {
                 connectivity = .failed(error.message)

NucleicRemote/NucleicRemote/Models/RemoteStore.swift

@@ -1672,10 +1672,13 @@ final class RemoteStore: ObservableObject {
         // Never originated from here (connection-internal, or handled by dedicated loops).
         // `requestPairingCode`/`cancelPairingCode` are sent straight to the chosen host by
         // `requestPairingCode()`/`cancelPairingCode()`, not through this owner-routing switch.
+        // The runner verbs (intelligence results, credential mesh — ANTIMATTER_RUNNER §5–6) will
+        // ride their own executor/vault loops when the phone side lands; nothing routes them here.
         case .hello, .ping, .listPeers, .addressUpdate, .meshRoster,
              .registerLiveActivity, .endLiveActivity, .registerPushToStartToken, .setForeground,
              .transferOffer, .transferChunk, .transferCommit, .transferCancel, .fetchTranscript,
-             .requestPairingCode, .cancelPairingCode, .respondMacPair:
+             .requestPairingCode, .cancelPairingCode, .respondMacPair,
+             .intelligenceResult, .credentialManifest, .credentialProvision:
             break
         }
     }
@@ -1862,7 +1865,9 @@ final class RemoteStore: ObservableObject {
              .transferOffer, .transferChunk, .transferCommit, .transferCancel,
              // "Add a device" mint is handled directly against a live host, not via demoHandle;
              // the demo path short-circuits in `requestPairingCode()` with a stand-in code.
-             .requestPairingCode, .cancelPairingCode, .respondMacPair:
+             .requestPairingCode, .cancelPairingCode, .respondMacPair,
+             // Antimatter runner verbs (ANTIMATTER_RUNNER §5–6) — demo has no runner host.
+             .intelligenceResult, .credentialManifest, .credentialProvision:
             break  // passive / already handled by the seeded fixtures (demo has no mesh peers)
         }
     }