Adventure: Pete learns the word "retreat"

gogobee has started filing a `retreat` bulletin — an expedition that ended with
the player walking out alive. Pete had no case for it, and handleAdventureIngest
answers an unrecognized event_type with 400.

That failure is silent and total. gogobee's sender treats any non-2xx as a
failure, retries eight times over roughly two hours, and then parks the row for
good. A gogobee emitting `retreat` at a Pete who doesn't know the word would not
log an error anyone reads — it would just quietly drop every retreat the realm
ever files.

So Pete has to learn it BEFORE gogobee starts saying it. Deploy order matters
here, and it is Pete first.

The copy leads with everyone coming home, because that is the true and the kind
part: a retreat is a bad day, not a funeral. Bulletin tier — it rides the daily
digest and does not interrupt the room. Announcing every failed run live would
be a firehose, and an unkind one.

https://claude.ai/code/session_01B2MwktU4RgfWkar8HM3zZn

internal/config/config.go

@@ -13,13 +13,44 @@ import (
 var envBracketRe = regexp.MustCompile(`\$\{([^}]+)\}`)
 
 type Config struct {
-	Matrix  MatrixConfig   `toml:"matrix"`
-	Posting PostingConfig  `toml:"posting"`
-	Storage StorageConfig  `toml:"storage"`
-	Web     WebConfig      `toml:"web"`
-	Sources []SourceConfig `toml:"sources"`
+	Matrix    MatrixConfig    `toml:"matrix"`
+	Posting   PostingConfig   `toml:"posting"`
+	Storage   StorageConfig   `toml:"storage"`
+	Web       WebConfig       `toml:"web"`
+	Adventure AdventureConfig `toml:"adventure"`
+	Sources   []SourceConfig  `toml:"sources"`
 }
 
+// AdventureConfig wires the gogobee adventure-news seam: gogobee POSTs
+// game-event facts to Pete's ingest endpoint, Pete templates them into stories
+// on the /adventure section and posts PRIORITY beats live to Matrix. Disabled by
+// default — the endpoint 404s and no adventure channel appears until enabled.
+type AdventureConfig struct {
+	Enabled bool `toml:"enabled"`
+	// IngestToken is the shared bearer secret gogobee presents on
+	// POST /api/ingest/adventure. Required when enabled. Use ${ENV_VAR}.
+	IngestToken string `toml:"ingest_token"`
+	// Channel is the Matrix channel name (a key in [matrix.channels]) that
+	// PRIORITY adventure beats post to live. If it isn't a configured Matrix
+	// channel, adventure runs website-only (stories still appear on /adventure).
+	Channel string `toml:"channel"`
+	// DigestHour is the UTC hour [0,23] the daily bulletin digest posts. Default
+	// 17. A pointer so digest_hour = 0 (midnight UTC) is distinguishable from
+	// "unset" and doesn't get silently rewritten to the default.
+	DigestHour *int `toml:"digest_hour"`
+}
+
+// DigestHourOrDefault is the UTC hour the daily digest posts, resolving the
+// unset case. Safe on a zero-value AdventureConfig.
+func (a AdventureConfig) DigestHourOrDefault() int {
+	if a.DigestHour == nil {
+		return defaultDigestHour
+	}
+	return *a.DigestHour
+}
+
+const defaultDigestHour = 17
+
 // WebConfig controls the read-only HTTP interface (news.parodia.dev style).
 type WebConfig struct {
 	Enabled    bool       `toml:"enabled"`
@@ -228,6 +259,21 @@ func (c *Config) validate() error {
 		}
 	}
 
+	if c.Adventure.Enabled {
+		if c.Adventure.IngestToken == "" {
+			return fmt.Errorf("adventure.ingest_token is required when adventure is enabled (the bearer secret gogobee presents)")
+		}
+		if h := c.Adventure.DigestHourOrDefault(); h < 0 || h > 23 {
+			return fmt.Errorf("adventure.digest_hour must be 0-23")
+		}
+		if c.Adventure.Channel != "" {
+			if _, ok := c.Matrix.Channels[c.Adventure.Channel]; !ok {
+				slog.Warn("adventure.channel is not a configured Matrix channel — adventure runs website-only",
+					"channel", c.Adventure.Channel)
+			}
+		}
+	}
+
 	for i, s := range c.Sources {
 		if s.Name == "" {
 			return fmt.Errorf("sources[%d].name is required", i)

internal/storage/queries.go

@@ -132,10 +132,10 @@ func MarkClassified(guid, channel, platforms string) {
 // GetStoryByGUID returns the full story record for a GUID, or nil if not found.
 func GetStoryByGUID(guid string) (*Story, error) {
 	row := Get().QueryRow(
-		`SELECT guid, headline, lede, image_url, article_url, source, platforms, channel, seen_at
+		`SELECT guid, headline, lede, COALESCE(content, ''), image_url, article_url, source, platforms, channel, seen_at
 		 FROM stories WHERE guid = ?`, guid)
 	var s Story
-	if err := row.Scan(&s.GUID, &s.Headline, &s.Lede, &s.ImageURL, &s.ArticleURL, &s.Source, &s.Platforms, &s.Channel, &s.SeenAt); err != nil {
+	if err := row.Scan(&s.GUID, &s.Headline, &s.Lede, &s.Content, &s.ImageURL, &s.ArticleURL, &s.Source, &s.Platforms, &s.Channel, &s.SeenAt); err != nil {
 		return nil, err
 	}
 	return &s, nil
@@ -252,6 +252,53 @@ func GetNewestPostableStoryByChannel(channel string) (*Story, error) {
 	return &s, nil
 }
 
+// UnpostedAdventureSince returns adventure dispatches seen at or after `since`
+// that have never been posted to Matrix (no post_log row). PRIORITY beats post
+// live and so carry a post_log row; the ones left are exactly the BULLETINs the
+// daily digest collects. Oldest first so the digest reads chronologically.
+//
+// At most `limit` rows come back, but total is how many match in all — the digest
+// quotes it to readers, so it must count the window rather than the returned page.
+func UnpostedAdventureSince(since int64, limit int) (stories []Story, total int, err error) {
+	const where = `WHERE classified = 1
+		   AND channel = 'adventure'
+		   AND seen_at >= ?
+		   AND guid NOT IN (SELECT guid FROM post_log)`
+
+	if err := Get().QueryRow(`SELECT COUNT(*) FROM stories `+where, since).Scan(&total); err != nil {
+		return nil, 0, err
+	}
+
+	rows, err := Get().Query(
+		`SELECT guid, headline, lede, article_url, seen_at
+		 FROM stories `+where+`
+		 ORDER BY seen_at ASC
+		 LIMIT ?`, since, limit)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+	var out []Story
+	for rows.Next() {
+		var s Story
+		if err := rows.Scan(&s.GUID, &s.Headline, &s.Lede, &s.ArticleURL, &s.SeenAt); err != nil {
+			return nil, 0, err
+		}
+		out = append(out, s)
+	}
+	return out, total, rows.Err()
+}
+
+// MarkAdventureDigested records each bulletin guid as posted (in a shared digest
+// event) so the next daily digest doesn't re-collect it. Idempotent per guid via
+// the post_log OR IGNORE. eventID is the digest's synthetic key (e.g.
+// "adv-digest:2026-07-11") shared by every story that went out in that digest.
+func MarkAdventureDigested(guids []string, eventID string) {
+	for _, g := range guids {
+		InsertPostLog(g, "adventure", eventID, "", false)
+	}
+}
+
 // ListClassifiedByChannel returns up to `limit` classified stories routed to a
 // real channel, newest first, with optional offset for pagination. Sentinel
 // channels (_discarded, _duplicate) are excluded.

internal/web/adventure.go

@@ -0,0 +1,417 @@
+package web
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// AdvFact is the game-event fact gogobee POSTs to Pete. It mirrors the contract
+// in pete_adventure_news_voice.md. Names are character names only (never Matrix
+// handles) and Actors is the allow-list of the only names permitted to appear in
+// rendered output.
+type AdvFact struct {
+	GUID       string   `json:"guid"`
+	EventType  string   `json:"event_type"`
+	Tier       string   `json:"tier"` // "priority" | "bulletin"
+	Actors     []string `json:"actors"`
+	Subject    string   `json:"subject"`
+	Opponent   string   `json:"opponent"`
+	Boss       string   `json:"boss"`
+	Zone       string   `json:"zone"`
+	Region     string   `json:"region"`
+	Level      int      `json:"level"`
+	Count      int      `json:"count"`
+	Outcome    string   `json:"outcome"`
+	Stakes     string   `json:"stakes"`
+	ClassRace  string   `json:"class_race"`
+	Milestone  string   `json:"milestone"`
+	OccurredAt int64    `json:"occurred_at"`
+	NoPush     bool     `json:"no_push"`
+}
+
+// AdvPost is a priority adventure item to post live to Matrix. Kept minimal and
+// web-local so the web package needs no dependency on internal/poster.
+type AdvPost struct {
+	GUID       string
+	Headline   string
+	Lede       string
+	ImageURL   string
+	ArticleURL string
+	Source     string
+	Channel    string
+}
+
+// PriorityPoster posts a priority adventure item to Matrix immediately. main
+// adapts *poster.Queue.PostNow to this; nil in web-only/local modes.
+type PriorityPoster func(AdvPost)
+
+const advSource = "Pete"
+
+// advBackfillEvent is the synthetic post_log event id used to retire a no_push
+// (cold-start backfill) dispatch against the daily digest. It never went to
+// Matrix; the row exists only so the digest skips it.
+const advBackfillEvent = "adv-backfill"
+
+// handleAdventureIngest receives a game-event fact from gogobee, templates it
+// into a deterministic story, publishes it to the /adventure section, and posts
+// PRIORITY beats live to Matrix. Bearer-authed; idempotent on the fact GUID.
+func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	if !s.bearerOK(r) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	var f AdvFact
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&f); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	if f.GUID == "" || f.EventType == "" {
+		http.Error(w, "guid and event_type are required", http.StatusBadRequest)
+		return
+	}
+	// Fact-guard: any player name we render must be in the actors allow-list.
+	// gogobee pre-sanitizes, but Pete never trusts the channel — this is the
+	// last line before a name reaches a public page.
+	if !factGuard(f) {
+		slog.Warn("adventure ingest: fact-guard rejected", "guid", f.GUID, "event_type", f.EventType)
+		http.Error(w, "fact-guard: subject/opponent not in actors", http.StatusBadRequest)
+		return
+	}
+
+	headline, lede, ok := renderAdventure(f)
+	if !ok {
+		http.Error(w, "unknown event_type", http.StatusBadRequest)
+		return
+	}
+
+	// Idempotent: a re-delivered fact (gogobee retry) is a no-op success.
+	if storage.IsGUIDSeen(f.GUID) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("duplicate"))
+		return
+	}
+
+	// A fact with no occurred_at would otherwise be stored at the Unix epoch:
+	// dated 1970 on the permalink, pinned to the bottom of the section, and
+	// outside every digest window. Treat "missing" as "now".
+	occurredAt := f.OccurredAt
+	if occurredAt <= 0 {
+		occurredAt = time.Now().Unix()
+	}
+
+	articleURL := s.advPermalink(f.GUID)
+	imageURL := advArtURL(f.EventType)
+	if err := storage.InsertStory(&storage.Story{
+		GUID:        f.GUID,
+		Headline:    headline,
+		Lede:        lede,
+		ImageURL:    imageURL,
+		ArticleURL:  articleURL,
+		Source:      advSource,
+		Channel:     "adventure",
+		Classified:  true,
+		SeenAt:      occurredAt,
+		PublishedAt: occurredAt,
+	}); err != nil {
+		slog.Error("adventure ingest: insert failed", "guid", f.GUID, "err", err)
+		http.Error(w, "insert failed", http.StatusInternalServerError)
+		return
+	}
+	slog.Info("adventure ingest: published", "guid", f.GUID, "event_type", f.EventType, "tier", f.Tier)
+
+	// NoPush (cold-start backfill) means "never goes to Matrix". Suppressing only
+	// the live post isn't enough: the digest collects adventure rows that carry no
+	// post_log entry, so a backfilled bulletin would still be swept into the next
+	// roundup — the back-catalogue dump NoPush exists to prevent. Retire the guid
+	// against the digest up front instead.
+	if f.NoPush {
+		storage.MarkAdventureDigested([]string{f.GUID}, advBackfillEvent)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+		return
+	}
+
+	// PRIORITY beats post live to Matrix; BULLETIN beats wait for the daily
+	// digest. Website section always gets the row above regardless of tier.
+	if f.Tier == "priority" && s.advPost != nil && s.adv.Channel != "" {
+		// No ImageURL: the emblem is an SVG (Matrix clients often block SVG
+		// media), and the link's og:image carries the preview instead.
+		s.advPost(AdvPost{
+			GUID:       f.GUID,
+			Headline:   headline,
+			Lede:       lede,
+			ArticleURL: articleURL,
+			Source:     advSource,
+			Channel:    s.adv.Channel,
+		})
+	}
+
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte("ok"))
+}
+
+// advEventMeta maps an event_type to a short display label and emoji used by the
+// permalink page (and, later, OG art selection). Unknown types fall back to a
+// neutral dispatch label so a new gogobee event never renders blank.
+func advEventMeta(eventType string) (label, emoji string) {
+	switch eventType {
+	case "siege_start", "siege_win", "siege_loss":
+		return "The Siege", "🏰"
+	case "boss_first", "boss_kill":
+		return "Boss down", "🐉"
+	case "zone_first":
+		return "First clear", "🗺️"
+	case "zone_clear":
+		return "Zone cleared", "🗺️"
+	case "death":
+		return "In memoriam", "🪦"
+	case "arrival":
+		return "New arrival", "👋"
+	case "standings", "rival_result":
+		return "The rival board", "⚔️"
+	case "pete_duel_loss", "pete_duel_win":
+		return "Pete's duels", "🤝"
+	case "milestone":
+		return "Milestone", "🏅"
+	case "retreat":
+		return "Pulled out", "🎒"
+	}
+	return "Dispatch", "📣"
+}
+
+// advArtURL is the card/OG image for a dispatch: a themed SVG emblem served by
+// handleAdventureArt, keyed on event_type. Local (root-relative) so it bypasses
+// the external-image thumbnailer.
+func advArtURL(eventType string) string {
+	return "/adventure/art/" + eventType + ".svg"
+}
+
+// handleAdventureArt renders the themed emblem for an event type — an adventure
+// gradient with the event's emoji and label. Deterministic and dependency-free
+// (no external asset), so every dispatch card has visual identity instead of the
+// blank placeholder that made the section look broken next to RSS cards.
+func (s *Server) handleAdventureArt(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	eventType := strings.TrimSuffix(r.PathValue("type"), ".svg")
+	label, emoji := advEventMeta(eventType)
+	w.Header().Set("Content-Type", "image/svg+xml; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=86400")
+	_, _ = fmt.Fprintf(w, advArtSVG, template.HTMLEscapeString(emoji), template.HTMLEscapeString(strings.ToUpper(label)))
+}
+
+// advArtSVG is the emblem template: %s = emoji, %s = label. 1200×630 (the OG
+// card ratio) so the same image works as a link-preview image.
+const advArtSVG = `<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
+  <defs>
+    <linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#7c5ce8"/>
+      <stop offset="1" stop-color="#5836b8"/>
+    </linearGradient>
+  </defs>
+  <rect width="1200" height="630" fill="url(#g)"/>
+  <text x="600" y="300" font-size="260" text-anchor="middle" dominant-baseline="central">%s</text>
+  <text x="600" y="500" font-size="64" font-family="Fredoka, Nunito, system-ui, sans-serif" font-weight="700" fill="#ffffff" text-anchor="middle" letter-spacing="6" opacity="0.92">%s</text>
+</svg>`
+
+// advStoryPage is the per-story permalink view. It reuses the shared layout so a
+// dispatch reads like the rest of the site, with an adventure-themed hero.
+type advStoryPage struct {
+	pageData
+	EventLabel string
+	Emoji      string
+	Headline   string
+	Body       string
+	Region     string
+	When       string
+	Permalink  string
+}
+
+// handleAdventureStory serves the server-rendered permalink for one dispatch
+// (the article_url every ingested story points at). Public and cacheable; 404s
+// when the section is disabled or the guid is unknown. Character names in the
+// stored headline/body already passed the ingest fact-guard, so nothing
+// player-controlled reaches here unchecked.
+func (s *Server) handleAdventureStory(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	guid := r.PathValue("guid")
+	st, err := storage.GetStoryByGUID(guid)
+	if err != nil || st == nil || st.Channel != "adventure" {
+		http.NotFound(w, r)
+		return
+	}
+	s.track(r, "adventure")
+
+	// event_type is encoded in the guid prefix (e.g. "death:<hash>:<ts>"); fall
+	// back to the neutral dispatch meta when it isn't a known type.
+	eventType, _, _ := strings.Cut(guid, ":")
+	label, emoji := advEventMeta(eventType)
+
+	body := st.Content
+	if strings.TrimSpace(body) == "" {
+		body = st.Lede // template-only dispatches carry the write-up in the lede
+	}
+
+	base := s.base(r)
+	base.Active = "adventure"
+	base.NoIndex = true // player-named page; keep out of search indexes (gap #5)
+	if abs := strings.TrimRight(s.cfg.BaseURL, "/"); abs != "" {
+		base.OGImage = abs + advArtURL(eventType) // emblem for link unfurls
+	}
+	s.render(w, "story", advStoryPage{
+		pageData:   base,
+		EventLabel: label,
+		Emoji:      emoji,
+		Headline:   st.Headline,
+		Body:       body,
+		Region:     "", // reserved: region isn't stored on the row yet
+		When:       time.Unix(st.SeenAt, 0).UTC().Format("Jan 2, 2006"),
+		Permalink:  s.advPermalink(guid),
+	})
+}
+
+// bearerOK checks the Authorization: Bearer header against the configured ingest
+// token in constant time.
+func (s *Server) bearerOK(r *http.Request) bool {
+	const prefix = "Bearer "
+	h := r.Header.Get("Authorization")
+	if !strings.HasPrefix(h, prefix) || s.adv.IngestToken == "" {
+		return false
+	}
+	got := strings.TrimPrefix(h, prefix)
+	return subtle.ConstantTimeCompare([]byte(got), []byte(s.adv.IngestToken)) == 1
+}
+
+// siteURL makes a root-relative path absolute against BaseURL. Links that go out
+// to Matrix need the absolute form to survive safeHref; when BaseURL isn't
+// configured the relative form is all we have, and it's still fine on-site.
+func (s *Server) siteURL(path string) string {
+	return strings.TrimRight(s.cfg.BaseURL, "/") + path
+}
+
+// advPermalink builds the per-story Pete permalink used as article_url (the card
+// link + Matrix link). The guid is path-escaped: it's ingest-supplied, and a
+// stray "/" or "?" would otherwise produce a link that routes somewhere else.
+func (s *Server) advPermalink(guid string) string {
+	return s.siteURL("/adventure/" + url.PathEscape(guid))
+}
+
+// factGuard verifies every player-name field we might render is present in the
+// actors allow-list. Boss/zone/region/milestone are game-authored content, not
+// player-controlled, so they are not guarded.
+func factGuard(f AdvFact) bool {
+	allow := make(map[string]bool, len(f.Actors))
+	for _, a := range f.Actors {
+		if a != "" {
+			allow[a] = true
+		}
+	}
+	if f.Subject != "" && !allow[f.Subject] {
+		return false
+	}
+	if f.Opponent != "" && !allow[f.Opponent] {
+		return false
+	}
+	return true
+}
+
+// renderAdventure returns the deterministic headline + lede for a fact. Copied
+// verbatim from the voice spec (pete_adventure_news_voice.md). Template-only —
+// no LLM — so output is safe and reproducible. ok is false for an unknown type.
+func renderAdventure(f AdvFact) (headline, lede string, ok bool) {
+	atLevel := ""
+	if f.Level > 0 {
+		atLevel = fmt.Sprintf(", at level %d", f.Level)
+	}
+	switch f.EventType {
+	case "siege_start":
+		return fmt.Sprintf("Breaking: %s is marching on the town.", f.Boss),
+			fmt.Sprintf("Folks, this is the big one — %s has camped outside the gates and the whole community's needed to turn it back. You've got %s. Let's rally.", f.Boss, f.Stakes), true
+	case "siege_win":
+		return fmt.Sprintf("The town holds! %s turned back.", f.Boss),
+			fmt.Sprintf("What a turnout — %d defenders stood shoulder to shoulder and sent %s packing. Spoils are going out now. Proud of you all.", f.Count, f.Boss), true
+	case "siege_loss":
+		return fmt.Sprintf("Heavy news: %s broke through.", f.Boss),
+			fmt.Sprintf("We gave it everything, but %s got past the gates and took its tribute. We'll be ready next time — heads up, everyone.", f.Boss), true
+	case "boss_first":
+		return fmt.Sprintf("First ever: %s brings down %s.", f.Subject, f.Boss),
+			fmt.Sprintf("History in %s today — %s is the first anyone's seen clear %s. Nobody had done it before. Hats off.", f.Region, f.Subject, f.Boss), true
+	case "boss_kill":
+		return fmt.Sprintf("%s takes down %s again.", f.Subject, f.Boss),
+			fmt.Sprintf("Another clean run in %s today. Routine for %s by now — but still worth a nod.", f.Zone, f.Subject), true
+	case "zone_first", "zone_clear":
+		// gogobee splits the realm's first-ever clear (zone_first, priority) from a
+		// later repeat (zone_clear, bulletin); they share a lede but differ in
+		// headline. Fall back to the tier for a legacy zone_first that predates the
+		// split.
+		if f.EventType == "zone_first" || f.Tier == "priority" {
+			headline = fmt.Sprintf("%s cleared for the very first time.", f.Zone)
+		} else {
+			headline = fmt.Sprintf("%s clears %s.", f.Subject, f.Zone)
+		}
+		inRegion := ""
+		if f.Region != "" {
+			inRegion = " in " + f.Region
+		}
+		return headline, fmt.Sprintf("%s made it through %s%s%s. Nicely done.", f.Subject, f.Zone, inRegion, atLevel), true
+	case "death":
+		return fmt.Sprintf("We lost %s in %s.", f.Subject, f.Zone),
+			fmt.Sprintf("Sad news to pass along: %s fell at level %d in %s. The graveyard's a little fuller tonight. Rest easy.", f.Subject, f.Level, f.Zone), true
+	case "retreat":
+		// An expedition that came apart without killing anyone. Until gogobee
+		// started sending these, the feed had no way to say "it went badly and
+		// everyone lived" — so it never said it, and the classes that retreat
+		// often simply never appeared. Warm, not a failure notice: everyone came
+		// home, and that is the part Pete leads with.
+		howFar := "barely a day in"
+		if f.Count > 1 {
+			howFar = fmt.Sprintf("%d days in", f.Count)
+		}
+		return fmt.Sprintf("%s backed out of %s.", f.Subject, f.Zone),
+			fmt.Sprintf("%s turned around %s — %s got the better of them this time%s, and they made the call to walk out rather than push it. Everybody came home breathing, which is the bit that counts. That dungeon'll still be there next week.",
+				f.Subject, howFar, f.Zone, atLevel), true
+	case "arrival":
+		return fmt.Sprintf("Welcome to the realm, %s!", f.Subject),
+			fmt.Sprintf("A new %s just walked through the gates. Say hello if you see them out there.", f.ClassRace), true
+	case "standings":
+		return "The rival board's been shaken up.",
+			fmt.Sprintf("%s is on the move — here's where the standings sit today.", f.Subject), true
+	case "rival_result":
+		return fmt.Sprintf("%s settles the score with %s.", f.Subject, f.Opponent),
+			fmt.Sprintf("Their duel went %s's way today, and the board reflects it. Good match, you two.", f.Subject), true
+	case "pete_duel_loss":
+		if f.Tier == "priority" {
+			headline = fmt.Sprintf("You got me, %s.", f.Subject)
+		} else {
+			headline = fmt.Sprintf("%s got the better of me again.", f.Subject)
+		}
+		return headline, fmt.Sprintf("Credit where it's due — %s beat me fair and square. Good duel. I'll want a rematch when you're ready.", f.Subject), true
+	case "pete_duel_win":
+		return fmt.Sprintf("Held my ground against %s today.", f.Subject),
+			fmt.Sprintf("Closer than the record will show, honestly — %s pushed me. Rematch whenever you like.", f.Subject), true
+	case "milestone":
+		return fmt.Sprintf("%s hits %s.", f.Subject, f.Milestone),
+			fmt.Sprintf("One for the books — %s just reached %s. The long road continues.", f.Subject, f.Milestone), true
+	}
+	return "", "", false
+}

internal/web/adventure_digest.go

@@ -0,0 +1,155 @@
+package web
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// The BULLETIN digest is the batched counterpart to the live PRIORITY beats.
+// Once a day (Adventure.DigestHour, UTC) Pete collects the adventure dispatches
+// that were seen since the last digest but never posted live — exactly the
+// bulletins — and posts a single warm roundup to the adventure channel. The
+// website already carries each one as its own card; the digest is the Matrix-only
+// nudge so quiet-but-real activity surfaces without one ping per event.
+
+const (
+	// digestWindow bounds how far back a digest looks. Wider than a day so a
+	// missed run (process down over a digest hour) still sweeps up the gap;
+	// re-collection is prevented by MarkAdventureDigested, not by the window.
+	digestWindow = 48 * time.Hour
+	// digestCap bounds a single digest. Far past the observed volume (a dormant
+	// community, per the voice spec); a runaway just truncates with a log line.
+	digestCap = 40
+	// digestPreview is how many headlines the roundup lede lists by name before
+	// collapsing the rest to "…and N more".
+	digestPreview = 4
+)
+
+// StartAdventureDigest launches the daily bulletin-digest loop. No-op unless the
+// section is enabled AND there's a live Matrix poster AND a channel to post to —
+// i.e. website-only and local modes never post a digest.
+func (s *Server) StartAdventureDigest(ctx context.Context) {
+	if !s.adv.Enabled || s.advPost == nil || s.adv.Channel == "" {
+		return
+	}
+	go s.runAdventureDigest(ctx)
+}
+
+// runAdventureDigest sleeps until the next DigestHour, posts, then repeats every
+// 24h. Sleeping to a wall-clock hour (not a fixed ticker from boot) keeps the
+// digest at a predictable time of day across restarts.
+func (s *Server) runAdventureDigest(ctx context.Context) {
+	hour := s.adv.DigestHourOrDefault()
+	slog.Info("web: adventure digest scheduler started", "digest_hour_utc", hour, "channel", s.adv.Channel)
+	for {
+		wait := durUntilNextHour(time.Now().UTC(), hour)
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(wait):
+			s.postDailyDigest(time.Now().UTC())
+		}
+	}
+}
+
+// durUntilNextHour returns the duration from now to the next occurrence of the
+// given UTC hour. If it's exactly the hour now, it targets tomorrow so a restart
+// at the hour doesn't double-fire.
+func durUntilNextHour(now time.Time, hour int) time.Duration {
+	next := time.Date(now.Year(), now.Month(), now.Day(), hour, 0, 0, 0, time.UTC)
+	if !next.After(now) {
+		next = next.Add(24 * time.Hour)
+	}
+	return next.Sub(now)
+}
+
+// postDailyDigest collects the window's un-posted bulletins, posts one roundup,
+// and marks them digested so they don't recur. Silent when there's nothing new —
+// a dormant realm should stay quiet, not ship an empty digest.
+func (s *Server) postDailyDigest(now time.Time) {
+	since := now.Add(-digestWindow).Unix()
+	bulletins, total, err := storage.UnpostedAdventureSince(since, digestCap)
+	if err != nil {
+		slog.Error("adventure digest: query failed", "err", err)
+		return
+	}
+	if len(bulletins) == 0 {
+		return
+	}
+	if total > len(bulletins) {
+		slog.Warn("adventure digest: window exceeded cap, truncating", "cap", digestCap, "total", total)
+	}
+
+	date := now.Format("2006-01-02")
+	eventID := "adv-digest:" + date
+	headline, lede := buildDigest(bulletins, total)
+
+	s.advPost(AdvPost{
+		GUID:       eventID,
+		Headline:   headline,
+		Lede:       lede,
+		ArticleURL: s.digestURL(date),
+		Source:     advSource,
+		Channel:    s.adv.Channel,
+	})
+
+	guids := make([]string, len(bulletins))
+	for i, b := range bulletins {
+		guids[i] = b.GUID
+	}
+	storage.MarkAdventureDigested(guids, eventID)
+	slog.Info("adventure digest: posted", "date", date, "items", len(bulletins))
+}
+
+// buildDigest renders the roundup headline + lede in Pete's warm reporter voice.
+// total is how many bulletins the window actually holds, which is larger than
+// len(bulletins) when the cap truncated the fetch — the counts quoted to readers
+// have to describe the realm, not the slice. Headlines come from stored,
+// fact-guarded rows, so no player-controlled text is introduced here.
+func buildDigest(bulletins []storage.Story, total int) (headline, lede string) {
+	if total == 1 {
+		return "Today in the realm: one dispatch.",
+			fmt.Sprintf("Quiet day out there, but one worth noting — %s Full story on the board.", trimHeadline(bulletins[0].Headline))
+	}
+	headline = fmt.Sprintf("Today in the realm: %d dispatches.", total)
+
+	shown := bulletins
+	if len(shown) > digestPreview {
+		shown = shown[:digestPreview]
+	}
+	parts := make([]string, len(shown))
+	for i, b := range shown {
+		parts[i] = trimHeadline(b.Headline)
+	}
+	list := strings.Join(parts, " ")
+	more := ""
+	if total > len(shown) {
+		more = fmt.Sprintf(" …and %d more.", total-len(shown))
+	}
+	return headline, fmt.Sprintf("Here's what came across the wire today. %s%s The full board's on the site.", list, more)
+}
+
+// trimHeadline ensures a headline ends with sentence punctuation so the joined
+// lede reads as prose rather than a run-on.
+func trimHeadline(h string) string {
+	h = strings.TrimSpace(h)
+	if h == "" {
+		return ""
+	}
+	if last := h[len(h)-1]; last != '.' && last != '!' && last != '?' {
+		h += "."
+	}
+	return h
+}
+
+// digestURL points the roundup at the section, with a per-day query param so the
+// canonical-URL dedup treats each day's digest as distinct (it strips only
+// tracking params, keeping ?digest=).
+func (s *Server) digestURL(date string) string {
+	return s.siteURL("/adventure?digest=" + date)
+}

internal/web/adventure_retreat_test.go

@@ -0,0 +1,55 @@
+package web
+
+import (
+	"strings"
+	"testing"
+
+	"pete/internal/storage"
+)
+
+// The retreat bulletin — gogobee's newest event type.
+//
+// The failure this guards against is silent and total: handleAdventureIngest
+// answers an unrecognized event_type with 400, and gogobee's sender treats any
+// non-2xx as a failure, retries eight times over ~two hours, and then PARKS the
+// row forever. So a gogobee that emits `retreat` against a Pete that doesn't
+// know the word doesn't log an error anyone reads — it just quietly drops every
+// retreat the realm ever files. Pete has to learn the word first, and this test
+// is what says he has.
+func TestAdventureIngest_AcceptsRetreat(t *testing.T) {
+	const token = "s3cret-token"
+	s, posted := newAdvServer(t, token)
+
+	f := AdvFact{
+		GUID: "retreat:abc:1000", EventType: "retreat", Tier: "bulletin",
+		Actors: []string{"Brannigan"}, Subject: "Brannigan",
+		Zone: "the Underforge", Level: 12, Count: 3, Outcome: "retreated",
+		OccurredAt: 1000,
+	}
+	if rw := postFact(t, s, token, f); rw.Code != 200 {
+		t.Fatalf("ingest status = %d body=%s — Pete rejected a retreat, so gogobee will "+
+			"retry it eight times and park it forever", rw.Code, rw.Body.String())
+	}
+
+	got, err := storage.GetStoryByGUID("retreat:abc:1000")
+	if err != nil || got == nil {
+		t.Fatalf("retreat was accepted but not stored: %v", err)
+	}
+	// It has to actually say what happened, in Pete's voice, using only the
+	// supplied facts.
+	body := got.Headline + " " + got.Lede
+	for _, want := range []string{"Brannigan", "the Underforge"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("rendered retreat is missing %q: %q", want, body)
+		}
+	}
+	if !strings.Contains(got.Lede, "3 days in") {
+		t.Errorf("the day count never made it into the copy: %q", got.Lede)
+	}
+	// Bulletin, not priority: a retreat goes in the daily digest, it does not
+	// interrupt the room. Pete announcing every failed run live would be a
+	// firehose — and an unkind one.
+	if len(*posted) != 0 {
+		t.Errorf("a bulletin was posted live: %+v", *posted)
+	}
+}

internal/web/adventure_test.go

@@ -0,0 +1,313 @@
+package web
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"pete/internal/config"
+	"pete/internal/storage"
+)
+
+// newAdvServer builds a web server with the adventure seam enabled and a
+// capturing priority poster, backed by a fresh temp DB.
+func newAdvServer(t *testing.T, token string) (*Server, *[]AdvPost) {
+	t.Helper()
+	storage.Close()
+	if err := storage.Init(filepath.Join(t.TempDir(), "adv.db")); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { storage.Close() })
+
+	var posted []AdvPost
+	adv := config.AdventureConfig{Enabled: true, IngestToken: token, Channel: "adventure"}
+	// Mirror the production poster's side effect: queue.PostNow records a
+	// post_log row, which is exactly what marks a beat "posted" and thus
+	// excludes it from the bulletin digest.
+	poster := func(p AdvPost) {
+		posted = append(posted, p)
+		storage.InsertPostLog(p.GUID, "adventure", p.GUID, "", false)
+	}
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0", BaseURL: "https://news.example"},
+		nil, true, adv, poster)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s, &posted
+}
+
+func postFact(t *testing.T, s *Server, token string, f AdvFact) *httptest.ResponseRecorder {
+	t.Helper()
+	body, _ := json.Marshal(f)
+	req := httptest.NewRequest("POST", "/api/ingest/adventure", bytes.NewReader(body))
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	rw := httptest.NewRecorder()
+	s.handleAdventureIngest(rw, req)
+	return rw
+}
+
+// TestAdventureIngestEndToEnd covers the seam: a priority death fact is
+// bearer-accepted, templated, stored as an adventure story, and posted live.
+func TestAdventureIngestEndToEnd(t *testing.T) {
+	const token = "s3cret-token"
+	s, posted := newAdvServer(t, token)
+
+	f := AdvFact{
+		GUID: "death:abc:1000", EventType: "death", Tier: "priority",
+		Actors: []string{"Brannigan"}, Subject: "Brannigan",
+		Zone: "the Underforge", Level: 14, OccurredAt: 1000,
+	}
+	if rw := postFact(t, s, token, f); rw.Code != 200 {
+		t.Fatalf("ingest status = %d body=%s", rw.Code, rw.Body.String())
+	}
+
+	got, err := storage.GetStoryByGUID("death:abc:1000")
+	if err != nil || got == nil {
+		t.Fatalf("story not stored: %v", err)
+	}
+	if got.Channel != "adventure" || got.Source != advSource {
+		t.Errorf("channel/source = %q/%q", got.Channel, got.Source)
+	}
+	if got.Headline != "We lost Brannigan in the Underforge." {
+		t.Errorf("headline = %q", got.Headline)
+	}
+	if got.ArticleURL != "https://news.example/adventure/death:abc:1000" {
+		t.Errorf("article_url = %q", got.ArticleURL)
+	}
+	if len(*posted) != 1 || (*posted)[0].GUID != f.GUID {
+		t.Fatalf("priority post not delivered: %+v", *posted)
+	}
+
+	// Idempotent re-delivery: no error, no second post.
+	if rw := postFact(t, s, token, f); rw.Code != 200 {
+		t.Fatalf("dup ingest status = %d", rw.Code)
+	}
+	if len(*posted) != 1 {
+		t.Errorf("duplicate fact re-posted: %d posts", len(*posted))
+	}
+}
+
+// TestAdventurePermalink renders the per-story page the article_url points at:
+// an ingested dispatch must be fetchable at /adventure/{guid} with its headline
+// and body, and an unknown guid must 404.
+func TestAdventurePermalink(t *testing.T) {
+	const token = "t"
+	s, _ := newAdvServer(t, token)
+	f := AdvFact{
+		GUID: "death:abc:1000", EventType: "death", Tier: "priority",
+		Actors: []string{"Brannigan"}, Subject: "Brannigan",
+		Zone: "the Underforge", Level: 14, OccurredAt: 1000,
+	}
+	if rw := postFact(t, s, token, f); rw.Code != 200 {
+		t.Fatalf("ingest status = %d", rw.Code)
+	}
+
+	req := httptest.NewRequest("GET", "/adventure/death:abc:1000", nil)
+	req.SetPathValue("guid", "death:abc:1000")
+	rw := httptest.NewRecorder()
+	s.handleAdventureStory(rw, req)
+	if rw.Code != 200 {
+		t.Fatalf("permalink status = %d body=%s", rw.Code, rw.Body.String())
+	}
+	body := rw.Body.String()
+	if !bytes.Contains([]byte(body), []byte("We lost Brannigan in the Underforge.")) {
+		t.Errorf("permalink missing headline; body=%s", body)
+	}
+	if !bytes.Contains([]byte(body), []byte("In memoriam")) {
+		t.Errorf("permalink missing event label; body=%s", body)
+	}
+
+	// Unknown guid 404s.
+	req2 := httptest.NewRequest("GET", "/adventure/nope:1", nil)
+	req2.SetPathValue("guid", "nope:1")
+	rw2 := httptest.NewRecorder()
+	s.handleAdventureStory(rw2, req2)
+	if rw2.Code != 404 {
+		t.Errorf("unknown guid status = %d, want 404", rw2.Code)
+	}
+}
+
+// TestDurUntilNextHour targets the next UTC occurrence of the digest hour and
+// rolls to tomorrow when it's already that hour (so a restart can't double-fire).
+func TestDurUntilNextHour(t *testing.T) {
+	// 14:30 UTC, targeting 17:00 → 2h30m today.
+	now := time.Date(2026, 7, 11, 14, 30, 0, 0, time.UTC)
+	if got := durUntilNextHour(now, 17); got != 2*time.Hour+30*time.Minute {
+		t.Errorf("before hour: got %v", got)
+	}
+	// 17:00 exactly → tomorrow's 17:00 (24h), not zero.
+	now = time.Date(2026, 7, 11, 17, 0, 0, 0, time.UTC)
+	if got := durUntilNextHour(now, 17); got != 24*time.Hour {
+		t.Errorf("at hour: got %v", got)
+	}
+	// 20:00, targeting 17:00 → tomorrow, 21h.
+	now = time.Date(2026, 7, 11, 20, 0, 0, 0, time.UTC)
+	if got := durUntilNextHour(now, 17); got != 21*time.Hour {
+		t.Errorf("after hour: got %v", got)
+	}
+}
+
+// TestAdventureDigest covers the batched path: bulletins (no live post) are
+// collected into one roundup, priority beats are excluded (they already posted),
+// digested bulletins don't recur, and an empty window stays silent.
+func TestAdventureDigest(t *testing.T) {
+	const token = "t"
+	s, posted := newAdvServer(t, token)
+	now := time.Now()
+
+	// Two bulletins + one priority (which posts live and must be excluded).
+	postFact(t, s, token, AdvFact{GUID: "arrival:a:1", EventType: "arrival", Tier: "bulletin",
+		Actors: []string{"Zapp"}, Subject: "Zapp", ClassRace: "Elf Ranger", OccurredAt: now.Unix()})
+	postFact(t, s, token, AdvFact{GUID: "rival:b:2", EventType: "rival_result", Tier: "bulletin",
+		Actors: []string{"Kif", "Zapp"}, Subject: "Kif", Opponent: "Zapp", Outcome: "won", OccurredAt: now.Unix()})
+	postFact(t, s, token, AdvFact{GUID: "death:c:3", EventType: "death", Tier: "priority",
+		Actors: []string{"Brannigan"}, Subject: "Brannigan", Zone: "the Underforge", Level: 9, OccurredAt: now.Unix()})
+	if len(*posted) != 1 {
+		t.Fatalf("setup: priority posts = %d, want 1", len(*posted))
+	}
+
+	s.postDailyDigest(now.UTC())
+	if len(*posted) != 2 {
+		t.Fatalf("digest not posted: total posts = %d, want 2", len(*posted))
+	}
+	dg := (*posted)[1]
+	if !strings.Contains(dg.Headline, "2 dispatches") {
+		t.Errorf("digest headline = %q", dg.Headline)
+	}
+	if !strings.HasPrefix(dg.GUID, "adv-digest:") {
+		t.Errorf("digest guid = %q", dg.GUID)
+	}
+
+	// Re-running finds nothing new (bulletins marked digested).
+	s.postDailyDigest(now.UTC())
+	if len(*posted) != 2 {
+		t.Errorf("digest re-posted: total = %d, want 2", len(*posted))
+	}
+}
+
+// TestAdventureArtAndMeta covers the visual-identity slice: the emblem endpoint
+// returns a themed SVG, ingested cards carry its local path, and the permalink
+// page is noindex with an og:image.
+// TestRenderZoneTaxonomy: a realm-first (zone_first) reads as first-ever; a
+// repeat (zone_clear) reads as a personal clear, not a mis-labeled "first".
+func TestRenderZoneTaxonomy(t *testing.T) {
+	first := AdvFact{EventType: "zone_first", Tier: "priority", Subject: "Brannigan",
+		Zone: "Dragon's Lair", Region: "the Underforge", Level: 14}
+	hl, _, ok := renderAdventure(first)
+	if !ok || !strings.Contains(hl, "very first time") {
+		t.Errorf("zone_first headline = %q (ok=%v)", hl, ok)
+	}
+
+	repeat := AdvFact{EventType: "zone_clear", Tier: "bulletin", Subject: "Brannigan",
+		Zone: "Dragon's Lair", Region: "the Underforge", Level: 14}
+	hl2, _, ok := renderAdventure(repeat)
+	if !ok || !strings.Contains(hl2, "Brannigan clears") || strings.Contains(hl2, "first") {
+		t.Errorf("zone_clear headline = %q (ok=%v)", hl2, ok)
+	}
+
+	// The permalink label distinguishes the two, so a repeat's page isn't stamped
+	// "First clear".
+	if lbl, _ := advEventMeta("zone_clear"); lbl == "First clear" {
+		t.Errorf("zone_clear meta label = %q, want distinct from first clear", lbl)
+	}
+}
+
+func TestAdventureArtAndMeta(t *testing.T) {
+	const token = "t"
+	s, _ := newAdvServer(t, token)
+
+	// Emblem endpoint returns SVG with the event's emoji.
+	areq := httptest.NewRequest("GET", "/adventure/art/death.svg", nil)
+	areq.SetPathValue("type", "death.svg")
+	arw := httptest.NewRecorder()
+	s.handleAdventureArt(arw, areq)
+	if arw.Code != 200 {
+		t.Fatalf("art status = %d", arw.Code)
+	}
+	if ct := arw.Header().Get("Content-Type"); !strings.HasPrefix(ct, "image/svg+xml") {
+		t.Errorf("art content-type = %q", ct)
+	}
+	if b := arw.Body.String(); !strings.Contains(b, "🪦") || !strings.Contains(b, "<svg") {
+		t.Errorf("art body missing emblem: %s", b)
+	}
+
+	// Ingest sets the card image to the local emblem path.
+	f := AdvFact{GUID: "death:abc:1000", EventType: "death", Tier: "priority",
+		Actors: []string{"Brannigan"}, Subject: "Brannigan", Zone: "the Underforge", Level: 4, OccurredAt: 1000}
+	if rw := postFact(t, s, token, f); rw.Code != 200 {
+		t.Fatalf("ingest status = %d", rw.Code)
+	}
+	got, _ := storage.GetStoryByGUID("death:abc:1000")
+	if got == nil || got.ImageURL != "/adventure/art/death.svg" {
+		t.Errorf("story image = %q", got.ImageURL)
+	}
+
+	// Permalink page is noindex with an og:image.
+	preq := httptest.NewRequest("GET", "/adventure/death:abc:1000", nil)
+	preq.SetPathValue("guid", "death:abc:1000")
+	prw := httptest.NewRecorder()
+	s.handleAdventureStory(prw, preq)
+	body := prw.Body.String()
+	if !strings.Contains(body, `name="robots" content="noindex"`) {
+		t.Error("permalink not noindex")
+	}
+	if !strings.Contains(body, `property="og:image" content="https://news.example/adventure/art/death.svg"`) {
+		t.Errorf("permalink missing og:image; body=%s", body)
+	}
+}
+
+// TestAdventureIngestBearer rejects missing/wrong tokens.
+func TestAdventureIngestBearer(t *testing.T) {
+	s, _ := newAdvServer(t, "right")
+	f := AdvFact{GUID: "arrival:x:1", EventType: "arrival", Tier: "bulletin", OccurredAt: 1}
+	if rw := postFact(t, s, "", f); rw.Code != 401 {
+		t.Errorf("no token: status = %d, want 401", rw.Code)
+	}
+	if rw := postFact(t, s, "wrong", f); rw.Code != 401 {
+		t.Errorf("wrong token: status = %d, want 401", rw.Code)
+	}
+}
+
+// TestAdventureFactGuard rejects a subject not present in the actors allow-list,
+// so a name that slipped the source can't reach a public page.
+func TestAdventureFactGuard(t *testing.T) {
+	const token = "t"
+	s, posted := newAdvServer(t, token)
+	f := AdvFact{
+		GUID: "death:evil:1", EventType: "death", Tier: "priority",
+		Actors: []string{"Brannigan"}, Subject: "Kif", // Kif not in actors
+		Zone: "the Underforge", Level: 3, OccurredAt: 1,
+	}
+	if rw := postFact(t, s, token, f); rw.Code != 400 {
+		t.Errorf("fact-guard: status = %d, want 400", rw.Code)
+	}
+	if storage.IsGUIDSeen("death:evil:1") {
+		t.Error("guarded fact was stored")
+	}
+	if len(*posted) != 0 {
+		t.Error("guarded fact was posted")
+	}
+}
+
+// TestAdventureDisabled 404s when the seam is off.
+func TestAdventureDisabled(t *testing.T) {
+	storage.Close()
+	if err := storage.Init(filepath.Join(t.TempDir(), "off.db")); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { storage.Close() })
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true, config.AdventureConfig{}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := AdvFact{GUID: "x", EventType: "arrival", OccurredAt: 1}
+	if rw := postFact(t, s, "anything", f); rw.Code != 404 {
+		t.Errorf("disabled: status = %d, want 404", rw.Code)
+	}
+}

internal/web/feed_test.go

@@ -53,7 +53,7 @@ func TestFeeds(t *testing.T) {
 		}
 	}
 
-	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0", BaseURL: "https://news.example/"}, nil, true)
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0", BaseURL: "https://news.example/"}, nil, true, config.AdventureConfig{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/web/handlers.go

@@ -105,6 +105,8 @@ type pageData struct {
 	PushEnabled    bool         // Web Push is configured (shows the notifications toggle to signed-in users)
 	PushPublicKey  string       // VAPID public key handed to the client to subscribe
 	TTS            template.JS  // JSON {enabled, default, voices:[{id,label}]} for read-aloud, or "null"
+	NoIndex        bool         // emit <meta name="robots" content="noindex"> — used by the adventure section
+	OGImage        string       // absolute og:image URL for link unfurls (adventure emblem); "" = none
 }
 
 type channelPage struct {
@@ -158,7 +160,7 @@ func (s *Server) base(r *http.Request) pageData {
 	}
 	d := pageData{
 		SiteTitle:      s.cfg.SiteTitle,
-		Channels:       channels,
+		Channels:       s.channels,
 		Weather:        currentWeather(time.Now()),
 		AllSources:     jsForScript(srcJSON),
 		AuthEnabled:    s.auth != nil,
@@ -215,8 +217,8 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
 	}
 
 	dayStart := time.Now().Add(-24 * time.Hour).Unix()
-	stats := make([]channelStat, 0, len(channels))
-	for _, ch := range channels {
+	stats := make([]channelStat, 0, len(s.channels))
+	for _, ch := range s.channels {
 		total, _ := storage.CountClassifiedByChannel(ch.Slug)
 		lastTs := storage.GetLastPostTime(ch.Slug)
 		stat := channelStat{
@@ -327,6 +329,9 @@ func (s *Server) handleChannel(w http.ResponseWriter, r *http.Request, ch Channe
 
 	base := s.base(r)
 	base.Active = ch.Slug
+	// The adventure section names player characters; keep it out of search
+	// indexes to bound the cached-forever exposure (see plan gap #5).
+	base.NoIndex = ch.Slug == "adventure"
 	data := channelPage{
 		pageData: base,
 		Channel:  ch,

internal/web/reader_test.go

@@ -42,7 +42,7 @@ func TestReaderCardDataAndArticleAPI(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true)
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true, config.AdventureConfig{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/web/server.go

@@ -31,6 +31,10 @@ type Channel struct {
 }
 
 // channels in display order. Add a new entry here to add a section.
+//
+// This is the full catalogue, used to resolve a story's channel slug to its
+// display metadata. It is NOT the list of live sections: an entry can be gated
+// off (adventure), so route registration and the nav read s.channels instead.
 var channels = []Channel{
 	{Slug: "gaming", Title: "Gaming", Theme: "gaming", Emoji: "🎮", Blurb: "Releases, platforms, and the people making the games."},
 	{Slug: "tech", Title: "Tech", Theme: "tech", Emoji: "💻", Blurb: "Industry, products, and the wires that hold it all together."},
@@ -42,6 +46,7 @@ var channels = []Channel{
 	{Slug: "kids", Title: "Kids", Theme: "kids", Emoji: "🧒", Blurb: "World news written for younger readers — short, clear, and curious."},
 	{Slug: "finance", Title: "Finance", Theme: "finance", Emoji: "💰", Blurb: "Markets, money, and the business of the world. Read-only — these stories don't post to Matrix."},
 	{Slug: "lego", Title: "LEGO", Theme: "lego", Emoji: "🧱", Blurb: "Sets, releases, and the wider brick-building world."},
+	{Slug: "adventure", Title: "Adventure", Theme: "adventure", Emoji: "⚔️", Blurb: "Dispatches from the realm — deaths, first-clears, arrivals, and rivalries. Reporting from the field, this is Pete."},
 }
 
 // SourceInfo is the trimmed view of a configured feed for the settings panel.
@@ -61,6 +66,9 @@ type Server struct {
 	tts            *ttsService                   // nil when server-side read-aloud is disabled
 	adminSubs      map[string]bool               // OIDC subjects allowed to view /status
 	pushHTTP       *http.Client                  // SSRF-guarded client for Web Push delivery; built lazily by pushClient()
+	adv            config.AdventureConfig        // gogobee adventure-news seam
+	advPost        PriorityPoster                // posts priority adventure beats to Matrix; nil = web-only
+	channels       []Channel                     // live sections: the catalogue minus anything gated off (adventure)
 
 	// Daily-rotated salt for the privacy-preserving unique-visitor estimate.
 	// Guarded by metricsMu; never persisted (see metrics.go).
@@ -72,8 +80,8 @@ type Server struct {
 // New builds the server. Templates are parsed once at startup. Each page
 // gets its own template set sharing layout.html + _card.html, which avoids
 // `main` define collisions between pages.
-func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled bool) (*Server, error) {
-	pages := []string{"index", "channel", "weather", "bookmarks", "for-you", "status"}
+func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled bool, adv config.AdventureConfig, advPost PriorityPoster) (*Server, error) {
+	pages := []string{"index", "channel", "weather", "bookmarks", "for-you", "status", "story"}
 	tpls := make(map[string]*template.Template, len(pages))
 	for _, p := range pages {
 		t, err := template.New("").Funcs(funcs).ParseFS(templateFS,
@@ -99,7 +107,18 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 			adminSubs[sub] = true
 		}
 	}
-	s := &Server{cfg: cfg, sources: infos, postingEnabled: postingEnabled, tpls: tpls, adminSubs: adminSubs}
+	// The adventure section only exists when it's enabled: with the seam off,
+	// there's no nav tab, no /adventure page and no /adventure feed, rather than
+	// an empty section nobody can fill.
+	live := make([]Channel, 0, len(channels))
+	for _, ch := range channels {
+		if ch.Slug == "adventure" && !adv.Enabled {
+			continue
+		}
+		live = append(live, ch)
+	}
+
+	s := &Server{cfg: cfg, sources: infos, postingEnabled: postingEnabled, tpls: tpls, adminSubs: adminSubs, adv: adv, advPost: advPost, channels: live}
 
 	// Optional OIDC sign-in (Authentik). Discovery is a network call; if the
 	// provider is unreachable at boot we log and serve anonymously rather than
@@ -147,7 +166,7 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 	mux.HandleFunc("GET /api/related", s.handleRelated)
 	mux.HandleFunc("GET /feed.xml", func(w http.ResponseWriter, r *http.Request) { s.handleFeedXML(w, r, "") })
 	mux.HandleFunc("GET /feed.json", func(w http.ResponseWriter, r *http.Request) { s.handleFeedJSON(w, r, "") })
-	for _, ch := range channels {
+	for _, ch := range s.channels {
 		ch := ch
 		mux.HandleFunc("GET /"+ch.Slug, func(w http.ResponseWriter, r *http.Request) {
 			s.handleChannel(w, r, ch)
@@ -165,6 +184,19 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 		_, _ = w.Write([]byte("ok"))
 	})
 
+	// gogobee adventure-news ingest. Bearer-authed (not OIDC), so it lives
+	// outside the sign-in block. Self-gates on adv.Enabled (404 when off).
+	mux.HandleFunc("POST /api/ingest/adventure", s.handleAdventureIngest)
+
+	// Per-dispatch permalink (the article_url every ingested story points at).
+	// Public GET; self-gates on adv.Enabled. Distinct from GET /adventure (the
+	// channel listing, registered in the channels loop above).
+	mux.HandleFunc("GET /adventure/{guid}", s.handleAdventureStory)
+
+	// Themed per-event emblem (card + og:image). A distinct path depth from
+	// /adventure/{guid}, so the two patterns never overlap.
+	mux.HandleFunc("GET /adventure/art/{type}", s.handleAdventureArt)
+
 	if s.auth != nil {
 		mux.HandleFunc("GET /auth/login", s.auth.handleLogin)
 		mux.HandleFunc("GET /auth/callback", s.auth.handleCallback)

internal/web/static/css/input.css

@@ -79,6 +79,7 @@ html[data-phase="night"] {
   .bg-theme-kids      { background-color: #14b8a6; }
   .bg-theme-finance   { background-color: #10b981; }
   .bg-theme-lego      { background-color: #d01012; }
+  .bg-theme-adventure { background-color: #6d4bd8; }
 
   .text-theme-gaming    { color: #2d8a5a; }
   .text-theme-tech      { color: #2f7fb8; }
@@ -90,6 +91,7 @@ html[data-phase="night"] {
   .text-theme-kids      { color: #0f766e; }
   .text-theme-finance   { color: #059669; }
   .text-theme-lego      { color: #b00d0e; }
+  .text-theme-adventure { color: #5836b8; }
 
   .decoration-theme-gaming    { text-decoration-color: #4caf7d; }
   .decoration-theme-tech      { text-decoration-color: #5aa9e6; }
@@ -101,6 +103,7 @@ html[data-phase="night"] {
   .decoration-theme-kids      { text-decoration-color: #14b8a6; }
   .decoration-theme-finance   { text-decoration-color: #10b981; }
   .decoration-theme-lego      { text-decoration-color: #d01012; }
+  .decoration-theme-adventure { text-decoration-color: #6d4bd8; }
 
   .border-theme-gaming    { border-color: #4caf7d; }
   .border-theme-tech      { border-color: #5aa9e6; }
@@ -112,6 +115,7 @@ html[data-phase="night"] {
   .border-theme-kids      { border-color: #14b8a6; }
   .border-theme-finance   { border-color: #10b981; }
   .border-theme-lego      { border-color: #d01012; }
+  .border-theme-adventure { border-color: #6d4bd8; }
 
   /* "Posted to Matrix" glow — soft pulsing aura in the channel's theme color. */
   .glow-theme-gaming   { box-shadow: 0 0 0 2px rgba(76,175,125,0.35), 0 0 24px 4px rgba(76,175,125,0.45); animation: pete-glow-pulse 2.4s ease-in-out infinite; }
@@ -124,6 +128,7 @@ html[data-phase="night"] {
   .glow-theme-kids     { box-shadow: 0 0 0 2px rgba(20,184,166,0.35), 0 0 24px 4px rgba(20,184,166,0.45); animation: pete-glow-pulse 2.4s ease-in-out infinite; }
   .glow-theme-finance  { box-shadow: 0 0 0 2px rgba(16,185,129,0.35), 0 0 24px 4px rgba(16,185,129,0.45); animation: pete-glow-pulse 2.4s ease-in-out infinite; }
   .glow-theme-lego     { box-shadow: 0 0 0 2px rgba(208,16,18,0.35), 0 0 24px 4px rgba(208,16,18,0.45); animation: pete-glow-pulse 2.4s ease-in-out infinite; }
+  .glow-theme-adventure { box-shadow: 0 0 0 2px rgba(109,75,216,0.35), 0 0 24px 4px rgba(109,75,216,0.45); animation: pete-glow-pulse 2.4s ease-in-out infinite; }
 
   @keyframes pete-glow-pulse {
     0%, 100% { filter: brightness(1); }

internal/web/status_render_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestStatusTemplateExecutes(t *testing.T) {
-	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true)
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true, config.AdventureConfig{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/web/templates/layout.html

@@ -4,6 +4,8 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>{{block "title" .}}{{.SiteTitle}}{{end}}</title>
+  {{if .NoIndex}}<meta name="robots" content="noindex">{{end}}
+  {{if .OGImage}}<meta property="og:image" content="{{.OGImage}}"><meta name="twitter:card" content="summary_large_image">{{end}}
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@400;500;600;700&family=Nunito:wght@400;600;700&display=swap" rel="stylesheet">

internal/web/templates/story.html

@@ -0,0 +1,27 @@
+{{define "title"}}{{.Headline}} — {{.SiteTitle}}{{end}}
+
+{{define "main"}}
+<article class="mt-2 mb-10 max-w-3xl mx-auto">
+  <nav class="mb-4">
+    <a href="/adventure" class="inline-flex items-center gap-1.5 text-sm font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)] transition">
+      <span aria-hidden="true">←</span> All dispatches
+    </a>
+  </nav>
+
+  <header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
+    <div class="absolute -top-6 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">{{.Emoji}}</div>
+    <div class="relative">
+      <p class="text-sm uppercase tracking-[0.2em] opacity-80">{{.Emoji}} {{.EventLabel}}</p>
+      <h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">{{.Headline}}</h1>
+      <p class="mt-4 text-xs uppercase tracking-wider opacity-75">Reported {{.When}}{{if .Region}} · {{.Region}}{{end}}</p>
+    </div>
+  </header>
+
+  <div class="mt-8 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 sm:p-8 shadow-pete">
+    <p class="text-lg leading-relaxed text-[color:var(--ink)]/90 whitespace-pre-line">{{.Body}}</p>
+    <p class="mt-8 pt-6 border-t border-[color:var(--ink)]/10 text-sm italic text-theme-adventure font-semibold">
+      Reporting from the realm, this is Pete.
+    </p>
+  </div>
+</article>
+{{end}}

internal/web/thumbs.go

@@ -67,6 +67,14 @@ func thumbURL(src string) string {
 	if src == "" {
 		return ""
 	}
+	// Root-relative sources are our own local assets (e.g. the adventure
+	// emblems) — serve them directly; the thumbnailer only handles remote
+	// http(s) images and would 404 a local path. "//host/x.jpg" is NOT local:
+	// it's a protocol-relative remote image, and it has to keep going through
+	// the guarded thumbnailer like any other third-party URL.
+	if strings.HasPrefix(src, "/") && !strings.HasPrefix(src, "//") {
+		return src
+	}
 	return "/img/" + thumbKey(src) + ".avif?u=" + url.QueryEscape(src)
 }
 

internal/web/trending_test.go

@@ -46,7 +46,7 @@ func TestIndexTrendingAndBadges(t *testing.T) {
 	storage.RecordStoryView(id)
 	storage.RecordStoryView(id)
 
-	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true)
+	s, err := New(config.WebConfig{SiteTitle: "Pete", ListenAddr: ":0"}, nil, true, config.AdventureConfig{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}

main.go

@@ -248,6 +248,13 @@ func main() {
 	if postingEnabled && roundRobinMode {
 		channelNames := make([]string, 0, len(cfg.Matrix.Channels))
 		for name := range cfg.Matrix.Channels {
+			// The adventure channel drives its own posting: priority beats go
+			// live at ingest, bulletins wait for the daily digest. Leaving it in
+			// the rotation would let the scheduler post bulletins one-by-one
+			// (they're "classified, not yet posted") and steal them from the digest.
+			if cfg.Adventure.Enabled && name == cfg.Adventure.Channel {
+				continue
+			}
 			channelNames = append(channelNames, name)
 		}
 		rr := scheduler.New(channelNames, cfg.Posting.RoundRobin.IntervalHours, queue)
@@ -258,14 +265,40 @@ func main() {
 		}
 	}
 
+	// Adapter: the web ingest handler posts priority adventure beats live to
+	// Matrix through the same queue everything else uses (bypasses pacing).
+	//
+	// Adventure carries its own enable switch and is push-based: facts arrive
+	// from gogobee at ingest, they are not polled, classified or paced, and they
+	// never enter the round-robin rotation. So it is gated on [adventure] alone,
+	// NOT on posting.enabled — that flag governs the RSS pipeline's chatter, and
+	// an operator running "news on the web only, adventure live in the games
+	// room" is a legitimate configuration. A nil poster (adventure off, or no
+	// channel) still keeps both the live beats and the digest loop shut.
+	var advPost web.PriorityPoster
+	if cfg.Adventure.Enabled && cfg.Adventure.Channel != "" {
+		advPost = func(p web.AdvPost) {
+			queue.PostNow(poster.QueueItem{
+				GUID:       p.GUID,
+				Headline:   p.Headline,
+				Lede:       p.Lede,
+				ImageURL:   p.ImageURL,
+				ArticleURL: p.ArticleURL,
+				Source:     p.Source,
+				Channel:    p.Channel,
+			})
+		}
+	}
+
 	// Start the read-only web UI alongside the Matrix bot.
 	if cfg.Web.Enabled {
-		ws, err := web.New(cfg.Web, cfg.Sources, postingEnabled)
+		ws, err := web.New(cfg.Web, cfg.Sources, postingEnabled, cfg.Adventure, advPost)
 		if err != nil {
 			slog.Error("web server init failed", "err", err)
 		} else {
 			go ws.Start(ctx)
 			ws.StartPushSender(ctx)
+			ws.StartAdventureDigest(ctx)
 		}
 	}
 
@@ -370,8 +403,9 @@ func runLocal(cfg *config.Config) {
 	poller.Start(ctx)
 	slog.Info("local: pollers started")
 
-	// Local mode never connects to Matrix, so it's always web-only.
-	ws, err := web.New(cfg.Web, cfg.Sources, false)
+	// Local mode never connects to Matrix, so it's always web-only: adventure
+	// stories still ingest and render, but nothing posts (nil priority poster).
+	ws, err := web.New(cfg.Web, cfg.Sources, false, cfg.Adventure, nil)
 	if err != nil {
 		slog.Error("local: web server init failed", "err", err)
 		os.Exit(1)