Adv 2.0 D&D Phase R7: post-completion audit hardening

High-priority fixes from the multi-agent audit of Adventure 2.0:

- Phase 11 nil-deref cluster: zoneOrFallback() helper replaces 8 unsafe
  getZone(_) sites in dnd_zone_cmd.go. Corrupted zone IDs render a
  placeholder instead of panicking.
- Briefing/recap idempotency: deliverBriefing/deliverRecap now claim
  the rollover via a conditional UPDATE. Double-fires from clock skew
  or restart become no-ops; supply burn and day++ no longer reapply.
- Graceful ticker shutdown: AdventurePlugin gains stopCh + Stop(); all
  11 background tickers now select on stopCh in addition to ticker.C.
- Mood decay (§3.2): math.Round(elapsed*2) replaces int() truncation
  so sub-hour gaps decay correctly.
- 24h auto-abandon (§4.3): getActiveZoneRun returns clean slate and
  abandons stale runs whose LastActionAt is over 24h old.
- Respec / auto-migrate orphan cleanup: !respec and the auto-migrated
  draft wipe now abandon active zone runs and expeditions before
  deleting the dnd_character row.
- Phase R combat-link: applyBossDefeatThreat now wired from
  resolveBossRoom (-20 threat); applyRoomCombatThreatForUser adds
  +5/+8 from non-boss/elite kills (§8.1).
- Starvation → forced extraction: briefing-time check forces extract
  with §10.2 coin tax when supplies hit zero.
- GMNat20/Nat1 narration wired into resolveCombatRoom and
  resolveBossRoom (nat-20 takes precedence over nat-1).
- Treasure-undo race: LoadAndDelete on both timer-fire and `undo`
  paths so only one side wins.
- Battle Master: Disarming, Menacing, Parry maneuvers added (3 → 6
  of 10). Remaining 4 (Pushing, Goading, Riposte, Commander's Strike)
  documented inline as needing ally/reaction mechanics the engine
  doesn't model.
- Threat-70 warning: tracked in RegionState["siege_warning_fired"]
  so a drop-and-recross doesn't re-fire the beat.
- region_state JSON decode error now logged via slog.Warn instead
  of silently discarded.

Failing TestProdDB_DnDLayer fixed via option (a): track migrated
characters and only run round-trip / idempotency assertions on those,
skipping pre-existing prod-DB rows accumulated from live bot use.

New tests in dnd_audit_phase_R7_test.go cover: 24h auto-abandon,
briefing double-fire idempotency, threat-70 warning idempotency,
multi-region extract→resume state preservation, and starvation
forced-extraction.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/plugin/dnd_zone_cmd.go

@@ -110,7 +110,7 @@ func (p *AdventurePlugin) zoneCmdList(ctx MessageContext, c *DnDCharacter) error
 		b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
 	}
 	if active, _ := getActiveZoneRun(ctx.Sender); active != nil {
-		zone, _ := getZone(active.ZoneID)
+		zone := zoneOrFallback(active.ZoneID)
 		b.WriteString(fmt.Sprintf("\n_⚠ Active run: **%s**, room %d/%d. Use `!zone status` or `!zone abandon`._",
 			zone.Display, active.CurrentRoom+1, active.TotalRooms))
 	}
@@ -180,7 +180,7 @@ func (p *AdventurePlugin) zoneCmdEnter(ctx MessageContext, c *DnDCharacter, rest
 		switch err {
 		case ErrRunAlreadyActive:
 			active, _ := getActiveZoneRun(ctx.Sender)
-			zone, _ := getZone(active.ZoneID)
+			zone := zoneOrFallback(active.ZoneID)
 			return p.SendDM(ctx.Sender, fmt.Sprintf(
 				"You're already in **%s** (room %d/%d). Finish it or `!zone abandon` first.",
 				zone.Display, active.CurrentRoom+1, active.TotalRooms))
@@ -193,7 +193,7 @@ func (p *AdventurePlugin) zoneCmdEnter(ctx MessageContext, c *DnDCharacter, rest
 			return p.SendDM(ctx.Sender, "Couldn't start zone run: "+err.Error())
 		}
 	}
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🗝 **Entering %s** _(T%d, %d rooms)_\n\n", zone.Display, int(zone.Tier), run.TotalRooms))
 	b.WriteString("_" + zone.Hook + "_\n\n")
@@ -221,7 +221,7 @@ func (p *AdventurePlugin) zoneCmdStatus(ctx MessageContext) error {
 		return p.SendDM(ctx.Sender, "No active zone run. Use `!zone list` then `!zone enter <id>`.")
 	}
 	_ = applyMoodDecayIfStale(run)
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("**%s** — room %d/%d (%s)\n",
 		zone.Display, run.CurrentRoom+1, run.TotalRooms, prettyRoomType(run.CurrentRoomType())))
@@ -279,7 +279,7 @@ func (p *AdventurePlugin) zoneCmdMap(ctx MessageContext) error {
 	if run == nil {
 		return p.SendDM(ctx.Sender, "No active zone run. Use `!zone enter <id>`.")
 	}
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	cleared := map[int]bool{}
 	for _, r := range run.RoomsCleared {
 		cleared[r] = true
@@ -354,7 +354,7 @@ func (p *AdventurePlugin) zoneCmdAdvance(ctx MessageContext) error {
 		return p.SendDM(ctx.Sender, "No active zone run. Use `!zone enter <id>`.")
 	}
 	_ = applyMoodDecayIfStale(run)
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	prev := run.CurrentRoomType()
 	prevIdx := run.CurrentRoom
 
@@ -479,7 +479,7 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 	if err != nil {
 		return "", false, err
 	}
-	scanMoodEventsFromCombat(run.RunID, result)
+	nat20s, nat1s := scanMoodEventsFromCombat(run.RunID, result)
 
 	var b strings.Builder
 	if elite {
@@ -492,6 +492,20 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 		b.WriteString(line)
 		b.WriteString("\n")
 	}
+	// Surface the most-impactful crit/fumble as TwinBee narration. A run
+	// with both gets the nat-20 line — players already see the fumble in
+	// the combat log, but the gloat lands harder than the pity.
+	if nat20s > 0 {
+		if line := twinBeeLine(zone.ID, GMNat20, run.RunID, run.CurrentRoom); line != "" {
+			b.WriteString(line)
+			b.WriteString("\n")
+		}
+	} else if nat1s > 0 {
+		if line := twinBeeLine(zone.ID, GMNat1, run.RunID, run.CurrentRoom); line != "" {
+			b.WriteString(line)
+			b.WriteString("\n")
+		}
+	}
 	if elite {
 		b.WriteString(fmt.Sprintf("⚔️ **Elite encounter — %s** (HP %d, AC %d)\n", monster.Name, monster.HP, monster.AC))
 	} else {
@@ -513,6 +527,7 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 	}
 	b.WriteString(fmt.Sprintf("✅ **%s** down (HP %d→%d).", monster.Name, result.PlayerStartHP, result.PlayerEndHP))
 	recordZoneKillForUser(userID, monster.ID)
+	applyRoomCombatThreatForUser(userID, elite)
 	if drop := p.dropZoneLoot(userID, zone.ID, monster, false); drop != "" {
 		b.WriteString("\n")
 		b.WriteString(drop)
@@ -531,10 +546,21 @@ func (p *AdventurePlugin) resolveBossRoom(userID id.UserID, run *DungeonRun, zon
 	if err != nil {
 		return "", false, err
 	}
-	scanMoodEventsFromCombat(run.RunID, result)
+	nat20s, nat1s := scanMoodEventsFromCombat(run.RunID, result)
 
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("👑 **Boss — %s** (HP %d, AC %d)\n", monster.Name, monster.HP, monster.AC))
+	if nat20s > 0 {
+		if line := twinBeeLine(zone.ID, GMNat20, run.RunID, run.CurrentRoom); line != "" {
+			b.WriteString(line)
+			b.WriteString("\n")
+		}
+	} else if nat1s > 0 {
+		if line := twinBeeLine(zone.ID, GMNat1, run.RunID, run.CurrentRoom); line != "" {
+			b.WriteString(line)
+			b.WriteString("\n")
+		}
+	}
 	if phaseTwoCrossedInEvents(result.Events, result.EnemyStartHP, zone.Boss.PhaseTwoAt) {
 		if line := bossPhaseTwoLine(zone.ID, run.RunID, run.CurrentRoom); line != "" {
 			b.WriteString(line)
@@ -557,6 +583,11 @@ func (p *AdventurePlugin) resolveBossRoom(userID id.UserID, run *DungeonRun, zon
 	}
 	b.WriteString(fmt.Sprintf("🏆 **%s** falls (HP %d→%d).", monster.Name, result.PlayerStartHP, result.PlayerEndHP))
 	recordZoneKillForUser(userID, monster.ID)
+	// §8.1: zone boss defeat drops expedition threat by 20. Silent
+	// no-op for standalone zone runs (no active expedition).
+	if exp, err := getActiveExpedition(userID); err == nil && exp != nil {
+		_ = applyBossDefeatThreat(exp.ID)
+	}
 	if drop := p.dropZoneLoot(userID, zone.ID, monster, true); drop != "" {
 		b.WriteString("\n")
 		b.WriteString(drop)
@@ -627,7 +658,7 @@ func (p *AdventurePlugin) zoneCmdLore(ctx MessageContext) error {
 	if run == nil {
 		return p.SendDM(ctx.Sender, "No active zone run. Use `!zone enter <id>`.")
 	}
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	line := twinBeeLine(zone.ID, GMLore, run.RunID, run.CurrentRoom)
 	if line == "" {
 		return p.SendDM(ctx.Sender, "TwinBee has nothing to say about this place.")
@@ -648,7 +679,7 @@ func (p *AdventurePlugin) zoneCmdAbandon(ctx MessageContext) error {
 	if run == nil {
 		return p.SendDM(ctx.Sender, "Run abandoned.")
 	}
-	zone, _ := getZone(run.ZoneID)
+	zone := zoneOrFallback(run.ZoneID)
 	return p.SendDM(ctx.Sender, fmt.Sprintf(
 		"🚪 Abandoned **%s** at room %d/%d. No rewards.",
 		zone.Display, run.CurrentRoom+1, run.TotalRooms))