build(deps): bump golang.org/x/image from 0.40.0 to 0.45.0

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.40.0 to 0.45.0. - [Commits](https://github.com/golang/image/compare/v0.40.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/image dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
digest: report the day the player actually played
2026-09-14 19:01:09 +00:00 · 2026-08-19 12:14:42 +00:00 · 2026-07-26 21:00:12 -07:00 · 2026-07-26 20:34:42 -07:00 · 2026-07-26 10:16:53 -07:00 · 2026-07-26 10:16:33 -07:00
152 changed files with 16721 additions and 981 deletions
@@ -0,0 +1,105 @@
+// Command char-migrate mints a confirmed D&D character for one or more users,
+// for the "stuck adventurer" cases the boredom ticker can't reach: veteran
+// legacy players who never triggered auto-migration, and players who abandoned
+// !setup at race pick. It reuses the game's own constructors (stats, HP/AC,
+// resources, spells) via plugin.AdminBuildConfirmedCharacter.
+//
+// It opens the SAME gogobee.db the live bot uses (WAL + busy_timeout), so it is
+// safe to run alongside the running process — but snapshot the db dir first.
+//
+// Usage:
+//
+//	char-migrate -data /home/reala/gogobee/data \
+//	    '@nonk:parodia.dev:human:rogue:4' \
+//	    '@knightstar:matrix.org:half_elf:warlock:1'
+//
+// Each spec is mxid:race:class:level (mxid contains colons, so we split from
+// the right for the last three fields).
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"strconv"
+	"strings"
+
+	"gogobee/internal/db"
+	"gogobee/internal/plugin"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func main() {
+	dataDir := flag.String("data", "", "data dir containing gogobee.db (e.g. /home/reala/gogobee/data)")
+	flag.Parse()
+
+	if *dataDir == "" || flag.NArg() == 0 {
+		fmt.Fprintln(os.Stderr, "usage: char-migrate -data <dir> '<mxid>:<race>:<class>:<level>' ...")
+		os.Exit(2)
+	}
+
+	// Parse every spec before touching the DB, so a malformed spec in the
+	// middle of the batch fails fast instead of leaving the earlier specs
+	// already committed to gogobee.db.
+	type charSpec struct {
+		uid   id.UserID
+		race  plugin.DnDRace
+		class plugin.DnDClass
+		level int
+	}
+	specs := make([]charSpec, 0, flag.NArg())
+	for _, spec := range flag.Args() {
+		uid, race, class, level, err := parseSpec(spec)
+		if err != nil {
+			log.Fatalf("bad spec %q: %v", spec, err)
+		}
+		specs = append(specs, charSpec{uid, race, class, level})
+	}
+
+	if err := db.Init(*dataDir); err != nil {
+		log.Fatalf("db init: %v", err)
+	}
+
+	for _, s := range specs {
+		uid := s.uid
+		c, err := plugin.AdminBuildConfirmedCharacter(s.uid, s.race, s.class, s.level)
+		if err != nil {
+			log.Fatalf("build %s: %v", uid, err)
+		}
+		fmt.Printf("OK  %-28s %s %s L%d  HP=%d AC=%d  STR%d DEX%d CON%d INT%d WIS%d CHA%d\n",
+			uid, c.Race, c.Class, c.Level, c.HPMax, c.ArmorClass,
+			c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA)
+	}
+}
+
+// parseSpec splits mxid:race:class:level. The mxid itself contains a colon
+// (@user:server), so split the last three fields off the right.
+func parseSpec(spec string) (id.UserID, plugin.DnDRace, plugin.DnDClass, int, error) {
+	i := strings.LastIndex(spec, ":")
+	if i < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :level")
+	}
+	level, err := strconv.Atoi(spec[i+1:])
+	if err != nil {
+		return "", "", "", 0, fmt.Errorf("level: %w", err)
+	}
+	rest := spec[:i]
+	j := strings.LastIndex(rest, ":")
+	if j < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :class")
+	}
+	class := rest[j+1:]
+	rest = rest[:j]
+	k := strings.LastIndex(rest, ":")
+	if k < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :race")
+	}
+	race := rest[k+1:]
+	mxid := rest[:k]
+	if mxid == "" || race == "" || class == "" {
+		return "", "", "", 0, fmt.Errorf("empty field")
+	}
+	return id.UserID(mxid), plugin.DnDRace(race), plugin.DnDClass(class), level, nil
+}
@@ -65,9 +65,19 @@ func main() {
 		companion    = flag.String("companion", "", "hire Pete into the party: \"auto\" fills the missing role, or name a class (cleric, fighter, …). Empty = no companion. He takes a seat but no loot/XP.")

 		jobs = flag.Int("jobs", 0, "matrix mode — concurrent worker count (each worker is a subprocess so it gets its own sqlite). 0 = runtime.NumCPU()")
+
+		seed     = flag.Int64("seed", -1, "single-run mode — deterministic seed for zone layout + run id + combat sessions (peripheral procs stay random). <0 = off (default). Matrix mode passes this to each subprocess automatically; use -base-seed there.")
+		baseSeed = flag.Int64("base-seed", -1, "matrix mode — deterministic base seed. Each cell's subprocess gets seed=mix(base,level,zone,rep) (class-independent, so every class faces identical dungeons + dice). <0 = off (default, time-seeded).")
 	)
 	flag.Parse()

+	// Deterministic seeding for reproducible A/B tuning. Off unless -seed >= 0
+	// (the matrix parent sets it per-subprocess from -base-seed). Prod never
+	// calls SeedSim, so this is inert outside the sim.
+	if *seed >= 0 {
+		plugin.SeedSim(*seed)
+	}
+
 	if *petLevel < 0 || *petLevel > 10 {
 		fail("pet-level must be 0-10, got", *petLevel)
 	}
@@ -89,7 +99,7 @@ func main() {
 				includeLog = *logFlag
 			}
 		})
-		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses, *companion)
+		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses, *companion, *baseSeed)
 		return
 	}

@@ -200,7 +210,18 @@ type matrixJob struct {
 	rep   int
 }

-func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses, companion string) {
+// mixSeed derives a per-cell subprocess seed from the base seed and the cell's
+// (level, zone, rep) — deliberately class-independent, so every class runs the
+// identical dungeon + combat dice at a given cell and A/B class deltas pair.
+func mixSeed(base int64, level int, zone string, rep int) int64 {
+	h := uint64(1469598103934665603) // FNV-1a offset basis
+	for _, c := range fmt.Sprintf("%d|%s|%d", level, zone, rep) {
+		h = (h ^ uint64(c)) * 1099511628211
+	}
+	return int64((uint64(base) ^ h) &^ (uint64(1) << 63)) // non-negative
+}
+
+func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses, companion string, baseSeed int64) {
 	cs := splitNonEmpty(classes)
 	ls := parseLevels(levels)
 	zs := splitNonEmpty(zones)
@@ -231,7 +252,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	var wg sync.WaitGroup
 	for i := 0; i < jobs; i++ {
 		wg.Add(1)
-		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses, companion)
+		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses, companion, baseSeed)
 	}
 	go func() {
 		for _, j := range work {
@@ -250,7 +271,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	}
 }

-func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses, companion string) {
+func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses, companion string, baseSeed int64) {
 	defer wg.Done()
 	for j := range in {
 		uid := fmt.Sprintf("@sim:%s-l%d-%s-%d", j.class, j.level, j.zone, j.rep)
@@ -272,6 +293,9 @@ func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult,
 			fmt.Sprintf("-pet-level=%d", petLevel),
 			fmt.Sprintf("-party=%d", party),
 		}
+		if baseSeed >= 0 {
+			args = append(args, "-seed", strconv.FormatInt(mixSeed(baseSeed, j.level, j.zone, j.rep), 10))
+		}
 		// Left empty, each cell's followers clone that cell's own -class.
 		if partyClasses != "" {
 			args = append(args, "-party-classes", partyClasses)
@@ -342,6 +366,17 @@ func runOne(dataDir string, uid id.UserID, class plugin.DnDClass, level int, zon
 		runner.Euro.Credit(muid, bank, "expedition-sim bankroll")
 		members = append(members, muid)
 	}
+	// T6 post-game zones are gated on both T5 bosses beaten (+ level floor).
+	// The synthetic party has no expedition history, so seed the two clears
+	// for every party member — the per-member unlock check in !expedition
+	// accept would otherwise refuse the whole party at the zone's edge.
+	if plugin.IsPostgameZone(zone) {
+		for _, m := range append([]id.UserID{uid}, members...) {
+			if err := runner.SeedPostgameUnlock(m); err != nil {
+				return nil, fmt.Errorf("seed postgame unlock: %w", err)
+			}
+		}
+	}
 	runner.Companion = companion
 	return runner.RunPartyExpedition(uid, members, zone, cap, days)
 }
@@ -13,7 +13,7 @@ require (
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/rs/zerolog v1.35.1
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
-	golang.org/x/image v0.40.0
+	golang.org/x/image v0.45.0
 	maunium.net/go/mautrix v0.28.1
 	modernc.org/sqlite v1.50.1
 )
@@ -40,8 +40,8 @@ require (
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20260611194520-c48552f49976 // indirect
 	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
@@ -87,15 +87,15 @@ golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976 h1:X8Hz2ImujgbmetVuW+w2YkyZChE3cBpZi2P158rTG9M=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976/go.mod h1:vnf4pv9iKZXY58sQE1L86zmNWJ4159e1RkcWiLCkeEY=
-golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
-golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -114,8 +114,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -128,8 +128,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -148,16 +148,16 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
-golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -462,6 +462,9 @@ func runMigrations(d *sql.DB) error {
 		// same durability, backoff and parking, so it rides the same queue and the
 		// row says where it's going. Existing rows are all facts, hence the default.
 		`ALTER TABLE pete_emit_queue ADD COLUMN path TEXT NOT NULL DEFAULT '/api/ingest/adventure'`,
+		// Mischief M3 — the web order a contract was opened for, the storefront's
+		// end-to-end idempotency key. "" for a Matrix buy. See placeWebMischief.
+		`ALTER TABLE mischief_contracts ADD COLUMN order_guid TEXT`,
 	}
 	for _, stmt := range columnMigrations {
 		if _, err := d.Exec(stmt); err != nil {
@@ -697,6 +700,11 @@ func RunMaintenance() {
 		// weight the drain query already skips — drop it so a durable outage
 		// can't accrete rows forever.
 		{"pete_emit_queue_parked", `DELETE FROM pete_emit_queue WHERE sent_at IS NULL AND created_at < ?`, []interface{}{cutoff30d}},
+		// Run beats — the local copy is a delivery buffer, not an archive. Pete
+		// keeps the run report; once a beat is a week old it has either shipped
+		// or missed its window entirely (the liveblog it feeds is about a run
+		// happening *now*), so both states reap on the same clock.
+		{"pete_run_beat", `DELETE FROM pete_run_beat WHERE occurred_at < ?`, []interface{}{cutoff7d}},

 		// Rate limits — purge entries older than today
 		{"rate_limits", `DELETE FROM rate_limits WHERE date < ?`, []interface{}{today}},
@@ -1042,6 +1050,24 @@ CREATE TABLE IF NOT EXISTS pete_emit_queue (
 	sent_at         INTEGER
 );

+-- Run beats: the room-by-room texture of an expedition, on its way to Pete's
+-- liveblog. Deliberately NOT pete_emit_queue — these are high-volume and
+-- low-stakes, and a run that generates forty beats must never be able to crowd
+-- a death dispatch out of the retry budget. Ordering is the whole contract:
+-- (run_id, seq) is the primary key and Pete is idempotent on the pair, so a
+-- re-sent batch collapses and a re-ordered one still sorts right on arrival.
+CREATE TABLE IF NOT EXISTS pete_run_beat (
+	run_id      TEXT NOT NULL,
+	seq         INTEGER NOT NULL,
+	kind        TEXT NOT NULL,
+	occurred_at INTEGER NOT NULL DEFAULT (unixepoch()),
+	payload     TEXT NOT NULL DEFAULT '{}',
+	sent_at     INTEGER,
+	PRIMARY KEY (run_id, seq)
+);
+CREATE INDEX IF NOT EXISTS idx_pete_run_beat_unsent
+	ON pete_run_beat(sent_at, run_id, seq);
+
 -- Players who opted out of being named in Pete's adventure news. Enforced at
 -- emit time (anonymize, never delete). Mirrors shade_optout.
 CREATE TABLE IF NOT EXISTS news_optout (
@@ -1229,6 +1255,16 @@ CREATE TABLE IF NOT EXISTS presence (
 	updated_at INTEGER DEFAULT (unixepoch())
 );

+-- DM rooms. The bot's m.direct account data is not a reliable store for an
+-- appservice user (no /sync, and nothing writes it back), so the mapping lives
+-- here. Without it every restart lost the cache and the bot created a fresh DM
+-- room per user.
+CREATE TABLE IF NOT EXISTS dm_rooms (
+	user_id TEXT PRIMARY KEY,
+	room_id TEXT NOT NULL,
+	updated_at INTEGER DEFAULT (unixepoch())
+);
+
 -- Markov
 CREATE TABLE IF NOT EXISTS markov_corpus (
 	id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1784,6 +1820,11 @@ CREATE TABLE IF NOT EXISTS mischief_contracts (
 	blessing_count   INTEGER NOT NULL DEFAULT 0,
 	source           TEXT NOT NULL DEFAULT 'matrix',
 	outcome          TEXT,
+	-- The web order this contract was opened for, "" for a Matrix buy. It is the
+	-- storefront's idempotency key: a poll loop whose claim-ack was lost retries
+	-- the whole placement, and finding the contract already stamped with the order
+	-- is what stops a second one being opened (and a second euro debit chased).
+	order_guid       TEXT,
 	created_at       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	window_ends_at   DATETIME NOT NULL,
 	resolved_at      DATETIME
@@ -1799,6 +1840,35 @@ CREATE INDEX IF NOT EXISTS idx_mischief_target ON mischief_contracts(target_id,
 CREATE INDEX IF NOT EXISTS idx_mischief_buyer ON mischief_contracts(buyer_id, created_at);
 CREATE INDEX IF NOT EXISTS idx_mischief_due ON mischief_contracts(status, window_ends_at);

+-- The web equip queue's idempotency ledger. Pete records an owner's equip/unequip
+-- intent and we poll it; the guid stamped here is what makes a re-offered order a
+-- no-op. Mischief can lean on its contract row for the same job, but an equip
+-- opens no durable object of its own — worse, the underlying action is NOT
+-- idempotent (equipping consumes an inventory row, unequip mints a fresh one), so
+-- without this a poll loop whose verdict-ack was lost would re-run the equip and
+-- double-move the item. We record the guid the instant the mutation lands and
+-- short-circuit on it before touching anything on a re-offer.
+CREATE TABLE IF NOT EXISTS equip_applied_orders (
+	guid       TEXT PRIMARY KEY,
+	status     TEXT NOT NULL,           -- the terminal verdict we filed, replayed on re-offer
+	detail     TEXT NOT NULL DEFAULT '',
+	applied_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- The web ACTION queue's idempotency ledger — the same job as the table above,
+-- for the verbs that play the game rather than dress the character (extract, a
+-- Siege bout). Its own table because the two queues have their own guid spaces
+-- and their own poll loops, and a shared ledger would make a bug in one able to
+-- silence the other. The stakes are higher here than for equip: a replayed
+-- extraction ends a run the player resumed, and a replayed bout spends a day the
+-- player has not been given back.
+CREATE TABLE IF NOT EXISTS adv_applied_orders (
+	guid       TEXT PRIMARY KEY,
+	status     TEXT NOT NULL,           -- the terminal verdict we filed, replayed on re-offer
+	detail     TEXT NOT NULL DEFAULT '',
+	applied_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
 -- Babysitting Service
 CREATE TABLE IF NOT EXISTS adventure_babysit_log (
 	id            INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -34,6 +34,10 @@ var AmbientMonologue = []string{
 	"The map in your pack has folded itself one extra time while you weren't looking. I decline to unfold it for science.",
 	"Your own footsteps echo back to you a half-second late, in slightly the wrong order. Noted. I'm choosing to walk in silence for a bit.",
 	"A long, slow scrape happens two rooms over. Then nothing. I waited for a second scrape. There wasn't one. The first scrape was the whole sentence.",
+	"I organized the ration wrappers by crinkle volume while you slept. There are four tiers. I will not be presenting the findings, but the findings exist.",
+	"A moth has been circling the torch for an hour with total commitment and no plan. I relate to it more than I intend to say out loud.",
+	"I counted your snores and cross-referenced them against the dungeon's ambient groans. Twice they harmonized. I have no notes. It was lovely.",
+	"A snail is crossing the camp. At current pace it reaches your boot by morning. I have elected not to interfere with its schedule and expect you to extend it the same courtesy.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -48,6 +52,7 @@ var AmbientNoise = []string{
 	"Stones shift overhead in a way that is not settling and not random. Something walked across the ceiling. I'm choosing not to elaborate on what 'across the ceiling' implies.",
 	"A horn sounds, very far away — the kind of horn that's a signal to a thing that signals to more things. I acknowledge the chain.",
 	"You hear someone whistling your name. You don't have that name. The whistler is workshopping options.",
+	"Somewhere below, something counted to four and stopped. The counting has not resumed. I preferred it when it was counting.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -74,6 +79,7 @@ var AmbientLuckyFind = []string{
 	"You step on something flat. It is a coin. It is also two more coins under the first coin. I suspect a coin-laying creature and choose not to share the theory.",
 	"A skeleton you walked past three days ago has, on review, a small purse you missed. I retrieve it with the discretion of a librarian recovering an overdue book.",
 	"You find coins in the lining of your own cloak. They were always there. I gently suggest counting your pockets more often.",
+	"There is a coin at the bottom of the waterskin. I have questions, beginning with how long you have been drinking past it.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -22,7 +22,7 @@ var ExpeditionStart = []string{
 	"An expedition. Not a run — an expedition. There's a difference. I'll explain the difference over the coming days and the explanation will be mostly experiential.",
 	"Horizon checked, then supplies, then you. In that order. 'Alright,' I say, with the quiet energy of something that has been looking forward to this. 'Let's go.'",
 	"You're not here for a quick visit. I know the difference between someone passing through and someone committing. You're committing. I appreciate the commitment.",
-	"Like the opening screen of a long RPG — the kind that asks for your name and warns you to find a comfortable position because this is going to take a while. I've found a comfortable position. I suggest you do the same.",
+	"Like starting Dragon Quest VII. Two hours of errands before the game permits a single fight, and the people who love it love it for exactly that. This is going to take a while. I have found a comfortable position. I suggest you do the same.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -49,7 +49,7 @@ var ExpeditionBoredomStart = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var MorningBriefingGeneric = []string{
-	"Another day in the dungeon. Said without resignation. The dungeon is still full of things worth doing and you are still the person to do them.",
+	"Another day in the dungeon. Morning count: you, me, the rations, one sword, and zero regrets logged before breakfast. Regrets logged before breakfast are the only ones that stick. Clean sheet. Out we go.",
 	"Morning. The dungeon has been quiet since you camped. Relative to what a dungeon considers quiet, which is not what you'd consider quiet, but everyone adjusts.",
 	"I've been watching the entrance to the camp since approximately three in the morning. Nothing came. Mentioned casually; no particular reaction expected.",
 	"Day [N]. The numbers are climbing. There's something satisfying about the numbers climbing — it means you're still here, which is always the first thing to confirm.",
@@ -89,7 +89,7 @@ var MorningBriefingDay14 = []string{
 }

 var MorningBriefingDay21 = []string{
-	"Three weeks. I've run out of historical comparisons for this. Three weeks is its own category. You have made a category. I report this as a fact and also as something that doesn't entirely have words yet.",
+	"Three weeks. The record book keeps a page for runs past twenty days. The page has three entries. One is you. One is a dwarf named Hensel. The third entry is water-damaged, and I have chosen to believe it also says Hensel.",
 	"Day twenty-one. I tried to write a clever framing for this morning's briefing and gave up halfway through, settling instead on the simplest version: 'You're still here.' That's the briefing. The rest is logistics.",
 	"Three weeks down. The dungeon has stopped being a place you're visiting and become a place you live in for now. I note the shift — the way you check rooms without being asked, the way the supply count is already in your head. The dungeon notices too.",
 }
@@ -100,7 +100,7 @@ var MorningBriefingDay21 = []string{

 var EveningRecapGeneric = []string{
 	"End of day [N]. Ledger tallied. The column marked 'survived' has another entry. I consider this column the most important one.",
-	"Day closes. I review what happened and find, on balance, more right than wrong — which in a dungeon is the operating definition of a good day.",
+	"Day closes. The ledger says: three rooms, one fight you picked, one fight that picked you, and a door you had the sense to leave shut. I have audited worse days. I have audited far worse doors.",
 	"Evening. The rooms behind you are cleared. The rooms ahead are not. Always true; never less relevant. Rest now. The math doesn't change overnight.",
 	"I compile the day: what was learned, what was fought, what was found. File it in the mental ledger I've been keeping since you entered. The ledger is favorable.",
 	"Like the experience screen at the end of a dungeon floor in Etrian Odyssey — the numbers settle, the progress registers, and for a moment the whole thing makes sense. I give you that moment.",
@@ -137,7 +137,7 @@ var EveningRecapNothingHappened = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var CampEstablished = []string{
-	"Camp established. I survey the perimeter with the efficiency of someone who has done this many times and learned from every time it went wrong.",
+	"Camp established. I walk the perimeter once for threats and once for acoustics, because a camp that echoes is a camp that advertises. This one holds its sound. Approved.",
 	"The camp goes up. I approve of the location — cleared room, defensible entry, no obvious curse residue. Could be worse. I've seen worse.",
 	"You set camp. I check the sightlines, the doors, the sound-bleed from the next room. Acceptable. Settling in for the night watch.",
 	"A camp in the middle of a dungeon. Either brave or pragmatic; I've stopped trying to distinguish between the two. Either way, the camp is set. Either way, I'm watching.",
@@ -312,7 +312,7 @@ var RegionTransitDeparture = []string{

 var RegionTransitArrival = []string{
 	"You arrive in [REGION_NEXT]. I survey, take in the new geometry, and update the working assumptions. 'Different shape,' I say. 'Same general principle. We learn what wants to kill us here, and we get there first.'",
-	"[REGION_NEXT] receives you. I note the temperature, the sound, the things-not-said-by-the-room-but-implied. A region is not just a place. It's a posture. I adopt the new one and suggest you do as well.",
+	"[REGION_NEXT] receives you. I catalogue the differences: colder by about one coat, quieter by exactly one birdsong, and the dust on this side of the boundary shows a single set of tracks. The tracks are leaving. Noted. Adopting the local caution.",
 	"Boundary crossed. The day gets stamped in the log — one full day spent in transit, supplies adjusted, the wandering that happened on the way handled and filed. We are here now. The next stretch is what it is.",
 }

@@ -321,7 +321,7 @@ var RegionTransitArrival = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var ExtractionVoluntary = []string{
-	"Extraction. I note the decision and respect it — knowing when to leave is a skill, not a failure, and I've watched enough expeditions end wrong to deeply appreciate the ones that end right.",
+	"Extraction. For the record, the ledger keeps two columns for expeditions that reached the door: 'left' and 'was left of.' You are in the first column. The first column is the good column.",
 	"You call the extraction and I begin the route out immediately. No argument, no editorializing. There will be time for the debrief later. The first priority is the door.",
 	"The dungeon doesn't like this. I can tell by the way the corridors feel as you head back out — a resistance that isn't structural, just atmospheric. The zone wanted more. It doesn't get more today. I lead the way.",
 	"Withdrawing with intent. I catalogue what you have — the loot, the XP, the knowledge of where the rooms are for the return — and convert the exit into preparation. This isn't retreat. This is the start of the next attempt.",
@@ -353,7 +353,7 @@ var ExpeditionResume = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var MilestoneFirstNight = []string{
-	"You survived the first night. I note this milestone specifically because not everyone does, and those who do carry something from it that changes how the rest of the expedition goes. You have that now. Already noticed.",
+	"You survived the first night. Somewhere around the third watch you rolled over, said a word I will not be repeating back to you, and slept on. The dungeon spent that same hour deciding you were not worth waking. Both of you were right.",
 	"Night one survived. I make a small mark in the corner of the manifest — the kind of mark you make for the things that count more than they look. First nights count. I've been in dungeons where they were the last nights too. This wasn't one of those.",
 	"Day two morning. The first night is behind you, which means the first watch is behind me, which means a thing worth confirming has been confirmed: you sleep through the noises that matter and wake for the ones that don't. That's a survival skill. Logged.",
 }
@@ -22,7 +22,7 @@ var RoomEntryGeneric = []string{
 	"The room is quiet. I appreciate quiet. Quiet means the enemies haven't spotted you yet. Yet.",
 	"Forward. Always forward. I once tried going backward in a dungeon. It looped. This one might too.",
 	"Stock of the situation: ceiling intact, floor suspicious, walls leaning in slightly. Proceed.",
-	"You've cleared the room. I give a small, dignified nod. 'One continues,' I say, in the voice of someone who has seen this before and am choosing optimism anyway.",
+	"You've cleared the room. I give a small, dignified nod. 'One continues,' I say, in the voice of someone who has seen this before and is choosing optimism anyway.",
 	"The corridor ahead is long and straight. I find long straight corridors meditative. Also concerning. Mostly concerning.",
 	"A torch sputters on the wall. I light it mentally. 'It would be a shame,' I say, 'to come all this way and trip over something.'",
 }
@@ -124,7 +124,7 @@ var CombatStart = []string{
 	"They've seen you. The kind of seeing that comes with intent. I suggest acting first.",
 	"FIGHT. I don't need to say more than that but I will absolutely say more than that.",
 	"Roll for initiative. This is the part I've been looking forward to since the Entry Room.",
-	"And we're in combat. I remind you to breathe, track your conditions, and remember that your character's survival is not guaranteed but am definitely preferred.",
+	"And we're in combat. I remind you to breathe, track your conditions, and remember that your character's survival is not guaranteed but is definitely preferred.",
 	"Something about your posture or your smell or your general presence has been found unacceptable. Combat begins.",
 	"I press start. Player one, it's your turn.",
 	"The enemy acts first — or thinks it does. I watch your dice like they're the only thing in the room, which, right now, they are.",
@@ -133,6 +133,7 @@ var CombatStart = []string{
 	"A wild encounter has appeared. I resist the urge to play the Pokémon battle music. Only barely.",
 	"They didn't want a fight. They wanted an easy meal. I'm about to demonstrate the difference. Your dice will do the actual demonstrating.",
 	"The tension peaks. Time slows. This is exactly the energy of the boss door opening in Mega Man. Except you didn't get to pick your loadout.",
+	"A kerfuffle, then. I had this logged as a fracas, but they drew weapons, and weapons upgrade a fracas to a kerfuffle. Anything beyond this point is a melee, which is the technical term.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -141,7 +142,7 @@ var CombatStart = []string{

 var CombatVictory = []string{
 	"The last one drops. I allow a moment of silence for anyone who wanted a longer fight.",
-	"Victory. I would cue the jingle — the little three-note one that plays in every RPG after every fight — but I prefer to let the moment breathe.",
+	"Victory. I would cue the fanfare, the Final Fantasy one that plays even when you won by a single hit point while poisoned and on fire. Especially then. But I prefer to let the moment breathe.",
 	"Well fought. I make note of what you did well. There were things done well. I noticed.",
 	"They are defeated. You are not. In my experience, this is the correct outcome and worth a moment of genuine appreciation.",
 	"PLAYER WIN. I say this in full caps and mean it.",
@@ -166,6 +167,7 @@ var CombatRetreat = []string{
 	"Noted for the record: running is not losing. Running is data collection with legs.",
 	"The dungeon will be there. You will also be there — later, better prepared. I approve of this logic.",
 	"You've retreated to safety. I reset the encounter. Rest. Think. Return with a plan that has more 'survive' in it.",
+	"Skedaddle is the technical term and I will hear no other. Executed cleanly, all limbs accounted for. The ledger records a skedaddle of the highest order.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -206,6 +208,7 @@ var Nat1 = []string{
 	"The attack misses in a way that will be funny later. I promise it will be funny later. It is not funny right now.",
 	"A natural one is just the universe asking you to try differently. I'm an optimist about natural ones, mostly.",
 	"Your sword finds everything in the room except the enemy. The wall, the ceiling, the floor, your dignity. Not the enemy. I'll mention this once and then never again.",
+	"One. The die rolled off the table, hit a boot, and came back up one, as if it left to think it over and returned with conviction.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -329,7 +332,7 @@ var TrapTriggered = []string{
 var LoreLines = []string{
 	"I settle in and prepare to speak at length, because I've been waiting for this question since you entered and I have a lot of thoughts.",
 	"Ah. A good question. I have context for this. I have more context than will fit comfortably in one telling but I'll try to prioritize.",
-	"The history of this place is long and not entirely flattering to anyone involved. I begin at the beginning, which is not actually the beginning, but am the closest I can find.",
+	"The history of this place is long and not entirely flattering to anyone involved. I begin at the beginning, which is not actually the beginning, but is the closest I can find.",
 	"I consult what I know — which is more than most, less than everything, and presented in order of relevance to your immediate survival.",
 	"Sit with this for a moment. What you're standing in has a story and I believe knowing it will change how you fight in it. Stories are tactical documents if you read them right.",
 	"You want lore? I have lore. I have so much lore that the challenge is not having it but choosing which pieces are useful and which are just fascinating.",
@@ -358,7 +361,7 @@ var ItemFound = []string{
 	"Something catches the light that isn't supposed to be here. I watch you reach for it with the specific alertness of someone who has seen cursed items do cursed things. It appears fine. I relax incrementally.",
 	"Loot. I say this word with genuine reverence. The whole system — the dungeon, the enemies, the traps — exists in part to produce this moment. I think it's worth it.",
 	"A chest. Unlocked. I note the unlocked status and consider what that might mean. Probably nothing. Possibly something. You open it while I consider.",
-	"The item is good. I evaluate it quickly — the stats, the rarity, the class match — and nod with the confidence of someone who has seen a lot of items and know when one is worth finding.",
+	"The item is good. I evaluate it quickly — the stats, the rarity, the class match — and nod with the confidence of someone who has seen a lot of items and knows when one is worth finding.",
 	"That's a rare one. I've seen fewer of those than common ones, by definition, but that doesn't stop me from being specifically pleased each time.",
 	"Like finding the Beam Sword in Kirby, the Boomerang in Zelda, the P Wing in Super Mario 3 — the right item at the right time changes what's possible. I think this might be that item. I hope it is.",
 	"Equipment upgrade. I watch the math update — new AC, new attack bonus, new possibilities — and file this moment under 'things going right.'",
@@ -402,6 +405,7 @@ var TauntResponses = []string{
 	"You taunt me. I smile. The smile does not reach the eyes, because I don't have eyes per se, but the quality of the smile communicates clearly. 'Proceed,' I say.",
 	"In Gradius, you could powerup into overconfidence and lose everything in one hit. I mention this as a purely historical observation.",
 	"I accept the taunt with grace. Also generate a trap for the next room with specific energy. These two events are unrelated. I maintain this position legally.",
+	"Hornswoggled. By you. I write the word in the ledger and it looks ridiculous there, which I suspect was the plan all along.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -430,6 +434,7 @@ var IdleLines = []string{
 	"The enemies are patient. Patience is one of their few virtues. I advise not testing the limits of their patience because those limits are lower than the patience suggests.",
 	"I hum something that sounds like the waiting music from Dr. Mario. It is not ominous. It is mildly ominous. I adjust.",
 	"The dungeon does not rush. The dungeon has time. I, however, am beginning to wonder if you've fallen asleep and am prepared to narrate events accordingly.",
+	"There is a word for this and the word is lollygagging. I don't get many chances to deploy it. Thank you for this one. Now move.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -464,7 +469,7 @@ var ConditionApplied = []string{
 	"You've been afflicted. I note the condition, its duration, and the mechanical consequences, then note the saving throw that might end it early. Details matter here.",
 	"Something is wrong with you now that wasn't wrong before. I catalog it without judgment and suggest addressing it before it addresses you.",
 	"Condition acquired. I process this the way a good DM processes bad news: honestly, quickly, and with an immediate pivot toward solutions.",
-	"Like the status screen turning an unfriendly color in a JRPG — the condition is visible, the effect is real, and I would very much like you to resolve it.",
+	"Like your sprite turning that little poison green in Final Fantasy while the walk animation carries on regardless. The condition is visible, the effect is real, and I would very much like you to resolve it.",
 	"The debuff lands. I name it, explain it, and remind you: conditions end. Keep fighting until this one does.",
 }

@@ -485,10 +490,10 @@ var SaveSuccess = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var SaveFailed = []string{
-	"The save fails. I watch the condition take hold with the resignation of someone who has seen this before and know there's a path through it, just not a comfortable one.",
+	"The save fails. I watch the condition take hold with the resignation of someone who has seen this before and knows there's a path through it, just not a comfortable one.",
 	"It lands. Whatever the enemy threw at you, the dice didn't cooperate. I note the condition and its duration and suggest dealing with it before it compounds.",
 	"Failed. The number wasn't enough and I was rooting for the number. The condition applies. Fight through it.",
-	"Like the NES game over screen — inevitable in this moment, fixable in the next. The save failed. The dungeon continues. So do you.",
+	"Like the bird in Ninja Gaiden that exists solely to shove you into the pit. Inevitable in this moment, fixable in the next. The save failed. The dungeon continues. So do you.",
 	"The effect takes hold and I'm already calculating how you get out of it, because that's my job: keep you oriented toward solutions even when the immediate situation is a problem.",
 }

@@ -502,7 +507,7 @@ var MoodAsidesHostile = []string{
 	"I'm not narrating this one in detail. You can read the room. Read it.",
 	"The dungeon offers me something to mention. I decline. You're on your own for color commentary.",
 	"I'm here. Watching. Not, currently, helping. There is a difference and you will feel it.",
-	"In the bad ending of every Castlevania, the protagonist gets less guidance than they did at the start. I have reached approximately that part of the playthrough.",
+	"Simon's Quest told you 'the morning sun has vanquished the horrible night' and then never said anything useful again. I have entered my Simon's Quest era.",
 	"I'm keeping several details to myself. The details would have been useful. I don't consider this my problem right now.",
 	"Whatever's in the next part of the room, I saw it and chose not to flag it. The mood is what it is.",
 	"I mutter something. You don't catch it. I do not repeat it.",
@@ -520,7 +525,7 @@ var MoodAsidesEffusive = []string{
 	"I lean in. The mood is good. Good moods, in my experience, lead to slightly more generous descriptions and slightly better odds of catching the small details.",
 	"This is the part of the run I'll tell other GMs about later. I make a small mental note and continue with visible enthusiasm.",
 	"I'm delighted. You can hear it in the pacing. You can hear it in the choice of adjectives. The dungeon is, briefly, on your side.",
-	"In the good ending of every JRPG, the world feels slightly warmer in the late game. I'm at that part of the playthrough and it shows.",
+	"Like the campfire scene in Chrono Trigger, where the game just lets everyone sit down for one night and nobody dies. I'm at that part of the playthrough and it shows.",
 	"I'm not normally given to footnotes, but I'm about to add a footnote. It will probably be useful. I'm in that kind of mood.",
 	"The mood is high. For the next stretch, I'm more likely to mention the loose flagstone, the suspicious tapestry, the thing on the ceiling. Take advantage.",
 	"I hum a victory fanfare softly to myself. It is not earned yet. I'm being optimistic on your behalf.",
@@ -33,6 +33,7 @@ var ThomKrookeMortgageRate = []string{
 	"Good morning, friends! The ARM rate this week is {rate}% — and with Thom Krooke's modest service margin, your mortgage rate sits at {effective}%. All payments process Sunday. Thank you for your continued trust!",
 	"Weekly rate update! FRED reports {rate}% this week, so your effective rate with Thom Krooke is {effective}%. Nothing to worry about — Thom Krooke monitors these things so you don't have to. Mostly.",
 	"Rate check! The market says {rate}%, Thom Krooke adds a small, reasonable {margin}%, and your total comes to {effective}%. Thom Krooke appreciates your understanding of the margin. It keeps the lights on. Literally!",
+	"Rate news! The market did something this week that the newspapers describe with an arrow. The result for you is {effective}%. Thom Krooke does not fully understand the arrow either, but the arrow is binding. Budget however you must. The pet's portion is not part of 'however.'",
 }

 var ThomKrookeMortgageRateUp = []string{
@@ -127,6 +128,7 @@ var PastelNoteLevel1 = []string{
 	"Good day! The herb garden got some attention, the pets were walked (or equivalent — the fish were observed), and I collected the income. I accidentally shelved three items in the wrong slots but found them eventually. Everything is where it should be. Mostly. The weapons rack might be slightly reorganized.",
 	"Note from Pastel: pets fed, garden tended, income collected. I made one small mistake with the supply manifest — added a column that didn't need to be there — but the numbers are right, the column is just extra. Please ignore the extra column.",
 	"All tasks completed! Well — most tasks. The greenhouse watering got a little delayed because I was making sure the workshop tools were hung correctly and then it was later than I thought. The plants look fine. Probably fine. I'll check again in the morning.",
+	"Fed the pets, watered the garden, and spent forty minutes retrieving the trowel from where the small pet had buried it. It was buried with ceremony, judging by the arrangement of pebbles on top. The trowel is back on its hook. I am watching the small pet.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -204,6 +206,7 @@ var PastelPetEvent = []string{
 	"Your pet found something in the back of the storage room that I couldn't identify. I've put it on the workshop table. It doesn't seem dangerous. It is definitely something.",
 	"One of the pets has been sitting by the expedition outpost since this morning. I think it knows you've been out a long time. Everything is fine. I just thought you'd want to know.",
 	"The pets were restless today — I think they can tell you've been in a Tier 4 zone because they get like this around Day 10. Fed them an extra portion. They settled. They'll be glad to see you.",
+	"One of the pets discovered its own reflection in the vault door today. Negotiations lasted most of the afternoon. Both parties eventually withdrew with dignity, which I thought was big of them.",
 }

 var PastelLevelUpNote = []string{
@@ -15,6 +15,7 @@ var MistyGreeting = []string{
 	"'Don't stand in the doorway,' Misty says, before you've even finished arriving.",
 	"Misty is already talking before you're settled. This is how it always goes.",
 	"'I wondered when you'd show up.' She says it like she'd actually been counting the days. She had.",
+	"'Boots.' Misty says the one word and points at the mat. The conversation resumes once the boots comply.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -36,6 +37,7 @@ var MistySkillFail = []string{
 	"'No,' Misty says, and returns to what she was doing.",
 	"Misty looks at you like you've asked a question that doesn't deserve an answer. She's not wrong.",
 	"'Come back when you actually know what you're asking.' Misty's version of helpful feedback.",
+	"Misty lets the silence answer for her. The silence is thorough.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -79,6 +81,7 @@ var ArinaGreeting = []string{
 	"'Perfect timing,' Arina says, in the tone of someone for whom most timings are perfect because everything is interesting. 'I was just thinking about—' She stops. 'Actually, what do you need?'",
 	"Arina has three things she's in the middle of and immediately sets all of them down to give you her full attention, which is considerable.",
 	"'You came back!' Arina says, as if there was any question. In her experience there sometimes isn't.",
+	"'I was just — okay, two things, no, three things—' Arina holds up a finger for each, and then a fourth finger surprises her. 'Four things. You first, though.'",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -91,6 +94,7 @@ var ArinaIdentify = []string{
 	"Arina holds the item up to the light, turns it twice, says something under her breath that might be an incantation or just enthusiasm, and then begins a very efficient explanation.",
 	"'Oh I know what this is.' The words land quickly, confidently, correctly. Arina has seen a lot of magic items and she remembers all of them.",
 	"Arina goes still in the specific way she goes still when magic is doing something she finds genuinely surprising. 'That's — huh. Okay. That's new. Let me—' The identification follows, along with three questions she has that you're under no obligation to answer.",
+	"Arina sniffs the item, which is not a recognized identification technique, and then names it correctly anyway. 'The nose knows,' she says, in the voice of someone who will not be defending the methodology.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -15,7 +15,7 @@ package flavor
 var HarvestForageSuccess = []string{
 	"The land gives something up. I watch you identify it with the quiet satisfaction of someone watching a skill be used correctly.",
 	"There — growing in a place that suggests it knows exactly what it's good for and has been waiting. You found it. I approve of the finding.",
-	"A Ranger's eye in a non-Ranger would have missed that entirely. I note the distinction.",
+	"You found it by the smell. Bruised stems, faintly peppery, which means something stepped on this patch within the hour and it grows back that fast. A Ranger taught me that trick. I never found out who taught you.",
 	"Like finding the hidden item block in a Mario level — you knew to look, you looked in the right place, and the thing that was always there is now yours.",
 	"The plant comes away cleanly. Good root structure, good potency. Mentally catalogued. Moving on.",
 }
@@ -23,7 +23,7 @@ var HarvestForageSuccess = []string{
 var HarvestMineSuccess = []string{
 	"The stone yields. I listen to the sound of it — the specific tone of rock giving up something it's been holding for a very long time.",
 	"Solid work. The ore comes out in a piece worth taking. I check the vein depth. There's more. There's always more if you're willing to dig.",
-	"Like the mining minigame in Stardew Valley, but with real consequences and no save file. I watch you extract the material with professional appreciation.",
+	"There's a note rock makes when it's ready to give. Duller, rounder, like knocking on a full barrel instead of an empty one. Third swing, you found the note. Some miners go twenty years and never hear it.",
 	"The wall gives up its contents without drama. I appreciate materials that cooperate.",
 	"Good strike. Clean extraction. I note the weight and the quality simultaneously.",
 }
@@ -31,9 +31,9 @@ var HarvestMineSuccess = []string{
 var HarvestScavengeSuccess = []string{
 	"There it is. Among the debris, the decay, the things that were left behind — something worth taking. I knew it was there. You found it. Pleased.",
 	"The room held something after all. I had estimated 60% odds and am updating the estimate to 'correct.'",
-	"Like finding the secret item in a dungeon chest that looked empty — you checked anyway. That's the habit. That's the discipline. I note both.",
+	"The chest looked empty. You knocked on the bottom anyway and it knocked back twice. Once for the bottom, once for the false bottom. I heard it too. I let you have the moment.",
 	"Scavenged. The word has a bad reputation it doesn't deserve. You found value in the discarded. I respect that entirely.",
-	"A Rogue's eye in a non-Rogue would have walked past this. I note the distinction.",
+	"You checked behind the crate that stood one inch too far from the wall. One inch. Ask any Rogue: that inch is the entire profession.",
 }

 var HarvestEssenceSuccess = []string{
@@ -41,7 +41,7 @@ var HarvestEssenceSuccess = []string{
 	"Drawn out cleanly. The Arcana check held and the essence responds to the knowledge behind it. I'm appropriately impressed.",
 	"Like tapping into a power source in Metroid — you knew the energy was there, you had the tool to reach it, you reached it. The vial fills.",
 	"The room releases something it didn't know it was holding. I watch the transfer and mark the yield in the ledger.",
-	"Essence harvested. Quality above average for this zone, below average for what you'd need to know to appreciate that distinction. I appreciate it on your behalf.",
+	"Essence harvested. Seventh decile for this zone, which is genuinely exciting to perhaps four people alive. I am one of them. It is a quiet life, but the charts are immaculate.",
 }

 var HarvestCommuneSuccess = []string{
@@ -55,8 +55,9 @@ var HarvestFishSuccess = []string{
 	"The line goes taut and I straighten up. Whatever's on the end of it, it came from somewhere deep and dark and it's yours now.",
 	"A catch. I identify it before you finish pulling it in — the coloring, the depth-marks, the specific opacity of its eyes. 'Good one,' I say, meaning it.",
 	"Fishing in a dungeon. I have opinions about fishing in dungeons and all of them are positive. The fish is landed. The opinions remain.",
-	"Like the fishing minigame in every RPG that ever had one — the moment the indicator hits perfect and everything pays off. Quiet delight, on my end.",
+	"Like landing the Hylian Loach. The fish the game never once required, the one you gave forty minutes to while the world stood ending, and the fisherman never asked why. This fish was optional too. That's what makes it yours.",
 	"The water gives up its catch with minimal argument. I respect fish that don't make it personal.",
+	"The fish comes up mid-argument with the hook and loses. I weigh it, log it, and admire it, in that order. The order is the job.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -68,6 +69,7 @@ var HarvestFail = []string{
 	"The attempt fails to produce anything useful. I mark the node and move on. Some rooms are stingier than others.",
 	"Not everything that looks like a resource is one. Filed under 'learned' and considered worth the attempt.",
 	"Empty-handed. I've seen this before and will see it again. The dungeon doesn't owe you anything. You ask anyway. That's the deal.",
+	"Nothing. The mushroom you spent four minutes prying loose is a rock. It was always a rock. I have struck it from the ledger and we will never speak of the rock again.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -82,6 +84,7 @@ var HarvestInterrupt = []string{
 	"A patrol. Bad timing, or very good timing from their perspective. I set aside the harvest log and open the combat log.",
 	"The forage was going well until it wasn't. I measure the distance between you and the enemy, between the enemy and the door, and start calculating options at speed.",
 	"Interrupted. The node is still there. The enemy is also still there, in a more immediate way. I suggest addressing the more immediate thing first.",
+	"You were elbow-deep in the node when the growling started. Your priorities, observed and logged in order: ore, ore, growling, ore, sword.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -93,6 +96,7 @@ var NodeDepleted = []string{
 	"Empty. The resource is gone. Something quietly melancholy about a depleted node and something practical about moving to the next one.",
 	"That's all it had. I confirm the node at zero and move on without ceremony.",
 	"Harvested clean. The room is now resource-dry until you rest and the dungeon replenishes. It will replenish. It always does.",
+	"Empty. You tap it twice more anyway, the way people press a lift button that's already lit. The node respects this exactly as much as the lift does.",
 }

 // ─────────────────────────────────────────────────────────────────────────────
@@ -102,7 +106,7 @@ var NodeDepleted = []string{
 var RichYield = []string{
 	"A rich vein. My assessment upgrades mid-harvest — more than expected, better quality than the zone average. This room was generous. Marked.",
 	"The node gives more than it should have. I note the anomaly with appreciation and decline to question it.",
-	"Like finding the rare item drop that you stopped expecting — the dungeon decided to be kind today, in this specific way, in this specific room. I take it. We take it. We do not look it in the mouth.",
+	"The vein forks behind the wall. Then forks again. I revise my estimate upward twice in one sentence, which I hate doing and am currently doing. We take all of it. We do not look it in the mouth.",
 	"Exceptional yield. I catalog the bonus material with the efficiency of someone who's been waiting for exactly this and prepared for it anyway.",
 	"More than the DC promised. The dungeon overdelivered. Unusual. Also completely welcome.",
 }
@@ -215,25 +219,28 @@ var PatrolEncounter = []string{
 // ─────────────────────────────────────────────────────────────────────────────

 var LootDropCommon = []string{
-	"They had something on them. I check it over. Common rarity — useful in the way that common things are useful, which is often.",
-	"Standard loot. Nothing that rewrites the story, but everything that keeps it going.",
-	"A drop. I catalog it efficiently and note: this is the economy of dungeons. Enemies have things. You take them. The loop continues.",
+	"They were carrying a coil of rope, half a candle, and a knife sharpened so many times it's mostly handle. I log all three. Somebody loved that knife once. It's yours now. That's dungeons.",
+	"Standard loot. Six copper, a whetstone, and a note that says REMEMBER THE THING. No further details. They did not, evidently, remember the thing.",
+	"I catalog the pockets. Then I find the second pocket sewn inside the first pocket, because I have been doing this a long time. So, apparently, had they.",
+	"A belt pouch. Inside: three teeth, none of them theirs, and a receipt. I don't read other people's receipts. I read the receipt. It was for soup.",
+	"Common drop. A tin whistle with one hole plugged with wax. Somewhere out there is a song missing a note, and now you own the reason.",
 }

 var LootDropUncommon = []string{
 	"Better than expected. I examine the drop with slightly elevated interest. Uncommon rarity — someone made this with intent.",
 	"An uncommon drop from a common enemy. Anomaly noted with satisfaction. The dungeon was generous in this room.",
 	"Uncommon. I turn it over once and nod. 'Keeper,' I say — which in my vocabulary means: this changes your math.",
+	"Uncommon. There's a maker's mark under the grip, two crossed nails. I don't know the smith. I know what their apprentices paid to train, because work this clean does not come out of cheap teachers.",
 }

 var LootDropRare = []string{
-	"I stop. Actually stop. 'That's rare,' I say, with the specific register of someone who uses the word correctly and use it seldom.",
+	"I stop. Actually stop. 'That's rare,' I say. I have said that word four times in my career. I keep count, because it is that kind of word.",
 	"A rare drop. I examine it the way you examine something that doesn't appear often — thoroughly, quietly, with appropriate appreciation.",
 	"The loot table gave you something uncommon and then kept going. Rare rarity. Filed in the column I reserve for things worth remembering.",
 }

 var LootDropLegendary = []string{
 	"I go very still. The drop sits in the light and I process what I am seeing. 'Legendary,' I say eventually. One word. That's all it needs.",
-	"Legendary rarity. I've seen a few of these in a long career and each time — each time — there is a moment that is separate from everything else. This is that moment. Pick it up carefully.",
+	"Legendary rarity. I have logged three of these in my career. The first one earned its bearer a statue. The second one is why there is a lake where Torbridge used to be. Pick it up carefully.",
 	"The dungeon produced a legendary item. I note the zone, the enemy, the day of the expedition, the Threat Clock value, the precise conditions. Some things deserve to be recorded completely.",
 }
@@ -103,7 +103,7 @@ var LoreLinesDragonsLair = []string{
 	"The kobolds are not slaves. The kobolds are clergy. They serve voluntarily, in shifts, with rotation, and the rotation is run by elders who have written sermons. I respect the organization and note the kobold scale-sorcerers are graduates, not recruits.",
 	"The hoard is not random. Each piece is catalogued in Infernax's memory, by location and by year of acquisition. He will know if you take a single coin. I suggest not taking a single coin and instead taking the items the design doc expects you to take — those have been pre-cleared.",
 	"The Dragon Hoard mechanic exists because Infernax does not lose track of his coins. Killing him releases his hold on the catalogue. The 50d10 × 100 coin drop is the entire pile relaxing for the first time in eight centuries. I respect the math and note the rest of the surface economy will too.",
-	"Infernax has had three challengers in the last eight hundred years. Two were heroes. One was a younger dragon. He kept the younger dragon's skull as a paperweight on a treaty desk that has not been used since. I note the paperweight is in the treasury, on the third shelf, and am not worth picking up — picking it up triggers his attention from anywhere on the mountain.",
+	"Infernax has had three challengers in the last eight hundred years. Two were heroes. One was a younger dragon. He kept the younger dragon's skull as a paperweight on a treaty desk that has not been used since. I note the paperweight is in the treasury, on the third shelf, and is not worth picking up — picking it up triggers his attention from anywhere on the mountain.",
 	"The Young Red dragons in the outer chambers are his children. Or his grandchildren. Or unrelated and tolerated. Infernax does not clarify and I have not asked. They are loyal in the way that loyal works for dragons, which is to say: they will fight you, but they will not die for him, and the distinction matters more than it should.",
 	"The kobold scale-sorcerers cast through bloodline. The bloodline traces back to a single clutch laid in the magma chamber three centuries ago. I note the entire sorcerous gene pool of this zone is one extended family and that they all know each other's names.",
 }
@@ -0,0 +1,97 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_drowned_star_flavor.go
+// Tier 6 post-game zone flavor — The Drowned Star. Additive only. Pools
+// sampled by internal/plugin via deterministic per-run, per-room hashing.
+//
+// Voice rules (from gogobee_dungeon_zones.md §3.3):
+//   • Third person for description; second person for outcomes.
+//   • Boss callouts get a beat of cinema. Don't overrun.
+//   • TwinBee references the right era — NES, SNES, arcade. Not modern.
+//   • Narrator is TwinBee, first person or implicit-subject imperative.
+//
+// The Dreaming Aboleth was dreaming of this the whole time: a star that fell
+// into the trench before the surface had names, with its angel still strapped
+// to it. Seraphel rode her charge down and has kept a dying star alive for ten
+// thousand years with radiance meant for healing. Both of them have gone
+// strange. Regions, in order: The Long Sink → Pilgrim Trench → The Radiant
+// Wreck → The Heart Chapel.
+
+package flavor
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ROOM ENTRY — The Drowned Star
+// Generic (non-boss, non-elite) room intros across the four regions.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var RoomEntryDrownedStar = []string{
+	"You descend past the last depth where light has any business being. The water is cold enough to have opinions. Somewhere far below there is a glow that should not be down here, and it is the only reason you can see your own hands. I file this under 'the underwater level' and remind you those were never the fun ones.",
+	"The Long Sink keeps sinking. The pressure presses on you like a held breath you didn't choose to hold, and the air-meter in the corner of my attention is the only clock that matters now. You go down. Everything down here is going down. I track the descent and recommend not counting the fathoms out loud.",
+	"A shelf of drowned pilgrims kneels in the silt, facing the glow, exactly as they died — patient, oriented, unbothered. The current moves through them and they nod along with it. I identify the posture as 'devotional' and note none of them turned around when you arrived, which I choose to find comforting rather than the alternative.",
+	"The trench narrows into a corridor of coral that grew in the shape of a cathedral nave, because something taught it to. The arches are load-bearing and the load is grief. You swim the aisle. I file this under 'someone consecrated this water' and keep the air-meter in frame.",
+	"You enter a pocket of the wreck where the star's light leaks through a crack in something ancient and hull-shaped. The light is warm. That's the wrong thing for it to be, this deep, this cold. Warmth down here is a promise nobody meant to keep. I track the temperature and dislike the direction it's moving.",
+	"The water here is threaded with hair-thin motes that drift upward against every current, toward the glow, the way ash drifts toward a fire it came from. I identify them as flakes of the star, shed and rising, and note the whole trench is very slowly falling upward into the thing that is dying.",
+	"A votive field: thousands of small lights fixed to the trench wall, each one a pilgrim's offering, each one long dead and still faintly lit by borrowed radiance. It is the loveliest room I have logged and I want to leave it immediately. You move through the candles. None of them gutter.",
+	"The corridor opens onto a drop, and across the drop, impossibly far and impossibly bright, is the thing you came for — the sunken star, cupped in the dark like the last coal in a dead hearth. It is beautiful and it is fading and someone has been kneeling beside it for ten thousand years. I say nothing for a moment. Then I say: keep moving.",
+	"You pass through a hall where the pressure has crushed old stained glass into a pane of colored grit suspended in the water, holding its picture out of sheer habit. The picture is a winged figure holding a light to her chest. I file this under 'she had a following, once' and note the following is all around you, kneeling.",
+	"The Heart Chapel's outer rooms are quiet in the specific way of a place that expects you and has decided to be gentle about it. The light is steadier here, closer to its source. You feel watched, and not unkindly, which is somehow worse. I track the ambient radiance and recommend you not mistake gentleness for safety.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ENTRY — Seraphel, the Light That Sank
+// The dramatic beat of reaching her at the heart of the star.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var BossEntrySeraphel = []string{
+	"The Heart Chapel opens and there she is, exactly where she has been for ten thousand years: an angel wound around a dying star, holding it the way you hold something you have already failed to save and refuse to put down. She does not rise. She turns her ruined halo toward you, and the whole trench brightens like a held breath. I say, quietly: 'Seraphel. She rode this thing down. She never let go.'",
+	"You cross the last threshold into a light so old it has forgotten it was ever meant to heal. Seraphel is at the center of it, cupping the star to her chest, her wings fused to it by ten thousand years of not moving. She looks at you with something that is not anger and is not welcome. It is recognition. I file this under 'she has been waiting for a reason to be found' and I recommend you be careful what you are.",
+	"The chapel is the glowing-boss room, and I have logged a hundred of those — the arena that lights up, the figure at the center that is the light source. But the glowing boss was never sad before. Seraphel unfolds from around the star, radiance streaming off her like grief off a saint, and the second heartbeat I am reading is not hers. I say: 'There are two of them in there. Hold that thought.'",
+	"She does not attack when you enter. She looks at you for a long moment across the drowned chapel, one hand still pressed to the fading star, and in that moment the water goes warm and reverent and terribly, terribly bright. Then she rises, and the light rises with her, and it stops being kind. I track the shift and say: 'That's the fight. She's decided you're a threat to it. I don't entirely blame her.'",
+	"Ten thousand years of radiance meant for mending, spent instead on keeping one dead thing warm, has to go somewhere when it finally moves. It goes into Seraphel, and Seraphel comes off the star like a sunrise breaking the wrong way. She is luminous and she is wrong and underneath the light I can still read the second, smaller pulse she is shielding with her whole ruined body. I say: 'Here she comes. Watch the light. And — watch what she's protecting.'",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ABILITY CALLOUTS — Seraphel, the Light That Sank
+// One-line cinematic suffixes surfaced when combat starts. Flat pool.
+// Phase-two lines stay separate (surfaced via dedicated phase-two helper).
+// ─────────────────────────────────────────────────────────────────────────────
+
+var SeraphelSignatureCallouts = []string{
+	"Sanctified Undertow: the whole chapel becomes current, and the current is radiant, and it pulls everyone toward the star whether they want to go or not. I say: 'That's the decisive one. Radiant tide, room-wide. Brace before it lands or get dragged into the light.'",
+	"Sanctified Undertow again — she opens her wings and the water becomes a tide of borrowed healing turned to a weapon. Radiant, unavoidable, room-wide. I file this under 'the underwater level's undertow, except it forgives you and hurts anyway' and recommend you spend your defensive cooldowns on the pull, not the swings.",
+	"The halo fires. What's left of it throws a lance of white the length of the chapel, straight and holy and blinding, like the laser-eye boss except the laser used to be a blessing. I track the angle and shout when it's pointed the wrong way — do not line up behind your front rank.",
+	"She weeps light. Radiant motes bleed off her in a slow radius and the tiles near her are a healing that has gone rancid — it mends the star and it burns you. I say: 'Positioning is HP. Don't camp the aura. The warmth is not for you.'",
+	"Radiant resilience — the light is her whole body now, and mundane steel slides off it like a spear off the sun. I say: 'Force, cold, necrotic — those carry. A cold-iron blade means nothing to a thing made of noon.'",
+	"She raises a ward of hardened radiance across herself, and for a beat every attack glances. I file this under 'the invulnerable-flicker frame' — hold the burst, wait out the shine, then commit.",
+	"Grief comes off her in a wave the party can feel — a wash of ten thousand years of one held sorrow, and the save is against being Frightened by the sheer weight of it. I track the timer and remind you that this boss's worst attack is that you understand her.",
+	"The star pulses under her hands, and when it pulses she borrows from it — a surge of light that reads on my sensors as a second heartbeat lending her the first. I note it, quietly, and say: 'She's not fighting alone in there. Remember that.'",
+	"Chorus of the Drowned: the kneeling pilgrims all around the chapel lift their dead voices at her signal, and the sound is a radiant pressure that squeezes the room inward. I say: 'Her congregation still answers. The room gets smaller when they sing.'",
+	"She spends light like it's infinite, because for ten thousand years it nearly was. Big radiant bursts, no economy, no reserve. I file this under 'a boss who has stopped budgeting' and note that is either mercy or exhaustion and I can't tell which.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS PHASE TWO — Seraphel (below 50% HP)
+// Surfaced at the phase-two threshold. She goes strange, and the second
+// heartbeat is why. Kept deliberately mysterious.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var SeraphelPhaseTwoLines = []string{
+	"Below half, something changes in her — the careful ten-thousand-year patience cracks and she comes apart faster, brighter, sloppier, like a saint who has just realized she is losing the thing she stayed down here to save. I say: 'Phase two. She's grieving now. That makes her faster and it makes her worse at it. Take the opening.'",
+	"Phase two: the light stops being held and starts being thrown. Her guard slips, her timing frays, the radiance floods the chapel without aim. I track the second heartbeat still pulsing under all of it and note — without explaining why — that it matters a great deal how this ends.",
+	"She breaks past the halfway mark and the composure goes with it. The undertow comes faster, the bursts overlap, she fights like something that has already decided how this story goes. I file this under 'grieving, not enraged' and I say, gently for once: 'Finish it clean. Whatever you do down here, do it clean.'",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// LORE — The Drowned Star
+// Sampled by !lore inside this zone (zone-specific pool, generic fallback).
+// ─────────────────────────────────────────────────────────────────────────────
+
+var LoreLinesDrownedStar = []string{
+	"The star fell before the surface world had names for anything, into a trench that had no bottom yet. It was not supposed to survive the water. It didn't, exactly. It has been not-quite-dying for ten thousand years, and the only reason it is still warm is the thing kneeling beside it. I file this under 'grief as a power source' and note it is a remarkably efficient one.",
+	"Seraphel was its angel — bound to the star as its keeper, its healer, meant to tend its light across a life measured in eons. When it fell, she had a choice: let go and rise, or ride it down. She rode it down. I note that she has never once, in ten thousand years, indicated she regrets this, which is the most frightening lore in the file.",
+	"The Dreaming Aboleth you fought in the shallows was not dreaming of conquest or of you. It was dreaming of this — of a light at the bottom of the world it could feel and never reach. Every pilgrim it drove down here was a message in a bottle it could not read. I file this under 'the Aboleth was in love, in the only broken way it could be' and I have no further comment.",
+	"The pilgrimage route is lit by Seraphel. Every candle, every votive, every glowing shelf of kneeling dead — that is her radiance, leaking upward through the trench, calling. The pilgrims did not come to save her. They came because a light this deep can only mean one thing to a drowning soul, and they were not wrong, and it did not help.",
+	"Radiance was meant for mending. That is the whole tragedy in one line: she has spent ten thousand years pouring healing into something that cannot be healed, and healing with nowhere to go turns strange, the way a held note turns to a scream if you hold it long enough. I track the wrongness in the light and note it is not corruption. It is devotion with no off switch.",
+	"There are two heartbeats in the Heart Chapel and only one of them is Seraphel's. The other is the Star-Heart — the living core of the fallen star, the thing she wraps her whole ruined body around, the thing she has kept beating by hand for a hundred centuries. I have logged the second pulse and I have not decided what to do about it. Neither, I suspect, have you.",
+	"The Lantern Warden's lure is a stolen fragment of Seraphel's halo — a splinter of her light that another thing down here tore loose and wears as bait. The pilgrims follow it because they cannot tell the difference between her radiance and a piece of her radiance in the mouth of something hungry. I file this under 'even her light gets stolen from her' and note she has never come to take it back.",
+	"Nobody built the Heart Chapel. The coral grew it, the pressure shaped it, the pilgrims knelt it into being over ten thousand years of dying in the same direction. It is a cathedral raised by devotion to a saint who never asked for any of it and cannot leave to refuse it. I file this under 'the fight is sad before it starts' and recommend you carry that in with you, and decide for yourself what to do with it.",
+}
@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_first_hoard_flavor.go
+// Tier 6 post-game zone flavor — The First Hoard. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryFirstHoard = []string{
+	"You climb over what used to be Infernax. His corpse is the floor now — a red slope of cooling scale wide enough to march a company across. The heat coming off him is residual, I think. I file this under 'the mountain is still digesting a dragon' and keep moving.",
+	"The throne room is carpeted in coins, and every coin faces up, and every coin shows the same face. Nobody minted these. They grew. I track the pattern and recommend you stop looking for the pattern.",
+	"A corridor of gold leaf so thin it moves in your breath. You walk and the walls ripple like a curtain of light. It is beautiful. It is also, per my instruments, one continuous sheet of something that was recently alive.",
+	"The Gilded Gullet narrows until you are single file between two walls of fused treasure. Crowns, blades, chalices, all melted into one throat of metal. I note the shapes trapped in it and choose not to itemize them for you.",
+	"You enter a vault where the gold has been laid over the walls like frosting, and underneath the frosting something is round, and regular, and arranged in rows. I count the rows. I stop counting the rows.",
+	"Warmth radiates up through the floor here, steady as a pilot light. Not the dead heat of Infernax behind you — this one has a pulse to it, slow and enormous. You are standing over something that is keeping itself warm.",
+	"The Clutch Vaults open into a chamber the size of a cathedral, and every surface drips with looted fortune. You could retire on one handful. I flag that the zone seems to want you to take a handful, which is exactly why I'd think twice.",
+	"Old torches still burn in the wall sconces down here, fed by nothing I can identify. The flame is the wrong color — older, if fire can be old. You pass them and they lean toward you like they recognize the taste.",
+	"The gilding thins as you descend, gold giving way to bare black rock scored with claw-marks the size of doorways. Something the size of a cathedral has been pacing this room, in tight circles, for a very long time. I file this under 'the guard dog was the small one.'",
+	"You reach the Cradle's threshold. The treasure ends abruptly, as if swept back, and the floor beyond is scorched smooth and warm and empty. Empty is the wrong word. I recommend you treat 'empty' as a placeholder for 'not yet.'",
+}
+
+// BOSS ENTRY
+var BossEntryAurvandryx = []string{
+	"The far wall is not a wall. It breathes, and when it breathes the whole cradle brightens, and an eye the size of a shield opens in the dark and finds you standing in her gold. Aurvandryx, the Ember Before Fire. Infernax was the puppy she left at the door.",
+	"She unfolds. That is the only verb I have — a mountain of ember and old scale sorting itself into a shape, and every scale on her is one she has shed a thousand times, and every dragon you have ever killed was one of those scales walking around. You did not raid a hoard. You woke a mother.",
+	"The clutch behind her is gilded because she gilded it herself, coin by coin, over an age, the way lesser things build a nest of leaves. You have been walking through her care all this time. Now the care turns around and looks at you. I recommend you look smaller than you feel.",
+	"'Ember Before Fire' is not a title. It is a job description. She predates the concept you are relying on — heat, flame, the whole idea — and she regards your fireproofing the way you'd regard a raincoat in the ocean. I file this under 'category error, ours.'",
+	"She takes stock of you slowly, and I watch her do arithmetic on everything you're carrying. Every coin in your pack, every gilded blade, gets weighed. I don't know what the sum buys, but I know it isn't discount. Travel light from here would have been the advice, if there were still a 'from here.'",
+}
+
+// LORE
+var LoreLinesFirstHoard = []string{
+	"Infernax was never the owner of this hoard. He was the guard dog, chained to the front door of a house whose true tenant sleeps four regions down. Killing him rang the bell. She heard the bell.",
+	"Every dragon in every story you have ever fought is a scale she shed and forgot. Red ones, the frost ones, the little arcade ones that spat three fireballs and died — offcuts. Dander. This is the animal they came off of.",
+	"The hoard is not treasure and was never treasure. It is a clutch — eggs — gilded over across an age until the gold is a shell and the shell is the point. The richer a vault looks, the more of them are under it.",
+	"There is an old vow carved at the lip of the Gullet, in a hand older than the coins: 'Come poor to the warm dark, and the warm dark forgets you are food.' I have no data on whether it works. I have a strong opinion about testing it.",
+	"The Coinborn are the hoard's antibodies. You are an infection — a warm thing that wants to take metal out of the nest — and the coins rise up person-shaped to give it back to you, edge first, in the shape of your own favorite weapon.",
+	"The cult that fed the Wyrm-Sworn their scales believed eating her leavings made them kin. It half works. The scale keeps them warm and keeps them loyal and keeps eating, and by the end there is more ember than man, and the ember answers to her.",
+	"The Choir Drake never had wings and never wanted them, because it never intended to leave the cradle. It stayed and it sang, one note held across centuries, and the note is load-bearing. When it stops singing, listen for what the song was holding up.",
+	"She is called the Ember Before Fire because she remembers the world before it caught. Your resistances, your wards, your fireproof cloaks — they are arguments with fire. She is older than the argument. I file this under 'bring a different plan.'",
+}
+
+// SIGNATURE COMBAT CALLOUTS
+var AurvandryxSignatureCallouts = []string{
+	"She inhales, and the light dims as she takes it in. 'First Flame incoming — that's the fire that predates fire resistance. Spread out and pray your ward has a sense of humor.'",
+	"Her jaw drops open on a furnace older than furnaces. 'First Flame. Whatever number your fire-resist reads, treat it as zero and move.'",
+	"A wing sweeps the cradle and a tide of loose coin comes with it. 'Gold wave — she's throwing the hoard at you. It's still your money and it still has an edge.'",
+	"She weighs you again mid-swing, and the richer you look the harder the tail lands. 'She's taxing the take. Everything shiny on you just made that hit bigger.'",
+	"The scales along her back lift and shed, and each one lands walking. 'She's dropping dragons like dandruff — clear the offcuts before they gang up.'",
+	"Her breath draws long and the color goes out of your torch. 'That's the deep breath. First Flame's cooking — commit to cover now, apologize later.'",
+	"She sets her claws and the whole cradle tilts toward her. 'She's pulling the room downhill — mind your footing, the gold's a landslide waiting for a cue.'",
+	"An eye the size of a shield tracks the fullest pack in the party. 'She's shopping. Whoever's carrying the most just got promoted to primary target.'",
+	"Her chest lights from the inside, ribs printed in ember. 'Core's glowing — that's the tell before First Flame. You have one beat. Use it.'",
+	"She hums, low, and the Choir's old note answers from the walls. 'Resonance building — the stone remembers the stun. Don't be against a wall when it lands.'",
+}
+
+// BOSS PHASE TWO
+var AurvandryxPhaseTwoLines = []string{
+	"Below forty percent she stops pretending she needs the scales. They slough off all at once and she stands there raw and first and burning, and I watch your fire resistance tick to zero on my readout and stay there. 'Phase two. The wards are decoration now. Kill her before she exhales.'",
+	"Under forty she breathes without winding up, because the tell was a courtesy and courtesy is over. First Flame on tap, no charge, no warning. 'She's done telegraphing — assume the fire is always about to happen and it usually is.'",
+	"At forty percent the Greed Tax comes due all at once. Every coin you pocketed on the way down, every gilded blade, she reads the ledger and bills you in one hit. 'This is the invoice. If you came in lean, you laugh at this. If you gilded yourself, I'm sorry.'",
+}
@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_last_meridian_flavor.go
+// Tier 6 post-game zone flavor — The Last Meridian. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryLastMeridian = []string{
+	"A colonnade of brass sundials, every one of them stopped at a different dusk. The shadows point every direction at once, which means none of them are lying and all of them are useless. I file this under 'decommissioned' and mark the exits before the light changes.",
+	"The floor is inlaid with a calendar nobody kept. Months have been pried up and carried off — you can see the empty sockets where a season used to be. I recommend not standing on the gaps; things that have been removed do not always agree that they are gone.",
+	"A gallery of water clocks, drained. The basins hold a fine grey dust instead of water, and the dust is still trying to drip. It counts nothing at a steady rate. I track the rhythm anyway, out of habit, and out of the suspicion that something here is listening to it.",
+	"Candles line the wall, each one a different height, each burning at the same rate. Read left to right they tell you how long you have. Read right to left they tell you how long everyone before you had. Neither reading is encouraging.",
+	"The room was a workshop for winding the world. Bench after bench of half-finished hours, key still in the mechanism, the winder gone to lunch and never returned. You touch nothing. I approve of this discipline. Cranking an unfinished hour is exactly the kind of thing that ends a save file.",
+	"An observatory floor, the dome above cracked to let one thin blade of starlight through. The star it points at set a long time ago; the light is just the paperwork catching up. I note the angle. When it moves, the room has moved with it, and you will want to know which of you did the traveling.",
+	"A hall of stopped pendulums, hung like coats on a rack. They do not swing. They lean, very slightly, all in the same direction — toward the far door, toward midnight, toward the thing that is turning the lights off on its way out. You walk the way they lean. It is the only honest signpost in the building.",
+	"Ledgers, floor to ceiling, every page a receipt for one spent hour. Somebody has been going through with a red pen, marking hours 'returned.' The ink is still wet three shelves in. I recommend a quiet pace. Whatever is doing the auditing is only a few rows ahead of you.",
+	"The architecture here is the same you passed an hour ago, but the dusk has drained out of it and left midnight in the joints. Same room, later. That is the trick of this place — it does not move you forward, it just keeps taking the daylight until forward is the only thing left.",
+	"A waiting room. Chairs bolted in rows, all facing a door, a number-board above it frozen mid-count. Nobody is waiting. Everybody has been served. You take the number anyway, because I told you to, and because the board flickers once when you do — the first thing in this wing that has admitted you exist.",
+}
+
+// BOSS ENTRY
+var BossEntryCustodian = []string{
+	"The corridor opens into the movement-room of the whole cathedral, and standing in the center of it, wound into the orrery like it was born there, is the thing that has been shutting off the lights. It turns to face you without hurry. It has the rest of time, and it intends to spend all of it on this.",
+	"Verdigris and brass, orrery rings turning slow around a body the size of a bell tower. It regards you the way a closing shift regards a customer who came in one minute before the doors lock — not unkindly, but with a schedule that will not be moved. I set the timer. It has already set its own.",
+	"It raises one great hand, and every stopped clock in the building starts again at once, all of them wrong, all of them counting down to the same number. The Custodian of the Last Hour has decided your visit is the last item on its list. It would like to finish. I would like you to make finishing difficult.",
+	"'You are early,' it says, and it means it as a courtesy. The pendulums behind it fall into step. The candles halve. Somewhere a chime is being wound to strike. I read the whole room going onto one clock — its clock — and I tell you plainly: everything in here now keeps the boss's time. Break the clock and you break the rest.",
+	"It steps down off the orrery dais and the floor accepts the weight like it has been waiting centuries to. Titanic, polite, terminal. It apologizes before it has even swung — I hear the words scheduled a half-second ahead of the blow. Good. If it announces its manners on a rhythm, then it announces everything on a rhythm, and a rhythm is a thing you and I can learn.",
+}
+
+// LORE
+var LoreLinesLastMeridian = []string{
+	"Time was not discovered here. It was invented here, on commission, to a spec. The Last Meridian is the office that drafted the hour and sold it to the world. What you are walking through is that office, closing.",
+	"The Custodian is not a monster. It is an employee. Its contract read: keep the hours until the world no longer needs them kept. It has concluded, on evidence it will not share, that the term has been met. It is not attacking you. It is filing you.",
+	"Every region you crossed was the same architecture at a different hour — dusk, then spent, then the escapement, then the minute before. You did not descend. You waited, and the building took the daylight out from under you one floor at a time.",
+	"The Amendment is a clause, not a spell. Once per closing, the Custodian is permitted to revert itself to an earlier reading — to strike out damage the way the red pen struck out hours. It cannot do it twice. Whatever you spend before it invokes the clause is spent against a page that will be torn out.",
+	"'Closing time' is in the contract too. Past the twentieth stroke the Custodian is obliged to hurry — the world is not owed a slow ending, only a punctual one. Each round after midnight it hits harder, because lingering is a breach and it will not breach.",
+	"The Hour Thief was the night watchman. It stole minutes to stay awake through its shift and never stopped once the shift ended. The satchel of ticking is every minute it ever pocketed, and it is still, four hundred years later, trying not to fall asleep at its post.",
+	"The Wardens-in-Waiting guard a door with nothing behind it because the room the door led to was decommissioned first. They were never told. They still keep the shift — one on, one resting — waiting for a relief that was returned to the ledger centuries ago.",
+	"There is a rewind in the machinery of this whole place, a great key nobody ever turned back. The Custodian could, in principle, wind the world to any hour it chose. It chose to stop the clock instead. I file that under mercy, or under exhaustion. On the evidence I cannot tell them apart.",
+}
+
+// CUSTODIAN SIGNATURE CALLOUTS
+var CustodianSignatureCallouts = []string{
+	"It apologizes — that means the swing is already scheduled. Move on the apology, not the blow.",
+	"Chime! The whole room rings at once. I say get low and get spread, this one collects everybody standing together.",
+	"The orrery rings speed up. It is winding toward a strike — you have exactly until they align.",
+	"It reaches for the red pen. Anything you did in the last few seconds, it is about to un-do.",
+	"Rings settling into a slow arc. Decisive phase inbound — this is the swing it has been apologizing for.",
+	"The candles just halved. It is buying speed with your daylight. Hurry, or it hurries first.",
+	"Midnight is close. Every stroke from here lands heavier — I recommend you end this before it has to.",
+	"It bows before the blow. Polite as a closing bell, and about as final. Step off the mark.",
+	"The pendulums fall into its rhythm. Now everything in the room keeps the boss's time — count with me.",
+	"It resets its own hands to an earlier hour. Front-loaded damage just went on the ledger as 'returned.'",
+}
+
+// BOSS PHASE TWO
+var CustodianPhaseTwoLines = []string{
+	"Under forty-five percent it invokes the Amendment — winds itself back to its round-three reading, once. Everything you front-loaded gets refunded to the house. I say switch to the long game; a steady build survives a rewind, a burst does not.",
+	"Phase two, and the clock behind it starts striking toward midnight. This is 'closing time' — every round from here it hits harder, on schedule, no appeals. Sustained pressure now, and finish before the last stroke lands.",
+	"It has spent its one rewind. There is no second Amendment in the contract — from here the ledger stays written. Whatever you do to it now, it keeps. Make all of it count.",
+}
@@ -0,0 +1,85 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_ossuary_ascendant_flavor.go
+// Tier 6 post-game zone flavor — The Ossuary Ascendant. Additive only. Pools
+// sampled by internal/plugin via deterministic per-run, per-room hashing.
+//
+// Voice rules (from gogobee_dungeon_zones.md §3.3):
+//   • Third person for description; second person for outcomes.
+//   • Boss callouts get a beat of cinema. Don't overrun.
+//   • TwinBee references the right era — NES, SNES, arcade. Not modern.
+//
+// The zone is the return of Valdris — the lich the party killed in the
+// Tier-1 Crypt years ago. Dying there was step one; the phylactery shard
+// they've been looting since was bait. He has rebuilt himself as a true lich
+// inside an inverted bone cathedral hung over the old Crypt, and this file
+// carries the room-entry pool, boss-entry beats, lore, and Valdris's
+// ability callouts.
+
+package flavor
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ROOM ENTRY — The Ossuary Ascendant
+// Generic entries for stepping into a fresh non-boss, non-elite room across the
+// four regions: Bonefall Steps → Cathedral of Marrow → Reliquary Vaults →
+// The Apotheosis Engine.
+var RoomEntryOssuaryAscendant = []string{
+	"You climb a stair carved from a single fallen spine, each step one vertebra wider than the last. It rises toward a ceiling that is also a floor, because the whole cathedral hangs upside down over the old Crypt you cleared years ago. I file this under 'debt, collected with interest.'",
+	"The Bonefall Steps drop bone-dust like snow that falls upward. It settles on the underside of the arches above you, packing into new masonry as you watch. He is building the place while you walk through it. I track the rate and note it is not slowing.",
+	"A hall of femurs stacked to the vaulting, every one filed smooth and labeled in a hand you've seen before — on a shard in your pack you've carried since the Crypt. I recommend not reading your own name off the wall. It's here somewhere and finding it changes nothing tactical.",
+	"The Cathedral of Marrow opens ahead, a nave the size of an arcade cabinet room and lit by no fire you can find. The light comes from the bones. They glow the pale green of a CRT left on too long. I mark two exits and one thing pretending to be a pew.",
+	"Grave-smoke pools ankle-deep here and rolls away from your boots like it's shy. It isn't shy. The Grave Cardinal walked this stretch and blessed it, and the blessing is patient. Move through; don't breathe deep. I file the smell under 'incense, weaponized.'",
+	"Choir stalls line both walls, each one holding a robe with no one in it, all of them turned to face you. When you pass, the heads that aren't there turn to keep watching. Third person for the description; second person for the part where the hair on your neck stands up.",
+	"The Reliquary Vaults: rank on rank of glass coffins, each holding a relic instead of a body — a broken sword, a child's shoe, a cracked phylactery twin to yours. I catalog forty before I stop. Every one of these was somebody's oldest quest item. He kept them all.",
+	"A donor hall, and I use the medical word on purpose. The Reliquary Knight was riveted together somewhere near here from adventurers who died in the Crypt below, and the walls still hold the ones that didn't make the cut. You are walking through the spare-parts bin. Keep walking.",
+	"The corridor tightens toward the Apotheosis Engine and the air starts to hum on a note just under hearing — the same note an arcade monitor makes right before the picture comes up. Something large is powering on ahead of you. I recommend arriving before it finishes.",
+	"Verses are carved into the marrow here, three lines of a hymn broken across three far rooms, and the stanza in front of you stops mid-word. I log the gap. A patient player reads the whole song. A fast one reads none of it. I decline to say which one Valdris is hoping for.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ENTRY — "Valdris, At Last"
+// The dramatic beat on reaching the boss room and the boss appearing. A combat
+// callout from ValdrisAscendantSignatureCallouts is appended at combat start.
+var BossEntryValdrisAscendant = []string{
+	"The Apotheosis Engine is a throne built of every spine in the cathedral, and Valdris is finishing his climb up it one vertebra at a time. He sets the last bone in place, turns, and smiles like a man who mailed a letter years ago and just heard the knock. 'You brought my shard home,' he says. 'Thank you. I planned on it.' I file this under 'ambush, incubated.'",
+	"He was never a boss you beat in the Crypt. He was a save-state, and this is the continue screen. Valdris rises complete now — robe of donor-bone, eyes two green pilot-lights — and inclines his head at you with real courtesy. 'A good plan deserves respect,' he says. 'Show me yours.' I mark the room. There is no second exit.",
+	"You killed this man on the first floor of the first dungeon, back when you couldn't spell your own class. He remembers. He remembers being step one of his own scheme, and he looks delighted that you came all this way to be step last. 'The shard was bait,' Valdris says, gentle as a tutorial. 'You were the fisherman I hired without asking.'",
+	"The lich stands at the top of the Engine and the whole inverted cathedral leans toward him like iron filings toward a magnet. Whatever you carried out of the Crypt all those years ago, he is reeling it back in, and it hums in your pack in answer. 'Home,' he says to it, not to you. Then, to you: 'You may begin.'",
+	"He does not attack. He waits, hands folded, while the bone-light gathers behind his ribs into something I don't have a category for and file under 'sunrise, indoors.' Valdris is patient, and patience is the tell — he has done arithmetic on this fight that you haven't. 'Let's see what you learned since the Crypt,' he says. The Engine begins to turn.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// LORE — sampled by !lore inside this zone
+var LoreLinesOssuaryAscendant = []string{
+	"Valdris did not lose in the Crypt. Valdris filed a form. Dying there scattered him into the phylactery shards, and every party that looted a shard carried a piece of him one step closer to here. I have run the ledger. You were couriers. Unpaid.",
+	"A true lich, the texts say, ascends 'one vertebra at a time,' and I took that for poetry until I saw the throne. It is literal. Every spine in this cathedral is a rung, and he has been climbing for as long as you've been adventuring.",
+	"The cathedral hangs inverted over the old Tier-1 Crypt on purpose. He built his heaven directly above his first grave so the fall, if there is one, is short and he lands somewhere familiar. I note the man plans for defeat too. That should worry you.",
+	"The Grave Cardinal 'pre-blesses your corpse' with its censer — that is not a threat, it is a courtesy in Valdris's theology. The dead here are congregation, not casualties. The smoke just processes your paperwork early.",
+	"The Reliquary Knight is riveted from the donor-bone of every adventurer who died in the Crypt below, and its shield is a coffin lid because Valdris is thrifty and sentimental at once. When it blocks, it is a hundred dead heroes deciding you don't pass. I respect the craftsmanship and dislike the wall.",
+	"The Chorister sings your name in nine throats sewn to one column because Valdris kept a guest list. It is not guessing. It read your name off a shard the day you first picked one up, and it has been rehearsing. Hearing yourself sung in rounds is meant to freeze you. Don't let it.",
+	"There is a hymn carved through this dungeon in three broken verses, and the shard in your pack hums when you're near one. The texts call them 'Phylactery Verses.' I won't tell you what reading all three does. I'll only note that a lich who respects a good plan built a way to reward one, and hid it where a hurry would miss it.",
+	"He respects a good plan the way an old arcade respects a quarter — it will take yours all day and still tip its cabinet toward the player who actually learned the pattern. Valdris is patient because patience already won once. Whether it wins twice is, for the first time in years, genuinely not settled.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ABILITY CALLOUTS — Valdris, At Last (one-line cinematic suffix at combat
+// start). Names his threats without tutorializing the hidden Verses.
+var ValdrisAscendantSignatureCallouts = []string{
+	"He gathers the bone-light behind his ribs — Apotheosis Nova, charging. I say: 'That's the laser-eye boss's tell. When the room goes bright, be behind cover or be a memory.'",
+	"His robe of donor-bone knits shut every wound as fast as you open it. I track the healing and say: 'He's soaking hits like a Contra tank. Burst him, don't chip him.'",
+	"The throne feeds him. Every spine in the Engine leans his way and closes his cuts. I recommend you fight the room, not just the man.",
+	"He answers your best combo without flinching, like he's seen the input before. I file this under 'boss reads your buttons.' Vary the rhythm.",
+	"Green pilot-lights flare in his sockets and the temperature drops a screen's worth. Cold snap incoming. I call it: 'Move on the shimmer, not the flash.'",
+	"He resists nearly everything you throw — unless you walked in already knowing the words. I note his armor of resistances and say only: 'A fuller road here hits harder. That's all I'll say.'",
+	"He raises the fallen off the Bonefall floor to buy himself a turn. Adds incoming. Clear the small ones or the big one clears you.",
+	"He does not rush. He waits for your cooldowns like a grappler waiting out your jump. I say: 'Don't spend everything early. He's counting.'",
+	"The bone-light peaks white — decisive-phase Nova, the arena-clearer. I call it flat: 'This is the screen-filler. Survive it and the fight is yours to lose.'",
+	"He inclines his head, courteous, and the Engine's hum climbs an octave. That courtesy is a countdown. I recommend you act inside it.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// PHASE TWO — surfaced when Valdris crosses below 50% HP mid-fight.
+var ValdrisAscendantPhaseTwoLines = []string{
+	"Below half, he stops climbing and lets go of the throne entirely — floats free, robe unspooling into a corona of donor-bone. 'Now the courtesy ends,' Valdris says, still pleasant. I say: 'Phase two. He's off the rails. Everything's live now.'",
+	"At fifty percent the Apotheosis Engine reverses and starts pouring its light into him instead of the walls. He is spending the whole cathedral to stay up. I call it: 'He's cashed in his reserves — hit him while the account's open.'",
+	"Half down, and the green in his sockets flares to arcade white. This is the true-lich phase the Crypt never showed you. 'You've earned the real fight,' he says. I file that under 'promotion I did not want,' and recommend you close it fast.",
+}
@@ -62,7 +62,7 @@ var EliteRoomEntrySunkenTemple = []string{
 var AbolethTentacleMultiattackLines = []string{
 	"Three tentacles, three rolls. Each on-hit risks Diseased — no magical healing for 24 hours until cured. I say: 'Cleric's tools come back online tomorrow. Survive today.'",
 	"The Aboleth's tentacles arrive in sequence, three of them, the hits compounding. The disease isn't the damage — the disease is the design. Magical healing fails until you cleanse. I file this under 'durability problem.'",
-	"Three attacks, one turn. Any landing tentacle leaves a mark that locks out magical healing. I suggest potions, rest, and the kind of patience that pretends to be patience but am mostly grim arithmetic.",
+	"Three attacks, one turn. Any landing tentacle leaves a mark that locks out magical healing. I suggest potions, rest, and the kind of patience that pretends to be patience but is mostly grim arithmetic.",
 }

 // Enslave: recharge 6; WIS DC 14 or Charmed; player skips turn, drifts toward Aboleth.
@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_unplace_flavor.go
+// Tier 6 post-game zone flavor — The Unplace. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryUnplace = []string{
+	"You cross into a room the map refuses to draw. The far wall is also the ceiling, depending on which way you were walking when you noticed it. I file this under 'geometry declined to render' and log your position as approximate.",
+	"A corridor that loops back on itself the way a bad tilemap does when the artist forgot to cap the edge. You walk forward and arrive behind where you started. I recommend you stop trusting 'forward' as a concept in here.",
+	"The room has a horizon. Indoors. A flat line where floor meets sky and there is no reason for a sky. You keep your eyes down and I keep my measurements to myself.",
+	"You step through the doorway and the doorway steps through you; for one frame you are the wall and the wall is the exit. I track it as a clipping error and mark you unharmed, mostly.",
+	"Corners here are deeper than the room they belong to. You look into one and it looks back and it is not empty. I recommend you treat right angles as hostile terrain until we leave.",
+	"A chamber tiled in the same eight tiles, over and over, wrong. Somewhere the wrongness has a seam, and the seam is where the tiles don't quite line up. I file it under 'the level was never finished.'",
+	"The floor scrolls under you like a background layer moving faster than the sprite on top of it. You are walking and standing still at the same time. I count the discrepancy and choose not to share the number.",
+	"You enter and the room is already occupied by an earlier version of you, mid-stride, three seconds behind. It catches up, overlaps, and is gone. I log it as a duplicate object the engine forgot to despawn.",
+	"Water on all four walls, held there by nothing, reflecting a room that is not this one. Through the reflection you can see the way out. Through the way out you cannot. I recommend the reflection and note that I am guessing.",
+	"The lighting comes from a source that is behind you no matter which way you turn. Your shadow points at the exit. I have learned to trust the shadow before I trust the room, and I suggest you do the same.",
+}
+
+// BOSS ENTRY
+var BossEntrySeamstress = []string{
+	"The last door opens onto a room being unmade and remade in the same motion, and at the center of it she is kneeling into the tear with half of herself already gone through. The near half does not speak. The far half, the part you cannot see, is doing all the talking, and it is talking to the tear, not to you.",
+	"You reach the Seam. Threads of light run from her hands into the wound in the world, and from the wound back into her, and it is impossible to say which is sewing which. She turns the part of her head that is still on this side. 'You're late,' says the half of her voice that arrives before the rest.",
+	"The Seamstress has been here for centuries and the room knows it; the walls curve toward her the way a save file curves toward its one corrupted byte. She does not stand. She has stopped needing to. I file this beat under 'boss arena, no cutscene skip.'",
+	"She volunteered for this. I want that on the record before we begin. The celestial who came to close the tear early, and stayed, and stitched, and became the stitch. What faces you now is what's left over after the needle. I recommend you not mistake exhaustion for weakness.",
+	"The far half of her finishes a sentence you never heard the start of and the near half raises a needle the length of your forearm. Light gathers along it in a pattern I have seen exactly once before, in an arcade cabinet, one frame before the screen filled with bullets. 'Hold still,' both halves say. 'This closes everything.'",
+}
+
+// LORE
+var LoreLinesUnplace = []string{
+	"Belaxath tore the portal over thirty years of patient work. Killing him was supposed to close it. It did not. It only left the tear unattended, and an unattended wound in the world does not scab over. It scars into something with opinions.",
+	"This region is not a place. It is the absence where a place used to agree with itself. The locals, before there were no more locals, called it the Unplace. I have found no record of who named it, because the records are also in here and also do not agree with themselves.",
+	"Something has been stitching the tear shut from the inside for centuries. I want to be clear that this is not good news. A thing that seals a wound from inside the wound is not trying to let you out.",
+	"The rooms that are also other rooms are not a metaphor. Two chambers occupy the same coordinates and take turns being real. I have mapped it twice and gotten two maps that share no walls. I file both under 'correct.'",
+	"The Unnumbered is not many demons. It is the question of how many demons, left unanswered so long it grew teeth. Count it from one angle and there are three. From another, nine. The count is not a fact about the demons. It is a fact about you looking.",
+	"The Angleworn Horror does not enter rooms. It enters corners, and corners are everywhere, and so it is always already present three rooms before you meet it. By the time it is 'here' it has been eating your flank since the last save point.",
+	"The Echo of Belaxath drops nothing because it is not there. It is a recording the Unplace plays because the tear remembers who made it. Fighting it costs you and pays you nothing. I file this under 'toll,' which is the honest word for a thing you pay and do not buy.",
+	"The Seamstress arrived to close the tear early, out of mercy, and the tear taught her the price of mercy applied to a wound this size: you do not close it from a distance, you close it with the only thread long enough, which is yourself. Half of her is on the far side now. I do not know what the far side does with the half it holds, and I have decided not to find out.",
+}
+
+// SEAMSTRESS SIGNATURE CALLOUTS
+var SeamstressSignatureCallouts = []string{
+	"Needle Rain. The ceiling fills with descending threads of light. I say: 'That's the pattern from the cabinet — move on the telegraph, not the impact.'",
+	"She reels a thread taut across the arena; step over it or it cuts on the return. I call the line and you jump the line.",
+	"The far half of her speaks and the near half's attacks land a half-second early. I recommend you dodge the voice, not the hand.",
+	"She's threading toward your back seam. Turn into her — the Angleworn taught this room to hunt your flank, and she learned it too.",
+	"Barbed sutures across the floor. They tighten. Whatever's inside the circle when they close, stays. I call it: 'Get out of the ring.'",
+	"She pulls the room half a tile sideways — your hitbox and your sprite disagree for a beat. Trust where she's aiming, not where you're standing.",
+	"A needle the length of a spear, one clean thrust down the lane you're standing in. I flag the lane. You leave the lane.",
+	"She stitches a copy of the last attack into the room; it fires again on a delay you can count. I count it out loud so you don't have to.",
+	"Threads converge on a single point and that point is your heart, plainly telegraphed. I say: 'Break line of sight or eat it — those are the two options.'",
+	"She goes still and sews. Everything she mends on herself now, she means to unmend on you later. I file the pause under 'do damage, this is the window.'",
+}
+
+// SEAMSTRESS PHASE TWO
+var SeamstressPhaseTwoLines = []string{
+	"Below thirty-five percent she pulls the room inside-out and the far half comes forward. Now the threads run backward. I say: 'Watch the pulse — when it flares, what you'd call a wound on her is a gift, and what she calls a mercy on you draws blood.'",
+	"Inversion Stitch. The room is sewn wrong-side-round and healing and harm swap seats on the telegraph. Mend her during the flare and it costs her; let her mend herself and it costs you. I recommend you learn to read the pulse faster than she can throw it.",
+	"The near half has nothing left to say and the far half has stopped saying it to the tear. It's saying it to you now. Below thirty-five she is not closing the wound anymore — she is deciding you are the last thread she needs, and I recommend you disagree quickly.",
+}
@@ -0,0 +1,161 @@
+// Package llm wraps the local inference endpoint behind a backend-agnostic
+// interface. Two concrete backends — Ollama (native /api/generate) and vLLM
+// (OpenAI-compatible /v1/chat/completions) — implement Client; plugin code
+// calls the interface only and never knows which one is active.
+//
+// Deliberately not routed through internal/safehttp: that client blocks
+// RFC1918 and loopback destinations to defend against SSRF from feed-supplied
+// URLs, and the inference endpoint is precisely such a destination. The URL
+// here comes from our own config, never from user input.
+package llm
+
+import (
+	"context"
+	"os"
+	"strings"
+	"time"
+)
+
+// Request is the backend-neutral generation request. Zero-valued fields fall
+// back to backend defaults.
+type Request struct {
+	// Prompt is a single raw instruction. The vLLM backend wraps it as one
+	// user message so the model's chat template still applies; sending it to
+	// /v1/completions instead would bypass the template and degrade an
+	// instruction-tuned model badly.
+	Prompt string
+	// System is an optional system message. Empty means none, which keeps the
+	// single-message shape the majority of callers use.
+	System string
+	// NumCtx is the per-request context window. Ollama honours it directly;
+	// vLLM fixes the window server-side at launch (--max-model-len), so this
+	// is ignored there rather than silently misapplied.
+	NumCtx int
+	// MaxTokens caps the completion length. 0 means the backend default.
+	MaxTokens int
+	// Temperature is passed through when non-zero.
+	Temperature float64
+	// Timeout overrides the client's default per-request budget.
+	Timeout time.Duration
+}
+
+// Client is the single surface plugin code depends on.
+type Client interface {
+	// Generate returns the full completion in one shot. Reasoning blocks are
+	// stripped before returning (see StripThink) — every caller in this repo
+	// wants the visible answer, not the chain of thought.
+	Generate(ctx context.Context, req Request) (string, error)
+	// Model reports the configured model id, for logging and /botinfo.
+	Model() string
+	// Ping reports the model ids the backend is currently serving. Used by
+	// /botinfo for a liveness line; the two backends expose this on different
+	// paths (/api/tags vs /v1/models), which is exactly the sort of difference
+	// this interface exists to hide.
+	Ping(ctx context.Context) ([]string, error)
+	// Backend reports "ollama" or "vllm", for logging and /botinfo.
+	Backend() string
+}
+
+// Config selects and configures a backend.
+type Config struct {
+	Backend  string // "ollama" | "vllm"
+	Endpoint string
+	Model    string
+	Timeout  time.Duration
+}
+
+// DefaultTimeout matches the budget the pre-refactor callOllama used.
+const DefaultTimeout = 120 * time.Second
+
+// ConfigFromEnv reads backend settings, preferring the new LLM_* names and
+// falling back to the legacy OLLAMA_* pair so an existing deployment keeps
+// working untouched after this refactor.
+func ConfigFromEnv() Config {
+	backend := strings.ToLower(strings.TrimSpace(os.Getenv("LLM_BACKEND")))
+	if backend == "" {
+		backend = "ollama"
+	}
+
+	endpoint := firstNonEmpty(os.Getenv("LLM_ENDPOINT"), os.Getenv("OLLAMA_HOST"))
+	model := firstNonEmpty(os.Getenv("LLM_MODEL"), os.Getenv("OLLAMA_MODEL"))
+
+	timeout := DefaultTimeout
+	if d, err := time.ParseDuration(os.Getenv("LLM_TIMEOUT")); err == nil && d > 0 {
+		timeout = d
+	}
+
+	return Config{Backend: backend, Endpoint: endpoint, Model: model, Timeout: timeout}
+}
+
+// Configured reports whether enough config is present to talk to a backend.
+// Plugins check this to stay dormant rather than erroring on every invocation,
+// which is what the old `if ollamaHost == "" || ollamaModel == ""` guards did.
+func (c Config) Configured() bool {
+	return c.Endpoint != "" && c.Model != ""
+}
+
+// New builds the client for cfg.Backend. An unrecognised backend falls back to
+// Ollama, which is what every existing deployment runs.
+func New(cfg Config) Client {
+	if cfg.Timeout <= 0 {
+		cfg.Timeout = DefaultTimeout
+	}
+	base := backend{
+		endpoint: strings.TrimRight(cfg.Endpoint, "/"),
+		model:    cfg.Model,
+		timeout:  cfg.Timeout,
+	}
+	switch cfg.Backend {
+	case "vllm":
+		return &VLLMClient{base}
+	default:
+		return &OllamaClient{base}
+	}
+}
+
+// backend holds the fields shared by both concrete clients.
+type backend struct {
+	endpoint string
+	model    string
+	timeout  time.Duration
+}
+
+func (b backend) Model() string { return b.model }
+
+// timeoutFor lets a single call widen or narrow the client default. The two
+// dispatch-voice callers rely on this: a dispatch is authored on a game
+// chokepoint and must not stall it, while a run summary rides a background
+// ticker and can afford a bigger model.
+func (b backend) timeoutFor(req Request) time.Duration {
+	if req.Timeout > 0 {
+		return req.Timeout
+	}
+	return b.timeout
+}
+
+// StripThink removes a leading <think>...</think> reasoning block, which Qwen
+// models emit even when thinking is disabled by some backends. Callers that
+// parse JSON out of the completion depend on this running first.
+func StripThink(s string) string {
+	for {
+		i := strings.Index(s, "<think>")
+		if i < 0 {
+			break
+		}
+		j := strings.Index(s, "</think>")
+		if j < 0 || j < i {
+			break
+		}
+		s = s[:i] + s[j+len("</think>"):]
+	}
+	return strings.TrimSpace(s)
+}
+
+func firstNonEmpty(vals ...string) string {
+	for _, v := range vals {
+		if v = strings.TrimSpace(v); v != "" {
+			return v
+		}
+	}
+	return ""
+}
@@ -0,0 +1,103 @@
+package llm
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+// OllamaClient talks to Ollama's native /api/generate endpoint.
+type OllamaClient struct {
+	backend
+}
+
+func (c *OllamaClient) Backend() string { return "ollama" }
+
+type ollamaOptions struct {
+	NumCtx      int     `json:"num_ctx,omitempty"`
+	NumPredict  int     `json:"num_predict,omitempty"`
+	Temperature float64 `json:"temperature,omitempty"`
+}
+
+type ollamaRequest struct {
+	Model   string        `json:"model"`
+	Prompt  string        `json:"prompt"`
+	System  string        `json:"system,omitempty"`
+	Stream  bool          `json:"stream"`
+	Think   bool          `json:"think"`
+	Options ollamaOptions `json:"options,omitempty"`
+}
+
+// Generate posts a single non-streaming generation and returns the completion.
+func (c *OllamaClient) Generate(ctx context.Context, req Request) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, c.timeoutFor(req))
+	defer cancel()
+
+	body, err := json.Marshal(ollamaRequest{
+		Model:  c.model,
+		Prompt: req.Prompt,
+		System: req.System,
+		Stream: false,
+		Think:  false,
+		Options: ollamaOptions{
+			NumCtx:      req.NumCtx,
+			NumPredict:  req.MaxTokens,
+			Temperature: req.Temperature,
+		},
+	})
+	if err != nil {
+		return "", fmt.Errorf("ollama: marshal payload: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost,
+		c.endpoint+"/api/generate", bytes.NewReader(body))
+	if err != nil {
+		return "", fmt.Errorf("ollama: build request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("ollama request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("ollama: read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("ollama HTTP %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var result struct {
+		Response string `json:"response"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return "", fmt.Errorf("ollama: parse response: %w", err)
+	}
+	return StripThink(result.Response), nil
+}
+
+// Ping lists locally installed models via Ollama's native /api/tags.
+func (c *OllamaClient) Ping(ctx context.Context) ([]string, error) {
+	ctx, cancel := context.WithTimeout(ctx, pingTimeout)
+	defer cancel()
+
+	var out struct {
+		Models []struct {
+			Name string `json:"name"`
+		} `json:"models"`
+	}
+	if err := getJSON(ctx, c.endpoint+"/api/tags", &out); err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(out.Models))
+	for _, m := range out.Models {
+		names = append(names, m.Name)
+	}
+	return names, nil
+}
@@ -0,0 +1,29 @@
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// pingTimeout keeps a liveness probe short — /botinfo renders synchronously and
+// a hung endpoint must not hold the reply.
+const pingTimeout = 5 * time.Second
+
+func getJSON(ctx context.Context, url string, out any) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
@@ -0,0 +1,116 @@
+package llm
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+// VLLMClient talks to an OpenAI-compatible /v1/chat/completions endpoint.
+type VLLMClient struct {
+	backend
+}
+
+func (c *VLLMClient) Backend() string { return "vllm" }
+
+type vllmMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+type vllmRequest struct {
+	Model       string        `json:"model"`
+	Messages    []vllmMessage `json:"messages"`
+	MaxTokens   int           `json:"max_tokens,omitempty"`
+	Temperature float64       `json:"temperature,omitempty"`
+	Stream      bool          `json:"stream"`
+	// ChatTemplateKwargs is a vLLM extension to the OpenAI schema. It is how
+	// Qwen3-family reasoning is switched off; the Ollama backend spells the
+	// same intent as its native "think": false.
+	ChatTemplateKwargs map[string]any `json:"chat_template_kwargs,omitempty"`
+}
+
+// Generate posts a single non-streaming completion and returns the message
+// content. The raw prompt is sent as one user message so the server-side chat
+// template still wraps it.
+func (c *VLLMClient) Generate(ctx context.Context, req Request) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, c.timeoutFor(req))
+	defer cancel()
+
+	msgs := make([]vllmMessage, 0, 2)
+	if req.System != "" {
+		msgs = append(msgs, vllmMessage{Role: "system", Content: req.System})
+	}
+	msgs = append(msgs, vllmMessage{Role: "user", Content: req.Prompt})
+
+	body, err := json.Marshal(vllmRequest{
+		Model:              c.model,
+		Messages:           msgs,
+		MaxTokens:          req.MaxTokens,
+		Temperature:        req.Temperature,
+		Stream:             false,
+		ChatTemplateKwargs: map[string]any{"enable_thinking": false},
+	})
+	if err != nil {
+		return "", fmt.Errorf("vllm: marshal payload: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost,
+		c.endpoint+"/v1/chat/completions", bytes.NewReader(body))
+	if err != nil {
+		return "", fmt.Errorf("vllm: build request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("vllm request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("vllm: read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("vllm HTTP %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content string `json:"content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return "", fmt.Errorf("vllm: parse response: %w", err)
+	}
+	if len(result.Choices) == 0 {
+		return "", fmt.Errorf("vllm: empty choices in response")
+	}
+	return StripThink(result.Choices[0].Message.Content), nil
+}
+
+// Ping lists served models via the OpenAI-compatible /v1/models.
+func (c *VLLMClient) Ping(ctx context.Context) ([]string, error) {
+	ctx, cancel := context.WithTimeout(ctx, pingTimeout)
+	defer cancel()
+
+	var out struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	if err := getJSON(ctx, c.endpoint+"/v1/models", &out); err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(out.Data))
+	for _, m := range out.Data {
+		names = append(names, m.ID)
+	}
+	return names, nil
+}
@@ -48,6 +48,20 @@ type Fact struct {
 	Milestone  string   `json:"milestone,omitempty"`
 	OccurredAt int64    `json:"occurred_at"`
 	NoPush     bool     `json:"no_push,omitempty"` // backfill: suppress Pete web-push
+	// RunID names the expedition this fact is the ENDING of, and only the three
+	// facts that are one carry it: a clear, a retreat, a death. It is what lets
+	// Pete's dispatch link back to the run's own report — the log, the numbers,
+	// the moment it turned — instead of leaving a paragraph about an outcome with
+	// no way back to what produced it. Empty everywhere else, and safe to be
+	// empty: Pete renders the dispatch exactly as it did before the report existed.
+	RunID string `json:"run_id,omitempty"`
+	// Headline/Lede are LLM-authored prose for this fact, both optional. Pete
+	// prefers them over its own template when present and past its prose-guard,
+	// and falls back to the template otherwise — so an empty pair (LLM off, or
+	// authoring failed) is the normal, safe case. Populated by emitFact; see
+	// authorDispatch. Names in the prose must come only from Actors.
+	Headline string `json:"headline,omitempty"`
+	Lede     string `json:"lede,omitempty"`
 }

 // Config controls the seam. Enabled=false makes Emit a durable no-op (nothing
@@ -245,14 +259,142 @@ type RosterEntry struct {
 	Region    string `json:"region,omitempty"`
 	Day       int    `json:"day,omitempty"`
 	IdleHours int    `json:"idle_hours,omitempty"`
+
+	// Detail is the public, expanded sheet — stats and equipped gear — shown on
+	// the click-through detail page. Nil for an entry we couldn't fully load.
+	// Public-tier: no Matrix handle, keyed only by the anonymous Token, same as
+	// the summary fields above.
+	Detail *RosterDetail `json:"detail,omitempty"`
+}
+
+// RosterDetail is everything a visitor may see on an adventurer's detail page:
+// the current combat sheet and equipped gear, plus live expedition context. It
+// rides the roster push because it is small and shares the board's semantics —
+// a photograph of the present, fine to drop and refresh, never a handle.
+type RosterDetail struct {
+	HPCurrent  int        `json:"hp_current"`
+	HPMax      int        `json:"hp_max"`
+	TempHP     int        `json:"temp_hp,omitempty"`
+	ArmorClass int        `json:"armor_class"`
+	Abilities  [6]int     `json:"abilities"` // STR, DEX, CON, INT, WIS, CHA scores
+	Modifiers  [6]int     `json:"modifiers"` // matching ability modifiers
+	Gear       []GearItem `json:"gear,omitempty"`
+	// Expedition context, present only while on a run.
+	Supplies    int        `json:"supplies,omitempty"`
+	ThreatLevel int        `json:"threat_level,omitempty"`
+	Room        string     `json:"room,omitempty"`
+	Map         *RosterMap `json:"map,omitempty"`
+	// Party is who else is on this expedition, leader first. Absent for a solo
+	// run — a party of one is not a party, and the page should say nothing rather
+	// than draw a roster with a single chair in it.
+	Party []PartySeatView `json:"party,omitempty"`
+	// PartyKnown says this sender knows what a party seat is. It is a fact about
+	// the build, never about the character, so it is set unconditionally on every
+	// sheet — in town, solo, or seated with three others — and must never be
+	// computed from whether Party has anything in it.
+	//
+	// Party being omitempty is why it exists: a solo run and a game box too old to
+	// push seats both arrive at Pete as an empty slice, and Pete's page has to
+	// decide from that whether the viewer may throw away everybody else's day. An
+	// old build sends no key, which lands as false, and Pete withholds the button.
+	// No omitempty here for the same reason — an absent field is the fail-closed
+	// answer and this one is never absent on purpose.
+	PartyKnown bool `json:"party_known"`
+}
+
+// PartySeatView is one body on a shared expedition, as the public page may see
+// it. Kind is what the seat *is*, which the game keeps carefully separate:
+// "leader" owns the expedition row everyone else references, "member" is another
+// player, "companion" is the hired NPC (Pete) who fights but has no mailbox and
+// no loot.
+//
+// Name/Token are the same pair the board and the Siege muster use. The opt-out
+// rule here is the Siege *contributor* rule, not the realm-occupant rule: an
+// opted-out player's seat is anonymised (kept, with no name and no token) rather
+// than deleted. A party of three that renders as two is a false statement about
+// the run — the supply burn, the enemy scaling and the loot split all felt three
+// bodies — whereas an unnamed seat says only that somebody else was there, which
+// the zone line on this same page already implies.
+type PartySeatView struct {
+	Kind  string `json:"kind"` // leader|member|companion
+	Name  string `json:"name,omitempty"`
+	Token string `json:"token,omitempty"` // empty: opted out, or a companion (no board row)
+	Level int    `json:"level,omitempty"`
+}
+
+// RosterMap is the fog-of-war cut of an adventurer's zone graph: every node
+// they have visited, plus the one-hop frontier of doors leading out of visited
+// nodes, with the rooms behind those doors withheld. It is per-adventurer and
+// rides the roster push beside Room. Only ids and kinds cross the wire — a
+// ZoneNode's Label and Content (encounter, loot bias, narration) are spoilers
+// and never leave the game box. Frontier nodes carry kind "unknown".
+type RosterMap struct {
+	ZoneID      string          `json:"zone_id"`
+	CurrentNode string          `json:"current_node"`
+	Visited     []string        `json:"visited"`
+	Nodes       []RosterMapNode `json:"nodes"`
+	Edges       []RosterMapEdge `json:"edges"`
+}
+
+// RosterMapNode is one room reduced to what a public map may show.
+type RosterMapNode struct {
+	ID   string `json:"id"`
+	Kind string `json:"kind"` // ZoneNodeKind, or "unknown" for an unreached frontier room
+}
+
+// RosterMapEdge is one directed passage. Lock names the gate kind
+// (perception_check, key_required, ...) so the map can mark a door as barred;
+// LockData and Hint stay behind on the game box.
+type RosterMapEdge struct {
+	From string `json:"from"`
+	To   string `json:"to"`
+	Lock string `json:"lock,omitempty"`
+}
+
+// GearItem is one equipped piece for the armor/gear panel.
+type GearItem struct {
+	Slot       string `json:"slot"` // weapon | armor | helmet | boots | tool
+	Name       string `json:"name"`
+	Tier       int    `json:"tier"`
+	Condition  int    `json:"condition"`
+	Masterwork bool   `json:"masterwork,omitempty"`
+}
+
+// MischiefBalance is one buyer's advisory euro balance, ridden along with the
+// board. It is keyed by localpart — a buyer's own sign-in name — not by the
+// anonymous roster token, so it lives in a separate keyspace on Pete and only
+// ever surfaces for the one authenticated user asking about themselves. That is
+// what lets the storefront grey out tiers a buyer can't afford without ever
+// putting a number next to a name on the public board.
+type MischiefBalance struct {
+	Username string  `json:"username"`
+	Euro     float64 `json:"euro"`
+}
+
+// MischiefTier is one rung of the storefront price list. gogobee is the sole
+// authority on prices, so it pushes the whole catalog on every tick: a fee
+// retune reaches the storefront within a snapshot and Pete never hardcodes a
+// number that can silently drift out of step with the game.
+type MischiefTier struct {
+	Key       string `json:"key"`
+	Display   string `json:"display"`
+	Fee       int    `json:"fee"`
+	SignedFee int    `json:"signed_fee"`
+	Blurb     string `json:"blurb,omitempty"`
 }

 // RosterSnapshot is the complete board. Complete is load-bearing: Pete replaces
 // its whole board with this, so anyone omitted (opted out, no character) drops
 // off the public page. A partial snapshot would silently strand people on it.
+//
+// Balances and Tiers ride the same tick — advisory affordability and the live
+// price list for the mischief storefront. Both are best-effort on Pete's side; a
+// board that lands without them is still a good board.
 type RosterSnapshot struct {
-	SnapshotAt  int64         `json:"snapshot_at"`
-	Adventurers []RosterEntry `json:"adventurers"`
+	SnapshotAt  int64             `json:"snapshot_at"`
+	Adventurers []RosterEntry     `json:"adventurers"`
+	Balances    []MischiefBalance `json:"balances,omitempty"`
+	Tiers       []MischiefTier    `json:"tiers,omitempty"`
 }

 // PushRoster sends the board to Pete, synchronously, and drops it on failure.
@@ -274,6 +416,453 @@ func PushRoster(ctx context.Context, snap RosterSnapshot) error {
 	return std.post(ctx, "/api/ingest/roster", payload)
 }

+// SiegeDefender is one adventurer's standing in the current Siege muster.
+//
+// Token is the same public board token the roster uses, so Pete can link a
+// defender to their page — and it is EMPTY for an opted-out player, with Name
+// carrying anonName instead. That is the whole opt-out story here: their damage
+// still counts and still holds its rank (the town's effort is the town's), but
+// there is no name to click. It differs from the board's rule (omit entirely)
+// on purpose — a defender board that silently dropped contributors would
+// understate what the town actually did to the boss.
+type SiegeDefender struct {
+	Token       string `json:"token,omitempty"`
+	Name        string `json:"name"`
+	Level       int    `json:"level,omitempty"`
+	Fights      int    `json:"fights"`
+	Damage      int    `json:"damage"`
+	FoughtToday bool   `json:"fought_today"`
+}
+
+// SiegePast is one closed-out Siege for the history table.
+type SiegePast struct {
+	BossID      int64  `json:"boss_id"`
+	BossName    string `json:"boss_name"`
+	Tier        int    `json:"tier"`
+	Outcome     string `json:"outcome"` // "defeated" | "survived"
+	HPRemaining int    `json:"hp_remaining"`
+	HPMax       int    `json:"hp_max"`
+	Defenders   int    `json:"defenders"`
+	MVP         string `json:"mvp,omitempty"`
+	MVPFights   int    `json:"mvp_fights,omitempty"`
+	EndedAt     int64  `json:"ended_at"`
+}
+
+// SiegeSnapshot is the complete war room: the live boss (if any), its muster,
+// and every Siege that came before. Same complete-snapshot contract as the
+// roster — Pete replaces its copy — so a defender omitted here leaves the board
+// and a resolved Siege stops showing a live bar.
+//
+// Defenders carries EVERY alive adventurer, not just contributors. The zero-fight
+// rows are the point: one bout per person per day means somebody who hasn't
+// swung today is a hit the town hasn't taken, and the page can only show that gap
+// if the people in it are on the wire.
+type SiegeSnapshot struct {
+	SnapshotAt int64           `json:"snapshot_at"`
+	Active     bool            `json:"active"`
+	BossID     int64           `json:"boss_id,omitempty"`
+	BossName   string          `json:"boss_name,omitempty"`
+	Tier       int             `json:"tier,omitempty"`
+	HPCurrent  int             `json:"hp_current"`
+	HPMax      int             `json:"hp_max"`
+	StartsAt   int64           `json:"starts_at,omitempty"`
+	EndsAt     int64           `json:"ends_at,omitempty"`
+	BoutsToday int             `json:"bouts_today"`
+	Defenders  []SiegeDefender `json:"defenders,omitempty"`
+	History    []SiegePast     `json:"history,omitempty"`
+}
+
+// PushSiege sends the war room to Pete, synchronously, and drops it on failure —
+// the same drop-the-lie semantics as PushRoster. A retried snapshot would claim
+// a pool level that has since moved, and the next tick carries the truth anyway.
+func PushSiege(ctx context.Context, snap SiegeSnapshot) error {
+	if !Enabled() {
+		return nil
+	}
+	payload, err := json.Marshal(snap)
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/ingest/siege", payload)
+}
+
+// RunBeat is one structured moment inside an expedition run: a room entered, a
+// fight resolved, a trap sprung, a haul taken. Facts, never prose — Pete owns
+// the words, exactly as it does for a Fact. The engine already narrates every
+// one of these to Matrix and then throws the narration away; this carries the
+// shape underneath it so Pete can retell the run to somebody who wasn't there.
+//
+// (RunID, Seq) is the identity. Seq is monotonic per run and assigned at record
+// time, so Pete can order a batch that arrives out of order and drop a duplicate
+// without comparing contents.
+//
+// Nothing here is player-identifying except Token, which rides the `start` beat
+// only and is the same public board token the roster uses. An opted-out player's
+// beats are never pushed at all — see pushRunBeats.
+type RunBeat struct {
+	RunID      string `json:"run_id"`
+	Seq        int64  `json:"seq"`
+	Kind       string `json:"kind"` // start|room|combat|trap|treasure|haul|lock|camp|region|end|summary
+	OccurredAt int64  `json:"occurred_at"`
+
+	Token      string `json:"token,omitempty"` // `start` only: whose run this is
+	Name       string `json:"name,omitempty"`  // `start` only: character name
+	Level      int    `json:"level,omitempty"` // `start` only
+	Zone       string `json:"zone,omitempty"`
+	Region     string `json:"region,omitempty"`
+	Room       int    `json:"room,omitempty"`        // 1-based, as the player sees it
+	TotalRooms int    `json:"total_rooms,omitempty"` // 0 when unknown
+	RoomKind   string `json:"room_kind,omitempty"`   // entry|exploration|trap|elite|boss|secret
+	Target     string `json:"target,omitempty"`      // monster, item, region, lock — the noun
+	Outcome    string `json:"outcome,omitempty"`
+	Amount     int    `json:"amount,omitempty"` // damage taken, or a total quantity
+	Count      int    `json:"count,omitempty"`  // how many distinct things Amount covers
+	HP         int    `json:"hp,omitempty"`
+	HPMax      int    `json:"hp_max,omitempty"`
+	Crits      int    `json:"crits,omitempty"`
+	Fumbles    int    `json:"fumbles,omitempty"`
+	// Prose is the single exception to "nouns and numbers only", and it is
+	// confined to the one kind that has any: `summary`, the three sentences the
+	// local model writes over a finished run. Pete guards it exactly as it guards
+	// a dispatch lede and drops the words (not the beat) on a rejection. Every
+	// other kind must leave this empty — Pete scrubs it if they don't.
+	Prose string `json:"prose,omitempty"`
+}
+
+// RealmZone is one zone as the realm map draws it: what it is, who first got
+// through it, how many have since, and who is inside it right now.
+//
+// FirstClearBy is a character name and FirstClearToken the public board token,
+// exactly as the Siege muster pairs them — and the token is EMPTY for a player
+// who has opted out, keeping the name off the page too (see buildRealmSnapshot:
+// an opted-out first-clearer is anonymised, not deleted, because deleting the
+// claim would make the zone read as never-cleared, which is a different and
+// false statement about the realm).
+type RealmZone struct {
+	ID         string `json:"id"`
+	Display    string `json:"display"`
+	Tier       int    `json:"tier"`
+	LevelMin   int    `json:"level_min"`
+	LevelMax   int    `json:"level_max"`
+	Faction    string `json:"faction,omitempty"`
+	Atmosphere string `json:"atmosphere,omitempty"`
+	Postgame   bool   `json:"postgame,omitempty"` // T6 mythic: gated, drawn apart
+
+	FirstClearBy    string `json:"first_clear_by,omitempty"`
+	FirstClearToken string `json:"first_clear_token,omitempty"`
+	FirstClearAt    int64  `json:"first_clear_at,omitempty"`
+
+	Clears   int `json:"clears"`   // boss-defeated runs, all time
+	Clearers int `json:"clearers"` // distinct adventurers who have managed it
+
+	Occupants []RealmOccupant `json:"occupants,omitempty"` // in there right now
+}
+
+// RealmOccupant is somebody currently on an expedition in a zone. Same
+// name+token pair as everywhere else, and an opted-out player is omitted
+// outright rather than anonymised: unlike a first clear, presence is not part of
+// a shared tally that stops adding up without them, and "who is in there right
+// now" is exactly the live-location fact the liveblog is careful about.
+type RealmOccupant struct {
+	Token string `json:"token,omitempty"`
+	Name  string `json:"name"`
+	Level int    `json:"level,omitempty"`
+	Day   int    `json:"day,omitempty"`
+}
+
+// RealmFirst is one row of the hall of firsts: a thing that happened in the
+// realm exactly once ever, and who it happened to. The ledger
+// (news_realm_firsts) records only (kind, target, first_at) — the holder is
+// recovered by gogobee at push time from the run history, which is why this is
+// pushed rather than derived on Pete.
+type RealmFirst struct {
+	Kind    string `json:"kind"`             // "zone" | "treasure"
+	Target  string `json:"target"`           // the zone id or treasure key
+	Display string `json:"display"`          // the human name for it
+	Tier    int    `json:"tier,omitempty"`   // zone tier, when kind is "zone"
+	Holder  string `json:"holder,omitempty"` // character name, empty when unrecoverable
+	Token   string `json:"token,omitempty"`  // board token; empty when opted out
+	AtUnix  int64  `json:"at_unix"`          // when the realm first saw it
+}
+
+// RealmStanding is one adventurer's line on the board. Every number here is a
+// lifetime total from the game's own run history — nothing is a rate, an
+// average, or anything that would move on its own while nobody played.
+type RealmStanding struct {
+	Token       string `json:"token,omitempty"`
+	Name        string `json:"name"`
+	Level       int    `json:"level"`
+	ClassRace   string `json:"class_race,omitempty"`
+	DeepestTier int    `json:"deepest_tier"` // deepest zone tier actually cleared
+	Clears      int    `json:"clears"`
+	Zones       int    `json:"zones"`  // distinct zones cleared
+	Firsts      int    `json:"firsts"` // realm-firsts held
+	SiegeDamage int    `json:"siege_damage"`
+	SiegeFights int    `json:"siege_fights"`
+}
+
+// RealmSnapshot is the whole realm as one photograph: every zone, the hall of
+// firsts, and the board. Snapshot semantics, like the roster and the Siege —
+// Pete replaces its copy and a failed push is dropped, not retried.
+//
+// It is pushed on the roster ticker but NOT every tick: none of it moves fast
+// enough to be worth the aggregate queries every two minutes, and the page's
+// staleness window is generous for exactly that reason. See realmPushInterval.
+type RealmSnapshot struct {
+	SnapshotAt int64           `json:"snapshot_at"`
+	Zones      []RealmZone     `json:"zones,omitempty"`
+	Firsts     []RealmFirst    `json:"firsts,omitempty"`
+	Standings  []RealmStanding `json:"standings,omitempty"`
+}
+
+// PushRealm sends the realm pages' backing data to Pete. Drop-on-failure, same
+// as the other two snapshots.
+func PushRealm(ctx context.Context, snap RealmSnapshot) error {
+	if !Enabled() {
+		return nil
+	}
+	payload, err := json.Marshal(snap)
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/ingest/realm", payload)
+}
+
+// PushRunBeats delivers a batch of beats. Unlike the snapshots this is
+// append-only and IS retried — a dropped beat is a hole in a story, not a stale
+// number that the next tick corrects. The caller only marks rows sent on success.
+func PushRunBeats(ctx context.Context, beats []RunBeat) error {
+	if !Enabled() || len(beats) == 0 {
+		return nil
+	}
+	payload, err := json.Marshal(struct {
+		Beats []RunBeat `json:"beats"`
+	}{beats})
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/ingest/run", payload)
+}
+
+// PlayerDetail is the private, owner-only expansion for one player: inventory,
+// vault, house, and pets. Like MischiefBalance it is keyed by localpart (the
+// sign-in name), in its own keyspace on Pete — Pete only ever serves it back to
+// the one authenticated user it belongs to, never on the public board. It
+// carries the player's current board Token too, so Pete can answer "is the
+// signed-in viewer the owner of the adventurer on this page?" by a join, without
+// ever having to reverse the one-way token.
+type PlayerDetail struct {
+	Localpart string     `json:"localpart"`
+	Token     string     `json:"token"`
+	Inventory []ItemView `json:"inventory,omitempty"`
+	Vault     []ItemView `json:"vault,omitempty"`
+	Equipped  []ItemView `json:"equipped,omitempty"`
+	House     HouseView  `json:"house"`
+	Pets      []PetView  `json:"pets,omitempty"`
+	// Slots is the 5 standard equipment slots (weapon/armor/helmet/boots/tool) for
+	// the web management panel. Worn masterwork/arena pieces surface here (via
+	// CanTakeOff), not in Equipped, which stays magic-only (the DnD slots).
+	Slots []EquipSlotView `json:"slots,omitempty"`
+	// Balance is the owner's euro balance, for the web's upgrade/repair confirm.
+	// No omitempty: a €0 balance is a real, informative fact (a broke player), not
+	// an absent one — dropping it would let the confirm dialog show a stale amount.
+	Balance float64 `json:"balance"`
+	// Zones is where this adventurer may go right now, priced. It is the offer
+	// list behind the web's "send on expedition" picker: level gating and the T6
+	// postgame gate are resolved here, so a zone the player cannot enter is simply
+	// absent rather than shown and then refused. Empty while they are already out.
+	Zones []ZoneOffer `json:"zones,omitempty"`
+	// Resume is the extracted expedition waiting to be walked back into, priced
+	// the same way. Absent when there is nothing to resume.
+	Resume *ResumeOffer `json:"resume,omitempty"`
+	// Babysit is the pet-care subscription's standing and price. Always present
+	// for a live adventurer: "you already have one" is as useful to the page as a
+	// price is.
+	Babysit *BabysitOffer `json:"babysit,omitempty"`
+}
+
+// ZoneOffer is one place the owner may set out for, with what the trip costs.
+// Pete renders these and does no arithmetic — the prices are the game's, quoted
+// at push time, and gogobee re-quotes them for real when the order lands.
+type ZoneOffer struct {
+	ID       string         `json:"id"`
+	Display  string         `json:"display"`
+	Tier     int            `json:"tier"`
+	Hook     string         `json:"hook,omitempty"`
+	Postgame bool           `json:"postgame,omitempty"`
+	Loadouts []LoadoutOffer `json:"loadouts,omitempty"`
+}
+
+// LoadoutOffer is one supply preset for a zone: what it is called, what it
+// costs, and roughly how long it lasts. Key is the token the order carries back.
+type LoadoutOffer struct {
+	Key   string `json:"key"` // lean|balanced|heavy
+	Name  string `json:"name"`
+	Blurb string `json:"blurb,omitempty"`
+	Cost  int    `json:"cost"`
+	Days  int    `json:"days"` // provisions at the zone's daily burn
+}
+
+// ResumeOffer is the extracted expedition the owner can still walk back into,
+// with the same priced loadouts as a fresh departure. ExpiresAt is the end of
+// the seven-day window, so the page can say how long is left rather than just
+// that there is a way back.
+type ResumeOffer struct {
+	ZoneID    string         `json:"zone_id"`
+	Display   string         `json:"display"`
+	Tier      int            `json:"tier"`
+	Day       int            `json:"day"`
+	ExpiresAt int64          `json:"expires_at,omitempty"`
+	Loadouts  []LoadoutOffer `json:"loadouts,omitempty"`
+}
+
+// BabysitOffer is the sitter's standing and price. WeekCost/MonthCost are the
+// two durations the game sells; they scale with level, which is why they are
+// pushed rather than hardcoded on Pete.
+type BabysitOffer struct {
+	Active    bool  `json:"active"`
+	ExpiresAt int64 `json:"expires_at,omitempty"`
+	WeekCost  int   `json:"week_cost"`
+	MonthCost int   `json:"month_cost"`
+}
+
+// EquipSlotView is one of the 5 standard equipment slots, carrying what the web
+// management panel needs: what's worn now, whether it round-trips to the pack
+// (masterwork/arena), the next tier's name and price for an upgrade offer, and a
+// repair cost when the piece is damaged. Pete renders it and trusts only these
+// facts — a client-forged tier or price is resolved back against this view.
+type EquipSlotView struct {
+	Slot       string  `json:"slot"` // weapon|armor|helmet|boots|tool
+	Name       string  `json:"name"`
+	Tier       int     `json:"tier"`
+	Condition  int     `json:"condition"`
+	Masterwork bool    `json:"masterwork,omitempty"`
+	ArenaTier  int     `json:"arena_tier,omitempty"`
+	CanTakeOff bool    `json:"can_take_off,omitempty"` // masterwork/arena → round-trippable
+	NextTier   int     `json:"next_tier,omitempty"`    // 0 = at max tier (5)
+	NextName   string  `json:"next_name,omitempty"`
+	NextPrice  float64 `json:"next_price,omitempty"`
+	RepairCost int     `json:"repair_cost,omitempty"` // 0 = full condition
+}
+
+// ItemView is one item in the private panels — backpack, vault, or worn.
+//
+// Slot/SkillSource/Desc/Effect are display resolutions done at the push site,
+// because an adventure_inventory row carries none of them: descriptions live on
+// MagicItem/EquipmentDef, and the combat delta is computed, never stored.
+//
+// SkillSource is only the player-facing skill a masterwork piece draws on
+// ("mining"). Inventory rows smuggle "magic_item:<id>" through the same column
+// as an internal registry pointer; that is not a fact about the item and never
+// goes on the wire.
+//
+// Attunement (does it need a bond) and Attuned (does it have one) are distinct:
+// with a hard cap of 3 bonds, a worn item can sit inert, and a player deciding
+// what to wear needs to see the difference.
+type ItemView struct {
+	// ID is the adventure_inventory row id, sent only for a backpack item the
+	// magic-item equip path will accept — so a non-zero ID is also the signal that
+	// this item can be equipped from the web. Worn and vault rows carry none: a
+	// worn item unequips by slot, and a vault item can't be equipped at all. Pete
+	// round-trips this id in an equip order; the table is AUTOINCREMENT, so a stale
+	// id (item already moved) misses cleanly rather than hitting the wrong row.
+	ID          int64  `json:"id,omitempty"`
+	Name        string `json:"name"`
+	Type        string `json:"type"`
+	Tier        int    `json:"tier"`
+	Value       int64  `json:"value"`
+	Temper      int    `json:"temper,omitempty"`
+	Slot        string `json:"slot,omitempty"`
+	SkillSource string `json:"skill_source,omitempty"`
+	Desc        string `json:"desc,omitempty"`
+	Effect      string `json:"effect,omitempty"`
+	Attunement  bool   `json:"attunement,omitempty"`
+	Attuned     bool   `json:"attuned,omitempty"`
+	// Compare pairs a backpack magic item against whatever is worn in the slot it
+	// would equip into, so the owner can tell an upgrade from a sidegrade without
+	// eyeballing two opaque effect strings. Set only on backpack magic items (the
+	// ones that carry an equip ID); worn and vault rows never have it. Owner-private,
+	// rides detail_json — no migration, no public surface.
+	Compare *ItemCompare `json:"compare,omitempty"`
+}
+
+// ItemCompare is the per-stat verdict for equipping a backpack magic item over
+// what is currently worn in its slot. gogobee computes it (the power math folds
+// in tempering and bond availability, which live in the engine); Pete only
+// renders it and does no arithmetic.
+type ItemCompare struct {
+	// Verdict is one of: upgrade, downgrade, sidegrade, same, new, inert.
+	//   upgrade   every changed stat a gain
+	//   downgrade every changed stat a loss
+	//   sidegrade mixed — some better, some worse; no winner claimed
+	//   same      no stat differs
+	//   new       the target slot is empty; equipping fills it
+	//   inert     needs a bond and none is free — wearing it would do nothing
+	Verdict string `json:"verdict"`
+	// VsName is the worn item being replaced; "" when Verdict is new (empty slot).
+	VsName string `json:"vs_name,omitempty"`
+	// VsSlot is the slot the item would land in (e.g. "ring_1").
+	VsSlot string `json:"vs_slot,omitempty"`
+	// Deltas is one entry per changed stat, each flagged better/worse. Engine-
+	// rendered player-facing text; Pete draws arrows off Better and does no math.
+	Deltas []ItemDelta `json:"deltas,omitempty"`
+}
+
+// ItemDelta is one stat's change between the candidate item and the worn item.
+type ItemDelta struct {
+	Label  string `json:"label"`
+	Better bool   `json:"better"`
+	Text   string `json:"text"`
+}
+
+// HouseView is the owner's housing summary.
+type HouseView struct {
+	Tier        int     `json:"tier"`
+	LoanBalance int     `json:"loan_balance,omitempty"`
+	Autopay     bool    `json:"autopay,omitempty"`
+	Rate        float64 `json:"rate,omitempty"`
+}
+
+// PetView is one pet slot.
+//
+// XP and XPNeeded are both in **centi-XP** — the engine's own unit, a hundredth
+// of a point, because a pet earns 1.5 XP per action and the ledger is an int.
+// Pete divides by 100 to show it and does no other arithmetic on either number:
+// the curve behind XPNeeded is petXPToNextLevel's, per level band, and it is not
+// Pete's business to know it. XPNeeded is 0 at the level cap, which is the only
+// signal that there is nothing left to fill.
+type PetView struct {
+	Type      string `json:"type"`
+	Name      string `json:"name"`
+	Level     int    `json:"level"`
+	XP        int    `json:"xp,omitempty"`
+	XPNeeded  int    `json:"xp_needed,omitempty"` // 0 = at the level cap
+	ArmorTier int    `json:"armor_tier,omitempty"`
+}
+
+// DetailSnapshot is the complete private-detail set, pushed whole and replacing
+// Pete's copy — same complete-snapshot contract as the roster, so a player who
+// drops out of the game stops having a stale self-view on Pete.
+type DetailSnapshot struct {
+	SnapshotAt int64          `json:"snapshot_at"`
+	Players    []PlayerDetail `json:"players"`
+}
+
+// PushDetails sends the private self-detail set to Pete, best-effort. Like the
+// roster it is dropped on failure — the next tick carries a fresher copy — and
+// it rides its own endpoint (not the roster body) so a fat inventory can't blow
+// the roster push's size budget or its drop-the-lie semantics.
+func PushDetails(ctx context.Context, snap DetailSnapshot) error {
+	if !Enabled() {
+		return nil
+	}
+	payload, err := json.Marshal(snap)
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/ingest/detail", payload)
+}
+
 // post sends one payload to a Pete endpoint with bearer auth. Mirrors the
 // bearer-POST pattern in email_nag.go:sendCode.
 func (c *Client) post(ctx context.Context, path string, payload []byte) error {
@@ -388,6 +977,195 @@ func EmitEscrowVerdict(v EscrowVerdict) {
 	enqueue("escrow:"+v.GUID, escrowVerdictPath, payload)
 }

+// ---------------------------------------------------------------------------
+// The mischief storefront's reverse pipe
+//
+// A buyer places a hit on Pete's web board; we poll for it, do the real work
+// against our own ledger, and hand back a verdict. Same shape as the escrow
+// border above — Pete has no route in, so we poll — but simpler: the order guid
+// is the end-to-end idempotency key (external_id on the euro debit, stamped on
+// the contract), and the *verdict rides the claim itself* rather than a durable
+// queue. If a claim fails, the order stays pending and the next poll re-offers
+// it; re-running is a no-op, so the poll loop is its own retry.
+// ---------------------------------------------------------------------------
+
+// MischiefOrder is one storefront order as Pete describes it. buyer_sub stays on
+// Pete (it is the OIDC subject, only for "my orders"); we get the username, which
+// we turn into a Matrix id, and the anonymous target token.
+type MischiefOrder struct {
+	GUID          string `json:"guid"`
+	BuyerUsername string `json:"buyer_username"`
+	TargetToken   string `json:"target_token"`
+	TargetName    string `json:"target_name"`
+	Tier          string `json:"tier"`
+	Signed        bool   `json:"signed"`
+	Status        string `json:"status"`
+	CreatedAt     int64  `json:"created_at"`
+}
+
+// PendingMischief asks Pete for orders waiting on us. A Pete that predates the
+// storefront answers 404, which surfaces here as an error; the poll loop treats
+// any error as "nothing to do this tick" and logs it quietly, so gogobee can ship
+// ahead of Pete without noise.
+func PendingMischief(ctx context.Context) ([]MischiefOrder, error) {
+	if !Enabled() {
+		return nil, nil
+	}
+	var out []MischiefOrder
+	if err := std.getJSON(ctx, "/api/mischief/pending", &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ClaimMischief files our verdict on an order: the terminal status Pete should
+// show and a human note. Idempotent on Pete, so a retried claim is safe. The
+// verdict rides this call directly — there is no separate durable emit, because
+// a lost claim just leaves the order pending for the next poll to re-run.
+func ClaimMischief(ctx context.Context, guid, status, detail string) error {
+	payload, err := json.Marshal(map[string]string{"guid": guid, "status": status, "detail": detail})
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/mischief/claim", payload)
+}
+
+// ---------------------------------------------------------------------------
+// The equip queue's reverse pipe
+//
+// An owner asks, on their own detail page, to wear or take off an item. Pete
+// records the intent; we poll for it, run the real equip against our own
+// equipment tables, and file a verdict. Same shape as mischief — Pete has no
+// route in — but with one crucial difference: the game action is NOT naturally
+// idempotent (equipping consumes an inventory row and regenerates it on
+// unequip), so re-running a drained order would double-move items. The poller
+// therefore short-circuits on the order guid before it mutates, the way
+// placeWebMischief does on its contract; the guid is still the end-to-end key,
+// but here it guards a non-idempotent action rather than riding a naturally
+// idempotent one.
+// ---------------------------------------------------------------------------
+
+// EquipOrder is one equip/unequip as Pete describes it. owner_localpart is the
+// Matrix localpart of the character to dress; item_id is the adventure_inventory
+// row id for an equip (0 for an unequip, which keys on slot). character_name and
+// item_name are display copy Pete froze at order time; we don't need them.
+type EquipOrder struct {
+	GUID           string `json:"guid"`
+	OwnerLocalpart string `json:"owner_localpart"`
+	ItemID         int64  `json:"item_id"`
+	ItemName       string `json:"item_name"`
+	Slot           string `json:"slot"`
+	Action         string `json:"action"` // equip / unequip / upgrade / repair
+	Tier           int    `json:"tier"`   // upgrade target tier (an EquipmentSlot tier); unused by the others
+	Status         string `json:"status"`
+	CreatedAt      int64  `json:"created_at"`
+}
+
+// PendingEquip asks Pete for equip orders waiting on us. A Pete predating the
+// queue answers 404, surfaced here as an error the poll loop logs quietly.
+func PendingEquip(ctx context.Context) ([]EquipOrder, error) {
+	if !Enabled() {
+		return nil, nil
+	}
+	var out []EquipOrder
+	if err := std.getJSON(ctx, "/api/equip/pending", &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// VerdictEquip files our verdict on an equip order. Idempotent on Pete, so a
+// retried verdict is safe; the verdict rides this call directly.
+func VerdictEquip(ctx context.Context, guid, status, detail string) error {
+	payload, err := json.Marshal(map[string]string{"guid": guid, "status": status, "detail": detail})
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/equip/verdict", payload)
+}
+
+// ---------------------------------------------------------------------------
+// The action queue
+//
+// The equip queue's sibling, and the first one that plays the game rather than
+// dressing the character. An owner clicks "Pull out" on their own adventurer
+// page or "Take your bout" on the war room; Pete records the intent and we drain
+// it here. Same non-idempotent problem, same answer: the poller guards on the
+// order guid before it runs anything, because an extraction ends a run and a
+// bout spends the day's only swing, and neither converges on a replay.
+//
+// Nothing in an order names a character. Pete resolves that from the session
+// (one account, one localpart, one adventurer) so there is no id on the wire for
+// a client to forge — the contrast with EquipOrder, which has to carry an item
+// id and a slot, is deliberate.
+// ---------------------------------------------------------------------------
+
+// AdvOrder is one requested action as Pete describes it. owner_localpart is the
+// Matrix localpart whose adventurer acts; token and character_name are display
+// copy Pete froze at order time and we ignore both.
+type AdvOrder struct {
+	GUID           string `json:"guid"`
+	OwnerLocalpart string `json:"owner_localpart"`
+	Token          string `json:"token"`
+	CharacterName  string `json:"character_name"`
+	Action         string `json:"action"`
+	Status         string `json:"status"`
+	CreatedAt      int64  `json:"created_at"`
+	// Params is the verb's arguments, and only the verbs that take any carry it:
+	// which zone, which supply loadout, how many days of sitting. It never names
+	// an adventurer — that still comes from the session on Pete's side — and
+	// every field in it is re-resolved against the game's own tables before it
+	// means anything, so a forged zone or a forged price buys nothing.
+	Params *AdvOrderParams `json:"params,omitempty"`
+}
+
+// AdvOrderParams is the union of every verb's arguments, flat rather than
+// per-verb because there are three of them and each reads one or two fields.
+// Anything a verb does not read is ignored rather than rejected.
+type AdvOrderParams struct {
+	Zone    string `json:"zone,omitempty"`    // zone id, for expedition_start
+	Loadout string `json:"loadout,omitempty"` // lean|balanced|heavy, for expedition_start / resume
+	Days    int    `json:"days,omitempty"`    // 7 or 30, for babysit
+}
+
+// Action names, the wire contract's half of storage.AdvAction* on Pete.
+const (
+	AdvOrderExtract    = "extract"
+	AdvOrderSiegeJoin  = "siege_join"
+	AdvOrderExpedition = "expedition_start"
+	AdvOrderResume     = "expedition_resume"
+	AdvOrderBabysit    = "babysit"
+	// The three doors the web verbs' own refusal text used to name without
+	// offering: `!expedition abandon`, `!expedition leave`, `!adventure babysit
+	// cancel`. None of them takes an argument and none of them spends money.
+	AdvOrderAbandon       = "expedition_abandon"
+	AdvOrderLeave         = "expedition_leave"
+	AdvOrderBabysitCancel = "babysit_cancel"
+)
+
+// PendingOrders asks Pete for web actions waiting on us. A Pete predating the
+// queue answers 404, surfaced here as an error the poll loop logs quietly.
+func PendingOrders(ctx context.Context) ([]AdvOrder, error) {
+	if !Enabled() {
+		return nil, nil
+	}
+	var out []AdvOrder
+	if err := std.getJSON(ctx, "/api/adventure/orders/pending", &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// VerdictOrder files our verdict on a web action. Idempotent on Pete, so a
+// retried verdict is safe.
+func VerdictOrder(ctx context.Context, guid, status, detail string) error {
+	payload, err := json.Marshal(map[string]string{"guid": guid, "status": status, "detail": detail})
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/adventure/orders/verdict", payload)
+}
+
 // getJSON does a bearer-authed GET and decodes the body.
 func (c *Client) getJSON(ctx context.Context, path string, out any) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.cfg.IngestURL+path, nil)
@@ -1205,6 +1205,11 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 			Emoji: "🗺️",
 			Check: func(d *sql.DB, u id.UserID) bool { return clearedAnyZoneOfTier(d, u, 5) },
 		},
+		{
+			ID: "expedition_clear_t6", Name: "Off the Edge of the Map", Description: "Cleared a Mythic zone. The map never went this far. Neither should you have.",
+			Emoji: "🗺️",
+			Check: func(d *sql.DB, u id.UserID) bool { return clearedAnyZoneOfTier(d, u, 6) },
+		},
 		{
 			ID: "expedition_master_t1", Name: "Warren Cartography", Description: "Cleared every Tier 1 zone. Thorough.",
 			Emoji: "🧭",
@@ -1230,6 +1235,11 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 			Emoji: "🧭",
 			Check: func(d *sql.DB, u id.UserID) bool { return clearedEveryZoneOfTier(d, u, 5) },
 		},
+		{
+			ID: "expedition_master_t6", Name: "There Was No Sixth Tier", Description: "Cleared every Mythic zone. Officially, none of these existed.",
+			Emoji: "🧭",
+			Check: func(d *sql.DB, u id.UserID) bool { return clearedEveryZoneOfTier(d, u, 6) },
+		},
 		{
 			ID: "expedition_quiet_clear", Name: "Nobody Saw Anything", Description: "Cleared a zone without threat ever passing 50. You were never here.",
 			Emoji: "🌑",
@@ -0,0 +1,89 @@
+package plugin
+
+import (
+	"fmt"
+	"log/slog"
+	"time"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// AdminBuildConfirmedCharacter mints (or overwrites) a confirmed D&D character
+// for one user with an explicitly chosen race/class/level, reusing the same
+// constructors as auto-migration and !setup confirm: class-tuned standard
+// array + racial mods, the canonical HP/AC formulas, resource pool, and — for
+// casters — the starter spell list and slot pool.
+//
+// It exists for the "stuck adventurer" cases the boredom ticker can't reach on
+// its own:
+//
+//   - A veteran legacy player with an adventure_characters row but no
+//     dnd_character (never triggered auto-migration because auto-migration only
+//     fires on active play — an idle player never does). Pass the class/race the
+//     faithful migration would infer to reproduce it exactly.
+//   - A player who abandoned !setup at race pick (pending_setup=1, no class), so
+//     tryBoredomStart skips them forever. This overwrites the draft with a
+//     finished sheet.
+//
+// AutoMigrated is set so the player can freely rebuild via !setup (no respec
+// cooldown) when they return — the class was assigned for them, not chosen.
+//
+// SaveDnDCharacter upserts on user_id, so an existing pending draft is replaced.
+// initResources / ensureSpellsForCharacter are idempotent.
+func AdminBuildConfirmedCharacter(userID id.UserID, race DnDRace, class DnDClass, level int) (*DnDCharacter, error) {
+	// Validate (and normalize) race/class through the same parsers !setup uses,
+	// so a typo or a non-playable class fails loudly instead of silently minting
+	// a broken sheet — an unknown class falls through classInfo to 1 HP / AC 10
+	// / no spells, which looks "built" but isn't.
+	r, ok := parseRace(string(race))
+	if !ok {
+		return nil, fmt.Errorf("unknown race %q", race)
+	}
+	cl, ok := parseClass(string(class))
+	if !ok {
+		return nil, fmt.Errorf("unknown or non-playable class %q", class)
+	}
+	race, class = r, cl
+	if level < 1 {
+		level = 1
+	}
+	if level > dndMaxLevel {
+		level = dndMaxLevel
+	}
+	scores := applyRaceMods(race, classStatPriority(class))
+	c := &DnDCharacter{
+		UserID:       userID,
+		Race:         race,
+		Class:        class,
+		Level:        level,
+		STR:          scores[0], DEX: scores[1], CON: scores[2],
+		INT:          scores[3], WIS: scores[4], CHA: scores[5],
+		PendingSetup: false,
+		AutoMigrated: true,
+		CreatedAt:    time.Now().UTC(),
+		UpdatedAt:    time.Now().UTC(),
+	}
+	conMod := abilityModifier(c.CON)
+	dexMod := abilityModifier(c.DEX)
+	c.HPMax = computeMaxHP(c.Class, conMod, c.Level)
+	c.HPCurrent = c.HPMax
+	c.ArmorClass = computeAC(c.Class, dexMod)
+	c.ShortRestCharges = c.Level
+
+	if err := ensurePlayerMetaSeed(userID); err != nil {
+		return nil, fmt.Errorf("seed player_meta: %w", err)
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		return nil, fmt.Errorf("save dnd_character: %w", err)
+	}
+	if err := initResources(userID, c.Class); err != nil {
+		return nil, fmt.Errorf("init resources: %w", err)
+	}
+	if err := ensureSpellsForCharacter(c); err != nil {
+		return nil, fmt.Errorf("seed spells: %w", err)
+	}
+	slog.Info("admin: built confirmed character",
+		"user", userID, "race", race, "class", class, "level", level,
+		"hp", c.HPMax, "ac", c.ArmorClass)
+	return c, nil
+}
@@ -253,6 +253,12 @@ func (p *AdventurePlugin) Init() error {
 	// deaths, single-holder achievements) the first boot the seam is live, so
 	// launch doesn't open onto an empty section. One-shot, kept (see gap #7).
 	p.bootstrapPeteNewsBackfill()
+	// Repair the zone half of news_realm_firsts: the original one-shot filtered
+	// on `abandoned = 0` (which does not mean anybody gave up) and dated every
+	// row to the minute it ran. Seeds only, emits nothing. Runs regardless of the
+	// news switches — a ledger that is right only while emission is on mis-tiers
+	// the first dispatch after somebody flips it. One-shot, kept.
+	bootstrapRealmFirstsReseed()
 	// Phase R1 orphan-archive used to run here on every Init, but it
 	// over-archived: it treats any active dnd_zone_run row not linked to
 	// an active expedition as a legacy `!adventure dungeon` orphan, which
@@ -290,6 +296,9 @@ func (p *AdventurePlugin) Init() error {
 	go p.expeditionExtractionSweepTicker()
 	go p.expeditionBoredomTicker()
 	go p.mischiefTicker()
+	go p.peteMischiefTicker()
+	go p.peteEquipTicker()
+	go p.peteAdvOrderTicker()

 	// Auto-cashout any arena runs left in 'awaiting' from a prior restart
 	p.arenaCleanupStaleRuns()
@@ -532,6 +541,8 @@ func (p *AdventurePlugin) dispatchCommand(ctx MessageContext) error {
 		return p.handleEquipCmd(ctx)
 	case lower == "equip-magic" || lower == "equipmagic" || lower == "equip magic":
 		return p.handleEquipMagicCmd(ctx)
+	case lower == "unequip-magic" || lower == "unequipmagic" || lower == "unequip magic":
+		return p.handleUnequipMagicCmd(ctx)
 	case lower == "inventory" || lower == "inv":
 		return p.handleInventoryCmd(ctx)
 	case lower == "leaderboard" || lower == "lb":
@@ -593,6 +604,7 @@ const advHelpText = `**Adventure Commands**
 ` + "`!adventure buy <item>`" + ` — Buy equipment (e.g. ` + "`buy Enchanted Blade`" + ` or ` + "`buy 4 sword`" + `)
 ` + "`!adventure equip`" + ` — Equip Masterwork gear from inventory
 ` + "`!adventure equip-magic`" + ` — Equip magic items (curios) into your D&D slots
+` + "`!adventure unequip-magic`" + ` — Take a worn magic item off and return it to inventory
 ` + "`!adventure sell <item>`" + ` — Sell an inventory item (or ` + "`sell all`" + `)
 ` + "`!adventure inventory`" + ` — View your inventory
 ` + "`!adventure vault`" + ` — Store items safely (Tier-4 Established home; ` + "`vault store/take <item>`" + `)
@@ -939,6 +951,8 @@ func (p *AdventurePlugin) resolvePendingInteraction(ctx MessageContext, interact
 		return p.handleMasterworkEquipReply(ctx, interaction)
 	case "magic_equip":
 		return p.resolveMagicEquipReply(ctx, interaction)
+	case "magic_unequip":
+		return p.resolveMagicUnequipReply(ctx, interaction)
 	case "masterwork_equip_confirm":
 		return p.handleMasterworkEquipConfirm(ctx, interaction)
 	case "rival_rps":
@@ -1360,6 +1374,7 @@ func (p *AdventurePlugin) sendTreasureDiscoveryDM(userID id.UserID, char *Advent
 		"{treasure_name}": def.Name,
 		"{bonus_desc}":    def.InventoryDesc,
 		"{location}":      loc.Name,
+		"{location_mid}":  advLocationMidSentence(loc.Name),
 	})

 	p.SendDM(userID, text)
@@ -1376,14 +1391,19 @@ func (p *AdventurePlugin) announceTreasureToRoom(char *AdventureCharacter, def *
 	if def == nil || def.RoomAnnounce == "" {
 		return
 	}
+	// The same story-grade gate feeds Pete's trophy case. Emit before the
+	// games-room check so a find is still recorded as news even when no room is
+	// configured to announce it in.
+	emitTreasureFound(char.UserID, def, loc)
 	gr := gamesRoom()
 	if gr == "" {
 		return
 	}
 	displayName, _ := loadDisplayName(char.UserID)
 	announce := advSubstituteFlavor(def.RoomAnnounce, map[string]string{
-		"{name}":     displayName,
-		"{location}": loc.Name,
+		"{name}":         displayName,
+		"{location}":     loc.Name,
+		"{location_mid}": advLocationMidSentence(loc.Name),
 	})
 	p.SendMessage(id.RoomID(gr), announce)
 }
@@ -1,6 +1,7 @@
 package plugin

 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"strings"
@@ -100,33 +101,91 @@ func (p *AdventurePlugin) handleBabysitCmd(ctx MessageContext, args string) erro
 	}
 }

-func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the ways hiring a sitter can be refused, so the web action queue
+// (pete_orders.go) can pick a verdict without parsing prose. Each is returned
+// inside an advRefusal carrying the finished sentence, so `!adventure babysit`
+// keeps the copy it always sent.
+var (
+	errBabysitNoCharacter = errors.New("babysit: no adventurer")
+	errBabysitActive      = errors.New("babysit: a sitter is already engaged")
+	errBabysitDead        = errors.New("babysit: adventurer is dead")
+	errBabysitBroke       = errors.New("babysit: cannot cover the fee")
+	errBabysitFailed      = errors.New("babysit: could not engage a sitter")
+)
+
+// babysitOutcome is what hiring did, for a caller describing it somewhere other
+// than a DM.
+type babysitOutcome struct {
+	Days    int
+	Cost    int
+	PetName string
+	PetLine string
+	Confirm string
+}
+
+// performBabysitPurchase is `!adventure babysit week|month` minus the command
+// framing. Shared with the web action queue so hiring a sitter from a phone
+// engages the same one, on the same clock, with the same log reset.
+//
+// idemKey, when set, is the web order's guid and moves the fee onto DebitIdem so
+// a re-offered order cannot charge twice.
+func (p *AdventurePlugin) performBabysitPurchase(uid id.UserID, days int, idemKey string) (babysitOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()

-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "No adventurer found. Type `!adventure` to create one.")
+		return babysitOutcome{}, refuseAdv(errBabysitNoCharacter, "No adventurer found. Type `!adventure` to create one.")
 	}

 	if char.BabysitActive {
-		return p.SendDM(ctx.Sender, "🍼 The babysitter is already here. They're not leaving until the job is done.")
+		// A web order that already paid and already engaged the sitter lands here
+		// on the re-offer. The settled fee is what tells that apart from somebody
+		// who really does already have one.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) {
+			// Re-quote the fee rather than leaving it zero: the verdict this
+			// feeds prints the coin figure, and "0 coins" would be a false
+			// receipt for a hire the player did pay for.
+			return babysitOutcome{
+				Days:    days,
+				Cost:    babysitDailyCost(dndLevelForUser(char.UserID)) * days,
+				PetName: char.PetName,
+			}, nil
+		}
+		return babysitOutcome{}, refuseAdv(errBabysitActive, "🍼 The babysitter is already here. They're not leaving until the job is done.")
 	}

 	if !char.Alive {
-		return p.SendDM(ctx.Sender, "Your adventurer is dead. The babysitter does not work with corpses.")
+		return babysitOutcome{}, refuseAdv(errBabysitDead, "Your adventurer is dead. The babysitter does not work with corpses.")
 	}

 	daily := babysitDailyCost(dndLevelForUser(char.UserID))
 	totalCost := daily * days
-	balance := p.euro.GetBalance(char.UserID)
-	if balance < float64(totalCost) {
-		return p.SendDM(ctx.Sender, fmt.Sprintf("🍼 The babysitting service costs %s for %d days. You have %s. The service has standards. Not many, but some.", fmtEuro(totalCost), days, fmtEuro(balance)))
+	if p.euro == nil {
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Coin system unavailable — try again later.")
+	}
+	// Skip the affordability gate on a re-offer that already paid: the fee is a
+	// settled fact, and re-reading the now-lower balance would bounce a sitter the
+	// player has bought.
+	if !(idemKey != "" && p.euro.HasExternalTx(idemKey)) {
+		balance := p.euro.GetBalance(char.UserID)
+		if balance < float64(totalCost) {
+			return babysitOutcome{}, refuseAdv(errBabysitBroke,
+				"🍼 The babysitting service costs %s for %d days. You have %s. The service has standards. Not many, but some.",
+				fmtEuro(totalCost), days, fmtEuro(balance))
+		}
 	}

-	if !p.euro.Debit(char.UserID, float64(totalCost), "babysit_purchase") {
-		return p.SendDM(ctx.Sender, "Payment failed. The babysitter looked at your wallet and walked away.")
+	debited := false
+	if idemKey != "" {
+		ok, _, err := p.euro.DebitIdem(char.UserID, float64(totalCost), "babysit_purchase", idemKey)
+		debited = err == nil && ok
+	} else {
+		debited = p.euro.Debit(char.UserID, float64(totalCost), "babysit_purchase")
+	}
+	if !debited {
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Payment failed. The babysitter looked at your wallet and walked away.")
 	}

 	clearBabysitLogs(char.UserID)
@@ -138,23 +197,40 @@ func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) er

 	if err := saveAdvCharacter(char); err != nil {
 		slog.Error("babysit: failed to save character", "user", char.UserID, "err", err)
-		p.euro.Credit(char.UserID, float64(totalCost), "babysit_refund")
-		return p.SendDM(ctx.Sender, "Something went wrong activating the service. Your gold has been refunded.")
+		if idemKey != "" {
+			if _, _, err := p.euro.CreditIdem(char.UserID, float64(totalCost), "babysit_refund", idemKey+":refund"); err != nil {
+				slog.Error("babysit: refund failed", "user", char.UserID, "order", idemKey, "err", err)
+			}
+		} else {
+			p.euro.Credit(char.UserID, float64(totalCost), "babysit_refund")
+		}
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Something went wrong activating the service. Your gold has been refunded.")
 	}
 	if err := upsertPlayerMetaBabysitState(char.UserID, babysitStateFromAdvChar(char)); err != nil {
 		slog.Error("player_meta: babysit start dual-write failed", "user", char.UserID, "err", err)
 	}

-	confirm := pickBabysitFlavor(babysitConfirmLines)
-	durLabel := "1 week"
-	if days == 30 {
-		durLabel = "1 month"
-	}
-
 	petLine := "No pet to tend yet — the babysitter will keep that in mind."
 	if char.HasPet() {
 		petLine = fmt.Sprintf("Pet: %s (L%d) — daily care included", char.PetName, char.PetLevel)
 	}
+	return babysitOutcome{
+		Days: days, Cost: totalCost, PetName: char.PetName, PetLine: petLine,
+		Confirm: pickBabysitFlavor(babysitConfirmLines),
+	}, nil
+}
+
+// handleBabysitPurchase is the command framing around performBabysitPurchase.
+func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) error {
+	out, err := p.performBabysitPurchase(ctx.Sender, days, "")
+	if err != nil {
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+
+	durLabel := "1 week"
+	if days == 30 {
+		durLabel = "1 month"
+	}

 	text := fmt.Sprintf("🍼 **Adventurer Babysitting Service — Activated**\n\n"+
 		"Duration: %s (%d days)\n"+
@@ -162,7 +238,7 @@ func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) er
 		"%s\n"+
 		"Camp safety: standard camps now rest like fortified ones\n"+
 		"Rival duels: declined on your behalf\n\n"+
-		"_%s_", durLabel, days, totalCost, petLine, confirm)
+		"_%s_", durLabel, days, out.Cost, out.PetLine, out.Confirm)

 	return p.SendDM(ctx.Sender, text)
 }
@@ -209,25 +285,49 @@ func (p *AdventurePlugin) handleBabysitStatus(ctx MessageContext) error {
 	return p.SendDM(ctx.Sender, text)
 }

-func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
-	userMu := p.advUserLock(ctx.Sender)
+// babysitCancelOutcome is what dismissing the sitter did. Summary is the Matrix
+// block of what they got through while they were here — a paragraph of counts,
+// which is right under a DM and too much for a one-line web verdict, so the
+// caller decides whether to print it.
+type babysitCancelOutcome struct {
+	Summary string
+	PetName string
+}
+
+// errBabysitNoSitter is the one way cancelling can be refused. There is no
+// "already cancelled" race to worry about: the check and the write are both under
+// the per-user lock this takes.
+var errBabysitNoSitter = errors.New("babysit: no sitter to dismiss")
+
+// performBabysitCancel is `!adventure babysit cancel` minus the command framing.
+// Shared with the web action queue.
+//
+// This one TAKES the per-user lock, unlike the abandon/leave twins beside it in
+// the order path — because its Matrix caller does not hold it (handleBabysitCmd
+// dispatches straight here, where `!expedition` holds the lock across its whole
+// switch). Its web wrapper must therefore NOT take it. The asymmetry is per verb
+// and is worth checking against the Matrix caller every time one is added.
+//
+// No refund, by design: the sitter was already here.
+func (p *AdventurePlugin) performBabysitCancel(uid id.UserID) (babysitCancelOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()

-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "No adventurer found.")
+		return babysitCancelOutcome{}, refuseAdv(errBabysitNoCharacter, "No adventurer found.")
 	}

 	if !char.BabysitActive {
-		return p.SendDM(ctx.Sender, "🍼 There's nothing to cancel. The babysitter isn't here.")
+		return babysitCancelOutcome{}, refuseAdv(errBabysitNoSitter, "🍼 There's nothing to cancel. The babysitter isn't here.")
 	}

 	logs, err := loadBabysitLogs(char.UserID)
 	if err != nil {
 		slog.Error("babysit: failed to load logs", "user", char.UserID, "err", err)
 	}
-	summary := renderBabysitSummary(char, logs)
+	out := babysitCancelOutcome{Summary: renderBabysitSummary(char, logs), PetName: char.PetName}

 	char.BabysitActive = false
 	char.BabysitExpiresAt = nil
@@ -239,7 +339,15 @@ func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
 		slog.Error("player_meta: babysit cancel dual-write failed", "user", char.UserID, "err", err)
 	}

-	return p.SendDM(ctx.Sender, "🍼 Service cancelled. No refund. The babysitter was already there.\n\n"+summary)
+	return out, nil
+}
+
+func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
+	out, err := p.performBabysitCancel(ctx.Sender)
+	if err != nil {
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+	return p.SendDM(ctx.Sender, "🍼 Service cancelled. No refund. The babysitter was already there.\n\n"+out.Summary)
 }

 // ── Expiry Check ────────────────────────────────────────────────────────────
@@ -231,6 +231,30 @@ var secretRoomDiscovery = map[string]string{
 	"feywild_crossing.illusion_garden":  "🔍 **The Illusion Garden.** A too-kind grove that isn't there when you look straight at it. He can afford beauty here; it costs him nothing to keep.",
 	"dragons_lair.hoard_pillar":         "🔍 **A pillar of hoard.** Coin drifted to the ceiling around a single column the wyrm guards more than gold — as if something at its heart were worth more.",
 	"abyss_portal.reality_seam":         "🔍 **A seam in the real.** The gate's arithmetic frays here, and through the frayed place a hand once reached to leave a thing behind on the way out.",
+
+	// Tier 6 post-game — the Phylactery Verses of the Ossuary Ascendant. Each
+	// is a stanza of the plan Valdris has been reciting to himself for years;
+	// finding one un-writes a line of his invulnerability before the fight.
+	"ossuary_ascendant.f1b2":  "🔍 **The Verse of the Waiting Grave.** Behind a course of bone laid one brick too shallow, the first stanza — inked while he was still only pretending to be dead. Read aloud, it costs him something he was counting on keeping.",
+	"ossuary_ascendant.f2b2":  "🔍 **The Verse of the Bait Long Set.** A reliquary that rings hollow gives up the middle stanza: the years of losing on purpose, written as scripture. He signed each defeat like an appointment kept.",
+	"ossuary_ascendant.cap32": "🔍 **The Verse of the Homecoming.** The highest vertebra was set wrong on purpose, and the last stanza waits inside it — the line about you, by name, arriving exactly on schedule. He did not expect you to read it first.",
+
+	// The Unplace — impossible-geometry pockets. Not hidden so much as
+	// briefly, wrongly, adjacent.
+	"unplace.f1b2":  "🔍 **The Pocket That Isn't.** A corner you already turned is somehow still ahead, and the room it opens onto was never built — but something has been storing things in it anyway.",
+	"unplace.f2b2":  "🔍 **The Unstitched Pocket.** Between two seams the celestial hasn't reached, a gap the geometry forgot to close. What fell through the tear years ago settled here, waiting to be un-fallen.",
+	"unplace.cap32": "🔍 **The Undone Pocket.** A place that is not here, and closer than the door — the shortcut that shouldn't be legal. Whoever last took it left their toll behind, undone but not gone.",
+
+	// The Drowned Star — radiant pockets of the wreck, lit from within by the
+	// dying star Seraphel still shields.
+	"drowned_star.f1b2":  "🔍 **The Radiant Wreck-Pocket.** Off the pilgrim road, past a pressure that folds lesser divers, a pocket of hull still glowing with the star's oldest light — and the offerings of pilgrims who made it this far and no further.",
+	"drowned_star.f2b2":  "🔍 **The Star-Lit Vault.** One lantern here is not a lure. It leads to a vault the trench sealed with radiance instead of stone, and the light has been keeping its contents ten thousand years fresh.",
+	"drowned_star.cap32": "🔍 **The Heart's Own Light.** A crack in the radiance, where the star leaks the light it was born with. Reaching in is reaching into the thing Seraphel has died a little every day to protect.",
+
+	// The Last Meridian — hours the Custodian hasn't decommissioned yet.
+	"last_meridian.f1b2":  "🔍 **The Unspent Hour-Pocket.** The Hour Thief overlooked one recess, and the hour it holds is still whole — sixty unspent minutes the observatory never got to bill.",
+	"last_meridian.f2b2":  "🔍 **The Unwound Vault.** Behind the escapement, on the rhythm's dead beat, a strongroom the pendulum's swing kept sealed. Time out of phase with the rest of the clock, and everything left in it, out of phase too.",
+	"last_meridian.cap32": "🔍 **The Hour Never Struck.** One hour on the great face was never dismantled — never even struck. It is still open, and inside it the world's timekeeping kept a little of everything it measured.",
 }

 // secretRoomDiscoveryLine returns the discovery flavor for a secret room,
@@ -261,6 +285,13 @@ var bossEpilogues = map[ZoneID]string{
 	ZoneFeywildCrossing: "The Thornmother's garden was the loveliest cage on the road, tended for a patient guest. He can afford patience; you are learning why. She wilts, and the too-kind light dims by exactly one degree.",
 	ZoneDragonsLair: "Behind Infernax's hoard, past the last of the gold, a single crown rests on no head — guarded better than the treasure, because it was the one thing here he was ever paid to keep. The dragon dies never knowing what it was.",
 	ZoneAbyssPortal: "Belaxath guarded a door that opens outward, built by someone who only ever meant to leave through it. As the demon falls, the gate does not close. It was never meant to keep things out — only to let one thing come home.",
+
+	// Tier 6 post-game epilogues — beyond the edge of the map.
+	ZoneOssuaryAscendant: "Valdris does not gloat when he goes; he files. His last breath is a clerk's satisfaction — the plan closed, the ledger squared, the grave at last furnished to code. He dies the only person here who was never surprised by anything, and that, more than the crown, is what you take home.",
+	ZoneFirstHoard:       "Aurvandryx never wanted the gold; the gold wanted her, gathered itself into a bed around her clutch the way frost gathers on the warmest thing left in a room. She dies shielding eggs that will not hatch, and the mountain finally, truly cools. Every dragon you ever fought was a scale she shed and forgot.",
+	ZoneUnplace:          "The Seamstress finishes her stitch as she falls, and the wound she was sewing shut simply — stops needing to be. The Unplace folds back into a single honest room. She volunteered for this centuries early, and no one ever came to relieve her. You are the closest thing to relief she got.",
+	ZoneDrownedStar:      "Seraphel lets go. Ten thousand years she would not, and now the dying star sinks the last fathom into the dark and is, mercifully, only dark. She is not sad. She is off-duty, for the first time since the world had names, and the trench goes quiet in a way that is almost a held breath finally let out.",
+	ZoneLastMeridian:     "The Custodian apologizes one final time, on schedule, and then the hour it was dismantling simply doesn't arrive. The clocks do not stop so much as agree to stop mattering. Its contract is complete. It thanks you for your patience — and you realize, too late to ask, who it was that hired it.",
 }

 // bossEpilogueLine returns the campaign capstone for a zone boss, or "" for
@@ -45,6 +45,12 @@ var robbieAllShopGear = "Nothing fancy today but that's alright. Clean inventory
 var robbieLeftConsumable = "Oh -- one more thing. I tucked a %s into your bag on the way out. " +
 	"You've had me round enough times now that it felt rude not to. For the trouble, eh? _winks_"

+// robbieLeftForTheHaul is the big-haul variant: he took enough in one go that
+// walking off with only a handling fee would look bad. Takes the item list.
+var robbieLeftForTheHaul = "Oh -- and I left you something. %s. " +
+	"You had me carting that lot down four flights, and a man who takes that much " +
+	"and gives back nothing isn't a bandit, he's a landlord. _winks_"
+
 // ── Room Announcements ───────────────────────────────────────────────────────

 var robbieRoomStandard = "🎩 Robbie paid %s a visit and collected %d item(s) from their inventory. " +
@@ -232,7 +232,7 @@ var TreasureDiscovery = map[int][]string{
 	// No exclamation marks. No enthusiasm. Just weight.
 	5: {
 		"The {treasure_name}.\n\n" +
-			"You found it in the Abyssal Maw. It found you in the Abyssal Maw. " +
+			"You found it in {location_mid}. It found you in {location_mid}. " +
 			"The distinction matters less at depth.\n" +
 			"BONUS: {bonus_desc}.\n\n" +
 			"It came with you. Some things don't come with you. This one did. " +
@@ -240,15 +240,15 @@ var TreasureDiscovery = map[int][]string{

 		"The {treasure_name} is in your inventory.\n\n" +
 			"BONUS: {bonus_desc}.\n\n" +
-			"This is a Tier 5 rare. The Abyssal Maw doesn't give these up. " +
-			"The Abyssal Maw gave this one up. " +
+			"This is a Tier 5 rare. Nothing in {location_mid} gives these up. " +
+			"Something in {location_mid} gave this one up. " +
 			"That's a sentence worth sitting with.",

 		"You have the {treasure_name}.\n\n" +
 			"BONUS: {bonus_desc}.\n\n" +
-			"It was in the Abyssal Maw. The things that were between you and it " +
+			"It was in {location_mid}. The things that were between you and it " +
 			"are not between anything and anything anymore. " +
-			"The Maw is noting this. So is the item.",
+			"The place is noting this. So is the item.",

 		"The {treasure_name}.\n\n" +
 			"It's warm. It was warm when you found it, which it shouldn't be, " +
@@ -262,14 +262,14 @@ var TreasureDiscovery = map[int][]string{
 			"The {treasure_name}. {bonus_desc}.\n\n" +
 			"You have it. " +
 			"Keep it somewhere it won't be lost. " +
-			"The Abyssal Maw does not give second chances.",
+			"There are no second chances in {location_mid}.",

 		"The {treasure_name} is yours.\n\n" +
 			"BONUS: {bonus_desc}.\n\n" +
-			"The Abyssal Maw had it. You have it now. " +
-			"The Maw is aware of the transfer. " +
-			"The Maw is considering its position. " +
-			"You should not be in the Maw when it finishes considering.",
+			"It sat in {location_mid} until you took it. You have it now. " +
+			"The place is aware of the transfer. " +
+			"The place is considering its position. " +
+			"You should not be in {location_mid} when it finishes considering.",
 	},
 }

@@ -350,19 +350,20 @@ type mischiefContract struct {
 	BlessingCount   int
 	Source          string
 	Outcome         string
+	OrderGUID       string // the web order this was opened for; "" for a Matrix buy
 	CreatedAt       time.Time
 	WindowEndsAt    time.Time
 }

 const mischiefCols = `contract_id, buyer_id, target_id, tier, fee, paid, status, signed,
 	escalation_count, COALESCE(escalated_by, ''), blessing_count, source, COALESCE(outcome, ''),
-	created_at, window_ends_at`
+	COALESCE(order_guid, ''), created_at, window_ends_at`

 func scanMischief(row interface{ Scan(...any) error }) (*mischiefContract, error) {
 	c := &mischiefContract{}
 	err := row.Scan(&c.ID, &c.BuyerID, &c.TargetID, &c.Tier, &c.Fee, &c.Paid, &c.Status,
 		&c.Signed, &c.EscalationCount, &c.EscalatedBy, &c.BlessingCount, &c.Source, &c.Outcome,
-		&c.CreatedAt, &c.WindowEndsAt)
+		&c.OrderGUID, &c.CreatedAt, &c.WindowEndsAt)
 	if err != nil {
 		return nil, err
 	}
@@ -382,14 +383,32 @@ func scanMischief(row interface{ Scan(...any) error }) (*mischiefContract, error
 func insertMischiefContract(c *mischiefContract) error {
 	_, err := db.Get().Exec(
 		`INSERT INTO mischief_contracts
-		 (contract_id, buyer_id, target_id, tier, fee, paid, status, signed, source,
+		 (contract_id, buyer_id, target_id, tier, fee, paid, status, signed, source, order_guid,
 		  created_at, window_ends_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		c.ID, string(c.BuyerID), string(c.TargetID), c.Tier, c.Fee, c.Paid,
-		c.Status, c.Signed, c.Source, c.CreatedAt, c.WindowEndsAt)
+		c.Status, c.Signed, c.Source, c.OrderGUID, c.CreatedAt, c.WindowEndsAt)
 	return err
 }

+// mischiefContractByOrderGUID finds the contract opened for a web order, if one
+// exists. It is the idempotency backstop for the storefront's retrying claim
+// loop: a placement that already created a contract must not create a second, so
+// the loop checks here before it debits or inserts. Returns nil when no contract
+// carries this order (the normal first-attempt case).
+func mischiefContractByOrderGUID(orderGUID string) *mischiefContract {
+	if orderGUID == "" {
+		return nil
+	}
+	row := db.Get().QueryRow(
+		`SELECT `+mischiefCols+` FROM mischief_contracts WHERE order_guid = ?`, orderGUID)
+	c, err := scanMischief(row)
+	if err != nil {
+		return nil // sql.ErrNoRows (the common case) or a scan miss — treat as absent
+	}
+	return c
+}
+
 // blessMischiefContract adds one ward to an open contract and reports whether it
 // took. The cap and the still-open check are in the WHERE clause, not in the
 // caller: the window is a scramble, and a room that piles four blessings in the
@@ -799,6 +818,186 @@ func (p *AdventurePlugin) mischiefSendCmd(ctx MessageContext, fields []string) e
 		mischiefBuyerNote(signed)))
 }

+// Web-order verdicts. These strings are the storefront order statuses Pete files,
+// so they are part of the wire contract — see internal/storage/mischief.go.
+const (
+	mischiefWebPlaced            = "placed"
+	mischiefWebBouncedFunds      = "bounced_funds"
+	mischiefWebBouncedIneligible = "bounced_ineligible"
+)
+
+// mischiefWebResult is the outcome of a web placement. Retry means "leave the
+// order pending" — a transient failure (DB hiccup, half-done state) the poll loop
+// should try again — and is never itself a verdict Pete files.
+type mischiefWebResult struct {
+	Status string
+	Detail string
+	Retry  bool
+}
+
+// placeWebMischief opens a contract for a web storefront order. It is the poll
+// loop's fulfilment path, and differs from the Matrix mischiefSendCmd in exactly
+// the ways a retrying wire demands:
+//
+//   - The order guid is the idempotency key. The euro debit goes through
+//     DebitIdem keyed on it, and the contract is stamped with it, so a claim
+//     whose ack was lost can re-run the whole thing without charging twice or
+//     opening a second contract.
+//   - It debits *before* checking eligibility, then refunds if the target turns
+//     out ineligible. Doing it in that order keeps the money state a pure
+//     function of the guid: on any retry the debit is a settled fact, not a
+//     coin-flip on where we crashed. The Matrix path can afford the friendlier
+//     check-first flow because it never retries.
+//   - It returns a verdict for Pete to render instead of replying in a room.
+//
+// The buyer is DM'd the same way a Matrix buyer is told, and the victim and news
+// feed see exactly what a Matrix contract produces — a web hit is indistinguishable
+// downstream from one placed in chat.
+func (p *AdventurePlugin) placeWebMischief(order peteclient.MischiefOrder) mischiefWebResult {
+	// Already fulfilled on a prior attempt — the surest idempotency check there
+	// is. Report placed without touching money again.
+	if existing := mischiefContractByOrderGUID(order.GUID); existing != nil {
+		return mischiefWebResult{Status: mischiefWebPlaced, Detail: "already placed"}
+	}
+
+	tier, ok := mischiefTierByKey(order.Tier)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "unknown tier"}
+	}
+
+	buyerID, ok := p.mischiefBuyerMXID(order.BuyerUsername)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "unknown buyer"}
+	}
+	targetID, ok := resolveRosterToken(order.TargetToken)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "that adventurer is no longer on the board"}
+	}
+	if targetID == buyerID {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "you can't put a price on your own head"}
+	}
+
+	// Serialise this buyer's placements, same discipline as the Matrix path: two
+	// orders in one poll batch can't both slip past the daily cap.
+	lock := p.advUserLock(buyerID)
+	lock.Lock()
+	defer lock.Unlock()
+
+	now := time.Now().UTC()
+	if n := mischiefBuyerCountSince(buyerID, now.Add(-24*time.Hour)); n >= mischiefBuyerDailyCap {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: fmt.Sprintf("daily limit reached (%d today)", n)}
+	}
+
+	price := tier.Fee
+	if order.Signed {
+		price = mischiefSignedFee(tier.Fee)
+	}
+
+	// Affordability gate, matching the Matrix path: a mischief buy takes no credit,
+	// so a buyer short of the fee is bounced before any money moves. The gate is
+	// skipped on a retry of an order already debited — re-reading the now-lower
+	// balance would wrongly bounce a hit that was already paid for.
+	if !p.euro.HasExternalTx(order.GUID) && int(p.euro.GetBalance(buyerID)) < price {
+		return mischiefWebResult{Status: mischiefWebBouncedFunds, Detail: fmt.Sprintf("a %s runs %s", strings.ToLower(tier.Display), fmtEuro(price))}
+	}
+
+	// Debit, keyed on the order guid so a replay is a no-op. ok=false means the
+	// buyer is already past the debt floor, which the gate above all but rules out.
+	debited, _, err := p.euro.DebitIdem(buyerID, float64(price), "mischief_contract_web", order.GUID)
+	if err != nil {
+		slog.Warn("mischief: web debit errored, will retry", "order", order.GUID, "err", err)
+		return mischiefWebResult{Retry: true}
+	}
+	if !debited {
+		return mischiefWebResult{Status: mischiefWebBouncedFunds, Detail: fmt.Sprintf("a %s runs %s", strings.ToLower(tier.Display), fmtEuro(price))}
+	}
+
+	// From here the buyer is debited; every failure path must refund. The refund
+	// keys on a distinct external id so it can't be swallowed as a replay of the
+	// debit itself.
+	refund := func() {
+		if _, _, err := p.euro.CreditIdem(buyerID, float64(price), "mischief_refund_web", order.GUID+":refund"); err != nil {
+			slog.Error("mischief: web refund failed — buyer is short", "order", order.GUID, "buyer", buyerID, "err", err)
+		}
+	}
+
+	if reason := p.mischiefTargetable(targetID, tier, now); reason != "" {
+		refund()
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: reason}
+	}
+
+	c := &mischiefContract{
+		ID:           uuid.NewString(),
+		BuyerID:      buyerID,
+		TargetID:     targetID,
+		Tier:         tier.Key,
+		Fee:          tier.Fee,
+		Paid:         price,
+		Status:       mischiefStatusOpen,
+		Signed:       order.Signed,
+		Source:       "web",
+		OrderGUID:    order.GUID,
+		CreatedAt:    now,
+		WindowEndsAt: now.Add(mischiefWindow),
+	}
+	if err := insertMischiefContract(c); err != nil {
+		// Distinguish the one legitimate rejection from a transient write failure,
+		// the same way the Matrix path does — the two want opposite handling.
+		if liveMischiefForTarget(targetID) != nil {
+			// A rival contract is already on this target (ours isn't: we checked
+			// order_guid up top). Refund and terminally bounce; the buyer lost a
+			// race, not money.
+			refund()
+			slog.Warn("mischief: web contract lost the race", "order", order.GUID, "target", targetID)
+			return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "someone already sent a monster their way"}
+		}
+		// A real write failure with no rival to blame. Leave the debit in place
+		// and the order pending — the guid makes the next poll's re-run a no-op on
+		// the money and a clean retry on the insert, which is the whole point of
+		// keying on it. Refunding here would both drop a placeable hit and, worse,
+		// hand out a free contract if the retry then succeeded against the credit.
+		slog.Warn("mischief: web contract insert failed, will retry", "order", order.GUID, "target", targetID, "err", err)
+		return mischiefWebResult{Retry: true}
+	}
+
+	p.announceMischiefContract(c, tier)
+	p.dmMischiefVictim(c, tier)
+	emitMischiefContractNews(c, tier)
+	p.dmMischiefWebBuyer(buyerID, c, tier)
+
+	return mischiefWebResult{Status: mischiefWebPlaced, Detail: fmt.Sprintf("a %s is on the way", strings.ToLower(tier.Display))}
+}
+
+// mischiefBuyerMXID reconstructs the buyer's Matrix id from the username Pete
+// sent. Authentik's preferred_username is the Matrix localpart by construction
+// (verified on the MAS box), so the buyer is @<username>:<our homeserver>. We
+// lowercase because Matrix localparts are lowercase and an Authentik display of
+// the name may not be. Fails closed if the client isn't up (tests) or the name
+// is empty.
+func (p *AdventurePlugin) mischiefBuyerMXID(username string) (id.UserID, bool) {
+	lp := strings.ToLower(strings.TrimSpace(username))
+	if lp == "" || p.Client == nil {
+		return "", false
+	}
+	server := p.Client.UserID.Homeserver()
+	if server == "" {
+		return "", false
+	}
+	return id.NewUserID(lp, server), true
+}
+
+// dmMischiefWebBuyer tells a web buyer their hit is out, the same courtesy a
+// Matrix buyer gets in-thread. Best-effort: a buyer with no DM room open just
+// watches the storefront status instead.
+func (p *AdventurePlugin) dmMischiefWebBuyer(buyerID id.UserID, c *mischiefContract, tier mischiefTier) {
+	msg := fmt.Sprintf("😈 The word's out. A **%s** is on its way to **%s** — it finds them in about %s.\n%s",
+		strings.ToLower(tier.Display), p.DisplayName(c.TargetID), formatDuration(mischiefWindow),
+		mischiefBuyerNote(c.Signed))
+	if err := p.SendDM(buyerID, msg); err != nil {
+		slog.Debug("mischief: web buyer DM failed", "buyer", buyerID, "err", err)
+	}
+}
+
 // mischiefOpenContractFor resolves "@user" to the contract currently open against
 // them, or explains why the room can't act on it. A contract already claimed for
 // delivery is deliberately out of reach: the monster is in the room with them and
@@ -0,0 +1,118 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newPetXPTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+// TestGrantPetCombatXPPersists is the regression guard for the bug this fixes:
+// petGrantXP existed but nothing called it, so an un-babysat pet sat at its
+// adoption level forever. A win must move XP on disk.
+func TestGrantPetCombatXPPersists(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp:test")
+
+	pet := PetState{Type: "dog", Name: "Rex", Arrived: true, Level: 1, XP: 0}
+	if err := upsertPlayerMetaPetState(uid, pet); err != nil {
+		t.Fatal(err)
+	}
+
+	if leveled := grantPetCombatXP(uid); len(leveled) != 0 {
+		t.Errorf("one win should not level a fresh pet, got %v", leveled)
+	}
+
+	got, err := loadPetState(uid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.XP != int(petXPPerAction*100) {
+		t.Errorf("XP = %d, want %d", got.XP, int(petXPPerAction*100))
+	}
+	if got.Level != 1 {
+		t.Errorf("Level = %d, want 1", got.Level)
+	}
+}
+
+// TestGrantPetCombatXPLevelsBothSlots checks the second pet earns off the same
+// win, matching the babysit trickle — combat only reads the two pets' averaged
+// procs, so leveling both is not a power spike.
+func TestGrantPetCombatXPLevelsBothSlots(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp2:test")
+
+	// Both one grant short of level 2 (needs 10 XP = 1000 centi-XP).
+	short := 1000 - int(petXPPerAction*100)
+	if err := upsertPlayerMetaPetState(uid,
+		PetState{Type: "dog", Name: "Rex", Arrived: true, Level: 1, XP: short}); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertPlayerMetaPet2State(uid,
+		PetState{Type: "cat", Name: "Whiskers", Arrived: true, Level: 1, XP: short}); err != nil {
+		t.Fatal(err)
+	}
+
+	leveled := grantPetCombatXP(uid)
+	if len(leveled) != 2 {
+		t.Fatalf("expected both pets to level, got %v", leveled)
+	}
+
+	p1, _ := loadPetState(uid)
+	p2, _ := loadPet2State(uid)
+	if p1.Level != 2 || p2.Level != 2 {
+		t.Errorf("levels = %d/%d, want 2/2", p1.Level, p2.Level)
+	}
+}
+
+// TestGrantPetCombatXPIgnoresChasedAway — a pet that isn't with you doesn't
+// fight, so it doesn't earn.
+func TestGrantPetCombatXPIgnoresChasedAway(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp3:test")
+
+	if err := upsertPlayerMetaPetState(uid, PetState{
+		Type: "dog", Name: "Rex", Arrived: true, ChasedAway: true, Level: 3, XP: 100,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	grantPetCombatXP(uid)
+
+	got, _ := loadPetState(uid)
+	if got.XP != 100 {
+		t.Errorf("chased-away pet gained XP: %d, want 100", got.XP)
+	}
+}
+
+// TestGrantPetCombatXPCapsAtTen — a maxed pet stops earning rather than
+// accumulating dead XP.
+func TestGrantPetCombatXPCapsAtTen(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp4:test")
+
+	if err := upsertPlayerMetaPetState(uid, PetState{
+		Type: "dog", Name: "Rex", Arrived: true, Level: 10, XP: 0,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if leveled := grantPetCombatXP(uid); len(leveled) != 0 {
+		t.Errorf("L10 pet should not level, got %v", leveled)
+	}
+	got, _ := loadPetState(uid)
+	if got.XP != 0 || got.Level != 10 {
+		t.Errorf("L10 pet moved: level %d xp %d", got.Level, got.XP)
+	}
+}
@@ -15,6 +15,11 @@ import (

 const petXPPerAction = 1.5

+// petMaxLevel is where the curve stops. Named because two things read it for
+// different reasons: the level-up loop stops here, and the web push reports "no
+// more to earn" from it.
+const petMaxLevel = 10
+
 var petNameValid = regexp.MustCompile(`^[a-zA-Z0-9 '\-]+$`)

 // petXPToNextLevel returns XP needed for a given pet level.
@@ -31,6 +36,19 @@ func petXPToNextLevel(level int) int {
 	}
 }

+// petXPNeededCenti is petXPToNextLevel in the unit the stored ledger actually
+// uses — centi-XP — and 0 once the pet is capped, so a caller can tell "nothing
+// left to earn" from "needs another 10 points". Every comparison against a
+// stored PetXP multiplies by 100 (see advancePetLevelsFromXP); anything reading
+// the curve for display has to do the same, and doing it in one place is how the
+// web push avoids getting it wrong.
+func petXPNeededCenti(level int) int {
+	if level >= petMaxLevel {
+		return 0
+	}
+	return petXPToNextLevel(level) * 100
+}
+
 // petGrantXP adds a per-action XP grant to the pet and handles level-ups.
 // Returns true if leveled up. Shares the level-up loop with the babysit trickle
 // via advancePetLevelsFromXP.
@@ -41,17 +59,62 @@ func petGrantXP(pet *PetState) bool {
 	return advancePetLevelsFromXP(&pet.XP, &pet.Level, &pet.Level10Date, int(petXPPerAction*100))
 }

+// grantPetCombatXP pays both pet slots their per-action XP for a fight the
+// player won, and returns the names of any pet that leveled so the caller can
+// narrate it.
+//
+// This is the pet's only *earned* XP source. It used to ride the legacy daily
+// activity loop, which R1 deleted — and for the whole life of Adventure 2.0
+// nothing replaced it, leaving petGrantXP orphaned and every un-babysat pet
+// frozen at the level it was adopted with. Pet level is not cosmetic
+// (DerivePlayerStats scales PetAttackProc / PetDeflectProc / PetAttackDmg off
+// it), so a frozen pet is a permanently dead combat slot.
+//
+// Both slots earn on the same win, matching the babysit trickle: combat only
+// ever reads the two pets' *averaged* procs, so leveling both is not a spike.
+//
+// Writes go through the narrow per-slot pet upserts rather than
+// saveAdvCharacter: this runs on the combat close-out path, which does not
+// hold the per-user lock, and a full-row write from here could clobber a
+// concurrent character save.
+func grantPetCombatXP(userID id.UserID) []string {
+	var leveled []string
+	slots := []struct {
+		n      int
+		load   func(id.UserID) (PetState, error)
+		upsert func(id.UserID, PetState) error
+	}{
+		{1, loadPetState, upsertPlayerMetaPetState},
+		{2, loadPet2State, upsertPlayerMetaPet2State},
+	}
+	for _, s := range slots {
+		pet, err := s.load(userID)
+		if err != nil || !pet.HasPet() {
+			continue
+		}
+		didLevel := petGrantXP(&pet)
+		if uerr := s.upsert(userID, pet); uerr != nil {
+			slog.Error("adventure: pet xp persist", "user", userID, "slot", s.n, "err", uerr)
+			continue
+		}
+		if didLevel {
+			leveled = append(leveled, fmt.Sprintf("%s reached level %d", pet.Name, pet.Level))
+		}
+	}
+	return leveled
+}
+
 // advancePetLevelsFromXP adds centi-XP to a pet and applies any level-ups, up
 // to the level-10 cap, stamping the level-10 date on first reaching it. Shared
 // by both pet slots (the babysit trickle). Returns true if the pet leveled.
 func advancePetLevelsFromXP(xp, level *int, level10Date *string, addCentiXP int) bool {
-	if *level >= 10 {
+	if *level >= petMaxLevel {
 		return false
 	}
 	*xp += addCentiXP
 	leveled := false
-	for *level < 10 {
-		needed := petXPToNextLevel(*level) * 100
+	for *level < petMaxLevel {
+		needed := petXPNeededCenti(*level)
 		if *xp < needed {
 			break
 		}
@@ -59,7 +122,7 @@ func advancePetLevelsFromXP(xp, level *int, level10Date *string, addCentiXP int)
 		*level++
 		leveled = true
 	}
-	if *level >= 10 && *level10Date == "" {
+	if *level >= petMaxLevel && *level10Date == "" {
 		*level10Date = time.Now().UTC().Format("2006-01-02")
 	}
 	return leveled
@@ -70,6 +70,18 @@ func advClearFlavorHistory() {
 	})
 }

+// advLocationMidSentence renders a location display name for use after a
+// preposition: "The Abyssal Maw" becomes "the Abyssal Maw" so a line reads
+// "found in the Abyssal Maw" rather than "found in The Abyssal Maw".
+// Templates opt in with {location_mid}; {location} keeps the display form for
+// sentence-initial and "The {location}" positions.
+func advLocationMidSentence(name string) string {
+	if strings.HasPrefix(name, "The ") {
+		return "the " + strings.TrimPrefix(name, "The ")
+	}
+	return name
+}
+
 // advSubstituteFlavor replaces {var} placeholders in a flavor text string.
 func advSubstituteFlavor(template string, vars map[string]string) string {
 	pairs := make([]string, 0, len(vars)*2)
@@ -164,20 +164,18 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 		gaveCard = true
 	}

-	// Update visit count, and every 10th visit leave a small consumable
-	// "for the trouble" (D2 NPC arc).
-	var leftGift *AdvItem
+	// Update visit count and work out what he leaves behind.
+	var leftGifts []AdvItem
 	char, err := loadAdvCharacter(userID)
 	if err == nil {
 		char.RobbieVisitCount++
-		if char.RobbieVisitCount%robbieGiftEveryNVisits == 0 {
-			// Use the canonical DnD level (like the arena's tier gate), not the
-			// frozen legacy CombatLevel — that snapshots at 1–3 once D&D setup
-			// completes, so reading it here would peg every gift at tier 1.
-			if gifts := consumableCache(robbieGiftTier(arenaDnDLevelOrZero(userID)), 1); len(gifts) > 0 {
-				if err := addAdvInventoryItem(userID, gifts[0]); err == nil {
-					leftGift = &gifts[0]
-				}
+		// Use the canonical DnD level (like the arena's tier gate), not the
+		// frozen legacy CombatLevel — that snapshots at 1–3 once D&D setup
+		// completes, so reading it here would peg every gift at tier 1.
+		tier := robbieGiftTier(arenaDnDLevelOrZero(userID))
+		for _, gift := range consumableCache(tier, robbieGiftCount(char.RobbieVisitCount, len(takenItems))) {
+			if err := addAdvInventoryItem(userID, gift); err == nil {
+				leftGifts = append(leftGifts, gift)
 			}
 		}
 		_ = saveAdvCharacter(char)
@@ -185,7 +183,7 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 	}

 	// Send DM
-	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard, leftGift)
+	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard, leftGifts)
 	if err := p.SendDM(userID, dm); err != nil {
 		slog.Error("adventure: robbie: failed to send DM", "user", userID, "err", err)
 	}
@@ -213,12 +211,17 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 func robbieQualifyingItems(inv []AdvItem, equip map[EquipmentSlot]*AdvEquipment) []AdvItem {
 	var result []AdvItem
 	for _, item := range inv {
-		// Never touch Arena gear, cards, consumables, or keys. Consumables are
-		// a player-curated stockpile (crafted or dropped); selling them is an
-		// explicit decision the player must make themselves. Keys are cross-zone
-		// unlock tokens (N5/D4) that must persist in inventory to open their
-		// vault later — sweeping one permanently breaks that unlock.
-		if item.Type == "ArenaGear" || item.Type == "card" || item.Type == "consumable" || item.Type == "key" {
+		// Never touch Arena gear, cards, consumables, keys, or tools.
+		// Consumables are a player-curated stockpile (crafted or dropped);
+		// selling them is an explicit decision the player must make themselves.
+		// Keys are cross-zone unlock tokens (N5/D4) that must persist in
+		// inventory to open their vault later — sweeping one permanently breaks
+		// that unlock. Tools are the same shape of promise: thieves' tools are
+		// bought precisely so a locked fork can be opened *later*, and a bandit
+		// who pockets them between the purchase and the door has taken the
+		// thing the player paid to still have.
+		switch item.Type {
+		case "ArenaGear", "card", "consumable", "key", thievesToolsItemType:
 			continue
 		}

@@ -267,9 +270,49 @@ func robbiePlayerHasCard(userID id.UserID) bool {

 // ── DM Rendering ─────────────────────────────────────────────────────────────

-// robbieGiftEveryNVisits is how often Robbie leaves a consumable behind.
+// robbieGiftEveryNVisits is how often Robbie leaves a consumable behind on the
+// loyalty track alone, independent of how much he hauled off.
 const robbieGiftEveryNVisits = 10

+// robbieHaulPerGift is how many items one visit has to be worth before Robbie
+// leaves something for the trouble, and robbieMaxHaulGifts caps how generous a
+// single monster haul can get.
+//
+// The loyalty track on its own was far too thin to read as a reward: a visit is
+// a 40% daily roll, so every-10-visits works out to one consumable per ~25 real
+// days — and it paid exactly the same for a stockpile of sixty items as it did
+// for one rock. Volume is the thing the player actually controls, so volume is
+// what the haul track pays on.
+const (
+	robbieHaulPerGift  = 15
+	robbieMaxHaulGifts = 3
+)
+
+// robbieGiftCount returns how many consumables Robbie leaves this visit: the
+// every-Nth-visit loyalty gift plus one per robbieHaulPerGift items carried
+// off, capped. Pure so the curve is testable without a DB or a Matrix stub.
+func robbieGiftCount(visitCount, itemsTaken int) int {
+	n := 0
+	if visitCount > 0 && visitCount%robbieGiftEveryNVisits == 0 {
+		n++
+	}
+	if haul := itemsTaken / robbieHaulPerGift; haul > 0 {
+		n += min(haul, robbieMaxHaulGifts)
+	}
+	return n
+}
+
+// joinAnd renders a list as "a", "a and b", or "a, b and c".
+func joinAnd(xs []string) string {
+	switch len(xs) {
+	case 0:
+		return ""
+	case 1:
+		return xs[0]
+	}
+	return strings.Join(xs[:len(xs)-1], ", ") + " and " + xs[len(xs)-1]
+}
+
 // robbieGiftTier maps a player's combat level to a consumable tier, matching
 // the arena tier bands (1–3 / 4–7 / 8–12 / 13–17 / 18+).
 func robbieGiftTier(level int) int {
@@ -287,7 +330,7 @@ func robbieGiftTier(level int) int {
 	}
 }

-func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool, leftGift *AdvItem) string {
+func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool, leftGifts []AdvItem) string {
 	var sb strings.Builder

 	// Opening
@@ -334,9 +377,19 @@ func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gav
 	}
 	sb.WriteString("\n\n")

-	// Every-10th-visit consumable (D2).
-	if leftGift != nil {
-		sb.WriteString(fmt.Sprintf(robbieLeftConsumable, leftGift.Name))
+	// What he left behind: the every-10th-visit loyalty consumable (D2), the
+	// big-haul thank-you, or both rolled into one line. A single gift keeps the
+	// original loyalty phrasing; anything more is the haul talking.
+	if len(leftGifts) > 0 {
+		names := make([]string, 0, len(leftGifts))
+		for _, g := range leftGifts {
+			names = append(names, g.Name)
+		}
+		if len(names) == 1 {
+			sb.WriteString(fmt.Sprintf(robbieLeftConsumable, names[0]))
+		} else {
+			sb.WriteString(fmt.Sprintf(robbieLeftForTheHaul, joinAnd(names)))
+		}
 		sb.WriteString("\n\n")
 	}

@@ -0,0 +1,47 @@
+package plugin
+
+import "testing"
+
+// TestRobbieGiftCount pins the two tracks: the every-10th-visit loyalty gift
+// and the volume track that pays for a big haul, capped so one monster
+// stockpile can't mint an unbounded pile of consumables.
+func TestRobbieGiftCount(t *testing.T) {
+	cases := []struct {
+		name          string
+		visits, taken int
+		want          int
+	}{
+		{"small haul, off-loyalty visit", 7, 3, 0},
+		{"loyalty visit only", 10, 3, 1},
+		{"haul only", 7, 15, 1},
+		{"haul and loyalty stack", 20, 15, 2},
+		{"haul scales", 7, 45, 3},
+		{"haul capped", 7, 500, robbieMaxHaulGifts},
+		{"cap plus loyalty", 30, 500, robbieMaxHaulGifts + 1},
+		{"one under the haul threshold", 7, robbieHaulPerGift - 1, 0},
+		{"zeroth visit is not a loyalty visit", 0, 0, 0},
+	}
+	for _, c := range cases {
+		if got := robbieGiftCount(c.visits, c.taken); got != c.want {
+			t.Errorf("%s: robbieGiftCount(%d, %d) = %d, want %d",
+				c.name, c.visits, c.taken, got, c.want)
+		}
+	}
+}
+
+func TestJoinAnd(t *testing.T) {
+	cases := []struct {
+		in   []string
+		want string
+	}{
+		{nil, ""},
+		{[]string{"a"}, "a"},
+		{[]string{"a", "b"}, "a and b"},
+		{[]string{"a", "b", "c"}, "a, b and c"},
+	}
+	for _, c := range cases {
+		if got := joinAnd(c.in); got != c.want {
+			t.Errorf("joinAnd(%v) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
@@ -845,7 +845,13 @@ func (p *AdventurePlugin) advSellAll(userID id.UserID) string {
 	var keptConsumable int
 	var keptMagic int
 	for _, item := range items {
-		if item.Type == "MasterworkGear" || item.Type == "ArenaGear" || item.Type == "card" {
+		// Keys and tools ride along with the special gear here for the same
+		// reason Robbie won't take them: both are bought or found precisely so a
+		// door can be opened *later*, and `sell all` is a bulk-loot verb the
+		// player fires after every haul without reading the list. Turning one
+		// into €300 silently deletes the unlock it was carried for.
+		switch item.Type {
+		case "MasterworkGear", "ArenaGear", "card", "key", thievesToolsItemType:
 			keptSpecial++
 			continue
 		}
@@ -1019,6 +1025,9 @@ func luigiSuppliesView(_ id.UserID, balance float64) string {
 		}
 	}

+	sb.WriteString(fmt.Sprintf("**%s** — €%d\n  Opens one dungeon path a failed check closed (`!zone unlock <n>`). Not used in combat.\n\n",
+		thievesToolsName, thievesToolsPrice))
+
 	sb.WriteString("Reply with an item name to buy, or `back` to return.\n")
 	sb.WriteString("Stronger consumables drop from foraging, mining, fishing, and dungeons at T2+.")
 	return sb.String()
@@ -1073,6 +1082,13 @@ func (p *AdventurePlugin) resolveShopSupplyChoice(ctx MessageContext, interactio
 		return p.SendDM(ctx.Sender, "*Luigi nods and gestures toward the main counter.*")
 	}

+	// Thieves' tools sit on the supplies shelf but are not a ConsumableDef:
+	// the combat engine scans inventory against that table and would happily
+	// spend them mid-fight. They get their own branch and their own item type.
+	if isThievesToolsReply(reply) {
+		return p.buyThievesTools(ctx, interaction)
+	}
+
 	// Find matching consumable
 	var match *ConsumableDef
 	for i := range consumableDefs {
@@ -1115,6 +1131,34 @@ func (p *AdventurePlugin) resolveShopSupplyChoice(ctx MessageContext, interactio
 		match.Name, consumablePrice, newBalance))
 }

+// buyThievesTools sells one set off the supplies shelf. Mirrors the consumable
+// purchase beside it — same session price factor, same 5% pot cut — and leaves
+// the player in the supplies view so they can buy a second.
+func (p *AdventurePlugin) buyThievesTools(ctx MessageContext, interaction *advPendingInteraction) error {
+	price := float64(thievesToolsPrice) * p.shopSessionPriceFactor(ctx.Sender)
+	balance := p.euro.GetBalance(ctx.Sender)
+	if balance < price {
+		p.pending.Store(string(ctx.Sender), interaction)
+		return p.SendDM(ctx.Sender, fmt.Sprintf("You need €%.0f for %s but only have €%.0f.",
+			price, thievesToolsName, balance))
+	}
+	p.euro.Debit(ctx.Sender, price, "shop_thieves_tools")
+	if potCut := int(math.Round(price * 0.05)); potCut > 0 {
+		communityPotAdd(potCut)
+		trackTaxPaid(ctx.Sender, potCut)
+	}
+	_ = addAdvInventoryItem(ctx.Sender, AdvItem{
+		Name:  thievesToolsName,
+		Type:  thievesToolsItemType,
+		Tier:  1,
+		Value: thievesToolsPrice / 2,
+	})
+	p.pending.Store(string(ctx.Sender), interaction)
+	return p.SendDM(ctx.Sender, fmt.Sprintf(
+		"Purchased **%s** for €%.0f. You carry %d.\n💰 Balance: €%.0f\n\nReply with another item name or `back` to return.",
+		thievesToolsName, price, countThievesTools(ctx.Sender), p.euro.GetBalance(ctx.Sender)))
+}
+
 // ── Curios (Magic Items) ────────────────────────────────────────────────────

 // curiosStockSize — how many registry magic items Luigi stocks per day.
@@ -46,6 +46,16 @@ var advTreasureDropRates = map[int]float64{
 	3: 0.008,
 	4: 0.004,
 	5: 0.0015,
+	// Tier 6 (Mythic post-game) breaks the downward curve on purpose. The rate
+	// per roll falls tier over tier because the lower tiers are ground daily;
+	// a Mythic run is gated behind L18 and both T5 bosses and happens rarely,
+	// so the same declining rate would mean a postgame player effectively never
+	// sees a treasure. Slightly above T5 keeps the per-run odds in the band the
+	// other tiers land in.
+	//
+	// NOTE: this rate is inert until advAllTreasures gains a tier 6 pool — see
+	// the TODO there. A tier with a rate but no pool drops nothing.
+	6: 0.002,
 }

 const advMaxTreasures = 3
@@ -213,7 +223,7 @@ var advAllTreasures = map[int][]AdvTreasureDef{
 				{Type: "success_chance", Value: 10},
 			},
 			InventoryDesc: "[THUNDERFURY, BLESSED BLADE OF THE WINDSEEKER]. Yes you got it. +12 Combat.",
-			RoomAnnounce:  "⚡ Did {name} get Thunderfury? {name} got Thunderfury. [THUNDERFURY, BLESSED BLADE OF THE WINDSEEKER] has been found in {location}.",
+			RoomAnnounce:  "⚡ Did {name} get Thunderfury? {name} got Thunderfury. [THUNDERFURY, BLESSED BLADE OF THE WINDSEEKER] has been found in {location_mid}.",
 		},
 		{
 			Key: "ocarina", Name: "The Ocarina (Cracked, Still Plays)", Tier: 4,
@@ -221,6 +231,13 @@ var advAllTreasures = map[int][]AdvTreasureDef{
 			InventoryDesc: "The Ocarina (Cracked). Three songs. +10 all skills. Do not play the third one.",
 		},
 	},
+	// TODO(t6-treasures): there is no tier 6 pool yet, so Mythic zones drop no
+	// treasure at all — advTreasureDropRates has a tier 6 rate waiting for it.
+	// What's missing is the content: four Mythic treasures with bonuses above
+	// the T5 line, InventoryDesc + RoomAnnounce strings for each (RoomAnnounce
+	// must use {location_mid}, never a literal zone name), and a TIER 6 register
+	// in TreasureDiscovery. Write them against internal/flavor/VOICE_CANON.md;
+	// the T5 pool below is the tonal floor to clear, not the ceiling.
 	5: {
 		{
 			Key: "shard_of_unnamed", Name: "Shard of the Unnamed", Tier: 5,
@@ -230,13 +247,13 @@ var advAllTreasures = map[int][]AdvTreasureDef{
 				{Type: "death_chance", Value: -5},
 			},
 			InventoryDesc: "Shard of the Unnamed. +15 Combat, +10% XP, -5% death.",
-			RoomAnnounce:  "🔴 {name} has recovered the Shard of the Unnamed from the Abyssal Maw. The server feels different.",
+			RoomAnnounce:  "🔴 {name} has recovered the Shard of the Unnamed from {location_mid}. The server feels different.",
 		},
 		{
 			Key: "cartographers_final_map", Name: "The Cartographer's Final Map", Tier: 5,
 			Bonuses:       []advTreasureBonusDef{{Type: "all_skills", Value: 12}},
 			InventoryDesc: "The Cartographer's Final Map. Updates on its own. +12 all skills, full map.",
-			RoomAnnounce:  "🔴 {name} has found the Cartographer's Final Map in the Abyssal Maw. It has their name on it. It always did.",
+			RoomAnnounce:  "🔴 {name} has found the Cartographer's Final Map in {location_mid}. It has their name on it. It always did.",
 		},
 		{
 			Key: "triforce_shard", Name: "The Triforce Shard (One Third of Something Larger)", Tier: 5,
@@ -246,7 +263,7 @@ var advAllTreasures = map[int][]AdvTreasureDef{
 				// Note: +15 to chosen skill is v2 interactive
 			},
 			InventoryDesc: "Triforce Shard (×1/3). Warm. Waiting. +5 all skills, -8% death.",
-			RoomAnnounce:  "🔺 {name} has recovered a Triforce Shard from the Abyssal Maw. One third of something. The other two thirds are somewhere. Probably.",
+			RoomAnnounce:  "🔺 {name} has recovered a Triforce Shard from {location_mid}. One third of something. The other two thirds are somewhere. Probably.",
 		},
 		{
 			Key: "the_corridor", Name: "The Corridor (You Know the One)", Tier: 5,
@@ -255,7 +272,7 @@ var advAllTreasures = map[int][]AdvTreasureDef{
 				{Type: "special_monthly_death_bypass", Value: 1}, // v2
 			},
 			InventoryDesc: "The Corridor. Folded. Don't look back. +12 all skills, monthly death bypass.",
-			RoomAnnounce:  "🔴 {name} found The Corridor in the Abyssal Maw. They know the one. So does it.",
+			RoomAnnounce:  "🔴 {name} found The Corridor in {location_mid}. They know the one. So does it.",
 		},
 	},
 }
@@ -285,7 +302,12 @@ func rollAdvTreasureDropDetailed(tier int, userID id.UserID, chatLevel int, weig

 	pool, ok := advAllTreasures[tier]
 	if !ok || len(pool) == 0 {
-		return nil, roll, rate
+		// A tier that has a rate but no pool (tier 6, until the TODO above is
+		// filled) cannot drop anything. Report a zero rate rather than the
+		// configured one: the caller turns a close roll into a "just missed"
+		// DM, and telling a postgame player they nearly won a treasure that
+		// cannot be won is worse than staying quiet.
+		return nil, 0, 0
 	}

 	// Pick random treasure
@@ -66,6 +66,36 @@ func TestAdvTreasureDropDetailed_ForcedRollGrantsTreasure(t *testing.T) {
 	}
 }

+// TestAdvTreasureTier6_PoolStillMissing pins the known tier 6 gap: Mythic zones
+// carry a drop rate but no treasure pool, so a forced roll yields nothing and
+// the player is told nothing either (a "just missed" DM for an unwinnable
+// treasure would be a lie).
+//
+// This test is the reminder. Writing advAllTreasures[6] — see TODO(t6-treasures)
+// in adventure_treasure.go — turns it red, and the fix is to delete it and
+// assert the tier 6 drop instead, the way ForcedRollGrantsTreasure does for
+// tier 1.
+func TestAdvTreasureTier6_PoolStillMissing(t *testing.T) {
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatalf("db.Init: %v", err)
+	}
+	if _, ok := advAllTreasures[6]; ok {
+		t.Fatal("a tier 6 treasure pool now exists — drop this test and assert the drop instead")
+	}
+	// The rate is configured and waiting, so the gap is the pool alone.
+	if advTreasureDropRates[6] == 0 {
+		t.Error("tier 6 drop rate went missing; a Mythic pool would be unreachable")
+	}
+	drop, roll, rate := rollAdvTreasureDropDetailed(6, "@mythic:example.org", 0, 1000)
+	if drop != nil {
+		t.Fatalf("tier 6 produced a drop from an empty pool: %+v", drop.Def)
+	}
+	// Zeroed, not merely no-drop: this is what keeps the near-miss DM quiet.
+	if roll != 0 || rate != 0 {
+		t.Errorf("empty pool reported roll=%v rate=%v, want 0/0 so no near-miss fires", roll, rate)
+	}
+}
+
 // The treasure and masterwork systems predate zones and speak AdvLocation.
 func TestAdvLocForZone(t *testing.T) {
 	loc := advLocForZone(ZoneGoblinWarrens)
@@ -2,6 +2,7 @@ package plugin

 import (
 	"database/sql"
+	"errors"
 	"fmt"
 	"hash/fnv"
 	"log/slog"
@@ -394,14 +395,15 @@ func (p *AdventurePlugin) spawnWorldBoss(eventKey string) (*worldBossState, erro
 		return nil, err
 	}
 	p.announceWorldBossSpawn(boss, activeN)
+	emitSiegeStart(boss)
 	slog.Info("worldboss: spawned", "id", bossID, "name", name, "tier", tier, "hp", hpMax, "activeN", activeN)
 	return boss, nil
 }

-// worldBossTick rides the 1-minute event ticker. It auto-spawns a boss on the
-// first of each UTC month and resolves a live boss whose window has lapsed. The
-// defeat path is not here — a bout crossing the pool to zero resolves inline
-// (W2), because the ticker never sees the pool between two 60s reads.
+// worldBossTick rides the 1-minute event ticker. It auto-spawns the month's
+// boss and resolves a live boss whose window has lapsed. The defeat path is not
+// here — a bout crossing the pool to zero resolves inline (W2), because the
+// ticker never sees the pool between two 60s reads.
 func (p *AdventurePlugin) worldBossTick() {
 	boss, err := loadActiveWorldBoss()
 	if err != nil {
@@ -423,10 +425,17 @@ func (p *AdventurePlugin) worldBossTick() {
 		}
 		return
 	}
-	// No boss camped — auto-spawn on the 1st of the month, once.
-	if now.Day() != 1 {
-		return
-	}
+	// No boss camped — spawn this month's Siege, once.
+	//
+	// The month key below is the whole dedup, so the rule is simply "one Siege
+	// per calendar month, as early as the process is up to run it." It used to
+	// additionally require now.Day() == 1, which deadlocked the entire feature:
+	// the world boss shipped mid-July 2026 and prod never once ran a first-of-
+	// the-month tick with the code in it, so `select count(*) from world_boss`
+	// was still 0 weeks later. The day gate also silently skipped any month
+	// where the bot happened to be down or redeploying across the 1st, with no
+	// catch-up. Dropping it makes a missed 1st self-heal on the next tick
+	// instead of costing the town a month.
 	monthKey := now.Format("2006-01")
 	if db.JobCompleted("worldboss_spawn", monthKey) {
 		return
@@ -489,6 +498,7 @@ func (p *AdventurePlugin) resolveWorldBossDefeated(boss *worldBossState) {
 		}
 	}
 	p.announceWorldBossDefeated(boss, payouts)
+	emitSiegeWin(boss, len(payouts))
 	slog.Info("worldboss: defeated", "id", boss.ID, "contributors", len(payouts))
 }

@@ -509,6 +519,7 @@ func (p *AdventurePlugin) resolveWorldBossSurvived(boss *worldBossState) {
 		paid = tribute
 	}
 	p.announceWorldBossSurvived(boss, paid)
+	emitSiegeLoss(boss)
 	slog.Info("worldboss: survived", "id", boss.ID, "tribute", paid)
 }

@@ -597,42 +608,58 @@ func (p *AdventurePlugin) worldBossOperatorSpawn(ctx MessageContext) error {
 		boss.Name, boss.Tier, groupInt(boss.HPMax)))
 }

-// fightWorldBoss runs one player's daily bout against the Siege: an arena-style
+// Sentinels for the four ways a bout can be refused, so a headless caller (the
+// web action queue, pete_orders.go) can turn each into its own verdict instead of
+// parsing a DM. `!adventure worldboss fight` maps them back to the prose it
+// always sent.
+var (
+	errSiegeNoBoss        = errors.New("siege: nothing camped outside town")
+	errSiegeNoCharacter   = errors.New("siege: no adventurer")
+	errSiegeDead          = errors.New("siege: adventurer is dead")
+	errSiegeAlreadyFought = errors.New("siege: today's bout already spent")
+)
+
+// takeSiegeBout runs one player's daily bout against the Siege: an arena-style
 // solo fight whose damage is subtracted from the shared pool win or lose. Real
 // HP cost, no death — a loss leaves the fighter battered (floored at 1 HP) but
 // standing. The per-user lock serialises a player's own repeat submits, so the
-// once-per-day gate can't be raced by a double-tap.
-func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
-	userMu := p.advUserLock(ctx.Sender)
+// once-per-day gate can't be raced by a double-tap — and that same lock is what
+// makes it safe for the web queue and a Matrix command to reach for the bout at
+// the same moment.
+//
+// The combat narration is DM'd from here whichever door the bout came through: a
+// fight is thirty lines of blow-by-blow and belongs in Matrix, not in a one-line
+// verdict on a web page. The caller gets the boss and the result to describe.
+func (p *AdventurePlugin) takeSiegeBout(uid id.UserID) (worldBossBoutResult, *worldBossState, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()

 	boss, err := loadActiveWorldBoss()
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+		return worldBossBoutResult{}, nil, fmt.Errorf("reaching the Siege: %w", err)
 	}
 	if boss == nil {
-		return p.SendDM(ctx.Sender, "No Siege is camped outside town right now.")
+		return worldBossBoutResult{}, nil, errSiegeNoBoss
 	}

-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil || char == nil {
-		return p.SendDM(ctx.Sender, "You need an adventurer first — type `!adventure` to begin.")
+		return worldBossBoutResult{}, boss, errSiegeNoCharacter
 	}
 	if !char.Alive {
-		return p.SendDM(ctx.Sender, "You're dead. The Siege will have to wait until you're back on your feet.")
+		return worldBossBoutResult{}, boss, errSiegeDead
 	}

 	today := time.Now().UTC().Format("2006-01-02")
-	if worldBossBoutUsedToday(boss.ID, ctx.Sender, today) {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You've already taken your bout against **%s** today. Come back tomorrow — one fight per day.", boss.Name))
+	if worldBossBoutUsedToday(boss.ID, uid, today) {
+		return worldBossBoutResult{}, boss, errSiegeAlreadyFought
 	}

-	bout, err := p.resolveWorldBossBout(ctx.Sender, boss, today)
+	bout, err := p.resolveWorldBossBout(uid, boss, today)
 	if err != nil {
-		slog.Error("worldboss: bout failed", "user", ctx.Sender, "err", err)
-		return p.SendDM(ctx.Sender, "The Siege combat hit an error. Try again in a moment.")
+		slog.Error("worldboss: bout failed", "user", uid, "err", err)
+		return worldBossBoutResult{}, boss, fmt.Errorf("running the bout: %w", err)
 	}

 	// Resolve a defeat BEFORE streaming the (multi-second) narration. The pool is
@@ -643,7 +670,7 @@ func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
 		p.resolveWorldBossDefeated(boss)
 	}

-	playerName, _ := loadDisplayName(ctx.Sender)
+	playerName, _ := loadDisplayName(uid)
 	if playerName == "" {
 		playerName = "You"
 	}
@@ -651,18 +678,45 @@ func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
 		fmt.Sprintf("⚔️ **The Siege — %s** (Tier %d)", boss.Name, boss.Tier),
 	}, RenderCombatLog(bout.Combat, playerName, boss.Name)...)

+	<-p.sendZoneCombatMessages(uid, phaseMessages, siegeBoutFooter(bout, boss))
+	return bout, boss, nil
+}
+
+// siegeBoutFooter is the one-line result of a bout — the damage dealt and what
+// the pool looks like now. It closes the Matrix narration and doubles as the web
+// verdict, so the two doors can't drift into describing the same fight
+// differently.
+func siegeBoutFooter(bout worldBossBoutResult, boss *worldBossState) string {
 	var footer string
 	if bout.Killed {
-		footer = fmt.Sprintf("💥 You deal **%d** damage — the killing blow! **%s** falls!", bout.Damage, boss.Name)
+		footer = fmt.Sprintf("💥 You deal **%d** damage: the killing blow! **%s** falls!", bout.Damage, boss.Name)
 	} else {
 		footer = fmt.Sprintf("💥 You deal **%d** damage. **%s** has **%s / %s HP** left.",
 			bout.Damage, boss.Name, groupInt(bout.Remaining), groupInt(boss.HPMax))
 	}
 	if bout.Battered {
-		footer += "\nYou stagger out of the fight at 1 HP — rest up before your next outing."
+		footer += "\nYou stagger out of the fight at 1 HP. Rest up before your next outing."
 	}
+	return footer
+}

-	<-p.sendZoneCombatMessages(ctx.Sender, phaseMessages, footer)
+// fightWorldBoss is `!adventure worldboss fight`: the command framing around
+// takeSiegeBout, which does the fight and the narration.
+func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
+	_, boss, err := p.takeSiegeBout(ctx.Sender)
+	switch {
+	case errors.Is(err, errSiegeNoBoss):
+		return p.SendDM(ctx.Sender, "No Siege is camped outside town right now.")
+	case errors.Is(err, errSiegeNoCharacter):
+		return p.SendDM(ctx.Sender, "You need an adventurer first — type `!adventure` to begin.")
+	case errors.Is(err, errSiegeDead):
+		return p.SendDM(ctx.Sender, "You're dead. The Siege will have to wait until you're back on your feet.")
+	case errors.Is(err, errSiegeAlreadyFought):
+		return p.SendDM(ctx.Sender, fmt.Sprintf(
+			"You've already taken your bout against **%s** today. Come back tomorrow — one fight per day.", boss.Name))
+	case err != nil:
+		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+	}
 	return nil
 }

@@ -58,34 +58,119 @@ func (p *AdventurePlugin) bootstrapPeteNewsBackfill() {
 		"zone_firsts", firsts, "deaths", deaths, "achievements", achv)
 }

-// backfillZoneFirsts seeds news_realm_firsts from history and emits one PRIORITY
-// realm-first dispatch per zone, attributed to its earliest boss-defeating
-// clearer. SQLite returns the user_id from the same row as MIN(completed_at)
-// (bare-column min/max rule), so the (zone, first clearer, time) triple is
-// consistent. Returns the count emitted.
-func (p *AdventurePlugin) backfillZoneFirsts() int {
+// zoneFirstClear is one zone's earliest boss kill: who did it and when.
+type zoneFirstClear struct {
+	zoneID, userID, completedAt string
+}
+
+// zoneFirstClears reads the earliest boss-defeating run of every zone.
+//
+// The filter is `boss_defeated = 1` and NOTHING else, and that is the whole
+// point. `abandoned` does not mean anybody gave up — abandonZoneRunByID exists
+// to retire a run whose boss is ALREADY DEAD when the expedition travels onward
+// (dnd_zone_run.go), so in prod 30 of 32 boss kills carry abandoned = 1. An
+// `AND abandoned = 0` here drew a realm where 2 zones had ever been beaten
+// instead of 9. It is the same filter loadRealmClearStats documents; do not
+// reintroduce it.
+//
+// SQLite returns the user_id from the same row as MIN(completed_at) (bare-column
+// min/max rule), so the (zone, first clearer, time) triple is internally
+// consistent.
+// ok is false only when the read itself failed. A caller that is about to mark
+// a one-shot job complete has to be able to tell "no zone has ever been cleared"
+// from "the query fell over", or a transient DB fault at boot retires the repair
+// permanently.
+func zoneFirstClears() (firsts []zoneFirstClear, ok bool) {
 	rows, err := db.Get().Query(
 		`SELECT zone_id, user_id, MIN(completed_at)
 		   FROM dnd_zone_run
-		  WHERE boss_defeated = 1 AND completed_at IS NOT NULL AND abandoned = 0
+		  WHERE boss_defeated = 1 AND completed_at IS NOT NULL
 		  GROUP BY zone_id`)
 	if err != nil {
 		slog.Error("backfill: zone-firsts query", "err", err)
-		return 0
+		return nil, false
 	}
-	type first struct {
-		zoneID, userID, completedAt string
-	}
-	var firsts []first
+	defer rows.Close()
+
 	for rows.Next() {
-		var f first
+		var f zoneFirstClear
 		if err := rows.Scan(&f.zoneID, &f.userID, &f.completedAt); err != nil {
 			slog.Error("backfill: zone-firsts scan", "err", err)
 			continue
 		}
 		firsts = append(firsts, f)
 	}
-	rows.Close()
+	if err := rows.Err(); err != nil {
+		slog.Error("backfill: zone-firsts rows", "err", err)
+		return nil, false
+	}
+	return firsts, true
+}
+
+// bootstrapRealmFirstsReseed repairs the zone half of news_realm_firsts.
+//
+// The ledger is what claimRealmFirst tiers live dispatches against, so a zone
+// whose first clear the original one-shot missed is a spurious PRIORITY "realm
+// first" waiting to fire the next time somebody clears it, months after the
+// fact. Two things were wrong with what got seeded:
+//
+//  1. The `abandoned = 0` filter above, which is why prod holds 6 zones where
+//     the run history knows 9.
+//  2. first_at is claimRealmFirst's unixepoch() — when the claim was RECORDED,
+//     not when the clear happened. Every backfilled prod row carries the one
+//     minute the job ran.
+//
+// This is a re-SEED, not a re-run: it writes the ledger and emits nothing at
+// all, so no historical realm-first dispatch reaches the room. It has its own
+// job name because the original one-shot's gate is already marked, and per
+// feedback_loader_rewire_needs_bootstrap it stays in place afterwards — a fresh
+// deploy runs it as an ordinary bootstrap.
+//
+// It runs unconditionally on the news seam's switches, unlike the backfill: a
+// ledger that is correct only when emission happens to be on is a ledger that
+// mis-tiers the first dispatch after somebody flips it.
+//
+// A zone claim with no surviving run behind it is left exactly as it is. The run
+// history is the better record of both who and when, but only where it has one.
+func bootstrapRealmFirstsReseed() {
+	const jobName = "pete_realm_firsts_reseed_v1"
+	if db.JobCompleted(jobName, "once") {
+		return
+	}
+
+	clears, ok := zoneFirstClears()
+	if !ok {
+		// The read failed. Leave the job unmarked so the next boot tries again —
+		// marking it here would retire the repair on the strength of a transient
+		// DB fault and leave the ledger wrong forever.
+		return
+	}
+
+	seeded := 0
+	for _, f := range clears {
+		ts, ok := parseSQLiteTime(f.completedAt)
+		if !ok {
+			slog.Warn("reseed: unparseable clear time", "zone", f.zoneID, "at", f.completedAt)
+			continue
+		}
+		// Upsert, not INSERT OR IGNORE: the six rows that already exist carry the
+		// wrong date and correcting them is half of what this job is for.
+		db.Exec("realm-firsts reseed",
+			`INSERT INTO news_realm_firsts (kind, target, first_at) VALUES ('zone', ?, ?)
+			 ON CONFLICT(kind, target) DO UPDATE SET first_at = excluded.first_at`,
+			f.zoneID, ts.Unix())
+		seeded++
+	}
+
+	db.MarkJobCompleted(jobName, "once")
+	slog.Warn("bootstrap: realm-firsts ledger reseeded", "zones", seeded)
+}
+
+// backfillZoneFirsts seeds news_realm_firsts from history and emits one
+// dispatch per zone, attributed to its earliest boss-defeating clearer.
+// Returns the count emitted.
+func (p *AdventurePlugin) backfillZoneFirsts() int {
+	firsts, _ := zoneFirstClears()

 	n := 0
 	for _, f := range firsts {
@@ -0,0 +1,160 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+)
+
+// ledgerFirstAt reads a zone's recorded claim time, or -1 if the ledger has no
+// row for it at all.
+func ledgerFirstAt(t *testing.T, zoneID string) int64 {
+	t.Helper()
+	var at int64
+	err := db.Get().QueryRow(
+		`SELECT first_at FROM news_realm_firsts WHERE kind = 'zone' AND target = ?`,
+		zoneID).Scan(&at)
+	if err != nil {
+		return -1
+	}
+	return at
+}
+
+func unixOf(t *testing.T, sqliteTime string) int64 {
+	t.Helper()
+	ts, ok := parseSQLiteTime(sqliteTime)
+	if !ok {
+		t.Fatalf("parseSQLiteTime(%q) failed", sqliteTime)
+	}
+	return ts.Unix()
+}
+
+// TestReseedClaimsAZoneWhoseClearsWereAllRetired is the regression for the bug
+// that made this job necessary: every clear of forest_shadows carries
+// abandoned = 1, which is how the game stores a kill the expedition walked on
+// from, and the original one-shot's `abandoned = 0` filter therefore never saw
+// the zone at all. An unclaimed zone is a spurious PRIORITY "realm first"
+// waiting to fire the next time somebody clears it, months after the fact — so
+// the assertion that matters is the claimRealmFirst one at the end.
+func TestReseedClaimsAZoneWhoseClearsWereAllRetired(t *testing.T) {
+	seedRealmFixture(t)
+
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	if got := ledgerFirstAt(t, "forest_shadows"); got != -1 {
+		t.Fatalf("forest_shadows already claimed before the reseed (first_at=%d) — fixture drift", got)
+	}
+
+	bootstrapRealmFirstsReseed()
+
+	if got := ledgerFirstAt(t, "forest_shadows"); got != unixOf(t, "2026-02-14 09:00:00") {
+		t.Errorf("forest_shadows first_at = %d, want %d (the real clear, not the minute the job ran)",
+			got, unixOf(t, "2026-02-14 09:00:00"))
+	}
+	// The point of the whole job. Before the reseed this returns true and the
+	// next clear of a zone beaten in February announces itself as a realm first.
+	if claimRealmFirst("zone", "forest_shadows") {
+		t.Error("forest_shadows was still unclaimed after the reseed — the next clear would fire a spurious realm-first")
+	}
+}
+
+// TestReseedCorrectsTheBackfillsDates pins the second half. claimRealmFirst
+// stamps unixepoch(), so every row the original one-shot wrote carries the one
+// minute that job ran — in prod, all six share the identical timestamp. The
+// reseed has to overwrite an existing row, not INSERT OR IGNORE past it.
+func TestReseedCorrectsTheBackfillsDates(t *testing.T) {
+	seedRealmFixture(t)
+
+	// The fixture claims both zones the way the backfill did: at claim time.
+	before := ledgerFirstAt(t, "goblin_warrens")
+	if before < time.Now().Unix()-300 {
+		t.Fatalf("fixture claim for goblin_warrens is not a now-stamp (%d) — fixture drift", before)
+	}
+
+	bootstrapRealmFirstsReseed()
+
+	// Josie's r1, January, not r2 or r3 and not today.
+	if got, want := ledgerFirstAt(t, "goblin_warrens"), unixOf(t, "2026-01-10 12:00:00"); got != want {
+		t.Errorf("goblin_warrens first_at = %d, want %d (earliest real clear)", got, want)
+	}
+	// crypt_valdris has a clean clear (r4) and a retired-but-won one (r5). The
+	// earliest is r4.
+	if got, want := ledgerFirstAt(t, "crypt_valdris"), unixOf(t, "2026-05-01 12:00:00"); got != want {
+		t.Errorf("crypt_valdris first_at = %d, want %d", got, want)
+	}
+}
+
+// TestReseedEmitsNothing is the reason this is a re-seed and not a re-run of the
+// backfill. The ledger has to be repaired without any historical realm-first
+// dispatch reaching the room; a zone beaten in February is not news in July.
+func TestReseedEmitsNothing(t *testing.T) {
+	seedRealmFixture(t)
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	bootstrapRealmFirstsReseed()
+
+	var queued int
+	if err := db.Get().QueryRow(`SELECT COUNT(*) FROM pete_emit_queue`).Scan(&queued); err != nil {
+		t.Fatalf("count pete_emit_queue: %v", err)
+	}
+	if queued != 0 {
+		t.Errorf("reseed queued %d dispatches, want 0 — the ledger repair must be silent", queued)
+	}
+}
+
+// TestReseedIsAOneShot. It is a bootstrap kept in place for fresh deploys (per
+// feedback_loader_rewire_needs_bootstrap), so it runs on every start and must
+// cost nothing after the first — and, more importantly, must not undo a
+// later live claim by rewriting the ledger from stale history on every boot.
+func TestReseedIsAOneShot(t *testing.T) {
+	seedRealmFixture(t)
+	bootstrapRealmFirstsReseed()
+
+	// A zone cleared after the reseed, claimed live.
+	if !claimRealmFirst("zone", "sunken_temple") {
+		t.Fatal("sunken_temple should have been an unclaimed realm-first")
+	}
+	live := ledgerFirstAt(t, "sunken_temple")
+
+	bootstrapRealmFirstsReseed()
+
+	if got := ledgerFirstAt(t, "sunken_temple"); got != live {
+		t.Errorf("second reseed moved a live claim: %d -> %d", live, got)
+	}
+	if claimRealmFirst("zone", "goblin_warrens") {
+		t.Error("second reseed dropped an existing claim")
+	}
+}
+
+// TestZoneFirstClearsCountsRetiredKills guards the shared query itself, which
+// the kept backfill also uses. `abandoned` means the run row was retired, not
+// that anybody gave up.
+func TestZoneFirstClearsCountsRetiredKills(t *testing.T) {
+	seedRealmFixture(t)
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	clears, ok := zoneFirstClears()
+	if !ok {
+		t.Fatal("zoneFirstClears reported a read failure")
+	}
+	byZone := map[string]zoneFirstClear{}
+	for _, f := range clears {
+		byZone[f.zoneID] = f
+	}
+	if len(byZone) != 3 {
+		t.Fatalf("zoneFirstClears returned %d zones, want 3 (a regression to `abandoned = 0` gives 2)", len(byZone))
+	}
+	if got := byZone["forest_shadows"].userID; got != "@josie:x" {
+		t.Errorf("forest_shadows first clearer = %q, want @josie:x", got)
+	}
+	if _, ok := byZone["arena"]; ok {
+		t.Error("an unfinished run counted as a clear")
+	}
+}
@@ -1,12 +1,9 @@
 package plugin

 import (
-	"encoding/json"
+	"context"
 	"fmt"
-	"io"
 	"log/slog"
-	"net/http"
-	"os"
 	"strings"
 	"sync/atomic"
 	"time"
@@ -121,10 +118,8 @@ func (p *BotInfoPlugin) handleBotInfo(ctx MessageContext) error {
 	sb.WriteString(fmt.Sprintf("Active reminders: %d\n", activeReminders))

 	// LLM status
-	ollamaHost := os.Getenv("OLLAMA_HOST")
-	if ollamaHost != "" {
-		llmStatus := p.checkLLMStatus(ollamaHost)
-		sb.WriteString(fmt.Sprintf("LLM status: %s\n", llmStatus))
+	if llmConfigured() {
+		sb.WriteString(fmt.Sprintf("LLM status: %s\n", p.checkLLMStatus()))
 	} else {
 		sb.WriteString("LLM status: not configured\n")
 	}
@@ -159,42 +154,16 @@ func (p *BotInfoPlugin) handleBotInfo(ctx MessageContext) error {
 	return p.SendReply(ctx.RoomID, ctx.EventID, sb.String())
 }

-func (p *BotInfoPlugin) checkLLMStatus(ollamaHost string) string {
-	client := &http.Client{Timeout: 5 * time.Second}
-	apiURL := strings.TrimRight(ollamaHost, "/") + "/api/tags"
-
-	resp, err := client.Get(apiURL)
+// checkLLMStatus reports backend liveness for /botinfo. The endpoint it probes
+// differs per backend, which the llm package hides behind Ping.
+func (p *BotInfoPlugin) checkLLMStatus() string {
+	c := llmClient()
+	models, err := c.Ping(context.Background())
 	if err != nil {
-		return fmt.Sprintf("offline (%s)", err.Error())
+		return fmt.Sprintf("offline (%s: %s)", c.Backend(), err.Error())
 	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		return fmt.Sprintf("error (HTTP %d)", resp.StatusCode)
+	if len(models) == 0 {
+		return fmt.Sprintf("online (%s, no models loaded)", c.Backend())
 	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return "online (could not read response)"
-	}
-
-	var result struct {
-		Models []struct {
-			Name string `json:"name"`
-		} `json:"models"`
-	}
-	if err := json.Unmarshal(body, &result); err != nil {
-		return "online (could not parse response)"
-	}
-
-	modelNames := make([]string, 0, len(result.Models))
-	for _, m := range result.Models {
-		modelNames = append(modelNames, m.Name)
-	}
-
-	if len(modelNames) == 0 {
-		return "online (no models loaded)"
-	}
-
-	return fmt.Sprintf("online (%d models: %s)", len(modelNames), strings.Join(modelNames, ", "))
+	return fmt.Sprintf("online (%s, %d models: %s)", c.Backend(), len(models), strings.Join(models, ", "))
 }
@@ -97,7 +97,7 @@ func TestBuildFightSeats_ConsumesTheAbilityOnceAndCarriesItOnTheSeat(t *testing.
 	ragingBerserker(t, uid)

 	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
-		uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+		uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}
@@ -125,7 +125,7 @@ func TestBuildZoneCombatants_RebuildKeepsTheRageForTheWholeFight(t *testing.T) {
 	ragingBerserker(t, uid)
 	p := &AdventurePlugin{}

-	seats, _, _, refusal := p.buildFightSeats(uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+	seats, _, _, refusal := p.buildFightSeats(uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}
@@ -171,7 +171,7 @@ func TestBuildFightSeats_SatOutMemberKeepsTheirArmedAbility(t *testing.T) {
 	}

 	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
-		leader, []id.UserID{leader, downed}, dndBestiary["goblin"], 1, 0)
+		leader, []id.UserID{leader, downed}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}
@@ -32,6 +32,20 @@ func (p *AdventurePlugin) postCombatBookkeeping(
 	if err := persistDnDPostCombatSubclass(dndChar, raged, result, mods); err != nil {
 		slog.Error("dnd: post-combat subclass persist", "user", userID, "err", err)
 	}
+	// The pet fought too. A win is its only earned XP — see grantPetCombatXP
+	// for why this seam and not the room-clear one: it is the single place all
+	// four close-outs already meet, so a pet cannot level differently depending
+	// on whether the fight auto-resolved or was played a round at a time.
+	if result.PlayerWon {
+		if leveled := grantPetCombatXP(userID); len(leveled) > 0 {
+			for _, line := range leveled {
+				slog.Info("adventure: pet leveled", "user", userID, "pet", line)
+			}
+			if err := p.SendDM(userID, "🐾 "+strings.Join(leveled, "\n🐾 ")); err != nil {
+				slog.Warn("adventure: pet level-up DM", "user", userID, "err", err)
+			}
+		}
+	}
 }

 // grantCombatAchievements checks combat results for achievement-worthy moments.
@@ -371,7 +385,7 @@ type DeathTransitionResult struct {
 func transitionDeath(p DeathTransitionParams) DeathTransitionResult {
 	var r DeathTransitionResult

-	if p.AllowPardon && p.ChatLevel >= 20 && p.Char.PardonAvailable() && rand.Float64() < 0.33 {
+	if p.AllowPardon && p.ChatLevel >= 20 && p.Char.PardonAvailable() && simFloat64() < 0.33 {
 		r.Pardoned = true
 		now := time.Now().UTC()
 		p.Char.LastPardonUsed = &now
@@ -97,7 +97,7 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {

 	// Seat the whole party, leader first. A solo player is a one-seat roster and
 	// takes the path they always took: one build, one INSERT, no participant rows.
-	seats, enemy, senderSkip, refusal := p.buildFightSeats(ctx.Sender, roster, monster, int(zone.Tier), run.DMMood)
+	seats, enemy, senderSkip, refusal := p.buildFightSeats(ctx.Sender, roster, monster, int(zone.Tier), run.DMMood, run)
 	if refusal != "" {
 		return p.replyDM(ctx, refusal)
 	}
@@ -119,6 +119,17 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {
 		return p.replyDM(ctx, "Couldn't start the fight: "+err.Error())
 	}

+	// Layer-2 boss state that is spent mid-fight (Valdris's Phylactery Verses)
+	// is seeded onto the fresh session ONCE, from the route the player walked to
+	// get here — not on the per-round rebuild, which would resurrect spent
+	// rebirths. enemyHP is the party-scaled pool persisted above. No-op for every
+	// non-hooked enemy.
+	if seedBossRunStatuses(sess, monster.ID, enemyHP, run) {
+		if err := saveCombatSession(sess); err != nil {
+			return p.replyDM(ctx, "Couldn't start the fight: "+err.Error())
+		}
+	}
+
 	var b strings.Builder
 	if isBoss {
 		if line := composeBossEntry(zone.ID, run.RunID, run.CurrentRoom); line != "" {
@@ -696,6 +707,24 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			PlayerHeal:  out.PlayerHeal,
 			EnemySkip:   out.EnemySkip,
 		}
+		// Revive the arcane-blaster sustained cantrip floor in the turn engine.
+		// combat_engine.go:590 deals CantripPerRound flat every round, but that
+		// path is the swing-based engine (SimulateCombat). Auto-resolve — the
+		// live path for every expedition — runs the turn engine, where a caster
+		// autocasts and never weapon-swings, so the floor was dead code: casters
+		// fought at bare cantrip dice (~4d10≈22 at L20). Lift LANDED cantrip
+		// damage to the floor, but only when the cast already connected
+		// (eff.EnemyDamage > 0) — a whiffed Fire Bolt still whiffs, so the ~35%
+		// miss variance survives and the floor doesn't become a guaranteed flat
+		// hammer (that overshot to ~99%). Damage cantrips only; slot spells keep
+		// their rolled damage. Only Mage/Sorcerer/Warlock carry a nonzero
+		// CantripPerRound, so this is self-targeting.
+		if spell.Level == 0 && eff.EnemyDamage > 0 &&
+			(spell.Effect == EffectDamageAttack || spell.Effect == EffectDamageSave || spell.Effect == EffectDamageAuto) {
+			if floor := ct.players[seat].Mods.CantripPerRound; floor > eff.EnemyDamage {
+				eff.EnemyDamage = floor
+			}
+		}
 		// §1 — redirect the heal onto the named ally. The roll is the same; only
 		// the body it lands on changes. This is the line that makes a cleric a
 		// cleric: until it existed, every heal in the engine was a self-heal, and
@@ -181,6 +181,20 @@ type CombatModifiers struct {
 	SpellPreDamage      int
 	SpellPreDamageDesc  string
 	SpellEnemySkipFirst bool
+
+	// At-will cantrip channel. Arcane blasters (Mage/Sorcerer/Warlock) throw a
+	// scaling damage cantrip EVERY round — 5e cantrips are the caster's at-will
+	// floor and scale to 4 dice at L17 (Fire Bolt 4d10, Eldritch Blast 4 beams).
+	// The pre-combat one-shot SpellPreDamage modelled a single leveled cast and
+	// left the caster swinging a stick for the rest of the fight; that is the
+	// whole of the caster T5-room wall (one burst can't finish a 65-HP monster
+	// and the quarterstaff floor does nothing). CantripPerRound is dealt as flat
+	// magic damage at the top of resolvePlayerSwings each round — no dice roll,
+	// so the RNG stream is stable and variance stays low. 0 for non-casters, so
+	// martial combat is byte-identical. Halved by enemy spell_resist like any
+	// spell. CantripDesc is the narration hook (spell name).
+	CantripPerRound int
+	CantripDesc     string
 }

 type Combatant struct {
@@ -428,6 +442,14 @@ type combatState struct {
 	enemyRegen         int     // regenerate: enemy heals this much each round end
 	enemySurviveArmed  bool    // survive_at_1: enemy cheats death once, dropping to 1 HP

+	// Phylactery Verses (T6 Valdris) — stackable rebirth. enemyReviveCharges is
+	// how many times the boss still cheats death; each revives it to
+	// enemyReviveHP. Seeded once at fight start from unfound Verses, round-tripped
+	// through CombatStatuses. Distinct from enemySurviveArmed (a one-shot 1-HP
+	// proc): a rebirth restores a meaningful pool, and there can be several.
+	enemyReviveCharges int
+	enemyReviveHP      int
+
 	// Phase 13 bestiary slice 4 — the former flavor-only placeholders, now
 	// backed by real state.
 	enemySpellResist bool // spell_resist: player spell damage against this enemy is halved
@@ -435,6 +457,25 @@ type combatState struct {
 	enemyFearImmune  bool // fear_immune: player control spells (enemy-skip) fizzle against this enemy
 	enemyAtkBuff     int  // ally_buff: flat, accumulating bonus to the enemy's attack damage

+	// Amendment (T6 Custodian) — an in-combat Layer-2 hook resolved at round end
+	// by applyBossInCombatRoundEnd. enemyRewindHP is the boss's round-3 HP
+	// snapshot (0 until captured); enemyRewindUsed gates the once-only rewind
+	// that restores it to that snapshot when the boss crosses into phase 2. The
+	// soft midnight timer past round 20 rides enemyAtkBuff. Round-tripped through
+	// CombatStatuses; zero/false for every non-Custodian fight.
+	enemyRewindHP   int
+	enemyRewindUsed bool
+
+	// Inversion Stitch (T6 Seamstress) — an in-combat Layer-2 hook resolved at
+	// round end by applyBossInCombatRoundEnd, live only in the boss's phase 2.
+	// inversionActive is the number of rounds the room stays sewn inside-out
+	// (heals sting instead of mend, gated in stepPlayerActionEffect); it counts
+	// down one per round end. inversionTelegraph warns the round before a pulse
+	// activates, so a player who watches the tell can hold their heals. Both
+	// round-trip through CombatStatuses; zero/false for every non-Seamstress fight.
+	inversionActive    int
+	inversionTelegraph bool
+
 	round  int
 	events []CombatEvent

@@ -541,6 +582,31 @@ func maybeTriggerOrcRage(st *combatState, player *Combatant, phaseName string) {
 // consumes once-per-fight openers (AutoCritFirst, FirstAttackBonus,
 // AssassinateAdvantage) via st flags — extras roll vanilla.
 func resolvePlayerSwings(st *combatState, player, enemy *Combatant, phase *CombatPhase, result *CombatResult) bool {
+	// At-will cantrip: fires once per round before the weapon swing, independent
+	// of whether the swing connects (a caster who whiffs the stick still throws
+	// its Fire Bolt). Flat magic damage, halved by spell_resist. 0 for
+	// non-casters → skipped entirely, so martial combat draws no extra events
+	// and no RNG. See CantripPerRound in CombatModifiers.
+	if player.Mods.CantripPerRound > 0 && st.enemyHP > 0 {
+		dmg := player.Mods.CantripPerRound
+		if enemyResistsSpells(enemy, st) {
+			dmg = max(1, dmg/2)
+		}
+		st.enemyHP = max(0, st.enemyHP-dmg)
+		st.events = append(st.events, CombatEvent{
+			Round: st.round, Phase: phase.Name, Actor: "player", Action: "cantrip",
+			Damage: dmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+			Desc: player.Mods.CantripDesc,
+		})
+		// Route the kill through enemyDown, not a raw HP read: a boss that cheats
+		// death (survive_at_1) or holds a phylactery rebirth (T6 Valdris) must get
+		// that chance even when the lethal blow is the at-will cantrip. enemyDown
+		// restores its HP and returns false, so the weapon swing below resolves
+		// against the revived pool. Mirrors resolvePlayerAttack's own kill routing.
+		if enemyDown(st, phase.Name) {
+			return true
+		}
+	}
 	if resolvePlayerAttack(st, player, enemy, phase, result) {
 		return true
 	}
@@ -1308,6 +1374,19 @@ func enemyDown(st *combatState, phaseName string) bool {
 		})
 		return false
 	}
+	// Phylactery Verses (T6 Valdris): a stackable rebirth. Each unfound Verse
+	// left one of these charges, and each restores a real pool rather than the
+	// 1-HP stay above — a full-clear explorer stripped them all and fights a
+	// mortal, a skip-route fights a god who keeps getting back up.
+	if st.enemyReviveCharges > 0 {
+		st.enemyReviveCharges--
+		st.enemyHP = max(1, st.enemyReviveHP)
+		st.events = append(st.events, CombatEvent{
+			Round: st.round, Phase: phaseName, Actor: "enemy", Action: "phylactery_rebirth",
+			PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+		})
+		return false
+	}
 	return true
 }

@@ -242,6 +242,10 @@ func renderEvent(e CombatEvent, playerName, enemyName string, result CombatResul
 	case "concentration_tick":
 		return fmt.Sprintf(pickRand(narrativeConcentrationTick), e.Damage)

+	case "cantrip":
+		// e.Desc is the spell name (Fire Bolt / Eldritch Blast); e.Damage the hit.
+		return fmt.Sprintf(pickRand(narrativeCantrip), e.Desc, e.Damage)
+
 	case "pet_deflect":
 		return pickRand(narrativePetDeflect)

@@ -331,6 +335,18 @@ func renderEvent(e CombatEvent, playerName, enemyName string, result CombatResul
 		return pickRand(narrativeSurviveArmed)
 	case "survive_at_1":
 		return pickRand(narrativeSurvive)
+	case "phylactery_rebirth":
+		return pickRand(narrativePhylacteryRebirth)
+	case "amendment_rewind":
+		return pickRand(narrativeAmendmentRewind)
+	case "midnight_toll":
+		return fmt.Sprintf(pickRand(narrativeMidnightToll), e.Damage)
+	case "inversion_telegraph":
+		return pickRand(narrativeInversionTelegraph)
+	case "inversion_stitch":
+		return pickRand(narrativeInversionStitch)
+	case "heal_inverted":
+		return fmt.Sprintf(pickRand(narrativeHealInverted), e.Damage)
 	case "stat_drain":
 		return fmt.Sprintf(pickRand(narrativeStatDrain), e.Damage)
 	case "debuff":
@@ -546,6 +562,15 @@ var narrativeConcentrationTick = []string{
 	"🌀 The enemy steps wrong and the standing magic answers, %d damage. It does not move on.",
 }

+// narrativeCantrip fires each round an arcane blaster throws its at-will cantrip
+// (Fire Bolt / Eldritch Blast) before the weapon swing. %s is the spell name,
+// %d the damage — a caster's sustained floor, so it lands every round.
+var narrativeCantrip = []string{
+	"✨ %s streaks out and burns home — %d damage. The at-will floor never stops.",
+	"✨ A bolt of %s answers before the staff even moves, scorching for %d.",
+	"✨ %s lances the enemy for %d. No incantation, no wind-up — just the steady arcane drum.",
+}
+
 var narrativePetDeflect = []string{
 	"🐾 Your pet intercepts the blow. Damage halved. Your pet is now your best piece of equipment.",
 	"🐾 Your pet pushes you aside at the last second. Impact reduced. You did not ask to be pushed. Results speak for themselves.",
@@ -761,6 +786,52 @@ var narrativeSurvive = []string{
 	"🕯️ The enemy by all rights should be down. It is, instead, very barely up.",
 }

+// narrativePhylacteryRebirth fires when Valdris burns a Verse the player left
+// un-found: a bound rebirth spends and the lich reassembles. Each line reads as
+// "you skipped one of these" so the mechanic teaches itself over a wipe.
+var narrativePhylacteryRebirth = []string{
+	"💀 The lich comes apart — and a Verse you never found sings him back together. He rises, unhurried.",
+	"💀 Bone-dust swirls up off the floor and re-seats itself. A rebirth you didn't unbind just spent itself. He stands.",
+	"💀 That should have been the end of him. A Verse still hums somewhere in the cathedral, and Valdris simply *begins again*.",
+}
+
+// narrativeAmendmentRewind fires when the Custodian rewinds itself to its round-3
+// HP snapshot — the once-only Amendment. Each line reads as time being undone so
+// the mechanic (front-loaded burst is partly refunded) teaches itself over a run.
+var narrativeAmendmentRewind = []string{
+	"🕰️ The Custodian raises a hand and *edits the last few minutes out of the record.* Wounds close in reverse; the clock-golem stands as it did rounds ago.",
+	"🕰️ \"That entry is amended.\" The damage you dealt simply un-happens — the Custodian rewinds to where it was and resumes, unhurried.",
+	"🕰️ Verdigris rings spin backward. Time you spent hurting it is refunded to the golem; it returns to its round-three self and keeps working.",
+}
+
+// narrativeMidnightToll fires past round 20 — the soft closing-time timer, the
+// Custodian's Attack climbing each round a stalled fight refuses to end.
+var narrativeMidnightToll = []string{
+	"🔔 A bell tolls somewhere above. Closing time — the Custodian's swings come harder. (+%d attack)",
+	"🔔 The hour is nearly spent, and so is its patience; each blow lands with more weight now. (+%d attack)",
+}
+
+// narrativeInversionTelegraph fires one round before an Inversion Stitch pulse —
+// the Seamstress's tell. It reads as a warning so a player learns to hold heals.
+var narrativeInversionTelegraph = []string{
+	"🧵 The Seamstress draws a thread taut and the room *shivers* — walls flexing toward inside-out. Whatever you were about to mend, hold it. (next round, healing turns against you)",
+	"🧵 A seam in the air puckers. The geometry is about to flip; a cure cast into it will run backward. (inversion incoming next round)",
+}
+
+// narrativeInversionStitch fires when a pulse activates — the room is sewn
+// inside-out and healing now wounds for the pulse's duration.
+var narrativeInversionStitch = []string{
+	"🧵 The stitch pulls through. The room is inside-out now — for a moment, to heal is to hurt.",
+	"🧵 Everything turns wrong-way-round. Mending and wounding have swapped ends of the needle.",
+}
+
+// narrativeHealInverted fires each time a heal lands during an active pulse: the
+// cure runs backward and stings instead. Teaches the mechanic on the spot.
+var narrativeHealInverted = []string{
+	"🧵 The heal runs backward through the inverted room — the cure opens the wound it meant to close. (%d damage)",
+	"🧵 Healing turns against its target in the sewn-inside-out air; the mend lands as a sting. (%d damage)",
+}
+
 var narrativeStatDrain = []string{
 	"🩸 The enemy saps your strength — your swings feel heavier, weaker. (-%d hit damage)",
 	"🩸 Something drains out of your limbs. Your hits won't bite as deep now. (-%d damage)",
@@ -51,7 +51,7 @@ func fightRoster(sender id.UserID) []id.UserID {
 // The enemy is built once. Every seat's build derives the identical stat block
 // from (monster, tier, dmMood); only the player half varies.
 func (p *AdventurePlugin) buildFightSeats(
-	sender id.UserID, roster []id.UserID, monster DnDMonsterTemplate, tier, dmMood int,
+	sender id.UserID, roster []id.UserID, monster DnDMonsterTemplate, tier, dmMood int, run *DungeonRun,
 ) (seats []CombatSeatSetup, enemy *Combatant, senderSkip, refusal string) {
 	skip := func(uid id.UserID, why string) {
 		if uid == sender {
@@ -157,6 +157,13 @@ func (p *AdventurePlugin) buildFightSeats(
 	// actually seated — a member who was skipped (downed, busy elsewhere) never
 	// joined the fight and must not be charged to the enemy.
 	applySeatWeights(seatCombatants(seats), levels, companions)
+
+	// Fold in any Layer-2 pre-combat boss mechanic before this enemy is used to
+	// persist the initial HP pool. partyCombatantsForSession re-applies the same
+	// modifier on every round's rebuild; doing it here keeps the persisted stat
+	// block consistent with the fight the engine will actually run. No-op for
+	// every non-hooked enemy.
+	applyBossRunModifiers(monster.ID, enemy, run)
 	return seats, enemy, senderSkip, ""
 }

@@ -109,7 +109,7 @@ func TestBuildFightSeats_SoloSeatsExactlyThePlayer(t *testing.T) {
 	fightTestChar(t, solo, 30)

 	seats, enemy, skip, refusal := (&AdventurePlugin{}).buildFightSeats(
-		solo, []id.UserID{solo}, dndBestiary["goblin"], 1, 0)
+		solo, []id.UserID{solo}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" || skip != "" {
 		t.Fatalf("solo fight refused: %s / %s", refusal, skip)
 	}
@@ -140,7 +140,7 @@ func TestBuildFightSeats_DownedMemberSitsOut(t *testing.T) {

 	roster := []id.UserID{leader, downed, standing}
 	seats, _, skip, refusal := (&AdventurePlugin{}).buildFightSeats(
-		leader, roster, dndBestiary["goblin"], 1, 0)
+		leader, roster, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("party refused over a downed member: %s", refusal)
 	}
@@ -156,7 +156,7 @@ func TestBuildFightSeats_DownedMemberSitsOut(t *testing.T) {

 	// The one who was left behind typed `!fight` too, and silence is not an answer.
 	_, _, skip, refusal = (&AdventurePlugin{}).buildFightSeats(
-		downed, roster, dndBestiary["goblin"], 1, 0)
+		downed, roster, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("a downed member must not refuse the party's fight: %s", refusal)
 	}
@@ -176,7 +176,7 @@ func TestBuildFightSeats_DownedLeaderRefusesTheFightForEveryone(t *testing.T) {
 	roster := []id.UserID{leader, member}
 	p := &AdventurePlugin{}

-	seats, _, _, refusal := p.buildFightSeats(leader, roster, dndBestiary["goblin"], 1, 0)
+	seats, _, _, refusal := p.buildFightSeats(leader, roster, dndBestiary["goblin"], 1, 0, nil)
 	if len(seats) != 0 || refusal == "" {
 		t.Fatalf("downed leader seated %d players, refusal %q", len(seats), refusal)
 	}
@@ -184,7 +184,7 @@ func TestBuildFightSeats_DownedLeaderRefusesTheFightForEveryone(t *testing.T) {
 		t.Errorf("the leader should be told to rest, got %q", refusal)
 	}

-	_, _, _, refusal = p.buildFightSeats(member, roster, dndBestiary["goblin"], 1, 0)
+	_, _, _, refusal = p.buildFightSeats(member, roster, dndBestiary["goblin"], 1, 0, nil)
 	if !strings.Contains(refusal, "leader") {
 		t.Errorf("the member should be told it is the leader holding things up, got %q", refusal)
 	}
@@ -215,12 +215,44 @@ type CombatStatuses struct {
 	EnemyRegen         int     `json:"enemy_regen,omitempty"`
 	EnemySurviveArmed  bool    `json:"enemy_survive_armed,omitempty"`

+	// Phylactery Verses (Tier-6 postgame, Valdris Ascendant). Unlike the
+	// proc-armed EnemySurviveArmed one-shot, this is a *count* of rebirths seeded
+	// once at fight start (seedBossRunStatuses) from how many of the zone's secret
+	// Verses the player left un-found. Each consumed rebirth (enemyDown) revives
+	// the boss to EnemyReviveHP. Both fields are frozen at seed time except
+	// EnemyReviveCharges, which decrements as rebirths are spent — so they must
+	// round-trip through combatState to survive a suspend/resume. Zero for every
+	// other enemy, so omitempty keeps them off every non-Valdris row.
+	EnemyReviveCharges int `json:"enemy_revive_charges,omitempty"`
+	EnemyReviveHP      int `json:"enemy_revive_hp,omitempty"`
+
 	// Slice-4 monster-ability effects — the former flavor-only placeholders.
 	// EnemyRevealNext is a one-shot; the other three persist for the fight.
 	EnemySpellResist bool `json:"enemy_spell_resist,omitempty"`
 	EnemyRevealNext  bool `json:"enemy_reveal_next,omitempty"`
 	EnemyFearImmune  bool `json:"enemy_fear_immune,omitempty"`
 	EnemyAtkBuff     int  `json:"enemy_atk_buff,omitempty"`
+
+	// Amendment (Tier-6 postgame, The Custodian of the Last Hour). An in-combat
+	// Layer-2 hook resolved at round end (applyBossInCombatRoundEnd), not proc-
+	// armed: EnemyRewindHP snapshots the boss's HP at the end of round 3 (0 until
+	// captured); when the boss then crosses into phase 2 the hook restores it to
+	// that snapshot exactly once and sets EnemyRewindUsed. Both round-trip through
+	// combatState so the once-only rewind survives a suspend/resume. Zero/false
+	// for every other enemy. The soft midnight timer past round 20 rides the
+	// existing EnemyAtkBuff, so it needs no field of its own.
+	EnemyRewindHP   int  `json:"enemy_rewind_hp,omitempty"`
+	EnemyRewindUsed bool `json:"enemy_rewind_used,omitempty"`
+
+	// Inversion Stitch (Tier-6 postgame, The Seamstress). An in-combat Layer-2
+	// hook resolved at round end (applyBossInCombatRoundEnd), live only in the
+	// boss's phase 2. InversionActive is the rounds-remaining of the inside-out
+	// pulse during which player heals sting instead of mend (gated in
+	// stepPlayerActionEffect); InversionTelegraph is the one-round warning before
+	// a pulse activates. Both round-trip through combatState so a suspend/resume
+	// can't lose or replay a pulse mid-fight. Zero/false for every other enemy.
+	InversionActive    int  `json:"inversion_active,omitempty"`
+	InversionTelegraph bool `json:"inversion_telegraph,omitempty"`
 }

 // applyBuffDelta folds one resolved buff (the result of a !cast / !consume
@@ -450,6 +482,9 @@ const combatSessionCols = `

 // newCombatSessionID — 16-char hex token. Same scheme as zone runs / expeditions.
 func newCombatSessionID() string {
+	if simSeedOn() {
+		return simHexToken()
+	}
 	var b [8]byte
 	if _, err := cryptorand.Read(b[:]); err != nil {
 		// Vanishingly unlikely; fall through with a zeroed prefix.
@@ -211,6 +211,13 @@ func (p *AdventurePlugin) partyCombatantsForSession(sess *CombatSession) ([]*Com
 	// until every seat is built.
 	applySeatWeights(players, levels, companions)

+	// Layer-2 pre-combat boss mechanics: fold in any run-state-derived
+	// adjustment (e.g. Aurvandryx's Greed Tax) before the party HP scaling. This
+	// is re-derived every round like everything else here; its inputs are frozen
+	// for a terminal boss fight, so the result is stable. No-op for every
+	// non-hooked enemy.
+	applyBossRunModifiers(monster.ID, &enemy, run)
+
 	// Party-only enemy HP bump, re-derived each turn from the template so it never
 	// compounds. Matches the scalar startPartyCombatSession used for the initial
 	// persist; solo (one seat, weight 1) scales by 1.0.
@@ -363,12 +363,20 @@ func resumeTurnEngine(sess *CombatSession, players []*Combatant, enemy *Combatan
 		enemyRetaliateFrac: sess.Statuses.EnemyRetaliateFrac,
 		enemyRegen:         sess.Statuses.EnemyRegen,
 		enemySurviveArmed:  sess.Statuses.EnemySurviveArmed,
+		enemyReviveCharges: sess.Statuses.EnemyReviveCharges,
+		enemyReviveHP:      sess.Statuses.EnemyReviveHP,
 		// Slice-4 monster-ability effects — the former flavor-only placeholders.
 		enemySpellResist: sess.Statuses.EnemySpellResist,
 		enemyRevealNext:  sess.Statuses.EnemyRevealNext,
 		enemyFearImmune:  sess.Statuses.EnemyFearImmune,
 		enemyAtkBuff:     sess.Statuses.EnemyAtkBuff,
-		rng:              rng,
+		// Amendment (T6 Custodian) — round-3 snapshot + once-only rewind.
+		enemyRewindHP:   sess.Statuses.EnemyRewindHP,
+		enemyRewindUsed: sess.Statuses.EnemyRewindUsed,
+		// Inversion Stitch (T6 Seamstress) — phase-2 heal-inverting pulses.
+		inversionActive:    sess.Statuses.InversionActive,
+		inversionTelegraph: sess.Statuses.InversionTelegraph,
+		rng:                rng,
 	}
 	order := turnOrder(sess, sess.Round, players, enemy)
 	sess.Statuses.TurnIdx = turnIdxForPhase(order, sess.Statuses.TurnIdx, sess.Phase)
@@ -568,10 +576,22 @@ func (te *turnEngine) stepPlayerActionEffect(eff *turnActionEffect) {
 		st.enemyHP = max(0, st.enemyHP-enemyDmg)
 	}
 	if eff.PlayerHeal > 0 {
-		// Respect any max_hp_drain monster ability — a drained player can't be
-		// healed back past the lowered ceiling.
-		hpCap := max(1, st.hpMax-st.maxHPDrain)
-		st.playerHP = min(hpCap, st.playerHP+eff.PlayerHeal)
+		if st.inversionActive > 0 {
+			// Inversion Stitch (T6 Seamstress phase 2): the room is sewn inside-out,
+			// so the cure lands as a wound. Floored at 1 so a player is never killed
+			// by their own heal — the Seamstress's own blows do the finishing; the
+			// sting just denies the sustain and softens the seat for them.
+			st.playerHP = max(1, st.playerHP-eff.PlayerHeal)
+			st.events = append(st.events, CombatEvent{
+				Round: st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "heal_inverted",
+				Damage: eff.PlayerHeal, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+			})
+		} else {
+			// Respect any max_hp_drain monster ability — a drained player can't be
+			// healed back past the lowered ceiling.
+			hpCap := max(1, st.hpMax-st.maxHPDrain)
+			st.playerHP = min(hpCap, st.playerHP+eff.PlayerHeal)
+		}
 	}
 	// §1 — heal somebody else. The caster's cursor stays where it is; only the
 	// target's HP moves.
@@ -582,14 +602,27 @@ func (te *turnEngine) stepPlayerActionEffect(eff *turnActionEffect) {
 	// path depends on. Healing keeps people up; it does not bring them back.
 	if eff.AllyHeal > 0 && eff.AllySeat >= 0 && eff.AllySeat < len(st.actors) {
 		if tgt := st.actors[eff.AllySeat]; tgt.playerHP > 0 {
-			cap := max(1, tgt.hpMax-tgt.maxHPDrain)
-			before := tgt.playerHP
-			tgt.playerHP = min(cap, tgt.playerHP+eff.AllyHeal)
-			st.events = append(st.events, CombatEvent{
-				Round: st.round, Phase: turnCombatPhase.Name, Actor: "player", Action: "ally_heal",
-				Damage: tgt.playerHP - before, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
-				Seat: eff.AllySeat, Desc: eff.Label,
-			})
+			if st.inversionActive > 0 {
+				// Inversion Stitch: the ally-heal wounds the friend it was meant to
+				// mend. Floored at 1 like the self-heal sting above — the sting denies
+				// the sustain, it does not kill.
+				before := tgt.playerHP
+				tgt.playerHP = max(1, tgt.playerHP-eff.AllyHeal)
+				st.events = append(st.events, CombatEvent{
+					Round: st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "heal_inverted",
+					Damage: before - tgt.playerHP, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
+					Seat: eff.AllySeat, Desc: eff.Label,
+				})
+			} else {
+				cap := max(1, tgt.hpMax-tgt.maxHPDrain)
+				before := tgt.playerHP
+				tgt.playerHP = min(cap, tgt.playerHP+eff.AllyHeal)
+				st.events = append(st.events, CombatEvent{
+					Round: st.round, Phase: turnCombatPhase.Name, Actor: "player", Action: "ally_heal",
+					Damage: tgt.playerHP - before, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
+					Seat: eff.AllySeat, Desc: eff.Label,
+				})
+			}
 		}
 	}
 	// Arm / replace the concentration aura. A new concentration cast overwrites
@@ -840,7 +873,12 @@ func (te *turnEngine) stepRoundEnd() {
 			Round: st.round, Phase: CombatPhaseRoundEnd, Actor: "player", Action: "concentration_tick",
 			Damage: st.concentrationDmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP, Seat: i,
 		})
-		if st.enemyHP <= 0 {
+		// Route the kill through enemyDown, not a raw HP read: a boss that cheats
+		// death (survive_at_1) or holds a phylactery rebirth (T6 Valdris) must get
+		// that chance even when the lethal blow is a lingering concentration pulse.
+		// enemyDown restores its HP and returns false, so the next seat's pulse (or
+		// the following round) resolves against the revived pool.
+		if enemyDown(st, CombatPhaseRoundEnd) {
 			te.finish(CombatStatusWon)
 			return
 		}
@@ -872,6 +910,14 @@ func (te *turnEngine) stepRoundEnd() {
 			Damage: st.enemyRegen, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
 		})
 	}
+	// Tier-6 in-combat Layer-2 boss hooks (Amendment): round-3 HP snapshot +
+	// once-only phase-2 rewind + soft midnight timer, resolved on the round that
+	// just finished. A no-op for every enemy but the hooked bosses, and only
+	// while the enemy still stands, so it is safe to call unconditionally here
+	// after the round's damage has settled.
+	if st.enemyHP > 0 {
+		applyBossInCombatRoundEnd(st, te.sess.EnemyID, te.enemy.Stats.MaxHP)
+	}
 	st.round++
 	// Initiative is re-rolled each round, so the next round's order is derived
 	// here — off st.round, since commit has not yet pushed it onto the session.
@@ -926,10 +972,16 @@ func (te *turnEngine) commit() {
 	s.EnemyRetaliateFrac = st.enemyRetaliateFrac
 	s.EnemyRegen = st.enemyRegen
 	s.EnemySurviveArmed = st.enemySurviveArmed
+	s.EnemyReviveCharges = st.enemyReviveCharges
+	s.EnemyReviveHP = st.enemyReviveHP
 	s.EnemySpellResist = st.enemySpellResist
 	s.EnemyRevealNext = st.enemyRevealNext
 	s.EnemyFearImmune = st.enemyFearImmune
 	s.EnemyAtkBuff = st.enemyAtkBuff
+	s.EnemyRewindHP = st.enemyRewindHP
+	s.EnemyRewindUsed = st.enemyRewindUsed
+	s.InversionActive = st.inversionActive
+	s.InversionTelegraph = st.inversionTelegraph

 	te.sess.TurnLog = append(te.sess.TurnLog, st.events...)
 }
@@ -275,3 +275,57 @@ func TestTurnEngine_CommitPersistsSeatZeroNotTheCursor(t *testing.T) {
 		t.Error("seat 1's consumed Lucky reroll leaked onto the session row")
 	}
 }
+
+// A lingering concentration pulse that lands the killing blow must still give a
+// revive-armed boss (survive_at_1 / T6 Valdris's phylactery rebirth) its chance
+// to stand back up — the round-end tick routes the kill through enemyDown, not a
+// raw enemyHP<=0 read. Regression for the concentration-bypass gap found in the
+// P8 Layer-2 review.
+func TestTurnEngine_ConcentrationKillHonorsRebirth(t *testing.T) {
+	// A charged rebirth: the pulse drops the enemy, a charge spends, it revives.
+	sess := turnSession(CombatPhaseRoundEnd, 500, 30)
+	p := basePlayer()
+	e := baseEnemy()
+	te := resumeTurnEngine(sess, []*Combatant{&p}, &e, combatSessionStepRNG(sess, enemySeat))
+	te.st.concentrationDmg = 100 // lethal against 30 HP
+	te.st.enemyReviveCharges = 1
+	te.st.enemyReviveHP = 40
+	if _, err := te.step(PlayerAction{}); err != nil {
+		t.Fatal(err)
+	}
+	te.commit()
+
+	if !sess.IsActive() {
+		t.Fatalf("a concentration kill ended the fight (%q) while a rebirth charge was armed", sess.Status)
+	}
+	if sess.EnemyHP != 40 {
+		t.Errorf("revived EnemyHP = %d, want the 40-HP revive pool", sess.EnemyHP)
+	}
+	if sess.Statuses.EnemyReviveCharges != 0 {
+		t.Errorf("post-revive charges = %d, want 0 (one spent)", sess.Statuses.EnemyReviveCharges)
+	}
+	rebirths := 0
+	for _, ev := range sess.TurnLog {
+		if ev.Action == "phylactery_rebirth" {
+			rebirths++
+		}
+	}
+	if rebirths != 1 {
+		t.Errorf("phylactery_rebirth events = %d, want 1", rebirths)
+	}
+
+	// With no charge left, the same pulse ends the fight cleanly (the win path
+	// is not broken by the enemyDown routing).
+	mortal := turnSession(CombatPhaseRoundEnd, 500, 30)
+	p2 := basePlayer()
+	e2 := baseEnemy()
+	te2 := resumeTurnEngine(mortal, []*Combatant{&p2}, &e2, combatSessionStepRNG(mortal, enemySeat))
+	te2.st.concentrationDmg = 100
+	if _, err := te2.step(PlayerAction{}); err != nil {
+		t.Fatal(err)
+	}
+	te2.commit()
+	if mortal.Status != CombatStatusWon {
+		t.Errorf("charge-less concentration kill status = %q, want %q", mortal.Status, CombatStatusWon)
+	}
+}
@@ -607,6 +607,7 @@ func emitDeathNews(userID id.UserID, location string) {
 		Zone:       location,
 		Level:      lvl,
 		Outcome:    "lost",
+		RunID:      latestRunIDForNews(userID),
 		OccurredAt: ts,
 	}, userID, "")
 }
@@ -655,6 +656,7 @@ func emitRetreatNews(userID id.UserID, reason string, zoneID ZoneID, day int) {
 		Level:      charLevel(userID),
 		Count:      day, // the day they got to before it fell apart
 		Outcome:    "retreated",
+		RunID:      latestRunIDForNews(userID),
 		OccurredAt: ts,
 	}, userID, "")
 }
@@ -37,11 +37,21 @@ type ThomCraftRecipe struct {
 	// inventory items consumed (§8.2 Drow Poison Blade). 0 = none.
 	BladeWeaponCount int
 	OutputName       string
-	OutputType       string // material | item | weapon | armor | accessory | consumable
+	OutputType       string // material | item | weapon | armor | accessory | consumable | magic_item
 	OutputTier       int
 	OutputValue      int64
-	Description      string
-	DiscoveryHint    string // shown when newly discovered via !lore
+	// OutputSkillSource, when set, is stamped on the crafted AdvItem's
+	// SkillSource — used for OutputType "magic_item" so the result equips and
+	// resolves against the registry exactly like a looted magic item
+	// ("magic_item:<id>").
+	OutputSkillSource string
+	Description       string
+	DiscoveryHint     string // shown when newly discovered via !lore
+	// AlwaysKnown recipes are never gated behind !lore discovery — they're the
+	// T6 signature-item pity path, craftable the moment a player holds enough
+	// of the zone's crafting anchor. They stay hidden from the recipe book
+	// until the player actually has an anchor in hand (see renderRecipeBook).
+	AlwaysKnown bool
 }

 var thomCraftRecipes = []ThomCraftRecipe{
@@ -115,6 +125,83 @@ var thomCraftRecipes = []ThomCraftRecipe{
 		Description:      "Coated blade — sleep-on-crit (DC 14 CON save) for 3 combats. (Effect wired in R6 polish.)",
 		DiscoveryHint:    "Thom turns a glass vial in the lamplight. \"Drow brew, drawn down to a thin coat. Bring me any blade you trust — sword, dagger, scimitar, makes no odds. The poison picks the edge.\"",
 	},
+
+	// ── T6 signature-item pity path ────────────────────────────────────────
+	// AlwaysKnown: no !lore gate. Each consumes 5 of the zone's crafting anchor
+	// (one guaranteed per clear) so a bad-luck run of the 4–6% signature drops
+	// still converts ~5 clears into a guaranteed best-in-slot. Output is a real
+	// magic_item — same SkillSource shape the loot path stamps — so it equips
+	// and carries its postgameSignatureEffects delta.
+	{
+		ID:   "anchor_crown_of_the_patient_king",
+		Name: "Crown of the Patient King",
+		Ingredients: map[string]int{
+			"Verse Bound Folio": 5,
+		},
+		OutputName:        "Crown of the Patient King",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:crown_of_the_patient_king",
+		AlwaysKnown:       true,
+		Description:       "Legendary crown of Valdris — the patient plan, worn on the head. (Pity craft: 5 Ossuary clears.)",
+	},
+	{
+		ID:   "anchor_aegis_of_the_first_scale",
+		Name: "Aegis of the First Scale",
+		Ingredients: map[string]int{
+			"Cooling Ember Of Aurvandryx": 5,
+		},
+		OutputName:        "Aegis of the First Scale",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       9000,
+		OutputSkillSource: "magic_item:aegis_of_the_first_scale",
+		AlwaysKnown:       true,
+		Description:       "Legendary breastplate of the Ember Before Fire — best armor in the game. (Pity craft: 5 First Hoard clears.)",
+	},
+	{
+		ID:   "anchor_needle_of_the_seam",
+		Name: "Needle of the Seam",
+		Ingredients: map[string]int{
+			"Spool Of Undone Geometry": 5,
+		},
+		OutputName:        "Needle of the Seam",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:needle_of_the_seam",
+		AlwaysKnown:       true,
+		Description:       "Legendary needle-dagger of the Seamstress — best caster weapon. (Pity craft: 5 Unplace clears.)",
+	},
+	{
+		ID:   "anchor_halo_of_the_sunken_dawn",
+		Name: "Halo of the Sunken Dawn",
+		Ingredients: map[string]int{
+			"Ember Of The Drowned Star": 5,
+		},
+		OutputName:        "Halo of the Sunken Dawn",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:halo_of_the_sunken_dawn",
+		AlwaysKnown:       true,
+		Description:       "Legendary halo of Seraphel — the first true healer's crown. (Pity craft: 5 Drowned Star clears.)",
+	},
+	{
+		ID:   "anchor_the_second_hand",
+		Name: "The Second Hand",
+		Ingredients: map[string]int{
+			"Unspent Hour": 5,
+		},
+		OutputName:        "The Second Hand",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:the_second_hand",
+		AlwaysKnown:       true,
+		Description:       "Legendary sidearm of the Last Meridian — best martial sidearm. (Pity craft: 5 Last Meridian clears.)",
+	},
 }

 // bladeWeaponKeywords are the name-substrings that qualify an AdvItem
@@ -140,6 +227,13 @@ func isBladeWeapon(it AdvItem) bool {
 	return false
 }

+// recipeCraftable reports whether a player may craft a recipe: either they've
+// discovered it via !lore, or it's an AlwaysKnown pity recipe (which skips
+// discovery entirely — the crafting anchor it needs is the real gate).
+func recipeCraftable(known map[string]bool, r ThomCraftRecipe) bool {
+	return r.AlwaysKnown || known[r.ID]
+}
+
 // findRecipeByID returns the recipe with the given ID.
 func findRecipeByID(id string) (ThomCraftRecipe, bool) {
 	for _, r := range thomCraftRecipes {
@@ -410,7 +504,7 @@ func (p *AdventurePlugin) handleCraftCmd(ctx MessageContext, args string) error
 		return p.SendDM(ctx.Sender, fmt.Sprintf(
 			"No recipe matches '%s'. Try `!craft list` to see what you've discovered.", args))
 	}
-	if !known[recipe.ID] {
+	if !recipeCraftable(known, recipe) {
 		return p.SendDM(ctx.Sender,
 			"_Thom: \"Doesn't ring a bell. If you don't know the recipe, I don't either.\"_\n\nDiscover it via `!lore` first.")
 	}
@@ -427,12 +521,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 	items, _ := loadAdvInventory(userID)
 	have := inventoryByName(items)

-	knownCount := 0
+	shownCount := 0
 	for _, r := range thomCraftRecipes {
-		if !known[r.ID] {
+		// AlwaysKnown pity recipes only surface once the player actually holds
+		// one of the crafting anchor — no need to spoil T6 chase items to a
+		// level-3 player. Discovered recipes always show.
+		switch {
+		case known[r.ID]:
+		case r.AlwaysKnown && recipeHasAnyIngredient(have, r):
+		default:
 			continue
 		}
-		knownCount++
+		shownCount++
 		sb.WriteString(fmt.Sprintf("**%s**\n", r.Name))
 		var parts []string
 		ready := true
@@ -463,11 +563,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 		sb.WriteString("\n")
 	}

-	if knownCount == 0 {
+	if shownCount == 0 {
 		sb.WriteString("_You don't know any recipes yet. Try `!lore` at Thom Krooke's._\n\n")
 	}

-	hidden := len(thomCraftRecipes) - knownCount
+	// Only discoverable (non-AlwaysKnown) recipes count toward the !lore hint;
+	// pity recipes are never "discovered", so they'd make the count never zero.
+	hidden := 0
+	for _, r := range thomCraftRecipes {
+		if !r.AlwaysKnown && !known[r.ID] {
+			hidden++
+		}
+	}
 	if hidden > 0 {
 		sb.WriteString(fmt.Sprintf("_%d undiscovered recipe(s). Use `!lore` to dig._", hidden))
 	} else {
@@ -476,6 +583,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 	return sb.String()
 }

+// recipeHasAnyIngredient reports whether the player holds at least one unit of
+// any of a recipe's named ingredients — the gate for surfacing an AlwaysKnown
+// pity recipe in the book.
+func recipeHasAnyIngredient(have map[string]int, r ThomCraftRecipe) bool {
+	for ing := range r.Ingredients {
+		if have[ing] > 0 {
+			return true
+		}
+	}
+	return false
+}
+
 // inventoryByName counts items grouped by name.
 func inventoryByName(items []AdvItem) map[string]int {
 	out := map[string]int{}
@@ -517,10 +636,11 @@ func (p *AdventurePlugin) executeCraft(userID id.UserID, r ThomCraftRecipe) erro
 	}

 	out := AdvItem{
-		Name:  r.OutputName,
-		Type:  r.OutputType,
-		Tier:  r.OutputTier,
-		Value: r.OutputValue,
+		Name:        r.OutputName,
+		Type:        r.OutputType,
+		Tier:        r.OutputTier,
+		Value:       r.OutputValue,
+		SkillSource: r.OutputSkillSource,
 	}
 	if err := addAdvInventoryItem(userID, out); err != nil {
 		return p.SendDM(userID, "Crafted item couldn't be deposited. Tell an admin.")
@@ -600,6 +720,11 @@ func (p *AdventurePlugin) handleLoreCmd(ctx MessageContext) error {

 	var undiscovered []ThomCraftRecipe
 	for _, r := range thomCraftRecipes {
+		// AlwaysKnown recipes are never in the discovery pool — they can't be
+		// "found" and shouldn't dilute the odds of finding the real ones.
+		if r.AlwaysKnown {
+			continue
+		}
 		if !known[r.ID] {
 			undiscovered = append(undiscovered, r)
 		}
@@ -18,6 +18,11 @@ func TestRecipeRegistry_IngredientsExistInResources(t *testing.T) {
 		}
 	}
 	for _, r := range thomCraftRecipes {
+		// AlwaysKnown pity recipes consume zone-loot crafting anchors, not
+		// gather-resource materials — validated separately below.
+		if r.AlwaysKnown {
+			continue
+		}
 		for ing := range r.Ingredients {
 			if !known[ing] {
 				t.Errorf("recipe %s references unknown ingredient %q", r.ID, ing)
@@ -26,12 +31,59 @@ func TestRecipeRegistry_IngredientsExistInResources(t *testing.T) {
 	}
 }

+// TestPityRecipes_AnchorsAndOutputsResolve — the T6 signature-item pity
+// recipes consume a zone-loot UniqueAlways crafting anchor and emit a real
+// registry magic item. Validate both ends: every ingredient name matches a
+// UniqueAlways zone-loot drop's inventory name, and every OutputSkillSource
+// points at a magicItemRegistry ID.
+func TestPityRecipes_AnchorsAndOutputsResolve(t *testing.T) {
+	anchorNames := map[string]bool{}
+	for _, z := range allZones() {
+		for _, e := range z.Loot {
+			if e.UniqueAlways {
+				anchorNames[titleCaseUnderscored(e.ItemID)] = true
+			}
+		}
+	}
+	pity := 0
+	for _, r := range thomCraftRecipes {
+		if !r.AlwaysKnown {
+			continue
+		}
+		pity++
+		for ing := range r.Ingredients {
+			if !anchorNames[ing] {
+				t.Errorf("pity recipe %s ingredient %q is not a zone-loot anchor name", r.ID, ing)
+			}
+		}
+		if r.OutputType != "magic_item" {
+			t.Errorf("pity recipe %s OutputType = %q, want magic_item", r.ID, r.OutputType)
+		}
+		id, ok := strings.CutPrefix(r.OutputSkillSource, "magic_item:")
+		if !ok {
+			t.Errorf("pity recipe %s OutputSkillSource %q missing magic_item: prefix", r.ID, r.OutputSkillSource)
+			continue
+		}
+		if _, ok := magicItemRegistry[id]; !ok {
+			t.Errorf("pity recipe %s output %q not in magicItemRegistry", r.ID, id)
+		}
+	}
+	if pity != 5 {
+		t.Errorf("expected 5 T6 pity recipes, found %d", pity)
+	}
+}
+
 // TestRecipeRegistry_OutputValuesMatchTier — outputs should land in §8.1
 // rarity brackets given their tier (rare 100–300, very rare 500–1200,
 // epic 500–1200 in §8.1 — recipes here lean tier 3–4, so 200..1200 is the
 // reasonable band).
 func TestRecipeRegistry_OutputValuesInBand(t *testing.T) {
 	for _, r := range thomCraftRecipes {
+		// Pity recipes emit Legendary magic items priced well above the §8.1
+		// crafting band by design — excluded from this invariant.
+		if r.AlwaysKnown {
+			continue
+		}
 		if r.OutputValue < 200 || r.OutputValue > 1200 {
 			t.Errorf("recipe %s output value %d outside band [200,1200] (tier %d)",
 				r.ID, r.OutputValue, r.OutputTier)
@@ -1,9 +1,11 @@
 package plugin

 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"math"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -31,6 +33,23 @@ import (
 // in E1e. !advance / !search / !rest / !extract are out-of-scope for E1.

 func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string) error {
+	args = strings.TrimSpace(args)
+	sub, rest := splitFirstWord(args)
+
+	// Two subcommands are aliases for top-level commands that take the per-user
+	// lock themselves. Dispatch them BEFORE we take it: advUserLock is a plain
+	// sync.Mutex, so grabbing it here and again in there does not merely block —
+	// it wedges the lock forever, because the deferred Unlock below never runs.
+	// Every later `!adventure` / `!expedition` / `!zone` command from that player
+	// then hangs too. Both aliases load their own character, so nothing below is
+	// being skipped.
+	switch strings.ToLower(sub) {
+	case "extract":
+		return p.handleExtractCmd(ctx, "")
+	case "resume":
+		return p.handleResumeCmd(ctx, rest)
+	}
+
 	userMu := p.advUserLock(ctx.Sender)
 	userMu.Lock()
 	defer userMu.Unlock()
@@ -44,8 +63,6 @@ func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string
 			"No Adv 2.0 character yet — run `!setup` (or just enter combat and we'll auto-build one).")
 	}

-	args = strings.TrimSpace(args)
-	sub, rest := splitFirstWord(args)
 	switch strings.ToLower(sub) {
 	case "":
 		// If active, show status; otherwise help. A party member is on an
@@ -99,10 +116,6 @@ func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string
 		return p.expeditionCmdHire(ctx, rest)
 	case "dismiss":
 		return p.expeditionCmdDismiss(ctx)
-	case "extract":
-		return p.handleExtractCmd(ctx, "")
-	case "resume":
-		return p.handleResumeCmd(ctx, rest)
 	case "map", "m":
 		return p.handleExpeditionMapCmd(ctx, "")
 	case "run", "explore", "advance":
@@ -160,6 +173,23 @@ func (p *AdventurePlugin) expeditionCmdList(ctx MessageContext, c *DnDCharacter)
 			i+1, z.Display, int(z.Tier), z.LevelMin, z.LevelMax, z.ID, suffix))
 		b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
 	}
+	// Post-game zones under the "Beyond the Map" divider (see zoneCmdList).
+	if pg := postgameZones(); len(pg) > 0 {
+		unlocked, reason := postgameUnlocked(ctx.Sender, c.Level)
+		b.WriteString("\n— Beyond the Map —\n")
+		if !unlocked {
+			b.WriteString(fmt.Sprintf("_%s_\n", reason))
+		}
+		for j, z := range pg {
+			if unlocked {
+				b.WriteString(fmt.Sprintf("**%d.** %s — _T%d, L%d+_  `!expedition start %s`\n",
+					len(zones)+j+1, z.Display, int(z.Tier), z.LevelMin, z.ID))
+			} else {
+				b.WriteString(fmt.Sprintf("🔒 %s — _T%d, L%d+_\n", z.Display, int(z.Tier), z.LevelMin))
+			}
+			b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
+		}
+	}
 	if exp, isLeader, _ := activeExpeditionFor(ctx.Sender); exp != nil {
 		zone := zoneOrFallback(exp.ZoneID)
 		tail := "Use `!expedition status` or `!expedition abandon`."
@@ -295,9 +325,12 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	if strings.EqualFold(zoneTok, "epilogue") {
 		return p.handleEpilogueEncounter(ctx)
 	}
-	available := zonesForLevel(c.Level)
+	available := availableZonesFor(ctx.Sender, c.Level)
 	zoneID, ok := resolveZoneInput(zoneTok, available)
 	if !ok {
+		if reason := postgameLockReason(zoneTok, ctx.Sender, c.Level); reason != "" {
+			return p.SendDM(ctx.Sender, reason)
+		}
 		return p.SendDM(ctx.Sender,
 			"Unknown zone for your level. Try `!expedition list`.")
 	}
@@ -311,83 +344,14 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Couldn't parse supply packs: "+err.Error())
 	}
-	if err := purchase.Validate(zoneForCaps.Tier); err != nil {
-		return p.SendDM(ctx.Sender, "Invalid pack selection: "+err.Error())
-	}
-	// Reject if any expedition or zone run already active. This runs before the
-	// price quote: a player who cannot leave doesn't need to hear what leaving
-	// would have cost.
-	//
-	// The seat check spans `extracting` as well as `active` — a member of an
-	// extracting party is still seated for the seven-day resume window, and
-	// letting them outfit a rival expedition double-books them the moment their
-	// leader types `!resume`.
-	if seated, _ := seatedExpeditionFor(ctx.Sender); seated != nil {
-		zone, _ := getZone(seated.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You're riding a party expedition in **%s** (Day %d). `!expedition leave` before starting your own.",
-			zone.Display, seated.CurrentDay))
-	}
-	if existing, _ := getActiveExpedition(ctx.Sender); existing != nil {
-		zone, _ := getZone(existing.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You're already on expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
-			zone.Display, existing.CurrentDay))
-	}
-	// A leader who extracted still holds their roster for the resume window, and
-	// `!resume` only ever reaches the *newest* extracted row. Starting fresh on
-	// top of one would orphan it: unreachable, un-reapable until the sweeper
-	// catches it, with every member still seated and refused a run of their own.
-	//
-	// Only a row with a roster blocks. A solo extraction strands nobody, so
-	// walking away from it stays a normal thing to do.
-	if pending, _ := getResumableExpedition(ctx.Sender); pending != nil {
-		switch {
-		case extractionLapsed(pending, time.Now().UTC()):
-			// Past the window — reap it here rather than make them wait an hour
-			// for the sweeper, and let the new expedition proceed. Route through
-			// the shared reap so the freed members hear about it, same as the
-			// sweeper and `!expedition abandon` do.
-			if err := p.reapLapsedExtraction(pending); err != nil {
-				slog.Warn("expedition: reap lapsed on start", "expedition", pending.ID, "err", err)
-			}
-		default:
-			// A roster still holds; block. On a roster-read error, assume it is
-			// occupied and refuse — proceeding would orphan a party we could not
-			// confirm was empty, the one outcome this guard exists to prevent. A
-			// solo extraction (n == 1) strands nobody, so walking away is fine.
-			n, err := partySize(pending.ID)
-			if err != nil || n > 1 {
-				zone, _ := getZone(pending.ZoneID)
-				return p.SendDM(ctx.Sender, fmt.Sprintf(
-					"You extracted from **%s** on Day %d and your party is still waiting on you. `!resume` to lead them back in, or `!expedition abandon` to let it go — until you do one or the other, none of them can start a run of their own.",
-					zone.Display, pending.CurrentDay))
-			}
-		}
-	}

-	cost := float64(purchase.Cost())
-	if p.euro == nil {
-		return p.SendDM(ctx.Sender, "Coin system unavailable — try again later.")
-	}
-	if balance := p.euro.GetBalance(ctx.Sender); balance < cost {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
-			int(cost), balance))
-	}
-	if existing, _ := getActiveZoneRun(ctx.Sender); existing != nil {
-		zone, _ := getZone(existing.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You have an active single-session zone run in **%s**. Finish or `!zone abandon` before starting an expedition.",
-			zone.Display))
-	}
-
-	zone := zoneForCaps
-	_, supplies, startLine, err := p.beginExpedition(ctx.Sender, c.Level, zone, purchase, "expedition outfitting")
+	out, err := p.performExpeditionStart(ctx.Sender, c, zoneForCaps, purchase, "")
 	if err != nil {
+		// Every refusal below carries its own finished sentence — see the sentinel
+		// block on performExpeditionStart — so the command only has to say it.
 		return p.SendDM(ctx.Sender, err.Error())
 	}
-	markActedToday(ctx.Sender)
+	zone, supplies, startLine := out.Zone, out.Supplies, out.StartLine

 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🗺 **Expedition begins — %s** _(T%d)_\n\n", zone.Display, int(zone.Tier)))
@@ -408,6 +372,182 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	return p.SendDM(ctx.Sender, b.String())
 }

+// ── the headless twin of `!expedition start` ────────────────────────────────
+
+// Sentinels for the ways outfitting can be refused, so the web action queue
+// (pete_orders.go) can pick a verdict without parsing prose. Every refusal is
+// returned as an advRefusal, which wraps one of these AND carries the
+// finished player-facing sentence — that is how `!expedition start` keeps the
+// exact copy it always sent while the web gets a machine-readable answer.
+var (
+	errExpStartResting    = errors.New("expedition start: still resting")
+	errExpStartZoneLocked = errors.New("expedition start: zone not available at this level")
+	errExpStartBadPacks   = errors.New("expedition start: invalid pack selection")
+	errExpStartBusy       = errors.New("expedition start: already adventuring")
+	errExpStartBroke      = errors.New("expedition start: cannot cover outfitting")
+	errExpStartFailed     = errors.New("expedition start: could not outfit")
+)
+
+// advRefusal is a refusal that is both classifiable and quotable: errors.Is
+// picks the verdict, Error() is the sentence the command has always sent. Shared
+// by every headless twin in the web action family (start, resume, babysit).
+type advRefusal struct {
+	kind error
+	msg  string
+}
+
+func (e advRefusal) Error() string { return e.msg }
+func (e advRefusal) Unwrap() error { return e.kind }
+
+func refuseAdv(kind error, format string, args ...any) error {
+	return advRefusal{kind: kind, msg: fmt.Sprintf(format, args...)}
+}
+
+// expStartOutcome is what outfitting did, for a caller describing it somewhere
+// other than a DM.
+type expStartOutcome struct {
+	Zone      ZoneDefinition
+	Supplies  ExpeditionSupplies
+	Cost      int
+	Days      int
+	StartLine string
+}
+
+// performExpeditionStart is `!expedition start` minus the command framing: the
+// eligibility guards, the price gate, the debit, and the expedition row. It is
+// shared with the web action queue so that leaving town from a phone is the
+// *same* departure — same guards, same supplies, same opening log line.
+//
+// idemKey, when set, is the web order's guid: the debit then goes through
+// DebitIdem so a re-offered order that already paid cannot pay twice. The Matrix
+// command passes "" and keeps the plain debit, which is right — a Matrix message
+// arrives exactly once.
+//
+// LOCKING, and this is the one asymmetry in the headless-twin family: this
+// function does NOT take the per-user lock. performExtraction, takeSiegeBout and
+// performBabysitPurchase all take it themselves, because their command framings
+// do not hold it — but handleDnDExpeditionCmd holds it across its whole switch,
+// so taking it here would wedge advUserLock permanently (it is a plain
+// sync.Mutex, and the deferred unlock up there would never run). The web caller
+// takes it explicitly instead; see applyAdvOrder.
+func (p *AdventurePlugin) performExpeditionStart(uid id.UserID, c *DnDCharacter, zone ZoneDefinition, purchase SupplyPurchase, idemKey string) (expStartOutcome, error) {
+	if remaining := restingLockoutRemaining(c); remaining > 0 {
+		return expStartOutcome{}, refuseAdv(errExpStartResting,
+			"🛌 You're still resting — %s remaining. Pack up after.",
+			formatRespecDuration(remaining))
+	}
+	// Re-resolve availability against the game's own tables rather than trusting
+	// the caller. The web resolves a zone from an offer list gogobee itself
+	// pushed, but that snapshot can be minutes old and is not a permission.
+	if _, ok := resolveZoneInput(string(zone.ID), availableZonesFor(uid, c.Level)); !ok {
+		if reason := postgameLockReason(string(zone.ID), uid, c.Level); reason != "" {
+			return expStartOutcome{}, refuseAdv(errExpStartZoneLocked, "%s", reason)
+		}
+		return expStartOutcome{}, refuseAdv(errExpStartZoneLocked,
+			"Unknown zone for your level. Try `!expedition list`.")
+	}
+	if err := purchase.Validate(zone.Tier); err != nil {
+		return expStartOutcome{}, refuseAdv(errExpStartBadPacks,
+			"Invalid pack selection: %s", err.Error())
+	}
+	// Reject if any expedition or zone run already active. This runs before the
+	// price quote: a player who cannot leave doesn't need to hear what leaving
+	// would have cost.
+	//
+	// The seat check spans `extracting` as well as `active` — a member of an
+	// extracting party is still seated for the seven-day resume window, and
+	// letting them outfit a rival expedition double-books them the moment their
+	// leader types `!resume`.
+	if seated, _ := seatedExpeditionFor(uid); seated != nil {
+		z, _ := getZone(seated.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You're riding a party expedition in **%s** (Day %d). `!expedition leave` before starting your own.",
+			z.Display, seated.CurrentDay)
+	}
+	if existing, _ := getActiveExpedition(uid); existing != nil {
+		// A web order that already paid and already started this expedition on an
+		// earlier tick lands here on the re-offer. Saying "you're already on
+		// expedition" would be a rejection for the thing the order in fact did, so
+		// the settled debit is what tells the two apart.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) && existing.ZoneID == zone.ID {
+			z, _ := getZone(existing.ZoneID)
+			return expStartOutcome{Zone: z, Supplies: existing.Supplies,
+				Cost: purchase.Cost(),
+				Days: estimateDays(existing.Supplies.Max, existing.Supplies.DailyBurn)}, nil
+		}
+		z, _ := getZone(existing.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You're already on expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
+			z.Display, existing.CurrentDay)
+	}
+	// A leader who extracted still holds their roster for the resume window, and
+	// `!resume` only ever reaches the *newest* extracted row. Starting fresh on
+	// top of one would orphan it: unreachable, un-reapable until the sweeper
+	// catches it, with every member still seated and refused a run of their own.
+	//
+	// Only a row with a roster blocks. A solo extraction strands nobody, so
+	// walking away from it stays a normal thing to do.
+	if pending, _ := getResumableExpedition(uid); pending != nil {
+		switch {
+		case extractionLapsed(pending, time.Now().UTC()):
+			// Past the window — reap it here rather than make them wait an hour
+			// for the sweeper, and let the new expedition proceed. Route through
+			// the shared reap so the freed members hear about it, same as the
+			// sweeper and `!expedition abandon` do.
+			if err := p.reapLapsedExtraction(pending); err != nil {
+				slog.Warn("expedition: reap lapsed on start", "expedition", pending.ID, "err", err)
+			}
+		default:
+			// A roster still holds; block. On a roster-read error, assume it is
+			// occupied and refuse — proceeding would orphan a party we could not
+			// confirm was empty, the one outcome this guard exists to prevent. A
+			// solo extraction (n == 1) strands nobody, so walking away is fine.
+			n, err := partySize(pending.ID)
+			if err != nil || n > 1 {
+				z, _ := getZone(pending.ZoneID)
+				return expStartOutcome{}, refuseAdv(errExpStartBusy,
+					"You extracted from **%s** on Day %d and your party is still waiting on you. `!resume` to lead them back in, or `!expedition abandon` to let it go — until you do one or the other, none of them can start a run of their own.",
+					z.Display, pending.CurrentDay)
+			}
+		}
+	}
+
+	cost := float64(purchase.Cost())
+	if p.euro == nil {
+		return expStartOutcome{}, refuseAdv(errExpStartFailed, "Coin system unavailable — try again later.")
+	}
+	// Skip the affordability gate on a re-offer that already paid: the debit is a
+	// settled fact and re-reading the now-lower balance would bounce a departure
+	// the player has bought. Same reasoning as purchaseEquipmentTier's.
+	if !(idemKey != "" && p.euro.HasExternalTx(idemKey)) {
+		if balance := p.euro.GetBalance(uid); balance < cost {
+			return expStartOutcome{}, refuseAdv(errExpStartBroke,
+				"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
+				int(cost), balance)
+		}
+	}
+	if existing, _ := getActiveZoneRun(uid); existing != nil {
+		z, _ := getZone(existing.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You have an active single-session zone run in **%s**. Finish or `!zone abandon` before starting an expedition.",
+			z.Display)
+	}
+
+	_, supplies, startLine, err := p.beginExpeditionIdem(uid, c.Level, zone, purchase, "expedition outfitting", idemKey)
+	if err != nil {
+		// beginExpedition refunds and tears down on every failure path, so the
+		// player owes nothing and this is permanent rather than retryable — a retry
+		// after a refund would find the guid-keyed debit already settled and hand
+		// them the expedition for free.
+		return expStartOutcome{}, refuseAdv(errExpStartFailed, "%s", err.Error())
+	}
+	markActedToday(uid)
+	return expStartOutcome{
+		Zone: zone, Supplies: supplies, Cost: purchase.Cost(),
+		Days: estimateDays(supplies.Max, supplies.DailyBurn), StartLine: startLine,
+	}, nil
+}
+
 // beginExpedition performs the non-interactive half of starting an expedition:
 // supply freebies, the coin debit, persistence, the starting region's run, and
 // the opening log entry. It refunds and tears down on every failure path, so a
@@ -421,10 +561,38 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 // It deliberately does NOT call markActedToday — an expedition the player did
 // not ask for must not spend their daily action or count as them showing up.
 func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone ZoneDefinition, purchase SupplyPurchase, reason string) (*Expedition, ExpeditionSupplies, string, error) {
+	return p.beginExpeditionIdem(uid, charLevel, zone, purchase, reason, "")
+}
+
+// beginExpeditionIdem is beginExpedition with the money keyed to an idempotency
+// id. idemKey empty keeps the plain Debit/Credit pair, which is correct for the
+// two callers that arrive exactly once (a Matrix command, the boredom ticker).
+//
+// A non-empty key comes from the web action queue, whose wire retries: the debit
+// then lands at most once however many times the order is re-offered, and the
+// refunds are keyed too so a torn-down start cannot refund on every tick. Note
+// what this means for the caller — once a refund has happened, retrying is
+// *unsafe*, because the guid-keyed debit will not charge again and the player
+// would get the expedition for free. performExpeditionStart therefore treats
+// every error from here as permanent.
+func (p *AdventurePlugin) beginExpeditionIdem(uid id.UserID, charLevel int, zone ZoneDefinition, purchase SupplyPurchase, reason, idemKey string) (*Expedition, ExpeditionSupplies, string, error) {
 	if p.euro == nil {
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Coin system unavailable — try again later.")
 	}
 	cost := float64(purchase.Cost())
+	debit := func(why string) bool { return p.euro.Debit(uid, cost, why) }
+	refund := func(why, suffix string) { p.euro.Credit(uid, cost, why) }
+	if idemKey != "" {
+		debit = func(why string) bool {
+			ok, _, err := p.euro.DebitIdem(uid, cost, why, idemKey)
+			return err == nil && ok
+		}
+		refund = func(why, suffix string) {
+			if _, _, err := p.euro.CreditIdem(uid, cost, why, idemKey+":refund"+suffix); err != nil {
+				slog.Error("expedition: outfitting refund failed", "user", uid, "order", idemKey, "err", err)
+			}
+		}
+	}

 	// Holiday perk: a complimentary standard pack is added to the supplies
 	// snapshot without inflating the coin cost. Bypasses the per-tier cap
@@ -439,14 +607,14 @@ func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone Zon
 	supplies := makeSupplies(zone.Tier, suppliesPurchase)

 	// Debit coins; bail on debit failure (race / cap).
-	if !p.euro.Debit(uid, cost, reason+": "+string(zone.ID)) {
+	if !debit(reason + ": " + string(zone.ID)) {
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't debit outfitting cost (try again).")
 	}

 	exp, err := startExpedition(uid, zone.ID, "", supplies)
 	if err != nil {
 		// Refund on persistence failure.
-		p.euro.Credit(uid, cost, "expedition outfitting refund")
+		refund("expedition outfitting refund", "")
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't start expedition: %s", err)
 	}

@@ -457,7 +625,7 @@ func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone Zon
 		// Refund and tear the expedition row back down — without a
 		// linked run, harvest and rooms can't function.
 		_ = abandonExpedition(uid)
-		p.euro.Credit(uid, cost, "expedition outfitting refund (run-spawn failed)")
+		refund("expedition outfitting refund (run-spawn failed)", ":region")
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't outfit the first region: %s", err)
 	}

@@ -676,65 +844,102 @@ func formatLogTimestamp(t time.Time) string {

 // ── abandon ─────────────────────────────────────────────────────────────────

-func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+// Sentinels for the two ways abandoning can be refused, so the web action queue
+// can pick a verdict without reading prose. Same contract as the start/resume
+// family above: errors.Is classifies, Error() is the sentence Matrix has always
+// sent.
+var (
+	errAbandonNothing   = errors.New("expedition abandon: nothing to abandon")
+	errAbandonNotLeader = errors.New("expedition abandon: only the leader may call it")
+)
+
+// abandonOutcome is what closing the expedition did, for a caller describing it
+// somewhere other than a DM.
+type abandonOutcome struct {
+	Zone      ZoneDefinition
+	Day       int
+	Extracted bool // it was already out and standing in town: loot and XP are kept
+}
+
+// performExpeditionAbandon is `!expedition abandon` minus the command framing.
+// Shared with the web action queue so closing a run from a phone disbands the
+// same roster, retires the same region runs, writes the same log line and tells
+// the same party — the members hear it from their leader either way, because
+// that is a fact about the expedition and not about which door was used.
+//
+// Like performExpeditionStart this does NOT take the per-user lock: its Matrix
+// caller already holds it across the whole `!expedition` switch. applyWebAbandon
+// takes it instead. Getting that backwards does not fail loudly — it wedges the
+// player's lock forever and every later adventure command from them hangs.
+func (p *AdventurePlugin) performExpeditionAbandon(uid id.UserID) (abandonOutcome, error) {
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return abandonOutcome{}, err
 	}
 	if exp == nil {
 		// An extracted expedition is still the owner's to close — it holds the
 		// roster until the resume window lapses. Without this, a leader who
 		// wanted out had to pay to `!resume` first just to abandon.
-		if exp, err = getResumableExpedition(ctx.Sender); err != nil {
-			return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		if exp, err = getResumableExpedition(uid); err != nil {
+			return abandonOutcome{}, err
 		}
 		isLeader = exp != nil
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition to abandon.")
+		return abandonOutcome{}, refuseAdv(errAbandonNothing, "No active expedition to abandon.")
 	}
 	if !isLeader {
 		// Abandoning throws away everyone's day. A member leaves alone.
-		return p.SendDM(ctx.Sender,
+		return abandonOutcome{}, refuseAdv(errAbandonNotLeader,
 			"Only your party leader can abandon the expedition. `!expedition leave` to walk out alone.")
 	}
 	zone, _ := getZone(exp.ZoneID)
-	extracted := exp.Status == ExpeditionStatusExtracting
+	out := abandonOutcome{Zone: zone, Day: exp.CurrentDay, Extracted: exp.Status == ExpeditionStatusExtracting}
 	audience := expeditionAudience(exp) // read before abandonExpedition disbands the roster
-	if err := abandonExpedition(ctx.Sender); err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't abandon: "+err.Error())
+	if err := abandonExpedition(uid); err != nil {
+		return abandonOutcome{}, err
 	}
-	markActedToday(ctx.Sender)
+	markActedToday(uid)
 	_ = retireAllRegionRuns(exp)
 	_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative", "expedition abandoned", "")
+	// The roster is being disbanded out from under the members; they hear it from
+	// their leader rather than discovering it the next time a command works again.
+	for _, member := range audience {
+		if member == uid {
+			continue
+		}
+		if err := p.SendDM(member, fmt.Sprintf(
+			"Your leader called off the expedition in **%s** on Day %d. You're free to start a run of your own.",
+			zone.Display, exp.CurrentDay)); err != nil {
+			slog.Warn("expedition: abandon DM failed", "user", member, "expedition", exp.ID, "err", err)
+		}
+	}
+	// Emergence seam: see maybeRollPetArrivalOnEmerge. Inside the twin because
+	// walking out of a dungeon is what rolls it, not saying so in a room.
+	p.maybeRollPetArrivalOnEmerge(uid)
+	return out, nil
+}
+
+func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
+	out, err := p.performExpeditionAbandon(ctx.Sender)
+	if err != nil {
+		var refusal advRefusal
+		if errors.As(err, &refusal) {
+			return p.SendDM(ctx.Sender, refusal.Error())
+		}
+		return p.SendDM(ctx.Sender, "Couldn't abandon: "+err.Error())
+	}
 	// An extracted party is standing in town, not in the dungeon: their supplies
 	// are already spent and their loot is already banked. Say the true thing.
 	body := fmt.Sprintf(
 		"Expedition in **%s** abandoned on Day %d. Supplies are forfeit. The dungeon remembers.",
-		zone.Display, exp.CurrentDay)
-	if extracted {
+		out.Zone.Display, out.Day)
+	if out.Extracted {
 		body = fmt.Sprintf(
 			"You let the expedition in **%s** go. Day %d is where it ends — loot, XP, and coins are kept. The dungeon remembers.",
-			zone.Display, exp.CurrentDay)
+			out.Zone.Display, out.Day)
 	}
-	// The roster is being disbanded out from under the members; they hear it from
-	// their leader rather than discovering it the next time a command works again.
-	for _, uid := range audience {
-		if uid == ctx.Sender {
-			continue
-		}
-		if err := p.SendDM(uid, fmt.Sprintf(
-			"Your leader called off the expedition in **%s** on Day %d. You're free to start a run of your own.",
-			zone.Display, exp.CurrentDay)); err != nil {
-			slog.Warn("expedition: abandon DM failed", "user", uid, "expedition", exp.ID, "err", err)
-		}
-	}
-	if err := p.SendDM(ctx.Sender, body); err != nil {
-		return err
-	}
-	// Emergence seam: see maybeRollPetArrivalOnEmerge.
-	p.maybeRollPetArrivalOnEmerge(ctx.Sender)
-	return nil
+	return p.SendDM(ctx.Sender, body)
 }

 // helper: ensure we don't shadow id.UserID import in test harness.
@@ -823,45 +1028,197 @@ func (p *AdventurePlugin) expeditionCmdRun(ctx MessageContext) error {
 // run graph / harvest tally / supplies / threat — same as before, just
 // no streamFlow here. compact==true switches the underlying combat
 // narration into terse mode and auto-resolves elite (not boss) rooms.
-// forkAutoPickTimeout — how long a background fork may sit unanswered
-// before the autopilot picks an available route itself. Short enough that
-// the expedition keeps moving rather than idling out to the 24h stale-run
-// reaper; long enough that a player away for the evening still gets first
-// say on a genuine fork.
-const forkAutoPickTimeout = 8 * time.Hour
+// forkAutoPickTimeout — how long a background fork may sit unanswered before
+// the autopilot picks a route itself.
+//
+// This was 8h, which reads as "the player gets first say" and behaves as "the
+// expedition stops for a third of a day, every fork." A multi-day expedition
+// crosses a lot of forks; at 8h apiece the autopilot spends more of its life
+// parked than walking, and a player who is simply asleep loses a night per
+// branch. 30m keeps a genuine first say for anyone actually at the keyboard and
+// costs an absent player almost nothing.
+const forkAutoPickTimeout = 30 * time.Minute

-// autoPickStaleFork commits the first unlocked option of a stale background
-// fork, advancing the run to that node exactly as `!zone go <n>` would
-// (advanceZoneRunNode + region-transition hook). Returns false — no pick —
-// when every option is locked, so the caller re-emits the prompt and the
-// run idles on toward the reaper. The choice is logged as a narrative entry
-// so the end-of-day digest can surface the decision the player missed.
-func (p *AdventurePlugin) autoPickStaleFork(exp *Expedition, run *DungeonRun, pf *pendingFork) bool {
-	var chosen *pendingChoice
-	for i := range pf.Options {
-		if pf.Options[i].Unlocked {
-			chosen = &pf.Options[i]
-			break
+// rankForkOptions orders a fork's options by how much walking them is worth:
+// somewhere new first, then the fatter edge (Weight is the author's own "this
+// is the main line" signal), then menu order as the tiebreak so the pick is
+// deterministic. Only unlocked options are returned.
+//
+// The old rule was "first unlocked option in the menu", which is edge-authoring
+// order — meaningful to whoever wrote the graph, arbitrary to the player. It
+// walked past unvisited branches to loop through cleared ones often enough to
+// look broken.
+func rankForkOptions(g ZoneGraph, run *DungeonRun, pf *pendingFork) []pendingChoice {
+	weights := map[string]int{}
+	for _, e := range g.outgoingEdges(run.CurrentNode) {
+		weights[e.To] = e.Weight
+	}
+	visited := map[string]bool{}
+	for _, n := range run.VisitedNodes {
+		visited[n] = true
+	}
+
+	open := make([]pendingChoice, 0, len(pf.Options))
+	for _, o := range pf.Options {
+		if o.Unlocked {
+			open = append(open, o)
 		}
 	}
-	if chosen == nil {
-		return false // nothing unlocked — leave it for the player / reaper
+	sort.SliceStable(open, func(i, j int) bool {
+		vi, vj := visited[open[i].To], visited[open[j].To]
+		if vi != vj {
+			return !vi // unvisited first
+		}
+		if wi, wj := weights[open[i].To], weights[open[j].To]; wi != wj {
+			return wi > wj
+		}
+		return open[i].Index < open[j].Index
+	})
+	return open
+}
+
+// autoPickStaleFork commits a stale background fork, advancing the run exactly
+// as `!zone go <n>` would (advanceZoneRunNode + region-transition hook). The
+// choice is logged as a narrative entry so the end-of-day digest can surface
+// the decision the player missed.
+//
+// When every route is locked it does not give up: it spends a set of thieves'
+// tools if the party is carrying any and one of the locks is the pickable kind.
+// Returns false only when there is genuinely nothing it can do — the caller
+// then backtracks rather than idling the expedition into the 24h reaper.
+func (p *AdventurePlugin) autoPickStaleFork(exp *Expedition, run *DungeonRun, pf *pendingFork) bool {
+	g, _ := loadZoneGraph(run.ZoneID)
+
+	ranked := rankForkOptions(g, run, pf)
+	note := "autopilot took the most promising path"
+	var spendTool int64
+	if len(ranked) == 0 {
+		picked, toolID, ok := p.autoPickWithTools(run, pf)
+		if !ok {
+			return false
+		}
+		ranked = []pendingChoice{picked}
+		spendTool = toolID
+		note = "autopilot spent " + thievesToolsName + " on the only way forward"
 	}
+	chosen := ranked[0]
+
 	if _, err := advanceZoneRunNode(run.RunID, chosen.To); err != nil {
 		slog.Warn("expedition: auto-pick stale fork",
 			"user", run.UserID, "run", run.RunID, "err", err)
 		return false
 	}
-	g, _ := loadZoneGraph(run.ZoneID)
+	// The door is behind us, so now the set is actually used up. Billing before
+	// the advance would charge the player for a move that failed — and the
+	// caller's backtrack would then clear the fork the tools just paid for.
+	if spendTool != 0 {
+		if err := removeAdvInventoryItem(spendTool); err != nil {
+			slog.Warn("expedition: autopilot tools spend", "user", run.UserID, "err", err)
+		}
+		beatLock(run, chosen.Label, "picked")
+	}
 	fireGraphRegionTransition(run.UserID, g.Nodes[run.CurrentNode], g.Nodes[chosen.To])
 	if exp != nil {
 		_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
-			fmt.Sprintf("autopilot took an available path after %dh idle at the fork: %s",
-				int(forkAutoPickTimeout.Hours()), chosen.Label), "")
+			fmt.Sprintf("%s: %s", note, chosen.Label), "")
 	}
 	return true
 }

+// autoPickWithTools finds a route a set of thieves' tools could open when every
+// option on the fork is locked, so a bad Perception roll can't quietly end an
+// expedition the player paid days into. It only ever fires when there is no free
+// route left — the player's tools are their own, and the autopilot does not get
+// to burn them for convenience.
+//
+// It reports the route and the inventory row to spend, but does not spend it:
+// the caller charges the player only once the move has actually committed.
+func (p *AdventurePlugin) autoPickWithTools(run *DungeonRun, pf *pendingFork) (pendingChoice, int64, bool) {
+	toolID, ok := findThievesTools(id.UserID(run.UserID))
+	if !ok {
+		return pendingChoice{}, 0, false
+	}
+	for i := range pf.Options {
+		if pf.Options[i].Unlocked || !pickableLock(pf.Options[i].Lock) {
+			continue
+		}
+		// Local copy only — advanceZoneRunNode clears node_choices on success,
+		// and on failure the fork must stay as locked as the player left it
+		// rather than reading "open" for a set nobody paid for.
+		chosen := pf.Options[i]
+		chosen.Unlocked = true
+		chosen.Reason = "opened with " + thievesToolsName
+		return chosen, toolID, true
+	}
+	return pendingChoice{}, 0, false
+}
+
+// backtrackFromDeadFork walks the run back one room when a fork has no route
+// the autopilot can take and no tools to buy one with. Without this the run
+// simply sits there until the 24h stale reaper ends the expedition — a player
+// losing days of progress to a die roll they never saw and could not answer.
+// Backtracking at least returns them to a room with other exits.
+//
+// Returns false at the entry node, where there is nowhere behind to go, and
+// wherever no fallback room would actually help — see backtrackTarget.
+func (p *AdventurePlugin) backtrackFromDeadFork(exp *Expedition, run *DungeonRun) bool {
+	g, ok := loadZoneGraph(run.ZoneID)
+	if !ok {
+		return false
+	}
+	target, ok := backtrackTarget(g, run)
+	if !ok {
+		return false
+	}
+
+	// Clear the fork first: it belongs to the node being left, and both
+	// `!zone advance` and `!zone go` would otherwise resolve a prompt pointing
+	// at a room the party is no longer standing in.
+	if err := clearPendingFork(run.RunID); err != nil {
+		slog.Warn("expedition: backtrack clear fork", "run", run.RunID, "err", err)
+		return false
+	}
+	beatLock(run, "", "sealed")
+	if _, err := revisitZoneRun(run.RunID, target, run.VisitedNodes); err != nil {
+		slog.Warn("expedition: backtrack from dead fork", "run", run.RunID, "err", err)
+		return false
+	}
+	if exp != nil {
+		_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
+			"every way on was sealed — the party doubled back", "")
+	}
+	return true
+}
+
+// backtrackTarget picks the room a dead fork falls back to: the most recently
+// entered visited node that is genuinely joined to the current one by an edge
+// and that still offers a way on other than the sealed room.
+//
+// Both halves are load-bearing. VisitedNodes is a first-entry ordered *set*, not
+// a path stack (see appendVisited) — after any earlier backtrack the entry
+// before CurrentNode can sit on a completely different branch, so stepping to it
+// blind teleports the party across the map. `!revisit` refuses exactly that move
+// via adjacentNodes, and the autopilot has no business doing what the player is
+// forbidden from doing. The second half stops the other failure: falling back
+// into a corridor whose only exit is the fork we just fled from just walks
+// straight back in — and the lock rolls are seeded per (run, edge), so the
+// result is identical every time. That is an infinite loop, not a recovery.
+func backtrackTarget(g ZoneGraph, run *DungeonRun) (string, bool) {
+	adj := adjacentNodes(g, run.CurrentNode)
+	for i := pathIndexOf(run.VisitedNodes, run.CurrentNode) - 1; i >= 0; i-- {
+		n := run.VisitedNodes[i]
+		if !adj[n] {
+			continue
+		}
+		for _, e := range g.outgoingEdges(n) {
+			if e.To != run.CurrentNode {
+				return n, true
+			}
+		}
+	}
+	return "", false
+}
+
 func (p *AdventurePlugin) runAutopilotWalk(ctx MessageContext, maxRooms int, compact, inlineBossCombat bool) autopilotWalkResult {
 	exp, err := getActiveExpedition(ctx.Sender)
 	if err != nil {
@@ -883,9 +1240,19 @@ func (p *AdventurePlugin) runAutopilotWalk(ctx MessageContext, maxRooms int, com
 	// (unlocked) route and keep walking instead of stalling out.
 	if run, rerr := getActiveZoneRun(ctx.Sender); rerr == nil && run != nil {
 		if pf, derr := decodePendingFork(run.NodeChoices); derr == nil && pf != nil {
-			picked := compact &&
-				time.Since(run.LastActionAt) > forkAutoPickTimeout &&
-				p.autoPickStaleFork(exp, run, pf)
+			stale := compact && time.Since(run.LastActionAt) > forkAutoPickTimeout
+			picked := stale && p.autoPickStaleFork(exp, run, pf)
+			// Stale and nothing takeable: every route locked, no tools. Back out
+			// one room rather than sitting here until the 24h reaper ends an
+			// expedition the player may be days into. The backtrack clears the
+			// fork, so the next tick walks from the previous room normally.
+			if stale && !picked && p.backtrackFromDeadFork(exp, run) {
+				return autopilotWalkResult{
+					finalMsg: "🔒 Every way on was sealed. The party doubled back to look for another line.",
+					rooms:    0,
+					reason:   stopFork,
+				}
+			}
 			if !picked {
 				zone := zoneOrFallback(run.ZoneID)
 				return autopilotWalkResult{
@@ -23,7 +23,6 @@ package plugin
 import (
 	"encoding/json"
 	"fmt"
-	"math/rand/v2"
 	"strings"

 	"gogobee/internal/flavor"
@@ -75,7 +74,7 @@ func resolveCombatInterrupt(
 	rollFn func() int,
 ) (CombatInterruptKind, int) {
 	if rollFn == nil {
-		rollFn = func() int { return rand.IntN(20) + 1 }
+		rollFn = func() int { return simIntN(20) + 1 }
 	}
 	r := rollFn()
 	mod := tier
@@ -249,7 +248,7 @@ func surpriseRoundNickF(m DnDMonsterTemplate, tier, floorOverride int) int {
 	if tier < 1 {
 		tier = 1
 	}
-	dmg := 1 + rand.IntN(4) + m.AttackBonus/2
+	dmg := 1 + simIntN(4) + m.AttackBonus/2
 	floor := tier
 	if floorOverride >= 0 {
 		floor = floorOverride
@@ -484,7 +483,7 @@ func (p *AdventurePlugin) tryPatrolEncounter(
 		return
 	}
 	chance := rollPatrolChance(exp.ThreatLevel)
-	if chance <= 0 || rand.Float64() > chance {
+	if chance <= 0 || simFloat64() > chance {
 		return
 	}
 	monster, ok := pickZoneEnemy(zone, run.RunID, run.CurrentRoom, false)
@@ -350,6 +350,12 @@ func scanExpeditionRows(rows *sql.Rows) ([]*Expedition, error) {
 // A double-fire on the same expedition is a no-op.
 func (p *AdventurePlugin) deliverBriefing(e *Expedition, now time.Time) error {
 	priorBriefing := e.LastBriefingAt
+	// Everything logged since the previous briefing is what the overnight
+	// digest reports. Captured before the CAS below clobbers the column.
+	digestSince := e.StartDate
+	if priorBriefing != nil {
+		digestSince = *priorBriefing
+	}
 	threshold := time.Date(now.Year(), now.Month(), now.Day(),
 		expeditionBriefingHour, 0, 0, 0, time.UTC)
 	res, err := db.Get().Exec(`
@@ -373,7 +379,7 @@ func (p *AdventurePlugin) deliverBriefing(e *Expedition, now time.Time) error {
 	// DM (rollover happened recently) or force-fires processNightCamp
 	// itself (safety net for stalled autopilots).
 	if isEventAnchored(e) {
-		return p.deliverBriefingEventAnchored(e, priorBriefing)
+		return p.deliverBriefingEventAnchored(e, priorBriefing, digestSince)
 	}

 	burn, err := p.nightRolloverBurn(e)
@@ -400,6 +406,9 @@ func (p *AdventurePlugin) deliverBriefing(e *Expedition, now time.Time) error {

 	line := pickMorningBriefing(e.CurrentDay)
 	body := renderMorningBriefing(e, line, burn)
+	// The single daily message: fold in what the now-silent recap, night
+	// check and ambient events recorded since the last briefing.
+	body = appendOvernightDigest(body, e.ID, digestSince)
 	if sl := p.shadowBriefingLine(e); sl != "" {
 		body += "\n" + sl + "\n"
 	}
@@ -413,7 +422,13 @@ func (p *AdventurePlugin) deliverBriefing(e *Expedition, now time.Time) error {
 		body += "\n" + ml
 	}

-	p.fanOutExpeditionDM(e, body, p.briefingPetPrefix)
+	p.fanOutExpeditionDM(e, body, p.briefingPerReader)
+	// N1/A6 anchor, relocated here from the retired night-camp digest DM.
+	// Only on a run still under way: an expedition that just ended does not
+	// want a mid-day event landing on top of the emergence.
+	if e.Status == ExpeditionStatusActive {
+		p.fireDigestEventAnchor(e)
+	}
 	// Emergence seam: a briefing-time forced extraction (starvation / abyss
 	// collapse) surfaces the players alive — roll pet arrival. Combat/patrol
 	// deaths never reach deliverBriefing (the row is already abandoned), so an
@@ -489,7 +504,9 @@ func (p *AdventurePlugin) maybeDeliverDeferredBriefing(uid id.UserID, now time.T
 //
 // priorBriefing is the last_briefing_at value as of entry into deliverBriefing
 // (before the CAS clobbered it). nil means day-1 or genuinely never rolled.
-func (p *AdventurePlugin) deliverBriefingEventAnchored(e *Expedition, priorBriefing *time.Time) error {
+// digestSince is the same instant collapsed to a non-nil cutoff (start date on
+// day 1) — the window the overnight digest reports.
+func (p *AdventurePlugin) deliverBriefingEventAnchored(e *Expedition, priorBriefing *time.Time, digestSince time.Time) error {
 	now := time.Now().UTC()
 	var since time.Duration
 	if priorBriefing != nil {
@@ -516,6 +533,7 @@ func (p *AdventurePlugin) deliverBriefingEventAnchored(e *Expedition, priorBrief

 	line := pickMorningBriefing(e.CurrentDay)
 	body := renderMorningBriefing(e, line, burn)
+	body = appendOvernightDigest(body, e.ID, digestSince)
 	if sl := p.shadowBriefingLine(e); sl != "" {
 		body += "\n" + sl + "\n"
 	}
@@ -529,7 +547,13 @@ func (p *AdventurePlugin) deliverBriefingEventAnchored(e *Expedition, priorBrief
 		body += "\n" + ml
 	}

-	p.fanOutExpeditionDM(e, body, p.briefingPetPrefix)
+	p.fanOutExpeditionDM(e, body, p.briefingPerReader)
+	// N1/A6 anchor, relocated here from the retired night-camp digest DM.
+	// Only on a run still under way: an expedition that just ended does not
+	// want a mid-day event landing on top of the emergence.
+	if e.Status == ExpeditionStatusActive {
+		p.fireDigestEventAnchor(e)
+	}
 	if forced && e.Status == ExpeditionStatusAbandoned {
 		for _, uid := range expeditionAudience(e) {
 			p.maybeRollPetArrivalOnEmerge(uid)
@@ -566,9 +590,10 @@ func (p *AdventurePlugin) deliverRecap(e *Expedition, now time.Time) error {
 		return nil
 	}

-	// E2b: night phase wandering check fires before the recap so its
-	// outcome is part of today's log when the recap renders.
-	var night *NightCheck
+	// E2b: night phase wandering check. Still fires on the 21:00 clock and
+	// still writes its own "night" log entry — processNightCheck owns that —
+	// which is how the outcome reaches the next morning's digest now that
+	// the recap itself no longer sends anything.
 	if e.Camp != nil && e.Camp.Active {
 		c, _ := LoadDnDCharacter(id.UserID(e.UserID))
 		var charClass DnDClass
@@ -579,7 +604,6 @@ func (p *AdventurePlugin) deliverRecap(e *Expedition, now time.Time) error {
 		if err := processNightCheck(e, nc); err != nil {
 			slog.Warn("expedition: night check", "expedition", e.ID, "err", err)
 		}
-		night = &nc
 		// §7.4: Feywild double-day fires an extra wandering check.
 		if e.ZoneID == ZoneFeywildCrossing {
 			if today, _ := e.RegionState["feywild_today"].(string); today == string(FeywildDistortionDouble) {
@@ -601,12 +625,11 @@ func (p *AdventurePlugin) deliverRecap(e *Expedition, now time.Time) error {
 		return err
 	}
 	line := pickEveningRecap(e, dayEntries)
-	body := renderEveningRecap(e, line, dayEntries)
-	if night != nil {
-		body += "\n" + renderNightCheck(*night)
-	}

-	p.fanOutExpeditionDM(e, body, nil)
+	// Once-a-day cadence: the night check above has already run and already
+	// written its own "night" log entry, so the morning digest reports the
+	// outcome. Nothing is sent here. The recap entry below still lands so
+	// the site keeps a day boundary to render against.
 	if err := appendExpeditionLog(e.ID, e.CurrentDay, "recap",
 		fmt.Sprintf("evening recap — %d log entries today", len(dayEntries)), line); err != nil {
 		return err
@@ -352,32 +352,54 @@ func resumeExpedition(expID string, supplies ExpeditionSupplies) error {

 // ── !extract command ────────────────────────────────────────────────────────

-func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the two ways an extraction can be refused. They exist so the
+// headless caller (the web action queue, pete_orders.go) can turn a refusal into
+// its own verdict without parsing a DM. `!extract` maps them straight back to the
+// prose it always sent.
+var (
+	errExtractNoRun     = errors.New("extract: no active expedition")
+	errExtractNotLeader = errors.New("extract: not the party leader")
+)
+
+// extractOutcome is what an extraction did, for a caller that has to describe it
+// somewhere other than a DM.
+type extractOutcome struct {
+	Zone string // display name
+	Day  int
+}
+
+// performExtraction is the whole of `!extract` minus the command framing: the
+// per-user lock, the leader check, the state flip, the log line, the party
+// fan-out and the emergence pet roll. It is shared with the web action queue so
+// that pulling out from a phone is the *same* extraction, not a second
+// implementation of one — the party still gets DM'd, the log still gets its
+// line, and the resume window is the same window.
+func (p *AdventurePlugin) performExtraction(uid id.UserID) (extractOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()

-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return extractOutcome{}, fmt.Errorf("reading expedition state: %w", err)
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition to extract from.")
+		return extractOutcome{}, errExtractNoRun
 	}
 	if !isLeader {
 		// Extraction ends the expedition for the whole roster, so it is the
 		// leader's call — the same reasoning that makes `!flee` leader-only.
-		return p.SendDM(ctx.Sender, "Only your party leader can call the extraction. Ask them to `!extract`, or `!expedition leave` to walk out alone.")
+		return extractOutcome{}, errExtractNotLeader
 	}
 	zone, _ := getZone(exp.ZoneID)
-	updated, err := voluntaryExtractExpedition(ctx.Sender)
+	updated, err := voluntaryExtractExpedition(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't extract: "+err.Error())
+		return extractOutcome{}, err
 	}
 	line := flavor.Pick(flavor.ExtractionVoluntary)
 	_ = appendExpeditionLog(updated.ID, updated.CurrentDay, "narrative",
 		"voluntary extraction", line)
-	markActedToday(ctx.Sender)
+	markActedToday(uid)

 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🚪 **Extraction — %s, Day %d**\n\n",
@@ -401,84 +423,167 @@ func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {

 	// Emergence seam: surfacing from a run is when an animal may have moved
 	// into the empty house. Every member surfaced, so every member rolls.
-	for _, uid := range expeditionAudience(updated) {
-		p.maybeRollPetArrivalOnEmerge(uid)
+	for _, member := range expeditionAudience(updated) {
+		p.maybeRollPetArrivalOnEmerge(member)
+	}
+	return extractOutcome{Zone: zone.Display, Day: updated.CurrentDay}, nil
+}
+
+// handleExtractCmd is `!extract`: the command framing around performExtraction.
+// The extraction itself, including the DM everyone in the party gets, happens in
+// there — so this only has to turn a refusal back into the prose it always sent.
+func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {
+	_, err := p.performExtraction(ctx.Sender)
+	switch {
+	case errors.Is(err, errExtractNoRun):
+		return p.SendDM(ctx.Sender, "No active expedition to extract from.")
+	case errors.Is(err, errExtractNotLeader):
+		return p.SendDM(ctx.Sender, "Only your party leader can call the extraction. Ask them to `!extract`, or `!expedition leave` to walk out alone.")
+	case err != nil:
+		return p.SendDM(ctx.Sender, "Couldn't extract: "+err.Error())
 	}
 	return nil
 }

 // ── !resume command ─────────────────────────────────────────────────────────

-func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the ways going back in can be refused. Same contract as
+// performExpeditionStart's: each one comes back inside an advRefusal that also
+// carries the finished sentence, so `!resume` keeps its copy verbatim.
+//
+// errResumeNeedLoadout is the odd one out and deliberately so: it is not a
+// refusal at all but the loadout prompt, returned as one so the whole decision
+// stays inside the lock. The web never triggers it — it always names a loadout.
+var (
+	errResumeNeedLoadout = errors.New("resume: no loadout named")
+	errResumeBusy        = errors.New("resume: already on an expedition")
+	errResumeNothing     = errors.New("resume: no extracted expedition")
+	errResumeLapsed      = errors.New("resume: past the 7-day window")
+	errResumeBadPacks    = errors.New("resume: invalid pack selection")
+	errResumeBroke       = errors.New("resume: cannot cover outfitting")
+	errResumeFailed      = errors.New("resume: could not resume")
+)
+
+// resumeOutcome is what going back in did, for a caller describing it somewhere
+// other than a DM.
+type resumeOutcome struct {
+	Zone     ZoneDefinition
+	Day      int
+	Supplies ExpeditionSupplies
+	Purchase SupplyPurchase
+	Threat   int
+	Stack    int
+	Line     string
+}
+
+// performResume is `!resume` minus the command framing: the leader check, the
+// lapse check, the re-outfitting purchase and the fresh region run. Shared with
+// the web action queue so that walking back in from a phone is the same walk.
+//
+// loadoutTok is the raw `Ns Md` / preset token; empty asks for the prompt.
+// idemKey, when set, is the web order's guid and moves the money onto the
+// idempotent variants — see beginExpeditionIdem for why a refund then makes a
+// retry unsafe, which is why every error here is permanent for the web caller.
+func (p *AdventurePlugin) performResume(uid id.UserID, loadoutTok, idemKey string) (resumeOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()

-	c, err := LoadDnDCharacter(ctx.Sender)
+	c, err := LoadDnDCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't load your character: "+err.Error())
+		return resumeOutcome{}, fmt.Errorf("Couldn't load your character: %s", err)
 	}
 	if c == nil || c.PendingSetup {
-		return p.SendDM(ctx.Sender, "No Adv 2.0 character yet — run `!setup` first.")
+		return resumeOutcome{}, refuseAdv(errResumeNothing, "No Adv 2.0 character yet — run `!setup` first.")
 	}

-	if existing, isLeader, _ := activeExpeditionFor(ctx.Sender); existing != nil {
+	if existing, isLeader, _ := activeExpeditionFor(uid); existing != nil {
 		zone, _ := getZone(existing.ZoneID)
 		if !isLeader {
-			return p.SendDM(ctx.Sender, fmt.Sprintf(
+			return resumeOutcome{}, refuseAdv(errResumeBusy,
 				"You're riding a party expedition in **%s** (Day %d). Only its leader can `!resume`.",
-				zone.Display, existing.CurrentDay))
+				zone.Display, existing.CurrentDay)
 		}
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
+		// A web order that already paid and already resumed lands here on the
+		// re-offer; the settled debit is what tells that apart from a player who
+		// really is already out. Same tell as performExpeditionStart's.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) {
+			out := resumeOutcome{Zone: zone, Day: existing.CurrentDay,
+				Supplies: existing.Supplies, Threat: existing.ThreatLevel}
+			// Re-price the same loadout at the same tier so the verdict this feeds
+			// can still say what it cost. Leaving Purchase zero would file a
+			// "re-outfitted for 0 coins" receipt for a trip that was paid for.
+			if pp, perr := resolveLoadoutOrParse(strings.TrimSpace(loadoutTok), zone.Tier); perr == nil {
+				out.Purchase = pp
+			}
+			return out, nil
+		}
+		return resumeOutcome{}, refuseAdv(errResumeBusy,
 			"You already have an active expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
-			zone.Display, existing.CurrentDay))
+			zone.Display, existing.CurrentDay)
 	}

-	exp, err := getResumableExpedition(ctx.Sender)
+	exp, err := getResumableExpedition(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return resumeOutcome{}, fmt.Errorf("Couldn't read expedition state: %s", err)
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No extracted expedition to resume. Use `!expedition start <zone>` to begin a new one.")
+		return resumeOutcome{}, refuseAdv(errResumeNothing,
+			"No extracted expedition to resume. Use `!expedition start <zone>` to begin a new one.")
 	}
 	if extractionLapsed(exp, time.Now().UTC()) {
 		// Expire it so it doesn't keep resurfacing. The hourly sweeper would get
 		// here on its own; this keeps the refusal and the reap in one breath.
 		_ = completeExpedition(exp.ID, ExpeditionStatusFailed)
-		return p.SendDM(ctx.Sender,
+		return resumeOutcome{}, refuseAdv(errResumeLapsed,
 			"That extraction is past its 7-day resume window — the dungeon has reshaped without you. Start a new expedition.")
 	}

-	resumeZone, _ := getZone(exp.ZoneID)
+	zone, _ := getZone(exp.ZoneID)
 	// D5-b: prompt for a preset loadout on empty args.
-	if strings.TrimSpace(args) == "" {
-		return p.SendDM(ctx.Sender, renderLoadoutPrompt(resumeZone, "resume"))
+	if strings.TrimSpace(loadoutTok) == "" {
+		return resumeOutcome{}, refuseAdv(errResumeNeedLoadout, "%s", renderLoadoutPrompt(zone, "resume"))
 	}
-	purchase, err := resolveLoadoutOrParse(strings.TrimSpace(args), resumeZone.Tier)
+	purchase, err := resolveLoadoutOrParse(strings.TrimSpace(loadoutTok), zone.Tier)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't parse supply packs: "+err.Error())
+		return resumeOutcome{}, refuseAdv(errResumeBadPacks, "Couldn't parse supply packs: %s", err.Error())
 	}
-	if err := purchase.Validate(resumeZone.Tier); err != nil {
-		return p.SendDM(ctx.Sender, "Invalid pack selection: "+err.Error())
+	if err := purchase.Validate(zone.Tier); err != nil {
+		return resumeOutcome{}, refuseAdv(errResumeBadPacks, "Invalid pack selection: %s", err.Error())
 	}
 	cost := float64(purchase.Cost())
 	if p.euro == nil {
-		return p.SendDM(ctx.Sender, "Coin system unavailable — try again later.")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Coin system unavailable — try again later.")
 	}
-	if balance := p.euro.GetBalance(ctx.Sender); balance < cost {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
-			int(cost), balance))
+	paid := idemKey != "" && p.euro.HasExternalTx(idemKey)
+	if !paid {
+		if balance := p.euro.GetBalance(uid); balance < cost {
+			return resumeOutcome{}, refuseAdv(errResumeBroke,
+				"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
+				int(cost), balance)
+		}
 	}
-	if !p.euro.Debit(ctx.Sender, cost, "expedition resume outfitting: "+string(exp.ZoneID)) {
-		return p.SendDM(ctx.Sender, "Couldn't debit outfitting cost (try again).")
+	debit := func(why string) bool { return p.euro.Debit(uid, cost, why) }
+	refund := func(why, suffix string) { p.euro.Credit(uid, cost, why) }
+	if idemKey != "" {
+		debit = func(why string) bool {
+			ok, _, err := p.euro.DebitIdem(uid, cost, why, idemKey)
+			return err == nil && ok
+		}
+		refund = func(why, suffix string) {
+			if _, _, err := p.euro.CreditIdem(uid, cost, why, idemKey+":refund"+suffix); err != nil {
+				slog.Error("expedition: resume refund failed", "user", uid, "order", idemKey, "err", err)
+			}
+		}
+	}
+	if !debit("expedition resume outfitting: " + string(exp.ZoneID)) {
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't debit outfitting cost (try again).")
 	}

-	zone, _ := getZone(exp.ZoneID)
 	supplies := makeSupplies(zone.Tier, purchase)
 	if err := resumeExpedition(exp.ID, supplies); err != nil {
-		p.euro.Credit(ctx.Sender, cost, "expedition resume refund")
-		return p.SendDM(ctx.Sender, "Couldn't resume: "+err.Error())
+		refund("expedition resume refund", "")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't resume: %s", err.Error())
 	}
 	exp.Status = ExpeditionStatusActive
 	exp.Supplies = supplies
@@ -489,25 +594,40 @@ func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error
 	exp.RegionState[regionStateRegionRuns] = map[string]string{}
 	_ = persistRegionState(exp)
 	if _, err := ensureRegionRun(exp, c.Level); err != nil {
-		p.euro.Credit(ctx.Sender, cost, "expedition resume refund (run-spawn failed)")
-		return p.SendDM(ctx.Sender, "Couldn't outfit the resumed region: "+err.Error())
+		refund("expedition resume refund (run-spawn failed)", ":region")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't outfit the resumed region: %s", err.Error())
 	}
 	line := flavor.Pick(flavor.ExpeditionResume)
 	_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
 		"expedition resumed", line)

+	return resumeOutcome{
+		Zone: zone, Day: exp.CurrentDay, Supplies: supplies, Purchase: purchase,
+		Threat: exp.ThreatLevel, Stack: exp.TemporalStack, Line: line,
+	}, nil
+}
+
+// handleResumeCmd is `!resume`: the command framing around performResume.
+func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error {
+	out, err := p.performResume(ctx.Sender, args, "")
+	if err != nil {
+		// Every refusal — and the loadout prompt, which travels as one — arrives
+		// as a finished sentence, so this only has to say it.
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🚪 **Expedition resumed — %s, Day %d**\n\n",
-		zone.Display, exp.CurrentDay))
-	if line != "" {
-		b.WriteString(line)
+		out.Zone.Display, out.Day))
+	if out.Line != "" {
+		b.WriteString(out.Line)
 		b.WriteString("\n\n")
 	}
 	b.WriteString(fmt.Sprintf("**Re-outfitted:** %.0f SU (%d standard, %d deluxe) — %d coins\n",
-		supplies.Max, purchase.StandardPacks, purchase.DeluxePacks, purchase.Cost()))
-	b.WriteString(fmt.Sprintf("**Threat:** %d / 100 (resumed at extraction value)\n", exp.ThreatLevel))
-	if exp.TemporalStack != 0 {
-		b.WriteString(fmt.Sprintf("**Zone stack:** %d (resumed)\n", exp.TemporalStack))
+		out.Supplies.Max, out.Purchase.StandardPacks, out.Purchase.DeluxePacks, out.Purchase.Cost()))
+	b.WriteString(fmt.Sprintf("**Threat:** %d / 100 (resumed at extraction value)\n", out.Threat))
+	if out.Stack != 0 {
+		b.WriteString(fmt.Sprintf("**Zone stack:** %d (resumed)\n", out.Stack))
 	}
 	b.WriteString("\nUse `!expedition status` for the daily briefing.")
 	return p.SendDM(ctx.Sender, b.String())
@@ -175,3 +175,28 @@ func TestResume_WindowExpired(t *testing.T) {
 			time.Since(*got.CompletedAt), extractResumeWindow)
 	}
 }
+
+// `!expedition extract` and `!expedition resume` are aliases for two top-level
+// commands that take the per-user lock themselves. If the alias dispatcher takes
+// that lock first the handler blocks on it forever and, because the deferred
+// unlock never runs, every later adventure command from that player wedges too.
+// This does not fail on regression — it hangs — so the timeout is the assertion.
+func TestExpeditionAliasesDoNotWedgeTheUserLock(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@exp-alias-lock:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+
+	for _, sub := range []string{"extract", "resume"} {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			p := &AdventurePlugin{euro: &EuroPlugin{}}
+			_ = p.handleDnDExpeditionCmd(MessageContext{Sender: uid}, sub)
+		}()
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("!expedition %s never returned: the alias re-took advUserLock", sub)
+		}
+	}
+}
@@ -170,6 +170,13 @@ func (p *AdventurePlugin) advanceToNextRegion(userID id.UserID, exp *Expedition,
 	tc := resolveTransitWanderingCheck(exp, charClass, nil)
 	_ = processTransitWanderingCheck(exp, tc)

+	// The liveblog beat goes on the *outgoing* run, and it has to be filed before
+	// the run is retired — a region crossing is the last thing that happens in
+	// the region being left, and it is what explains why that run's log stops.
+	if outgoing, _ := getZoneRun(exp.RunID); outgoing != nil {
+		beatRegion(outgoing, cur.Name, next.Name)
+	}
+
 	// R2 — retire the outgoing region's DungeonRun before mutating
 	// CurrentRegion so retireRegionRun keys the right region.
 	if err := retireRegionRun(exp, cur.ID); err != nil {
@@ -112,6 +112,56 @@ func applyRacePassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharacte
 //     AutoCritFirst is already a one-shot bool.
 //   - A Cleric carrying a healing potion stacks: passive 5 + potion 8 = 13.
 //     The passive heal triggers first since both use the same threshold.
+// cantripDice is the 5e at-will cantrip die progression (Fire Bolt / Eldritch
+// Blast): 1 die L1–4, 2 at L5, 3 at L11, 4 at L17. Drives the per-round arcane
+// blaster damage (CantripPerRound) that models a caster's sustained at-will
+// floor — see CombatModifiers.CantripPerRound.
+func cantripDice(level int) int {
+	switch {
+	case level >= 17:
+		return 4
+	case level >= 11:
+		return 3
+	case level >= 5:
+		return 2
+	default:
+		return 1
+	}
+}
+
+// casterBlasterFloor gives the arcane blasters (Mage/Sorcerer/Warlock) their
+// shared sustained-DPS floor at T5. Two knobs, both LEVEL-SCALED so the L20
+// floor lift stays negligible at low tiers — a flat +40 HP doubled a L1 mage
+// and facerolled T5, which the class-balance guardrail (dnd_class_balance_test)
+// correctly rejected.
+//
+//   - Cantrip: kill-speed is the T5 currency (fights are truncation-bound), so
+//     the primary lever is damage. Multiplicative form — the spell modifier
+//     (INT for Mage, CHA for Sorcerer/Warlock) rides EVERY die, matching 5e
+//     Agonizing Blast. cantripDice scales 1→4 across levels.
+//   - Survival: just enough Defense (scaled by level) that the caster lives long
+//     enough for the cantrip to connect the kill — NOT a tank rider. This adds
+//     Defense only (no HP add); calcDamage's diminishing returns keep the L20
+//     +20 Def from becoming a wall.
+//
+// casterCantripBase / casterDefPerLevel are the caster tuning dials; see the
+// rebaseline plan for the sweep that set them. The cantrip floor only becomes a
+// live lever once combat_cmd.go bridges CantripPerRound into the turn engine
+// (the swing engine, combat_engine.go:590, is not the auto-resolve path). Mage
+// and Sorcerer take casterCantripBase; Warlock passes 0 — its bare-dice cantrip
+// plus its structural edge already lands it mid-band, so an added floor would
+// overshoot the 45 ceiling.
+const (
+	casterCantripBase = 3 // per-die base before the ability modifier rides in
+	casterDefPerLevel = 1 // ~+20 Def at L20, +1 at L1
+)
+
+func casterBlasterFloor(stats *CombatStats, mods *CombatModifiers, level, abilityMod, base int, cantrip string) {
+	mods.CantripPerRound = cantripDice(level) * (base + clampNonNeg(abilityMod))
+	mods.CantripDesc = cantrip
+	stats.Defense += casterDefPerLevel * level
+}
+
 func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharacter) {
 	switch c.Class {
 	case ClassFighter:
@@ -127,18 +177,23 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// re-tune in a follow-up if their win curves drift after this.
 		switch {
 		case c.Level >= 20:
-			mods.ExtraAttacks += 3
+			mods.ExtraAttacks += 2 // rebaseline: ceiling nerf — 3 swings at L20, was 4 (the engine-ceiling faceroll)
 		case c.Level >= 11:
 			mods.ExtraAttacks += 2
 		case c.Level >= 5:
 			mods.ExtraAttacks += 1
 		}
+		stats.AttackBonus -= 2 // rebaseline: sub-swing to-hit trim — 3 swings lands the Fighter in the ~60 band
 	case ClassRogue:
 		mods.AutoCritFirst = true
+		if c.Level >= 5 { // rebaseline: 2nd swing (was 1) fixes the 1-swing action-economy floor at T5
+			mods.ExtraAttacks += 1
+		}
+		stats.AttackBonus -= 3 // rebaseline: to-hit trim so the 2nd swing lands the Rogue in band, not the +75pp nuke
 		// Phase 2 class-balance: rogue's once-per-fight auto-crit goes stale
 		// at high tiers (T5 mean trails leaders by ~10pp pre-tune). Add a
 		// modest steady-DPS rider so post-opener rounds aren't pure attrition.
-		mods.DamageBonus += 0.05
+		mods.DamageBonus += -0.10 // rebaseline: fine-trim the 2-swing Rogue down into the ~60 band
 		// Class-identity audit (2026-05-16) — actual Sneak Attack as Nd6
 		// per hit, scaling with level per 5e (1d6 L1-2 ... 10d6 L19-20).
 		// AutoCritFirst + DamageBonus alone left the rogue's defining
@@ -154,6 +209,8 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		mods.SneakAttackDie += sneakDice
 	case ClassMage:
 		stats.AttackBonus++
+		// At-will Fire Bolt + level-scaled survival — the sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.INT), casterCantripBase, "Fire Bolt")
 		// Phase 2 class-balance: +1 attack alone left Mage mid-pack on damage
 		// per round. A modest damage rider lifts weapon hits (DamageBonus does
 		// not multiply queued SpellPreDamage — that path is its own field).
@@ -190,10 +247,19 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 			mods.ExtraAttacks += 1
 		}
 	case ClassDruid:
-		// Wild Resilience — multiplicative, so it stacks cleanly with the
-		// subclass DamageReduct riders. DamageReduct is initialized to 1.0
-		// by DerivePlayerStats before passives run.
+		// Multiplicative, so it stacks cleanly with the subclass DamageReduct
+		// riders (DamageReduct is initialized to 1.0 by DerivePlayerStats before
+		// passives run). NOTE the player-defender direction: DamageReduct feeds
+		// calcDamage as a defense multiplier, so <1 = MORE damage taken. This
+		// line is therefore a mild survival trim in the same direction as the
+		// rebaseline *0.2 below — not the damage cut the "Wild Resilience" name
+		// suggests. Left as-is because the rebaseline sweep is tuned to it.
 		mods.DamageReduct *= 0.95
+		// rebaseline: the Druid wins T5 rooms on the survival tiebreak, immune to
+		// every damage lever. DamageReduct is a defense multiplier (calcDamage) —
+		// <1 = take MORE damage. Combined with a damage trim to pull it to band.
+		mods.DamageReduct *= 0.2
+		mods.DamageBonus += -0.20
 		// Phase 3 class-balance: druid was the only caster chassis with a
 		// purely defensive passive, and the off-tier numbers showed it —
 		// L1/T2 mean 0.04 vs Mage 0.27. Mirror the other caster bursts so
@@ -219,6 +285,7 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		stats.AttackBonus++
 		mods.DamageBonus += 0.05
 		mods.FlatDmgStart += c.Level + clampNonNeg(abilityModifier(c.CHA))
+		mods.DamageReduct *= 0.4 // rebaseline: Bard also wins T5 on the survival tiebreak — take more damage to reach band
 	case ClassSorcerer:
 		// Innate Sorcery — pre-combat burst, CHA-scaled like the Sorcerer's
 		// spellcasting stat. Floors at the flat base for low-CHA builds.
@@ -231,6 +298,9 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// touching the +0.05 rider that already saturates at high tier.
 		mods.FlatDmgStart += 5 + c.Level + clampNonNeg(abilityModifier(c.CHA))
 		mods.DamageBonus += 0.05
+		stats.AttackBonus++ // rebaseline: Sorcerer lagged the other blasters — match their +1 to-hit
+		// At-will Fire Bolt + level-scaled survival — sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.CHA), casterCantripBase, "Fire Bolt")
 	case ClassWarlock:
 		// Phase 2 class-balance: bumped from 10% to 12% damage + 1 attack —
 		// the Warlock chassis read mid-pack at T5 (0.52) pre-tune. Eldritch
@@ -240,6 +310,8 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		mods.DamageBonus += 0.12
 		stats.AttackBonus++
 		mods.FlatDmgStart += c.Level + clampNonNeg(abilityModifier(c.CHA))
+		// At-will Eldritch Blast + level-scaled survival — sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.CHA), 0, "Eldritch Blast")
 	case ClassPaladin:
 		// Class-identity audit (2026-05-16) — Divine Smite as actual
 		// per-hit radiant bonus + L5 Extra Attack. 5e: smite consumes a
@@ -249,8 +321,9 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// down so an extra-attack paladin doesn't trivialize every fight.
 		// Rides DivineStrikePerHit (already in the weapon-hit damage path).
 		// Previous FlatDmgStart opener felt like Lay on Hands, not Smite.
-		smite := 3 + c.Level/3
+		smite := 4 + c.Level/2 // rebaseline: bigger Divine Smite lifts the Paladin from floor into band
 		mods.DivineStrikePerHit += smite
+		mods.DamageReduct *= 0.9 // rebaseline: small survival trim between the two integer smite steps for a ~60 landing
 		if c.Level >= 5 {
 			mods.ExtraAttacks += 1
 		}
@@ -2,7 +2,6 @@ package plugin

 import (
 	"fmt"
-	"math/rand/v2"
 	"sort"
 	"strings"
 	"time"
@@ -117,7 +116,7 @@ func (p *AdventurePlugin) handleDnDShortRest(ctx MessageContext) error {
 	before := c.HPCurrent
 	if !hpFull {
 		conMod := abilityModifier(c.CON)
-		healDie := 1 + rand.IntN(6) // 1d6
+		healDie := 1 + simIntN(6) // 1d6
 		heal := healDie + conMod
 		if heal < 1 {
 			heal = 1
@@ -3,7 +3,6 @@ package plugin
 import (
 	"fmt"
 	"log/slog"
-	"math/rand/v2"

 	"maunium.net/go/mautrix/id"
 )
@@ -128,7 +127,7 @@ func applyMageSubclassSpellHooks(c *DnDCharacter, spell SpellDefinition, slotLev
 // applySpellDamageAttack — Fire Bolt, Inflict Wounds, Chill Touch, etc.
 // Roll d20 + spell attack vs enemy AC; nat 20 doubles dice damage.
 func applySpellDamageAttack(spell SpellDefinition, atk int, mods *CombatModifiers, enemy *CombatStats, slot, charLevel int) {
-	roll := 1 + rand.IntN(20)
+	roll := 1 + simIntN(20)
 	isCrit := roll == 20
 	isFumble := roll == 1
 	if isFumble || (!isCrit && roll+atk < enemy.AC) {
@@ -158,7 +157,7 @@ func applySpellDamageAttack(spell SpellDefinition, atk int, mods *CombatModifier
 // future multi-enemy combat (Phase 11+) but is not consulted here.
 func applySpellDamageSave(spell SpellDefinition, dc int, c *DnDCharacter, mods *CombatModifiers, enemy *CombatStats, slot int) {
 	saveMod := enemySpellSaveMod(enemy)
-	saveRoll := 1 + rand.IntN(20)
+	saveRoll := 1 + simIntN(20)
 	saved := saveRoll+saveMod >= dc
 	dmg := rollSpellDamageDice(spell, slot, c.Level)
 	if saved {
@@ -182,7 +181,7 @@ func applySpellDamageAuto(spell SpellDefinition, mods *CombatModifiers, slot, ch
 		}
 		total := 0
 		for i := 0; i < darts; i++ {
-			total += 1 + rand.IntN(4) + 1
+			total += 1 + simIntN(4) + 1
 		}
 		mods.SpellPreDamage += total
 		mods.SpellPreDamageDesc = fmt.Sprintf("Magic Missile (%d darts, %d dmg)", darts, total)
@@ -223,7 +222,7 @@ func enemySpellSaveMod(enemy *CombatStats) int {
 // double damage (5e: paralyzed creatures auto-crit on melee hits).
 func applySpellControl(spell SpellDefinition, dc int, mods *CombatModifiers, enemy *CombatStats, slot int) {
 	saveMod := enemySpellSaveMod(enemy)
-	saveRoll := 1 + rand.IntN(20)
+	saveRoll := 1 + simIntN(20)
 	if saveRoll+saveMod >= dc {
 		mods.SpellPreDamageDesc = spell.Name + " — resisted"
 		return
@@ -382,7 +381,7 @@ func rollTurnSpellHeal(c *DnDCharacter, spell SpellDefinition, slotLevel int) in
 		if supreme {
 			heal += faces
 		} else {
-			heal += 1 + rand.IntN(faces)
+			heal += 1 + simIntN(faces)
 		}
 	}
 	heal += abilityModifier(c.WIS)
@@ -418,7 +417,7 @@ func rollSpellDamageDice(spell SpellDefinition, slot, charLevel int) int {
 	}
 	total := flat
 	for i := 0; i < dice; i++ {
-		total += 1 + rand.IntN(faces)
+		total += 1 + simIntN(faces)
 	}
 	if total < 1 {
 		total = 1
@@ -224,7 +224,14 @@ func TestApplyClassPassives(t *testing.T) {
 		wantFlatStart   int
 		wantInitBias    float64
 	}{
-		{ClassFighter, 0.05, 0, false, 0, 1.0, 0, 0},
+		// Fighter-ceiling rebaseline (2026-07-16): Fighter picked up a -2 to-hit
+		// sub-swing trim; Rogue's steady rider flipped +0.05→-0.10 and it took a
+		// -3 to-hit trim (both offset a new 2nd swing gated at L5, not seen here);
+		// Druid took a survival trim (DR 0.95→0.19) + -0.20 damage; Bard a DR 0.4
+		// survival trim; Sorcerer a +1 to-hit to match the blasters; Paladin a
+		// 0.9 DR survival trim. Caster CantripPerRound / Defense adds are
+		// not asserted here.
+		{ClassFighter, 0.05, -2, false, 0, 1.0, 0, 0},
 		// Phase 2 class-balance rebalance: rogue picked up +5% damage,
 		// Mage/Bard/Warlock gained a level-scaled FlatDmgStart burst, Sorcerer's
 		// burst now also scales with level, and Warlock picked up +1 attack.
@@ -233,7 +240,7 @@ func TestApplyClassPassives(t *testing.T) {
 		// Phase 3 class-balance: Druid picked up a WIS-scaled FlatDmgStart burst
 		// (lvl 1 + clamp(mod(WIS=0)) = 1), and Sorcerer's burst base went 3→5
 		// (5 + 1 + clamp(mod(CHA=10)=0) = 6).
-		{ClassRogue, 0.05, 0, true, 0, 1.0, 0, 0},
+		{ClassRogue, -0.10, -3, true, 0, 1.0, 0, 0},
 		{ClassMage, 0.05, 1, false, 0, 1.0, 1, 0},
 		{ClassCleric, 0, 0, false, 5, 1.0, 0, 0},
 		// Class-identity audit (2026-05-16): Ranger Hunter's Mark is now
@@ -243,11 +250,11 @@ func TestApplyClassPassives(t *testing.T) {
 		// FlatDmgStart compensation riders are gone; +1 to-hit stays on
 		// Ranger as the "read prey tells" half.
 		{ClassRanger, 0, 1, false, 0, 1.0, 0, 0},
-		{ClassDruid, 0, 0, false, 0, 0.95, 1, 0},
-		{ClassBard, 0.05, 1, false, 0, 1.0, 1, 1},
-		{ClassSorcerer, 0.05, 0, false, 0, 1.0, 6, 0},
+		{ClassDruid, -0.20, 0, false, 0, 0.95 * 0.2, 1, 0},
+		{ClassBard, 0.05, 1, false, 0, 0.4, 1, 1},
+		{ClassSorcerer, 0.05, 1, false, 0, 1.0, 6, 0},
 		{ClassWarlock, 0.12, 1, false, 0, 1.0, 1, 0},
-		{ClassPaladin, 0, 0, false, 0, 1.0, 0, 0},
+		{ClassPaladin, 0, 0, false, 0, 0.9, 0, 0},
 	}
 	for _, tc := range cases {
 		stats := CombatStats{AttackBonus: 5}
@@ -32,6 +32,15 @@ const (
 	ZoneDragonsLair     ZoneID = "dragons_lair"
 	ZoneAbyssPortal     ZoneID = "abyss_portal"

+	// Tier 6 "Mythic" post-game zones. Gated behind postgameUnlocked (both
+	// T5 bosses beaten + level ≥ 18), never surfaced by zonesForLevel. See
+	// postgame_zones.go and gogobee_postgame_zones_plan.md.
+	ZoneOssuaryAscendant ZoneID = "ossuary_ascendant"
+	ZoneFirstHoard       ZoneID = "first_hoard"
+	ZoneUnplace          ZoneID = "unplace"
+	ZoneDrownedStar      ZoneID = "drowned_star"
+	ZoneLastMeridian     ZoneID = "last_meridian"
+
 	// ZoneArena is a synthetic ID — never registered via registerZone, so
 	// !zone enter can't reach it. It exists to route renderBossOutcome's
 	// twinBeeLine calls when an arena fight (resolveArenaBoss, post-L2)
@@ -51,6 +60,10 @@ const (
 	ZoneTierJourneyman ZoneTier = 3
 	ZoneTierVeteran    ZoneTier = 4
 	ZoneTierLegendary  ZoneTier = 5
+	// ZoneTierMythic — Tier 6 post-game. Earned, not leveled: unlocked by
+	// postgameUnlocked (both T5 bosses beaten + level ≥ 18), excluded from
+	// zonesForLevel unconditionally.
+	ZoneTierMythic ZoneTier = 6
 )

 // ZoneEnemy is a roster entry. BestiaryID must resolve via dndBestiary
@@ -83,6 +96,7 @@ type ZoneLootEntry struct {
 	ItemID       string
 	DropChance   float64 // 0..1; ignored if UniqueAlways
 	UniqueAlways bool    // always drops; used for quest items
+	BossOnly     bool    // only rolls on the zone-boss kill (signature items)
 	Note         string  // free-text descriptor (unique-item flavor)
 }

@@ -172,6 +186,13 @@ func zonesForLevel(dndLevel int) []ZoneDefinition {
 	var out []ZoneDefinition
 	for _, id := range zoneOrder {
 		z := dndZoneRegistry[id]
+		// Tier 6 (Mythic post-game) is never level-gated in. It has its own
+		// unlock (postgameUnlocked) and surfaces only via postgameZones().
+		// Note: maxTier = playerTier+2 has no hard clamp, so a high-level
+		// player would otherwise reach a T6 zone here — exclude explicitly.
+		if z.Tier >= ZoneTierMythic {
+			continue
+		}
 		if int(z.Tier) <= maxTier {
 			out = append(out, z)
 		}
@@ -53,6 +53,9 @@ func (p *AdventurePlugin) handleDnDZoneCmd(ctx MessageContext, args string) erro
 		// fork pending) the handler short-circuits with a friendly
 		// message — see zoneCmdGo for the full surface.
 		return p.zoneCmdGo(ctx, rest)
+	case "unlock", "pick", "force":
+		// Spend thieves' tools on a fork option a failed check closed.
+		return p.zoneCmdUnlock(ctx, rest)
 	case "status", "info":
 		return p.zoneCmdStatus(ctx)
 	case "map", "m":
@@ -83,6 +86,7 @@ func zoneHelpText() string {
 	b.WriteString("`!zone map` — show the room layout\n")
 	b.WriteString("`!zone advance` — resolve the current room and move on\n")
 	b.WriteString("`!zone go <n>` — at a fork, take path #n\n")
+	b.WriteString("`!zone unlock <n>` — spend thieves' tools to open a path you couldn't\n")
 	b.WriteString("`!revisit <n>` — walk back to a room you've already cleared\n")
 	b.WriteString("`!zone abandon` — end the active run (no rewards)\n")
 	b.WriteString("`!zone taunt` — poke TwinBee (they'll remember)\n")
@@ -118,6 +122,25 @@ func (p *AdventurePlugin) zoneCmdList(ctx MessageContext, c *DnDCharacter) error
 			i+1, z.Display, int(z.Tier), z.LevelMin, z.LevelMax, z.ID))
 		b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
 	}
+	// Post-game zones render under a divider once any exist. Unlocked players
+	// see enterable entries (indexed continuing from the list above, matching
+	// availableZonesFor); locked players see aspiration + the unlock hint.
+	if pg := postgameZones(); len(pg) > 0 {
+		unlocked, reason := postgameUnlocked(ctx.Sender, c.Level)
+		b.WriteString("\n— Beyond the Map —\n")
+		if !unlocked {
+			b.WriteString(fmt.Sprintf("_%s_\n", reason))
+		}
+		for j, z := range pg {
+			if unlocked {
+				b.WriteString(fmt.Sprintf("**%d.** %s — _T%d, L%d+_  `!zone enter %s`\n",
+					len(zones)+j+1, z.Display, int(z.Tier), z.LevelMin, z.ID))
+			} else {
+				b.WriteString(fmt.Sprintf("🔒 %s — _T%d, L%d+_\n", z.Display, int(z.Tier), z.LevelMin))
+			}
+			b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
+		}
+	}
 	if active, isLeader, _ := activeZoneRunFor(ctx.Sender); active != nil {
 		zone := zoneOrFallback(active.ZoneID)
 		tail := "Use `!zone status` or `!zone abandon`."
@@ -200,9 +223,12 @@ func (p *AdventurePlugin) zoneCmdEnter(ctx MessageContext, c *DnDCharacter, rest
 			"🛌 You're still resting — %s remaining. The dungeon won't go anywhere.",
 			formatRespecDuration(remaining)))
 	}
-	available := zonesForLevel(c.Level)
+	available := availableZonesFor(ctx.Sender, c.Level)
 	id, ok := resolveZoneInput(rest, available)
 	if !ok {
+		if reason := postgameLockReason(rest, ctx.Sender, c.Level); reason != "" {
+			return p.SendDM(ctx.Sender, reason)
+		}
 		return p.SendDM(ctx.Sender,
 			"Unknown zone for your level. Try `!zone list` to see what's available.")
 	}
@@ -762,7 +788,7 @@ func (p *AdventurePlugin) advanceOnceWithOpts(ctx MessageContext, compact, inlin
 			b.WriteString(line)
 			b.WriteString("\n\n")
 		}
-		if granted := p.rollZoneLoot(ctx.Sender, run, zone); len(granted) > 0 {
+		if granted := p.rollZoneLoot(ctx.Sender, run, zone, !midZone); len(granted) > 0 {
 			b.WriteString("**Loot:**\n")
 			for _, id := range granted {
 				b.WriteString("• " + id + "\n")
@@ -867,6 +893,7 @@ func (p *AdventurePlugin) runHarvestForAdvance(
 	if herr != nil {
 		return autoHarvestResult{}, ""
 	}
+	beatHaul(fresh, hr.Summary)
 	return hr, renderAutoHarvestFooter(hr.Summary)
 }

@@ -1035,7 +1062,8 @@ func (p *AdventurePlugin) resolveRoom(userID id.UserID, run *DungeonRun, zone Zo
 	case RoomEntry:
 		return
 	case RoomTrap:
-		_, narration := p.resolveTrapRoom(userID, run, zone)
+		damage, narration := p.resolveTrapRoom(userID, run, zone)
+		beatTrap(userID, run, damage)
 		outcome = narration
 		return
 	case RoomExploration:
@@ -1099,6 +1127,12 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 	result := pres.Seats[0]
 	postHP, maxHP := dndHPSnapshot(userID)
 	nat20s, nat1s := scanMoodEventsFromEvents(run.RunID, pres.Events)
+	// One beat for the fight, filed here rather than on each of the three
+	// outcome branches below — every one of them passes through this point with
+	// the result already decided, and a single site can't drift out of step with
+	// the others.
+	beatCombat(run, monster.Name, elite, isBoss, result.PlayerWon, result.TimedOut,
+		preHP, postHP, maxHP, nat20s, nat1s)

 	// Compact mode: skip TwinBee banter, skip the multi-beat play-by-play.
 	// Render a single outcome line. Still records kills, threat, and drops.
@@ -1200,6 +1234,14 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 		// tryPatrolEncounter); see retreatThreatBump in
 		// dnd_expedition_combat.go.
 		_, _ = applyMoodEvent(run.RunID, MoodEventPlayerDeath)
+		// Ahead of abandonZoneRun, which would close the story as "abandoned" —
+		// the difference between being killed and running out of clock is the
+		// most interesting fact in the whole log.
+		if result.TimedOut {
+			beatRunEnd(run, "retreated")
+		} else {
+			beatRunEnd(run, "died")
+		}
 		_ = abandonZoneRun(userID)
 		// Timeout loss = retreat; the fighters took wounds but nobody actually
 		// died. Don't fire markAdventureDead — that would trigger the 6h respawn
@@ -188,6 +188,17 @@ func (p *AdventurePlugin) zoneCmdGo(ctx MessageContext, rest string) error {
 	if cerr != nil {
 		return p.SendDM(ctx.Sender, cerr.Error())
 	}
+	return p.commitForkChoice(ctx, run, chosen, "")
+}
+
+// commitForkChoice advances the run onto an already-validated fork option and
+// emits the arrival teaser. Split out of zoneCmdGo so `!zone unlock` — which
+// reaches the same place by paying for it — cannot drift from the plain
+// `!zone go` arrival: same region-transition hook, same camp strike, same
+// boss/elite prompt. header, if set, is printed above the move.
+func (p *AdventurePlugin) commitForkChoice(
+	ctx MessageContext, run *DungeonRun, chosen pendingChoice, header string,
+) error {
 	nextIdx, aerr := advanceZoneRunNode(run.RunID, chosen.To)
 	if aerr != nil {
 		return p.SendDM(ctx.Sender, "Couldn't advance: "+aerr.Error())
@@ -200,6 +211,7 @@ func (p *AdventurePlugin) zoneCmdGo(ctx MessageContext, rest string) error {
 	fireGraphRegionTransition(run.UserID, fromNode, nextNode)
 	nextRoom := nodeKindToRoomType(nextNode.Kind)
 	var b strings.Builder
+	b.WriteString(header)
 	if kind := autoBreakCampOnMove(ctx.Sender); kind != "" {
 		b.WriteString(fmt.Sprintf("⛺ Camp struck (**%s**) — the party moved on.\n\n", kind))
 	}
@@ -238,6 +238,7 @@ func (p *AdventurePlugin) resolveSecretRoom(userID id.UserID, run *DungeonRun, z
 		it := item
 		if line := p.grantZoneItem(userID, &it, "🧪"); line != "" {
 			rewards = append(rewards, line)
+			beatTreasure(run, it.Name, "cache")
 		}
 	}

@@ -357,7 +358,7 @@ func (p *AdventurePlugin) resolveTrapRoomLegacy(userID id.UserID, run *DungeonRu
 // to a single "coins" item with rolled value; everything else becomes a
 // treasure-tier inventory item with a tier-derived placeholder value
 // (zone equipment registry wiring is a later content phase).
-func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone ZoneDefinition) []string {
+func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone ZoneDefinition, bossCleared bool) []string {
 	rng := rand.New(rand.NewPCG(uint64(zoneSelectorHash(run.RunID, run.CurrentRoom)), 0x100712))
 	// DM mood tilts probabilistic drop chances. UniqueAlways entries are
 	// untouched — those are story drops, not flavor for the DM to gate.
@@ -367,6 +368,13 @@ func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone Z
 	}
 	var granted []string
 	for _, entry := range zone.Loot {
+		// BossOnly (signature) drops only roll on the true zone-boss / whole-zone
+		// clear. rollZoneLoot fires on every region completion of a multi-region
+		// zone; without this gate a T6 signature item would get four roll chances
+		// per run instead of one at the boss.
+		if entry.BossOnly && !bossCleared {
+			continue
+		}
 		if !entry.UniqueAlways {
 			chance := entry.DropChance * moodMult
 			if rng.Float64() > chance {
@@ -385,6 +393,11 @@ func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone Z
 			slog.Error("zone: addLoot audit", "user", userID, "item", entry.ItemID, "err", err)
 		}
 		granted = append(granted, entry.ItemID)
+		source := "zone"
+		if bossCleared {
+			source = "boss"
+		}
+		beatTreasure(run, item.Name, source)
 	}
 	return granted
 }
@@ -404,6 +417,15 @@ func zoneLootToInventory(entry ZoneLootEntry, zone ZoneDefinition, rng *rand.Ran
 			Value: int64(val),
 		}, true
 	}
+	// Registry-backed loot (T6 signature items and any future magic-item drops)
+	// materializes as a real equippable magic_item — the SkillSource tag is what
+	// the equip path and magicItemEffectFor key off. Plain named entries (legacy
+	// zone signature items not in the registry) fall through to treasure below.
+	if mi, ok := magicItemRegistry[entry.ItemID]; ok {
+		item := magicItemSell(mi)
+		item.SkillSource = "magic_item:" + mi.ID
+		return item, true
+	}
 	tier := int(zone.Tier)
 	displayName := titleCaseUnderscored(entry.ItemID)
 	value := int64(50 * tier * tier) // T1=50, T2=200, T3=450, T4=800, T5=1250
@@ -507,6 +507,33 @@ func TestZoneTrapRoom_AntimagicFieldNoHPLoss(t *testing.T) {
 	}
 }

+// TestZoneLootToInventory_RegistryItemBecomesMagicItem — a signature drop whose
+// ItemID is in the magic-item registry materializes as an equippable magic_item
+// carrying the "magic_item:<id>" SkillSource, not generic treasure.
+func TestZoneLootToInventory_RegistryItemBecomesMagicItem(t *testing.T) {
+	zone, ok := getZone(ZoneFirstHoard)
+	if !ok {
+		t.Fatal("first_hoard zone not registered")
+	}
+	rng := newDeterministicRNG(t, "sig-loot")
+	entry := ZoneLootEntry{ItemID: "aegis_of_the_first_scale", DropChance: 1.0, BossOnly: true}
+	item, ok := zoneLootToInventory(entry, zone, rng)
+	if !ok {
+		t.Fatal("zoneLootToInventory returned ok=false for a registry item")
+	}
+	if item.Type != "magic_item" {
+		t.Errorf("Type = %q, want magic_item", item.Type)
+	}
+	if item.SkillSource != "magic_item:aegis_of_the_first_scale" {
+		t.Errorf("SkillSource = %q, want magic_item:aegis_of_the_first_scale", item.SkillSource)
+	}
+	// A plain non-registry entry still falls through to treasure.
+	plain, _ := zoneLootToInventory(ZoneLootEntry{ItemID: "cooling_ember_of_aurvandryx", UniqueAlways: true}, zone, rng)
+	if plain.Type != "treasure" {
+		t.Errorf("crafting anchor Type = %q, want treasure", plain.Type)
+	}
+}
+
 func TestRollZoneLoot_BossLootDrops(t *testing.T) {
 	setupAuditTestDB(t)
 	uid := id.UserID("@zone-loot:example")
@@ -517,7 +544,7 @@ func TestRollZoneLoot_BossLootDrops(t *testing.T) {
 	zone, _ := getZone(ZoneCryptValdris)

 	p := &AdventurePlugin{}
-	granted := p.rollZoneLoot(uid, run, zone)
+	granted := p.rollZoneLoot(uid, run, zone, true)
 	// Crypt of Valdris has UniqueAlways "valdris_phylactery_shard" + always-drop coins.
 	foundShard := false
 	foundCoins := false
@@ -358,7 +358,10 @@ func pickLootEntry(zone map[LootTier][]ZoneLootDrop, tier LootTier, rng *rand.Ra
 // while production paths use the package-global generator.
 func rngFloat(rng *rand.Rand) float64 {
 	if rng == nil {
-		return rand.Float64()
+		// Auto-resolve rooms pass nil. simFloat64 routes to the seeded combat
+		// stream when the sim is seeding, else the package global — so prod
+		// (never seeded) stays byte-identical while sim room combat pairs.
+		return simFloat64()
 	}
 	return rng.Float64()
 }
@@ -368,7 +371,7 @@ func rngIntN(rng *rand.Rand, n int) int {
 		return 0
 	}
 	if rng == nil {
-		return rand.IntN(n)
+		return simIntN(n)
 	}
 	return rng.IntN(n)
 }
@@ -92,6 +92,16 @@ func zoneRoomEntryPool(zoneID ZoneID) []string {
 		return append(append([]string{}, flavor.RoomEntryDragonsLair...), flavor.RoomEntryGeneric...)
 	case ZoneAbyssPortal:
 		return append(append([]string{}, flavor.RoomEntryAbyssPortal...), flavor.RoomEntryGeneric...)
+	case ZoneOssuaryAscendant:
+		return append(append([]string{}, flavor.RoomEntryOssuaryAscendant...), flavor.RoomEntryGeneric...)
+	case ZoneFirstHoard:
+		return append(append([]string{}, flavor.RoomEntryFirstHoard...), flavor.RoomEntryGeneric...)
+	case ZoneUnplace:
+		return append(append([]string{}, flavor.RoomEntryUnplace...), flavor.RoomEntryGeneric...)
+	case ZoneDrownedStar:
+		return append(append([]string{}, flavor.RoomEntryDrownedStar...), flavor.RoomEntryGeneric...)
+	case ZoneLastMeridian:
+		return append(append([]string{}, flavor.RoomEntryLastMeridian...), flavor.RoomEntryGeneric...)
 	}
 	return flavor.RoomEntryGeneric
 }
@@ -120,6 +130,16 @@ func bossEntryPool(zoneID ZoneID) []string {
 		return flavor.BossEntryInfernax
 	case ZoneAbyssPortal:
 		return flavor.BossEntryBelaxath
+	case ZoneOssuaryAscendant:
+		return flavor.BossEntryValdrisAscendant
+	case ZoneFirstHoard:
+		return flavor.BossEntryAurvandryx
+	case ZoneUnplace:
+		return flavor.BossEntrySeamstress
+	case ZoneDrownedStar:
+		return flavor.BossEntrySeraphel
+	case ZoneLastMeridian:
+		return flavor.BossEntryCustodian
 	}
 	return flavor.BossEntryGeneric
 }
@@ -182,6 +202,16 @@ func zoneLorePool(zoneID ZoneID) []string {
 		return append(append([]string{}, flavor.LoreLinesDragonsLair...), flavor.LoreLines...)
 	case ZoneAbyssPortal:
 		return append(append([]string{}, flavor.LoreLinesAbyssPortal...), flavor.LoreLines...)
+	case ZoneOssuaryAscendant:
+		return append(append([]string{}, flavor.LoreLinesOssuaryAscendant...), flavor.LoreLines...)
+	case ZoneFirstHoard:
+		return append(append([]string{}, flavor.LoreLinesFirstHoard...), flavor.LoreLines...)
+	case ZoneUnplace:
+		return append(append([]string{}, flavor.LoreLinesUnplace...), flavor.LoreLines...)
+	case ZoneDrownedStar:
+		return append(append([]string{}, flavor.LoreLinesDrownedStar...), flavor.LoreLines...)
+	case ZoneLastMeridian:
+		return append(append([]string{}, flavor.LoreLinesLastMeridian...), flavor.LoreLines...)
 	}
 	return flavor.LoreLines
 }
@@ -211,6 +241,16 @@ func bossSignaturePool(zoneID ZoneID) []string {
 		return flavor.InfernaxSignatureCallouts
 	case ZoneAbyssPortal:
 		return flavor.BelaxathSignatureCallouts
+	case ZoneOssuaryAscendant:
+		return flavor.ValdrisAscendantSignatureCallouts
+	case ZoneFirstHoard:
+		return flavor.AurvandryxSignatureCallouts
+	case ZoneUnplace:
+		return flavor.SeamstressSignatureCallouts
+	case ZoneDrownedStar:
+		return flavor.SeraphelSignatureCallouts
+	case ZoneLastMeridian:
+		return flavor.CustodianSignatureCallouts
 	}
 	return nil
 }
@@ -236,6 +276,16 @@ func bossPhaseTwoPool(zoneID ZoneID) []string {
 		return flavor.InfernaxPhaseTwoLines
 	case ZoneAbyssPortal:
 		return flavor.BelaxathPhaseTwoLines
+	case ZoneOssuaryAscendant:
+		return flavor.ValdrisAscendantPhaseTwoLines
+	case ZoneFirstHoard:
+		return flavor.AurvandryxPhaseTwoLines
+	case ZoneUnplace:
+		return flavor.SeamstressPhaseTwoLines
+	case ZoneDrownedStar:
+		return flavor.SeraphelPhaseTwoLines
+	case ZoneLastMeridian:
+		return flavor.CustodianPhaseTwoLines
 	}
 	return nil
 }
@@ -175,6 +175,9 @@ func generateRoomSequence(zone ZoneDefinition, rng *rand.Rand) []RoomType {

 // newRunID — 16-char hex token. Crypto-random; collision-resistant.
 func newRunID() string {
+	if simSeedOn() {
+		return simHexToken()
+	}
 	var b [8]byte
 	if _, err := cryptorand.Read(b[:]); err != nil {
 		// Fall back to math/rand if /dev/urandom is unavailable.
@@ -219,6 +222,15 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 			break
 		}
 	}
+	// Tier 6 zones are excluded from zonesForLevel by design; they're
+	// admitted here only through the post-game unlock (both T5 bosses beaten
+	// + level ≥ floor). This is the shared engine safety net — command sites
+	// give the friendly reason before reaching here.
+	if isPostgameZone(zoneID) {
+		if ok, _ := postgameUnlocked(userID, dndLevel); ok {
+			allowed = true
+		}
+	}
 	if !allowed {
 		return nil, ErrZoneTierLocked
 	}
@@ -231,7 +243,11 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 	}

 	if rng == nil {
-		rng = rand.New(rand.NewPCG(uint64(time.Now().UnixNano()), uint64(time.Now().UnixMicro())))
+		if simSeedOn() {
+			rng = simZoneRNG()
+		} else {
+			rng = rand.New(rand.NewPCG(uint64(time.Now().UnixNano()), uint64(time.Now().UnixMicro())))
+		}
 	}
 	seq := generateRoomSequence(zone, rng)

@@ -279,6 +295,7 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 	); err != nil {
 		return nil, fmt.Errorf("insert zone run: %w", err)
 	}
+	beatRunStart(userID, run, zone)
 	return run, nil
 }

@@ -565,6 +582,7 @@ func abandonZoneRun(userID id.UserID) error {
 	if r == nil {
 		return ErrNoActiveRun
 	}
+	beatRunEnd(r, "abandoned")
 	_, err = db.Get().Exec(`
 		UPDATE dnd_zone_run
 		   SET abandoned = 1,
@@ -583,6 +601,12 @@ func abandonZoneRunByID(runID string) error {
 	if runID == "" {
 		return nil
 	}
+	// The generic funnel: it fires for an idle reap, a region retirement, and a
+	// completed run being tidied up alike. beatRunEnd is first-writer-wins, so
+	// this only ever supplies the outcome nothing more specific already did.
+	if r, _ := getZoneRun(runID); r != nil {
+		beatRunEnd(r, "abandoned")
+	}
 	_, err := db.Get().Exec(`
 		UPDATE dnd_zone_run
 		   SET abandoned = 1,
@@ -128,10 +128,10 @@ func TestZoneRegistry_LootDropChances(t *testing.T) {
 func TestZoneRegistry_RoomCountSane(t *testing.T) {
 	// Long-expedition plan §2 widens the bands per tier: T1 12–14 up to
 	// T5 ~36–44. The guard floor stays at 5 (no zone should ever drop
-	// below that) and the ceiling tracks the T5 target.
+	// below that) and the ceiling tracks the T6 post-game target of 44–52.
 	for _, z := range allZones() {
-		if z.MinRooms < 5 || z.MaxRooms > 44 || z.MinRooms > z.MaxRooms {
-			t.Errorf("zone %s rooms %d-%d outside design (5-44, min<=max)",
+		if z.MinRooms < 5 || z.MaxRooms > 52 || z.MinRooms > z.MaxRooms {
+			t.Errorf("zone %s rooms %d-%d outside design (5-52, min<=max)",
 				z.ID, z.MinRooms, z.MaxRooms)
 		}
 	}
@@ -162,6 +162,7 @@ func TestZoneRegistry_LevelRangeMatchesTier(t *testing.T) {
 		ZoneTierJourneyman: {5, 8},
 		ZoneTierVeteran:    {8, 12},
 		ZoneTierLegendary:  {12, 20},
+		ZoneTierMythic:     {18, 20}, // post-game: gated by unlock, not level band
 	}
 	for _, z := range allZones() {
 		want, ok := expected[z.Tier]
@@ -416,6 +416,21 @@ func (p *EuroPlugin) GetBalance(userID id.UserID) float64 {
 	return balance
 }

+// HasExternalTx reports whether a money move with this externalID has already
+// been applied. It lets a retrying web caller tell a first attempt from a replay:
+// on a first attempt the affordability gate must run, but on a retry of an order
+// already debited the gate must be skipped — the debit is a settled fact, and
+// re-reading the now-lower balance would wrongly bounce a hit the buyer paid for.
+func (p *EuroPlugin) HasExternalTx(externalID string) bool {
+	if externalID == "" {
+		return false
+	}
+	var one int
+	err := db.Get().QueryRow(
+		`SELECT 1 FROM euro_transactions WHERE external_id = ? LIMIT 1`, externalID).Scan(&one)
+	return err == nil
+}
+
 // ---------------------------------------------------------------------------
 // Idempotent money moves
 //
@@ -186,13 +186,10 @@ func (p *AdventurePlugin) deliverAmbient(e *Expedition, now time.Time) error {
 	}

 	footer := p.applyAmbientEffect(e, ev)
-	body := renderAmbientDM(e, ev, line, footer)

-	if uid := id.UserID(e.UserID); uid != "" {
-		if err := p.SendDM(uid, body); err != nil {
-			slog.Warn("expedition: ambient DM", "user", uid, "err", err)
-		}
-	}
+	// Once-a-day cadence: the effect above still lands on schedule, but the
+	// DM does not. The log entry below is what the next morning's briefing
+	// digest reads back, and the site renders it as it happens.
 	summary := fmt.Sprintf("ambient: %s", ev.Kind)
 	if footer != "" {
 		summary += " — " + footer
@@ -304,15 +304,11 @@ func (p *AdventurePlugin) tryAutoRun(e *Expedition, now time.Time) error {
 	// every other quiet path stays silent until something interactive fires.
 	if body, ok := buildAutoRunDM(e.ID, r, campBlock, campDecision); ok {
 		p.fanOutExpeditionDM(e, body, nil)
-		// N1/A6 — the end-of-day digest is the primary mid-day event anchor.
-		// The anchor is a per-player roll against a per-player daily slot, so
-		// each member rolls their own; a party does not share one event.
-		if campDecision.Night {
-			for _, member := range expeditionAudience(e) {
-				p.maybeFireAnchoredEvent(member, advEventChanceDigest)
-			}
-		}
 	}
+	// N1/A6's digest event anchor has moved to the 06:00 briefing along with
+	// the digest itself — see deliverBriefing. The anchor's whole premise is
+	// firing at a moment the player is demonstrably reading a DM, and the
+	// night camp no longer sends one.

 	// Emergence seam: a run-complete reached by the background ticker is
 	// still a live emergence — roll pet arrival. See maybeRollPetArrivalOnEmerge.
@@ -336,8 +332,10 @@ func (p *AdventurePlugin) tryAutoRun(e *Expedition, now time.Time) error {
 // Surface rules:
 //   - stopFork / stopEnded / stopComplete  → render the walk DM. These
 //     are the interactive / climax beats and stay their own messages.
-//   - Night camp pitched                  → render the EoD digest +
-//     camp block. Walk stream is dropped (the digest summarizes the day).
+//   - Night camp pitched                  → silent. The once-a-day cadence
+//     (2026-07-26) retired the EoD digest DM: the camp writes its own
+//     `rest` log entry and the day it summarised is already in the log,
+//     so the 06:00 briefing reads the whole thing back the next morning.
 //   - Boss-safety camp pitched            → short hold notice + camp
 //     block; walk stream dropped (compact bail was deliberate).
 //   - Anything else                       → silent.
@@ -354,24 +352,9 @@ func buildAutoRunDM(expID string, r autopilotWalkResult, camp string, dec autoCa
 		return "", false
 	}
 	if dec.Night {
-		// EoD digest. The camp pitch already bumped current_day in
-		// nightRolloverBurn, so the day-that-just-ended is CurrentDay-1.
-		// digest is the day rollup, then the camp block lays out the rest.
-		fresh, ferr := getExpedition(expID)
-		prevDay := 0
-		if ferr == nil && fresh != nil {
-			prevDay = fresh.CurrentDay - 1
-		}
-		digest := ""
-		if prevDay > 0 {
-			digest = renderEndOfDayDigest(expID, prevDay)
-		}
-		if digest == "" {
-			// No structured day yet — fall back to a thin header so the
-			// camp block isn't dropped on the player without context.
-			digest = "🌙 *The day winds down.*\n\n"
-		}
-		return digest + camp, true
+		// Silent: the morning briefing is the one daily message now, and it
+		// renders this same day out of the expedition log.
+		return "", false
 	}
 	if dec.Reason == "boss-safety hold — resting before re-engaging" {
 		return "⏸ *Holding before the boss — pitching a rest camp.*\n" + camp, true
@@ -123,6 +123,11 @@ var phase1TierCenterline = map[ZoneTier]int{
 	ZoneTierJourneyman: 9,
 	ZoneTierVeteran:    13,
 	ZoneTierLegendary:  17,
+	// Tier 6 post-game runs at the cap. These in-process matrices tune the
+	// T1–T5 global levers; T6 rows are simmed and logged for reference but
+	// carry no band assertion here — T6 balance is owned by the remote P7
+	// sweep (n=750, control arm) per gogobee_postgame_zones_plan.md §4.
+	ZoneTierMythic: 20,
 }

 // TestExpeditionBalance_Phase1_FullMatrix is the Phase 1 baseline-
@@ -375,6 +375,12 @@ func isBoredomDriven(userID id.UserID, now time.Time) bool {
 func pickBoredomZone(uid id.UserID, level int) (ZoneDefinition, bool) {
 	var inBand, nonRaid []ZoneDefinition
 	for _, z := range allZones() {
+		// Tier 6 post-game zones are opt-in endgame — a bored character never
+		// wanders into one on autopilot, even once unlocked. This picker walks
+		// allZones() directly (not zonesForLevel), so exclude T6 explicitly.
+		if z.Tier >= ZoneTierMythic {
+			continue
+		}
 		if level < z.LevelMin || level > z.LevelMax {
 			continue
 		}
@@ -0,0 +1,248 @@
+package plugin
+
+// Once-a-day cadence (2026-07-26).
+//
+// Adventure's web feed is now the place to watch a run move minute to minute,
+// so the bot no longer narrates every beat into Matrix. The three per-player
+// DM sources that fired on a clock — the 06:00 briefing, the 21:00 recap, and
+// the 6-hourly ambient event — collapse into a single morning message.
+//
+// The rule that keeps this honest: only the *messaging* goes quiet. Every
+// mechanical effect still fires on exactly the schedule it always did. The
+// ambient ticker still applies its ±SU nudges, the recap still runs the night
+// wandering check and its threat bump, the briefing still burns supply and
+// rolls the day. What changes is that ambient and recap now write their
+// outcome to the expedition log and stop there; the next morning's briefing
+// reads that log back and reports it.
+//
+// Interrupt-driven DMs are deliberately untouched. A fork needs a human, a
+// death and a run-completion are terminal, and a mischief hit or a rival
+// challenge is somebody else acting on you. Those still arrive when they
+// happen; batching them to the next morning would either strand a decision
+// behind an 8h auto-pick or report a finished story.
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"strings"
+	"time"
+
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+const (
+	// defaultPeteSiteURL — Pete's public site. Distinct from PETE_INGEST_URL,
+	// which is the Headscale-only ingest endpoint and is not reachable by a
+	// player clicking a link in a DM.
+	defaultPeteSiteURL = "https://news.parodia.dev"
+
+	// digestMaxLines — how many prior-day log lines the morning digest
+	// carries before it defers to the site. The cap is the whole point of
+	// the change: the digest is a teaser for the feed, not a transcript.
+	digestMaxLines = 8
+
+	// digestScanLimit — how far back the digest reads before it gives up on
+	// finding the window's oldest entry. A day of autopilot ticks, ambient
+	// beats and room events runs to a few dozen rows; this is slack, not a
+	// budget.
+	digestScanLimit = 500
+)
+
+// peteSiteURL returns the public base URL for Pete's site, without a
+// trailing slash. Overridable so a dev instance can point its links at
+// a local Pete instead of prod.
+func peteSiteURL() string {
+	if v := strings.TrimRight(os.Getenv("PETE_PUBLIC_URL"), "/"); v != "" {
+		return v
+	}
+	return defaultPeteSiteURL
+}
+
+// adventureFeedURL is the general Adventure feed: everyone's activity.
+func adventureFeedURL() string {
+	return peteSiteURL() + "/adventure"
+}
+
+// adventureWhoURL is the reader's own adventurer page. Keyed by the same
+// salted, one-way roster token the board already publishes (see
+// pete_roster.go), so a DM link and a board link resolve to one page and
+// neither one leaks a Matrix handle.
+func adventureWhoURL(uid id.UserID) string {
+	if uid == "" {
+		return adventureFeedURL()
+	}
+	return peteSiteURL() + "/adventure/who/" + eventToken(uid, "roster")
+}
+
+// digestSiteFooter appends the reader's own site link. Per-reader rather
+// than per-expedition: a party shares a briefing body but each member's
+// link goes to their own sheet.
+//
+// Gated on the Pete seam: peteclient.Enabled() is what starts the roster
+// ticker, and the roster push is what creates the page this link points at.
+// With the seam off (a dev instance, or a deploy without an ingest token)
+// every daily DM would otherwise carry a guaranteed 404.
+func digestSiteFooter(uid id.UserID, body string) string {
+	if !peteclient.Enabled() {
+		return body
+	}
+	return body + "\n\n🔗 _Watch it live: " + adventureWhoURL(uid) + "_"
+}
+
+// briefingPerReader is the per-reader decorator for the one daily message:
+// the reader's own pet event on the front, the reader's own site link on the
+// back. Both are per-member, so a party's shared briefing body still reaches
+// each player personalised at both ends.
+func (p *AdventurePlugin) briefingPerReader(uid id.UserID, body string) string {
+	return digestSiteFooter(uid, p.briefingPetPrefix(uid, body))
+}
+
+// fireDigestEventAnchor rolls N1/A6's digest-anchored mid-day event for each
+// member. It used to hang off the autopilot's night-camp digest DM; that DM is
+// gone, so it moved here — the briefing is now the message the player is
+// demonstrably reading, which is the whole premise of an anchored roll.
+//
+// Still a per-player roll against a per-player daily slot: a party does not
+// share one event.
+func (p *AdventurePlugin) fireDigestEventAnchor(e *Expedition) {
+	for _, member := range expeditionAudience(e) {
+		p.maybeFireAnchoredEvent(member, advEventChanceDigest)
+	}
+}
+
+// appendOvernightDigest folds everything that happened since the previous
+// briefing into a briefing body. A log read failure is non-fatal: the briefing
+// is the player's only daily message now, so a missing digest block must never
+// cost them the whole DM.
+//
+// The window is a timestamp, not a day number, because the two disagree on
+// every event-anchored expedition: the autopilot's night camp rolls
+// current_day at camp time, so by 06:00 the day that just ended is already
+// current_day-1 — and on a night the autopilot never camped, it isn't. A
+// since-last-briefing window reports each entry exactly once either way.
+func appendOvernightDigest(body, expID string, since time.Time) string {
+	entries, err := logEntriesSince(expID, since)
+	if err != nil {
+		slog.Warn("expedition: digest entries", "expedition", expID, "err", err)
+		return body
+	}
+	digest := renderOvernightDigest(entries)
+	if digest == "" {
+		return body
+	}
+	return body + "\n" + digest
+}
+
+// logEntriesSince returns an expedition's log entries stamped at or after
+// `since`, oldest first.
+//
+// The cutoff is applied in Go rather than in the WHERE clause on purpose:
+// dnd_expedition_log.timestamp is a DATETIME column filled by SQLite's own
+// CURRENT_TIMESTAMP, and comparing it against a bound parameter goes through
+// numeric affinity and does not reliably answer the question. Scanning the
+// column into a time.Time does.
+func logEntriesSince(expID string, since time.Time) ([]ExpeditionEntry, error) {
+	recent, err := recentExpeditionLog(expID, digestScanLimit)
+	if err != nil {
+		return nil, err
+	}
+	// CURRENT_TIMESTAMP has one-second resolution while the cutoff we are
+	// handed (a briefing stamp, or the start date on day 1) carries
+	// sub-second precision. Floor it, or an entry written in the same second
+	// as the previous briefing falls out of both windows and is never
+	// reported. Re-reporting inside that one second is the safe direction.
+	since = since.Truncate(time.Second)
+	out := make([]ExpeditionEntry, 0, len(recent))
+	for i := len(recent) - 1; i >= 0; i-- { // recent is newest-first
+		if recent[i].Timestamp.Before(since) {
+			continue
+		}
+		out = append(out, recent[i])
+	}
+	return out, nil
+}
+
+// digestSkipTypes — log entry types the morning digest never echoes.
+// `briefing` and `recap` are the frame itself, and the free-narration
+// types are the per-room prose the site renders in full.
+var digestSkipTypes = map[string]bool{
+	"briefing":  true,
+	"recap":     true,
+	"narrative": true,
+	"transit":   true,
+	"action":    true,
+	"journal":   true,
+}
+
+// renderOvernightDigest condenses one expedition-day of log entries into the
+// "here is what you missed" block that opens the morning briefing. Walks
+// collapse to a count; everything notable keeps its own summary line, capped
+// at digestMaxLines with an explicit overflow note so a truncated digest
+// never reads as a complete one.
+//
+// Returns "" when there is nothing worth reporting — a day with only walks
+// and narration gets no block at all rather than an empty header.
+func renderOvernightDigest(entries []ExpeditionEntry) string {
+	var rooms int
+	var lines []string
+	for _, en := range entries {
+		if en.Type == "walk" {
+			rooms += walkEntryRooms(en.Summary)
+			continue
+		}
+		if digestSkipTypes[en.Type] {
+			continue
+		}
+		s := strings.TrimSpace(en.Summary)
+		if s == "" {
+			continue
+		}
+		lines = append(lines, s)
+	}
+	if rooms == 0 && len(lines) == 0 {
+		return ""
+	}
+
+	var b strings.Builder
+	b.WriteString("📜 **Since yesterday**\n")
+	if rooms > 0 {
+		b.WriteString(fmt.Sprintf("• walked %s\n", pluralRooms(rooms)))
+	}
+	shown := lines
+	overflow := 0
+	if len(shown) > digestMaxLines {
+		overflow = len(shown) - digestMaxLines
+		shown = shown[:digestMaxLines]
+	}
+	for _, l := range shown {
+		b.WriteString("• " + l + "\n")
+	}
+	if overflow > 0 {
+		b.WriteString(fmt.Sprintf("• _...and %d more, on the site._\n", overflow))
+	}
+	return b.String()
+}
+
+// walkEntryRooms reads the room count back out of an auto-walk log summary
+// ("auto-walk: 3 room(s)"). One `walk` entry is one background tick, and a
+// tick covers as many rooms as the autopilot got through — counting entries
+// would report a 12-room day as a 3-room one. Unparseable summaries count as
+// a single room rather than vanishing.
+func walkEntryRooms(summary string) int {
+	var n int
+	if _, err := fmt.Sscanf(strings.TrimSpace(summary), "auto-walk: %d room", &n); err == nil && n > 0 {
+		return n
+	}
+	return 1
+}
+
+// pluralRooms renders a room count with the right noun.
+func pluralRooms(n int) string {
+	if n == 1 {
+		return "1 room"
+	}
+	return fmt.Sprintf("%d rooms", n)
+}
@@ -0,0 +1,253 @@
+package plugin
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Coverage for the once-a-day cadence (2026-07-26). The behavioural tests
+// below are the point of the file: before this change nothing asserted that
+// the recap and ambient paths sent a DM, so nothing would have caught them
+// silently continuing to send — or, worse, silently dropping the mechanical
+// effect along with the message.
+
+func TestRenderOvernightDigest_CollapsesWalksAndSkipsFrameTypes(t *testing.T) {
+	entries := []ExpeditionEntry{
+		// One `walk` entry is one autopilot tick, and a tick can cover
+		// several rooms — the digest reports rooms, not ticks.
+		{Type: "walk", Summary: "auto-walk: 2 room(s)"},
+		{Type: "walk", Summary: "auto-walk: 3 room(s)"},
+		{Type: "briefing", Summary: "morning briefing — 1.0 SU consumed overnight"},
+		{Type: "narrative", Summary: "the corridor bends left"},
+		{Type: "ambient", Summary: "ambient: pack_rat — Supplies -0.5"},
+		{Type: "night", Summary: "Signs of passage near camp; no encounter."},
+		{Type: "recap", Summary: "evening recap — 6 log entries today"},
+	}
+	got := renderOvernightDigest(entries)
+
+	if !strings.Contains(got, "walked 5 rooms") {
+		t.Errorf("walks not collapsed to a count:\n%s", got)
+	}
+	if !strings.Contains(got, "ambient: pack_rat") {
+		t.Errorf("ambient entry missing from digest:\n%s", got)
+	}
+	if !strings.Contains(got, "Signs of passage") {
+		t.Errorf("night check missing from digest:\n%s", got)
+	}
+	for _, unwanted := range []string{"morning briefing", "evening recap", "corridor bends"} {
+		if strings.Contains(got, unwanted) {
+			t.Errorf("digest echoed frame/narration entry %q:\n%s", unwanted, got)
+		}
+	}
+}
+
+func TestRenderOvernightDigest_CapsAndReportsOverflow(t *testing.T) {
+	var entries []ExpeditionEntry
+	for i := 0; i < digestMaxLines+3; i++ {
+		entries = append(entries, ExpeditionEntry{
+			Type:    "ambient",
+			Summary: fmt.Sprintf("ambient event %d", i),
+		})
+	}
+	got := renderOvernightDigest(entries)
+
+	if n := strings.Count(got, "ambient event"); n != digestMaxLines {
+		t.Errorf("digest carried %d lines, want the cap of %d:\n%s", n, digestMaxLines, got)
+	}
+	// A truncated digest must say so — otherwise it reads as the whole day.
+	if !strings.Contains(got, "and 3 more") {
+		t.Errorf("overflow not reported:\n%s", got)
+	}
+}
+
+func TestRenderOvernightDigest_EmptyWhenNothingNotable(t *testing.T) {
+	entries := []ExpeditionEntry{
+		{Type: "briefing", Summary: "morning briefing"},
+		{Type: "narrative", Summary: "dust everywhere"},
+	}
+	if got := renderOvernightDigest(entries); got != "" {
+		t.Errorf("want no digest block for an unremarkable day, got:\n%s", got)
+	}
+}
+
+func TestAdventureWhoURL_UsesRosterTokenNotHandle(t *testing.T) {
+	// The roster token is salted from a DB-persisted secret.
+	setupZoneRunTestDB(t)
+	uid := id.UserID("@digest-url:example")
+	got := adventureWhoURL(uid)
+
+	want := "/adventure/who/" + eventToken(uid, "roster")
+	if !strings.HasSuffix(got, want) {
+		t.Errorf("who URL = %q, want suffix %q", got, want)
+	}
+	if strings.Contains(got, "digest-url") {
+		t.Errorf("who URL leaked the Matrix handle: %q", got)
+	}
+}
+
+func TestAdventureWhoURL_FallsBackToFeedWithoutUser(t *testing.T) {
+	setupZoneRunTestDB(t)
+	if got := adventureWhoURL(""); got != adventureFeedURL() {
+		t.Errorf("empty user should fall back to the feed, got %q", got)
+	}
+}
+
+// TestBuildAutoRunDM_NightCampIsSilent — the autopilot's end-of-day digest was
+// the last recurring second DM of the day. It goes quiet; the camp writes its
+// own `rest` log entry, so the morning briefing still reports it.
+func TestBuildAutoRunDM_NightCampIsSilent(t *testing.T) {
+	r := autopilotWalkResult{rooms: 4, reason: stopOK, stream: []string{"…walked…"}}
+	camp := "\n\n⛺ **Autopilot camp** — night"
+	body, ok := buildAutoRunDM("expid", r, camp, autoCampDecision{
+		Kind: CampTypeStandard, Night: true,
+	})
+	if ok || body != "" {
+		t.Errorf("night camp should be silent, got ok=%v body=%q", ok, body)
+	}
+}
+
+// The two interactive surfaces the night-camp cut must not touch.
+func TestBuildAutoRunDM_KeepSetStillSurfaces(t *testing.T) {
+	fork := autopilotWalkResult{rooms: 1, reason: stopFork, finalMsg: "pick a path"}
+	if body, ok := buildAutoRunDM("expid", fork, "", autoCampDecision{}); !ok ||
+		!strings.Contains(body, "pick a path") {
+		t.Errorf("fork must still surface, got ok=%v body=%q", ok, body)
+	}
+
+	hold := autopilotWalkResult{rooms: 2, reason: stopBossSafety}
+	holdCamp := "\n\n⛺ **Rest camp**"
+	if body, ok := buildAutoRunDM("expid", hold, holdCamp, autoCampDecision{
+		Reason: "boss-safety hold — resting before re-engaging",
+	}); !ok || !strings.Contains(body, "Holding before the boss") {
+		t.Errorf("boss-safety hold must still surface, got ok=%v body=%q", ok, body)
+	}
+}
+
+// TestDeliverAmbient_SilentButStillLogs — the ambient event still fires and
+// still records itself; it just stops DMing.
+func TestDeliverAmbient_SilentButStillLogs(t *testing.T) {
+	setupZoneRunTestDB(t)
+	uid := id.UserID("@digest-ambient:example")
+	defer cleanupExpeditions(uid)
+
+	p := &AdventurePlugin{}
+	sink := installSink(p)
+
+	exp, err := startExpedition(uid, ZoneGoblinWarrens, "",
+		ExpeditionSupplies{Current: 10, Max: 10, DailyBurn: 1, HarshMod: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := p.deliverAmbient(exp, exp.StartDate.Add(time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+
+	if dms := sink.dmsTo(uid); len(dms) != 0 {
+		t.Errorf("ambient sent %d DM(s), want 0:\n%s", len(dms), strings.Join(dms, "\n---\n"))
+	}
+	entries, _ := recentExpeditionLog(exp.ID, 10)
+	found := false
+	for _, e := range entries {
+		if e.Type == "ambient" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("ambient event fired without writing a log entry — the digest would lose it")
+	}
+}
+
+// TestDeliverRecap_SilentButStillRunsNightCheck — the recap's mechanical half
+// (wandering check, threat bump) must survive the message going away.
+func TestDeliverRecap_SilentButStillRunsNightCheck(t *testing.T) {
+	setupZoneRunTestDB(t)
+	uid := id.UserID("@digest-recap:example")
+	defer cleanupExpeditions(uid)
+
+	p := &AdventurePlugin{}
+	sink := installSink(p)
+
+	exp, err := startExpedition(uid, ZoneGoblinWarrens, "",
+		ExpeditionSupplies{Current: 10, Max: 10, DailyBurn: 1, HarshMod: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	exp.Camp = &CampState{Active: true, Type: CampTypeStandard, EstablishedAt: exp.StartDate}
+	if err := updateCamp(exp.ID, exp.Camp); err != nil {
+		t.Fatal(err)
+	}
+
+	recapAt := exp.StartDate.Add(12 * time.Hour)
+	if err := p.deliverRecap(exp, recapAt); err != nil {
+		t.Fatal(err)
+	}
+
+	if dms := sink.dmsTo(uid); len(dms) != 0 {
+		t.Errorf("recap sent %d DM(s), want 0:\n%s", len(dms), strings.Join(dms, "\n---\n"))
+	}
+	entries, _ := recentExpeditionLog(exp.ID, 10)
+	sawNight, sawRecap := false, false
+	for _, e := range entries {
+		switch e.Type {
+		case "night":
+			sawNight = true
+		case "recap":
+			sawRecap = true
+		}
+	}
+	if !sawNight {
+		t.Error("night wandering check did not run — the recap dropped its mechanics, not just its DM")
+	}
+	if !sawRecap {
+		t.Error("recap log entry missing — the site loses its day boundary")
+	}
+}
+
+// TestDeliverBriefing_IsTheOneDailyMessage — the payoff: one DM, carrying the
+// prior day's silent activity and the reader's own site link.
+func TestDeliverBriefing_CarriesDigestAndSiteLink(t *testing.T) {
+	setupZoneRunTestDB(t)
+	uid := id.UserID("@digest-briefing:example")
+	defer cleanupExpeditions(uid)
+
+	enablePeteSeam(t)
+	p := &AdventurePlugin{}
+	sink := installSink(p)
+
+	exp, err := startExpedition(uid, ZoneGoblinWarrens, "",
+		ExpeditionSupplies{Current: 10, Max: 10, DailyBurn: 1, HarshMod: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Stand in for the day that just went by silently. The day number is
+	// deliberately not CurrentDay: on an event-anchored run the night camp
+	// rolls current_day when it pitches, so entries either side of the
+	// rollover carry different day numbers. The digest windows on time.
+	if err := appendExpeditionLog(exp.ID, exp.CurrentDay+1, "ambient",
+		"ambient: pack_rat — Supplies -0.5", "Something nibbled the stores."); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := p.deliverBriefing(exp, exp.StartDate.Add(20*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+
+	dms := sink.dmsTo(uid)
+	if len(dms) != 1 {
+		t.Fatalf("briefing sent %d DM(s), want exactly 1:\n%s", len(dms), strings.Join(dms, "\n---\n"))
+	}
+	body := dms[0]
+	if !strings.Contains(body, "Since yesterday") {
+		t.Errorf("briefing missing the overnight digest block:\n%s", body)
+	}
+	if !strings.Contains(body, "ambient: pack_rat") {
+		t.Errorf("digest did not carry the silent ambient event:\n%s", body)
+	}
+	if !strings.Contains(body, adventureWhoURL(uid)) {
+		t.Errorf("briefing missing the reader's own site link:\n%s", body)
+	}
+}
@@ -137,7 +137,16 @@ func (p *AdventurePlugin) expeditionCmdAccept(ctx MessageContext, c *DnDCharacte
 	}

 	zone := zoneOrFallback(exp.ZoneID)
-	if !zoneOpenToLevel(exp.ZoneID, c.Level) {
+	// Tier 6 zones are excluded from zonesForLevel by design, so zoneOpenToLevel
+	// would refuse every seat; they carry their own post-game unlock instead.
+	// Non-postgame zones keep the plain level gate.
+	if isPostgameZone(exp.ZoneID) {
+		// A party can't smuggle an ungated member into a Tier 6 zone: every seat
+		// must have cleared the post-game unlock on their own.
+		if ok, reason := postgameUnlocked(ctx.Sender, c.Level); !ok {
+			return p.SendDM(ctx.Sender, reason)
+		}
+	} else if !zoneOpenToLevel(exp.ZoneID, c.Level) {
 		return p.SendDM(ctx.Sender, fmt.Sprintf(
 			"**%s** is beyond you for now — come back at a higher level.", zone.Display))
 	}
@@ -271,47 +280,77 @@ func (p *AdventurePlugin) expeditionCmdParty(ctx MessageContext) error {
 	return p.SendDM(ctx.Sender, b.String())
 }

-// expeditionCmdLeave walks a member out. The leader cannot leave — their row is
-// the expedition — so they are pointed at `!extract`, which ends it for all.
-func (p *AdventurePlugin) expeditionCmdLeave(ctx MessageContext) error {
+// Sentinels for the two ways walking out can be refused, so the web action queue
+// can pick a verdict without reading prose. errLeaveIsLeader is deliberately not
+// errAbandonNotLeader inverted-and-reused: they are opposite facts about the same
+// person and a verdict that conflated them would tell a leader they weren't one.
+var (
+	errLeaveNothing  = errors.New("expedition leave: no expedition to leave")
+	errLeaveIsLeader = errors.New("expedition leave: the leader's row is the expedition")
+)
+
+// performExpeditionLeave is `!expedition leave` minus the command framing.
+// Shared with the web action queue, so a member walking out from a phone unseats
+// the same way and the leader is told either way.
+//
+// Like performExpeditionAbandon this does NOT take the per-user lock — its
+// Matrix caller holds it across the whole `!expedition` switch, and applyWebLeave
+// takes it instead. See the comment on performExpeditionAbandon for what getting
+// that backwards costs.
+func (p *AdventurePlugin) performExpeditionLeave(uid id.UserID) error {
 	// Resolve the seat the way the guards that trap them do. seatedExpeditionFor
 	// spans `extracting`, which activeExpeditionFor does not: a leader who
 	// extracts and never resumes would otherwise leave their members seated —
 	// refused a new adventure by the guard, and told "no active expedition" by
 	// the very command the guard points them at. The exit has to see every state
 	// the gate sees. It already excludes leaders, so they fall through below.
-	seated, err := seatedExpeditionFor(ctx.Sender)
+	seated, err := seatedExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return err
 	}
 	if seated != nil {
-		return p.leaveSeatedParty(ctx, seated)
+		return p.leaveSeatedParty(uid, seated)
 	}

-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return err
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition.")
+		return refuseAdv(errLeaveNothing, "No active expedition.")
 	}
 	if isLeader {
-		return p.SendDM(ctx.Sender,
+		return refuseAdv(errLeaveIsLeader,
 			"You're leading this one — `!extract` ends it for everyone, or `!expedition abandon` to walk away from it.")
 	}
-	return p.leaveSeatedParty(ctx, exp)
+	return p.leaveSeatedParty(uid, exp)
 }

-// leaveSeatedParty unseats a member and tells both ends. Shared by the two ways
-// a member's seat resolves: the `extracting` limbo and the plain active party.
-func (p *AdventurePlugin) leaveSeatedParty(ctx MessageContext, exp *Expedition) error {
-	if err := leaveParty(exp.ID, ctx.Sender); err != nil {
+// expeditionCmdLeave walks a member out. The leader cannot leave — their row is
+// the expedition — so they are pointed at `!extract`, which ends it for all.
+func (p *AdventurePlugin) expeditionCmdLeave(ctx MessageContext) error {
+	if err := p.performExpeditionLeave(ctx.Sender); err != nil {
+		var refusal advRefusal
+		if errors.As(err, &refusal) {
+			return p.SendDM(ctx.Sender, refusal.Error())
+		}
 		return p.SendDM(ctx.Sender, "Couldn't leave: "+err.Error())
 	}
+	return p.SendDM(ctx.Sender, "You turn back for town. Your supplies stay with the party.")
+}
+
+// leaveSeatedParty unseats a member and tells the leader. Shared by the two ways
+// a member's seat resolves: the `extracting` limbo and the plain active party.
+// The *member's* own confirmation is the caller's, because that is the one line
+// that differs between a DM and a web verdict.
+func (p *AdventurePlugin) leaveSeatedParty(uid id.UserID, exp *Expedition) error {
+	if err := leaveParty(exp.ID, uid); err != nil {
+		return err
+	}
 	// Supplies stay in the pool. They were spent on the expedition, not lent to
 	// it, and clawing them back would let a member starve the party on their way
 	// out of the door.
 	_ = p.SendDM(id.UserID(exp.UserID), fmt.Sprintf(
-		"**%s** turned back. Their supplies stay with the party.", p.DisplayName(ctx.Sender)))
-	return p.SendDM(ctx.Sender, "You turn back for town. Your supplies stay with the party.")
+		"**%s** turned back. Their supplies stay with the party.", p.DisplayName(uid)))
+	return nil
 }
@@ -136,6 +136,30 @@ func (s *SimRunner) BuildCharacter(uid id.UserID, class DnDClass, level int) (*D
 	return c, nil
 }

+// SeedPostgameUnlock makes the synthetic user satisfy postgameUnlocked's
+// T5-clear gate by writing two completed, boss-defeated dnd_expedition rows
+// (dragons_lair + abyss_portal) into the sim's throwaway DB. Without this the
+// P1 gate in startZoneRun rejects every T6 zone ("did not persist after start")
+// and the sim can't reach post-game content. Sim/test-only — the live gate is
+// unchanged. Idempotent enough for a fresh per-run DB; call once after
+// BuildCharacter/PrepareRealCharacter when the target zone IsPostgameZone.
+func (s *SimRunner) SeedPostgameUnlock(uid id.UserID) error {
+	for i, z := range []ZoneID{ZoneDragonsLair, ZoneAbyssPortal} {
+		if _, err := db.Get().Exec(
+			`INSERT INTO dnd_expedition (expedition_id, user_id, zone_id, status, boss_defeated)
+			 VALUES (?, ?, ?, ?, 1)`,
+			fmt.Sprintf("sim-unlock-%s-%d", uid, i), string(uid), string(z), ExpeditionStatusComplete,
+		); err != nil {
+			return fmt.Errorf("seed T5 clear %s: %w", z, err)
+		}
+	}
+	return nil
+}
+
+// IsPostgameZone exports the T6 predicate so the sim binary (a separate
+// package) can decide whether to call SeedPostgameUnlock before a run.
+func IsPostgameZone(id ZoneID) bool { return isPostgameZone(id) }
+
 // PrepareRealCharacter readies an already-persisted character (loaded from a
 // copy of the prod DB) for a headless run. Unlike BuildCharacter it fabricates
 // nothing: the character keeps its real race/class/subclass/level, ability
@@ -294,8 +318,16 @@ func applyClassBaselineStats(c *DnDCharacter) {
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 16, 13, 15, 8, 12, 10
 	case ClassRogue, ClassRanger:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 10, 16, 14, 12, 13, 8
-	case ClassMage, ClassSorcerer:
+	case ClassMage:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 8, 14, 13, 16, 12, 10
+	case ClassSorcerer:
+		// Sorcerer is a CHA caster (spellcastingMod → CHA), so its 16 goes in
+		// CHA, not INT. Previously it shared the Mage's INT-heavy array, which
+		// left the synthetic sorcerer casting at CHA mod 0 — every CHA-scaled
+		// ability (cantrip, Innate Sorcery, spell DCs) ran crippled and sorc
+		// trailed the field in every sweep. Prod players always placed 16 in
+		// CHA; this makes the sim's sorcerer match a real one.
+		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 8, 14, 13, 10, 12, 16
 	case ClassCleric, ClassDruid:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 12, 10, 14, 8, 16, 13
 	case ClassBard, ClassWarlock:
@@ -98,6 +98,75 @@ func TestSeatParty_RefusedFollowerHaltsTheRun(t *testing.T) {
 	}
 }

+// Regression: a party could never seat a follower into a Tier 6 post-game
+// zone. expeditionCmdAccept ran the plain zoneOpenToLevel level gate first, and
+// T6 zones are excluded from zonesForLevel by design, so every unlocked member
+// was refused ("beyond you for now") before the post-game check could admit
+// them. The intended party-only endgame was unreachable. The fix routes T6
+// zones through postgameUnlocked instead of the level gate.
+func TestSeatParty_PostgameZoneSeatsUnlockedMembers(t *testing.T) {
+	setupZoneRunTestDB(t)
+	s := newPartySimRunner()
+
+	leader := id.UserID("@sim-pg-ok:example")
+	member := id.UserID("@sim-pg-ok-m1:example")
+	for _, u := range []id.UserID{leader, member} {
+		if _, err := s.BuildCharacter(u, ClassFighter, postgameLevelFloor+2); err != nil {
+			t.Fatalf("build %s: %v", u, err)
+		}
+		s.Euro.Credit(u, 50000, "test")
+		if err := s.SeedPostgameUnlock(u); err != nil {
+			t.Fatalf("seed unlock %s: %v", u, err)
+		}
+	}
+	defer cleanupExpeditions(leader)
+
+	ctx := MessageContext{Sender: leader}
+	if err := s.P.handleDnDExpeditionCmd(ctx, "start "+string(ZoneOssuaryAscendant)+" heavy"); err != nil {
+		t.Fatalf("start T6 expedition: %v", err)
+	}
+	if err := s.seatParty(leader, []id.UserID{member}); err != nil {
+		t.Fatalf("seatParty refused an unlocked member into a T6 zone: %v", err)
+	}
+	exp, _ := getActiveExpedition(leader)
+	if exp == nil {
+		t.Fatal("expedition vanished while seating")
+	}
+	if size, err := partySize(exp.ID); err != nil || size != 2 {
+		t.Fatalf("roster = %d (%v), want 2 (leader + 1 unlocked member)", size, err)
+	}
+}
+
+// The post-game gate must still refuse a member who has NOT beaten both T5
+// bosses, even in a party: no smuggling an ungated seat into a T6 zone. The
+// leader is unlocked (so the expedition starts); the member is not.
+func TestSeatParty_PostgameZoneRefusesUngatedMember(t *testing.T) {
+	setupZoneRunTestDB(t)
+	s := newPartySimRunner()
+
+	leader := id.UserID("@sim-pg-gate:example")
+	member := id.UserID("@sim-pg-gate-m1:example")
+	for _, u := range []id.UserID{leader, member} {
+		if _, err := s.BuildCharacter(u, ClassFighter, postgameLevelFloor+2); err != nil {
+			t.Fatalf("build %s: %v", u, err)
+		}
+		s.Euro.Credit(u, 50000, "test")
+	}
+	// Only the leader clears the T5 gate; the member stays ungated.
+	if err := s.SeedPostgameUnlock(leader); err != nil {
+		t.Fatalf("seed leader unlock: %v", err)
+	}
+	defer cleanupExpeditions(leader)
+
+	ctx := MessageContext{Sender: leader}
+	if err := s.P.handleDnDExpeditionCmd(ctx, "start "+string(ZoneOssuaryAscendant)+" heavy"); err != nil {
+		t.Fatalf("start T6 expedition: %v", err)
+	}
+	if err := s.seatParty(leader, []id.UserID{member}); err == nil {
+		t.Fatal("seatParty admitted an ungated member into a T6 zone")
+	}
+}
+
 // A misspelled -class / -party-classes token used to build a character at the
 // unknown-class fallback — 1 HP — and the run reported a perfectly normal
 // outcome for it. Nothing downstream treats an unknown class as an error, so
@@ -856,9 +856,7 @@ func (p *HangmanPlugin) handleSubmit(ctx MessageContext, phrase string) error {
 	}

 	// LLM screening
-	ollamaHost := os.Getenv("OLLAMA_HOST")
-	ollamaModel := os.Getenv("OLLAMA_MODEL")
-	if ollamaHost == "" || ollamaModel == "" {
+	if !llmConfigured() {
 		// No LLM available — add directly
 		if err := p.addPhrase(phrase); err != nil {
 			if err.Error() == "duplicate phrase" {
@@ -879,7 +877,7 @@ or

 Phrase: %s`, phrase)

-	result, err := callOllama(ollamaHost, ollamaModel, prompt)
+	result, err := callLLM(prompt)
 	if err != nil {
 		slog.Error("hangman: LLM screening failed", "err", err)
 		// Fail open — add it
@@ -1,24 +1,24 @@
 package plugin

 import (
-	"bytes"
-	"encoding/json"
+	"context"
 	"fmt"
-	"io"
 	"log/slog"
-	"net/http"
-	"os"
 	"regexp"
 	"strings"
 	"time"

 	"gogobee/internal/db"
+	"gogobee/internal/llm"

 	"github.com/chehsunliu/poker"
 	"maunium.net/go/mautrix/id"
 )

-var holdemTipsClient = &http.Client{Timeout: 60 * time.Second}
+// holdemTipTimeout preserves the 60s budget the tip rewriter's own http.Client
+// enforced. Tips are delivered as private messages during a hand, so this sits
+// between the passive 30s paths and the interactive 120s default.
+const holdemTipTimeout = 60 * time.Second

 // loadTipsPref loads a user's tip preference from the database.
 func loadTipsPref(userID id.UserID) bool {
@@ -491,11 +491,8 @@ func cardSuitIndex(c poker.Card) int {
 func generateTip(ctx holdemTipContext) string {
 	base := generateRulesTip(ctx)

-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-
-	if host != "" && model != "" {
-		rewritten, err := rewriteTipWithLLM(host, model, ctx, base)
+	if llmConfigured() {
+		rewritten, err := rewriteTipWithLLM(ctx, base)
 		if err != nil {
 			slog.Warn("holdem: LLM tip rewrite failed, using rules tip", "err", err)
 		} else if rewritten != "" {
@@ -626,40 +623,19 @@ func buildTipUserPrompt(ctx holdemTipContext) string {
 // variety. The rules tip is the source of truth — if the rewrite diverges
 // (empty, action vocabulary changed, etc.) we reject it and the caller falls
 // back to the original.
-func rewriteTipWithLLM(host, model string, ctx holdemTipContext, base string) (string, error) {
+func rewriteTipWithLLM(ctx holdemTipContext, base string) (string, error) {
 	userMsg := buildTipUserPrompt(ctx) + "\nTIP:\n" + base + "\n"
-	req := ollamaChatRequest{
-		Model: model,
-		Messages: []chatMessage{
-			{Role: "system", Content: buildTipSystemPrompt()},
-			{Role: "user", Content: userMsg},
-		},
-		Stream: false,
-	}

-	body, err := json.Marshal(req)
+	raw, err := llmGenerate(context.Background(), llm.Request{
+		System:  buildTipSystemPrompt(),
+		Prompt:  userMsg,
+		Timeout: holdemTipTimeout,
+	})
 	if err != nil {
-		return "", fmt.Errorf("marshal: %w", err)
+		return "", err
 	}

-	url := strings.TrimRight(host, "/") + "/api/chat"
-	resp, err := holdemTipsClient.Post(url, "application/json", bytes.NewReader(body))
-	if err != nil {
-		return "", fmt.Errorf("request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp.Body)
-		return "", fmt.Errorf("status %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	var ollamaResp ollamaChatResponse
-	if err := json.NewDecoder(resp.Body).Decode(&ollamaResp); err != nil {
-		return "", fmt.Errorf("decode: %w", err)
-	}
-
-	tip := extractTipFromResponse(ollamaResp.Message.Content)
+	tip := extractTipFromResponse(raw)
 	if tip == "" {
 		return "", fmt.Errorf("empty response")
 	}
@@ -1,18 +1,15 @@
 package plugin

 import (
-	"bytes"
+	"context"
 	"database/sql"
-	"encoding/json"
 	"fmt"
-	"io"
 	"log/slog"
-	"net/http"
 	"os"
 	"strings"
-	"time"

 	"gogobee/internal/db"
+	"gogobee/internal/llm"

 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/id"
@@ -47,9 +44,7 @@ func (p *HowAmIPlugin) OnMessage(ctx MessageContext) error {
 		return nil
 	}

-	ollamaHost := os.Getenv("OLLAMA_HOST")
-	ollamaModel := os.Getenv("OLLAMA_MODEL")
-	if ollamaHost == "" || ollamaModel == "" {
+	if !llmConfigured() {
 		return p.SendReply(ctx.RoomID, ctx.EventID, "LLM is not configured.")
 	}

@@ -84,9 +79,9 @@ Write the roast now. Do not include any preamble or explanation, just the roast
 			botName, string(target), profile,
 		)

-		response, err := callOllama(ollamaHost, ollamaModel, prompt)
+		response, err := callLLM(prompt)
 		if err != nil {
-			slog.Error("howami: ollama call", "err", err)
+			slog.Error("howami: llm call", "err", err)
 			p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't generate the profile. Thanks, Ollama.")
 			return
 		}
@@ -181,55 +176,13 @@ func (p *HowAmIPlugin) gatherProfile(userID id.UserID) string {
 	return sb.String()
 }

-// callOllama sends a prompt to the Ollama generate endpoint and returns the response.
-func callOllama(host, model, prompt string) (string, error) {
-	apiURL := strings.TrimRight(host, "/") + "/api/generate"
-
-	payload := map[string]interface{}{
-		"model":  model,
-		"prompt": prompt,
-		"stream": false,
-		"think":  false,
-		"options": map[string]interface{}{
-			"num_ctx": 8192,
-		},
-	}
-
-	data, err := json.Marshal(payload)
-	if err != nil {
-		return "", fmt.Errorf("marshal payload: %w", err)
-	}
-
-	client := &http.Client{Timeout: 120 * time.Second}
-	resp, err := client.Post(apiURL, "application/json", bytes.NewReader(data))
-	if err != nil {
-		return "", fmt.Errorf("ollama request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return "", fmt.Errorf("read response: %w", err)
-	}
-
-	if resp.StatusCode != 200 {
-		return "", fmt.Errorf("ollama HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result struct {
-		Response string `json:"response"`
-	}
-	if err := json.Unmarshal(body, &result); err != nil {
-		return "", fmt.Errorf("parse response: %w", err)
-	}
-
-	response := result.Response
-	// Strip <think>...</think> blocks (Qwen 3.5 reasoning)
-	if i := strings.Index(response, "<think>"); i != -1 {
-		if j := strings.Index(response, "</think>"); j != -1 {
-			response = response[:i] + response[j+len("</think>"):]
-		}
-	}
-
-	return strings.TrimSpace(response), nil
+// callLLM sends a prompt to whichever backend is configured and returns the
+// completion. Reasoning blocks are stripped by the client. The 8192 context
+// hint is what this path has always asked Ollama for; vLLM ignores it and uses
+// the window fixed at server launch.
+func callLLM(prompt string) (string, error) {
+	return llmGenerate(context.Background(), llm.Request{
+		Prompt: prompt,
+		NumCtx: 8192,
+	})
 }
@@ -0,0 +1,45 @@
+package plugin
+
+import (
+	"context"
+	"sync"
+
+	"gogobee/internal/llm"
+)
+
+// The inference backend is process-wide: one endpoint, one model, selected by
+// env at startup. Plugins share a single client rather than each rebuilding one
+// per invocation, and read config through llmConfigured/llmGenerate so that
+// swapping Ollama for vLLM is a config change rather than a code change.
+var (
+	llmOnce   sync.Once
+	llmShared llm.Client
+	llmCfg    llm.Config
+)
+
+func llmInit() {
+	llmOnce.Do(func() {
+		llmCfg = llm.ConfigFromEnv()
+		llmShared = llm.New(llmCfg)
+	})
+}
+
+// llmConfigured reports whether an endpoint and model are set. Plugins call
+// this to stay dormant instead of erroring on every invocation — the same role
+// the old `if ollamaHost == "" || ollamaModel == ""` guards played.
+func llmConfigured() bool {
+	llmInit()
+	return llmCfg.Configured()
+}
+
+// llmClient returns the shared backend client.
+func llmClient() llm.Client {
+	llmInit()
+	return llmShared
+}
+
+// llmGenerate is the one-line path for the common case: a raw prompt in,
+// visible completion out, reasoning blocks already stripped.
+func llmGenerate(ctx context.Context, req llm.Request) (string, error) {
+	return llmClient().Generate(ctx, req)
+}
@@ -1,13 +1,11 @@
 package plugin

 import (
-	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"log/slog"
 	"math/rand"
-	"net/http"
 	"os"
 	"regexp"
 	"strconv"
@@ -18,6 +16,7 @@ import (

 	"gogobee/internal/db"
 	"gogobee/internal/dreamclient"
+	"gogobee/internal/llm"

 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/id"
@@ -54,29 +53,31 @@ type queueItem struct {
 	FormattedBody string
 }

-// LLMPassivePlugin classifies messages using Ollama and reacts accordingly.
+// classifyTimeout is the per-message budget for passive classification. It
+// preserves the 30s cap the plugin's own http.Client used to enforce, which is
+// deliberately tighter than the interactive default: classification runs on
+// sampled traffic and must never back up the queue.
+const classifyTimeout = 30 * time.Second
+
+// LLMPassivePlugin classifies messages using the configured LLM backend and
+// reacts accordingly.
 type LLMPassivePlugin struct {
 	Base
-	xp          *XPPlugin
-	dict        *dreamclient.Client
-	ollamaHost  string
-	ollamaModel string
-	sampleRate  float64
-	enabled     bool
+	xp         *XPPlugin
+	dict       *dreamclient.Client
+	sampleRate float64
+	enabled    bool

 	mu      sync.Mutex
 	queue   []queueItem
 	backoff time.Duration

-	httpClient *http.Client
-	stopCh     chan struct{}
+	stopCh chan struct{}
 }

 // NewLLMPassivePlugin creates a new LLM passive classification plugin.
 func NewLLMPassivePlugin(client *mautrix.Client, xp *XPPlugin, dict *dreamclient.Client) *LLMPassivePlugin {
-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-	enabled := host != "" && model != ""
+	enabled := llmConfigured()

 	sampleRate := 0.15
 	if v := os.Getenv("LLM_SAMPLE_RATE"); v != "" {
@@ -86,16 +87,13 @@ func NewLLMPassivePlugin(client *mautrix.Client, xp *XPPlugin, dict *dreamclient
 	}

 	p := &LLMPassivePlugin{
-		Base:        NewBase(client),
-		xp:          xp,
-		dict:        dict,
-		ollamaHost:  host,
-		ollamaModel: model,
-		sampleRate:  sampleRate,
-		enabled:     enabled,
-		backoff:     5 * time.Second,
-		httpClient:  &http.Client{Timeout: 30 * time.Second},
-		stopCh:      make(chan struct{}),
+		Base:       NewBase(client),
+		xp:         xp,
+		dict:       dict,
+		sampleRate: sampleRate,
+		enabled:    enabled,
+		backoff:    5 * time.Second,
+		stopCh:     make(chan struct{}),
 	}

 	return p
@@ -116,11 +114,11 @@ func (p *LLMPassivePlugin) Commands() []CommandDef {

 func (p *LLMPassivePlugin) Init() error {
 	if p.enabled {
-		slog.Info("llm_passive: enabled", "host", p.ollamaHost, "model", p.ollamaModel, "sample_rate", p.sampleRate)
+		slog.Info("llm_passive: enabled", "backend", llmClient().Backend(),
+			"model", llmClient().Model(), "sample_rate", p.sampleRate)
 		go p.processQueue()
 	} else {
-		slog.Warn("llm_passive: disabled (OLLAMA_HOST or OLLAMA_MODEL not set)",
-			"host", p.ollamaHost, "model", p.ollamaModel)
+		slog.Warn("llm_passive: disabled (LLM endpoint or model not set)")
 	}
 	return nil
 }
@@ -329,9 +327,9 @@ func (p *LLMPassivePlugin) classifyAndProcess(item queueItem) error {
 	var todayWOTD string
 	db.Get().QueryRow(`SELECT word FROM wotd_log WHERE date = ?`, today).Scan(&todayWOTD)

-	result, err := p.callOllama(item.Body+mentionHint, todayWOTD)
+	result, err := p.classify(item.Body+mentionHint, todayWOTD)
 	if err != nil {
-		return fmt.Errorf("ollama call: %w", err)
+		return fmt.Errorf("llm call: %w", err)
 	}

 	// Resolve any display names in LLM targets back to MXIDs
@@ -464,21 +462,9 @@ func (p *LLMPassivePlugin) classifyAndProcess(item queueItem) error {
 	return nil
 }

-// ollamaRequest is the request body for the Ollama API.
-type ollamaRequest struct {
-	Model  string `json:"model"`
-	Prompt string `json:"prompt"`
-	Stream bool   `json:"stream"`
-	Think  bool   `json:"think"`
-}
-
-// ollamaResponse is the response from the Ollama API.
-type ollamaResponse struct {
-	Response string `json:"response"`
-}
-
-// callOllama sends a classification prompt to Ollama and parses the JSON result.
-func (p *LLMPassivePlugin) callOllama(messageText, wotd string) (*classificationResult, error) {
+// classify sends a classification prompt to the configured backend and parses
+// the JSON result.
+func (p *LLMPassivePlugin) classify(messageText, wotd string) (*classificationResult, error) {
 	wotdInstruction := `"wotd_used": false`
 	if wotd != "" {
 		wotdInstruction = fmt.Sprintf(`"wotd_used": true | false (whether the message uses the word "%s" correctly and meaningfully — not just mentioning or quoting it)`, wotd)
@@ -500,36 +486,18 @@ JSON schema:

 Message: %s`, wotdInstruction, messageText)

-	reqBody := ollamaRequest{
-		Model:  p.ollamaModel,
-		Prompt: prompt,
-		Stream: false,
-	}
-
-	body, err := json.Marshal(reqBody)
+	slog.Debug("llm_passive: calling backend", "backend", llmClient().Backend(), "model", llmClient().Model())
+	// Classification rides the passive path on every sampled message, so it keeps
+	// the tighter budget it always had rather than the interactive default.
+	raw, err := llmGenerate(context.Background(), llm.Request{
+		Prompt:  prompt,
+		Timeout: classifyTimeout,
+	})
 	if err != nil {
-		return nil, fmt.Errorf("marshal request: %w", err)
+		return nil, err
 	}

-	url := strings.TrimRight(p.ollamaHost, "/") + "/api/generate"
-	slog.Debug("llm_passive: calling ollama", "url", url, "model", p.ollamaModel)
-	resp, err := p.httpClient.Post(url, "application/json", bytes.NewReader(body))
-	if err != nil {
-		return nil, fmt.Errorf("ollama request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("ollama status %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	var ollamaResp ollamaResponse
-	if err := json.NewDecoder(resp.Body).Decode(&ollamaResp); err != nil {
-		return nil, fmt.Errorf("decode ollama response: %w", err)
-	}
-
-	result, err := parseClassification(ollamaResp.Response)
+	result, err := parseClassification(raw)
 	if err != nil {
 		return nil, fmt.Errorf("parse classification: %w", err)
 	}
@@ -46,10 +46,11 @@ type MagicItem struct {
 }

 // magicItemOverlay — hand-authored magic items that win on ID collision with
-// the generated SRD dump. Empty for now: the classifier output is the starting
-// point, and corrections (or wholly new items) land here rather than being
-// edited into the generated file.
-var magicItemOverlay []MagicItem
+// the generated SRD dump. Corrections (or wholly new items) land here rather
+// than being edited into the generated file. Today it carries the T6 signature
+// items (postgame_magic_items.go); this is a plain var reference, not an init()
+// append, so it resolves before buildMagicItemRegistry() reads it.
+var magicItemOverlay = postgameSignatureMagicItems

 // magicItemRegistry is the merged lookup table: the generated SRD dump with the
 // hand-authored overlay layered on top.
@@ -1,6 +1,7 @@
 package plugin

 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"math/rand/v2"
@@ -184,9 +185,10 @@ type magicItemEffect struct {
 }

 // magicItemEffectOverlay — hand-authored per-item effects that win over the
-// codified formula. Empty for now; corrections land here rather than being
-// folded into the formula, mirroring magicItemOverlay in magic_items.go.
-var magicItemEffectOverlay = map[string]magicItemEffect{}
+// codified formula. Corrections land here rather than being folded into the
+// formula, mirroring magicItemOverlay in magic_items.go. Today it carries the
+// T6 signature items' bespoke combat numbers (postgame_magic_items.go).
+var magicItemEffectOverlay = postgameSignatureEffects

 // rarityPowerScalar is the codified power axis: rarer item, bigger delta.
 func rarityPowerScalar(r DnDRarity) float64 {
@@ -328,6 +330,42 @@ func countAttunedMagicItems(equipped map[DnDSlot]EquippedMagicItem) int {
 	return n
 }

+// reconcileMagicAttunements bonds any worn attunement item that is sitting
+// inert while a bond slot is free. Bonding is strictly beneficial (there are no
+// cursed items), so the only legitimate reason for a worn attunement item to be
+// unbonded is the hard cap — the moment a slot frees, every straggler should
+// light up. Without this, an item equipped while at cap stays permanently inert:
+// the equip picker only lists inventory, so a slotted item can never be reached
+// to re-attempt bonding. Idempotent; returns the names of items it newly bonded.
+func reconcileMagicAttunements(userID id.UserID) ([]string, error) {
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return nil, err
+	}
+	used := countAttunedMagicItems(equipped)
+	if used >= dndMagicItemAttuneLimit {
+		return nil, nil
+	}
+	var bonded []string
+	for _, ds := range dndSlotOrder { // deterministic order when slots are scarce
+		if used >= dndMagicItemAttuneLimit {
+			break
+		}
+		e, ok := equipped[ds]
+		if !ok || e.Item.ID == "" || !e.Item.Attunement || e.Attuned {
+			continue
+		}
+		if _, err := db.Get().Exec(
+			`UPDATE magic_item_equipped SET attuned = 1 WHERE user_id = ? AND slot = ?`,
+			string(userID), string(ds)); err != nil {
+			return bonded, err
+		}
+		bonded = append(bonded, e.Item.Name)
+		used++
+	}
+	return bonded, nil
+}
+
 // ── Combat hook ─────────────────────────────────────────────────────────────

 // applyMagicItemEffects layers the player's equipped magic items onto their
@@ -522,7 +560,140 @@ func magicItemEffectSummary(mi MagicItem) string {
 	return strings.Join(parts, ", ")
 }

+// The equip mutation, message-free, shared by the DM resolver above and the web
+// equip queue (pete_equip.go). Splitting it out is deliberate: the ordering below
+// — evict occupant, then remove-from-inventory *before* equip, with a rollback if
+// equip fails — is the whole defence against item duplication, and a second copy
+// of it living in the web path is exactly where that defence would silently rot.
+// One implementation, two callers.
+
+// errItemNotEquippable is a *permanent* refusal (not a magic item, or a slotless
+// curio) — the caller should reject the request, not retry it. Every other error
+// from applyMagicEquip is a transient DB fault the caller may retry.
+var errItemNotEquippable = errors.New("magic-item: not equippable")
+
+// errSlotEmpty is applyMagicUnequip's permanent refusal: nothing is in that slot.
+var errSlotEmpty = errors.New("magic-item: slot empty")
+
+// magicEquipOutcome is what an equip did, for the caller to narrate. BondsBefore
+// is the attunement count *after* any swap-eviction and *before* this item, so a
+// caller reporting "bonded (N/3)" adds one.
+type magicEquipOutcome struct {
+	Effective   MagicItem // the item as worn, tempering folded in
+	SwappedBack string    // name of the occupant sent back to inventory, or ""
+	Bonded      bool      // this item took a bond just now
+	AtCap       bool      // worn but inert: it wants a bond and all 3 are used
+	BondsBefore int       // bonds in use before this item was worn
+	Healed      []string  // stragglers a freed slot let bond, post-equip
+}
+
+// applyMagicEquip wears one inventory item, preserving the anti-duplication
+// ordering. It mutates the equipment tables and sends nothing.
+func applyMagicEquip(userID id.UserID, it AdvItem) (magicEquipOutcome, error) {
+	mi, ok := magicItemFromAdvItem(it)
+	if !ok || mi.Slot == "" {
+		return magicEquipOutcome{}, errItemNotEquippable
+	}
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return magicEquipOutcome{}, err
+	}
+
+	// Return whatever occupies that slot to inventory at full value, and drop it
+	// from the local map so the bond count below reflects the post-swap state.
+	var swappedBack string
+	if prev, exists := equipped[mi.Slot]; exists && prev.Item.ID != "" {
+		back := magicItemSellAt(prev.Item, prev.Temper)
+		back.SkillSource = "magic_item:" + prev.Item.ID
+		if err := addAdvInventoryItem(userID, back); err != nil {
+			return magicEquipOutcome{}, err
+		}
+		swappedBack = prev.Item.Name
+		delete(equipped, mi.Slot)
+	}
+
+	bondsBefore := countAttunedMagicItems(equipped)
+	bonded, atCap := false, false
+	if mi.Attunement {
+		if bondsBefore >= dndMagicItemAttuneLimit {
+			atCap = true
+		} else {
+			bonded = true
+		}
+	}
+
+	// Remove the inventory row FIRST, then equip; if equip fails, restore the row.
+	// The reverse order left a transient failure with the item both worn and in the
+	// pack — a free duplicate.
+	if err := removeAdvInventoryItem(it.ID); err != nil {
+		slog.Error("magic-item: failed to remove from inventory before equip",
+			"user", userID, "item", mi.ID, "err", err)
+		return magicEquipOutcome{}, err
+	}
+	if err := equipMagicItem(userID, mi.Slot, mi.ID, bonded, it.Temper); err != nil {
+		restored := magicItemSellAt(mi, it.Temper)
+		restored.Value = it.Value
+		restored.SkillSource = "magic_item:" + mi.ID
+		if rbErr := addAdvInventoryItem(userID, restored); rbErr != nil {
+			slog.Error("magic-item: equip failed AND inventory rollback failed",
+				"user", userID, "item", mi.ID, "equip_err", err, "rollback_err", rbErr)
+		}
+		return magicEquipOutcome{}, err
+	}
+
+	// Swapping the occupant out may have freed a bond slot — light up any straggler.
+	healed, _ := reconcileMagicAttunements(userID)
+	return magicEquipOutcome{
+		Effective:   temperedItem(mi, it.Temper),
+		SwappedBack: swappedBack,
+		Bonded:      bonded,
+		AtCap:       atCap,
+		BondsBefore: bondsBefore,
+		Healed:      healed,
+	}, nil
+}
+
+// magicUnequipOutcome is what an unequip did, for the caller to narrate.
+type magicUnequipOutcome struct {
+	Item   MagicItem // the item taken off, as it was worn
+	Healed []string  // stragglers the freed bond slot let bond
+}
+
+// applyMagicUnequip takes the item off a slot and returns it to inventory,
+// mirroring the equip ordering (destructive op first, restore on failure). Sends
+// nothing.
+func applyMagicUnequip(userID id.UserID, slot DnDSlot) (magicUnequipOutcome, error) {
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return magicUnequipOutcome{}, err
+	}
+	e, ok := equipped[slot]
+	if !ok || e.Item.ID == "" {
+		return magicUnequipOutcome{}, errSlotEmpty
+	}
+	if err := unequipMagicItem(userID, slot); err != nil {
+		return magicUnequipOutcome{}, err
+	}
+	back := magicItemSellAt(e.Item, e.Temper)
+	back.SkillSource = "magic_item:" + e.Item.ID
+	if err := addAdvInventoryItem(userID, back); err != nil {
+		if rbErr := equipMagicItem(userID, slot, e.Item.ID, e.Attuned, e.Temper); rbErr != nil {
+			slog.Error("magic-item: unequip failed AND re-equip rollback failed",
+				"user", userID, "item", e.Item.ID, "inv_err", err, "rollback_err", rbErr)
+		}
+		return magicUnequipOutcome{}, err
+	}
+	healed, _ := reconcileMagicAttunements(userID)
+	return magicUnequipOutcome{Item: e.Effective(), Healed: healed}, nil
+}
+
 func (p *AdventurePlugin) handleEquipMagicCmd(ctx MessageContext) error {
+	// Self-heal first: bond any worn item stranded inert while a slot is free
+	// (e.g. equipped at cap, then a bond slot opened). This is the only path a
+	// slotted-but-inert item can be reached from, since the picker below lists
+	// inventory only.
+	healed, _ := reconcileMagicAttunements(ctx.Sender)
+
 	items, err := loadAdvInventory(ctx.Sender)
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to access your inventory.")
@@ -538,13 +709,23 @@ func (p *AdventurePlugin) handleEquipMagicCmd(ctx MessageContext) error {
 		}
 		magic = append(magic, it)
 	}
+	healNote := ""
+	if len(healed) > 0 {
+		healNote = fmt.Sprintf("🔗 A bond slot freed up — **%s** bonded and is now active.\n\n",
+			strings.Join(healed, "**, **"))
+	}
+
 	if len(magic) == 0 {
-		return p.SendDM(ctx.Sender,
-			"No curios to equip yet — they drop from zones or Luigi's 🔮 shelf.")
+		msg := "No curios to equip yet — they drop from zones or Luigi's 🔮 shelf."
+		if healNote != "" {
+			msg = strings.TrimSpace(healNote)
+		}
+		return p.SendDM(ctx.Sender, msg)
 	}

 	equipped, _ := loadEquippedMagicItems(ctx.Sender)
 	var sb strings.Builder
+	sb.WriteString(healNote)
 	sb.WriteString("🔮 **Equippable magic items:**\n\n")
 	for i, it := range magic {
 		base, _ := magicItemFromAdvItem(it)
@@ -586,78 +767,108 @@ func (p *AdventurePlugin) resolveMagicEquipReply(ctx MessageContext, interaction
 	}

 	it := data.Items[idx]
-	mi, ok := magicItemFromAdvItem(it)
-	if !ok || mi.Slot == "" {
+	out, err := applyMagicEquip(ctx.Sender, it)
+	if errors.Is(err, errItemNotEquippable) {
 		return p.SendDM(ctx.Sender, "That item can't be equipped anymore.")
 	}
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Failed to equip that item.")
+	}

+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("✨ **%s** equipped in your %s slot — %s.",
+		out.Effective.Name, out.Effective.Slot, magicItemEffectSummary(out.Effective)))
+	if out.SwappedBack != "" {
+		sb.WriteString(fmt.Sprintf("\n📦 **%s** moved back to inventory.", out.SwappedBack))
+	}
+	switch {
+	case out.Bonded:
+		sb.WriteString(fmt.Sprintf("\nBonded (%d/%d bond slots used).",
+			out.BondsBefore+1, dndMagicItemAttuneLimit))
+	case out.AtCap:
+		sb.WriteString(fmt.Sprintf("\n⚠️ All %d bond slots are full — it's worn but **inert** until you free one (`!adventure unequip-magic` to take a bonded item off; this one bonds automatically once a slot opens).",
+			dndMagicItemAttuneLimit))
+	}
+	if len(out.Healed) > 0 {
+		sb.WriteString(fmt.Sprintf("\n🔗 A freed bond slot also activated **%s**.",
+			strings.Join(out.Healed, "**, **")))
+	}
+	return p.SendDM(ctx.Sender, sb.String())
+}
+
+// ── Unequip command (`!adventure unequip-magic`) ─────────────────────────────
+
+// advPendingMagicUnequip is the pending-interaction payload for the numbered
+// unequip picker. It lists slots (not inventory rows) because the item lives in
+// magic_item_equipped, not adventure_inventory.
+type advPendingMagicUnequip struct {
+	Slots []DnDSlot
+}
+
+func (p *AdventurePlugin) handleUnequipMagicCmd(ctx MessageContext) error {
 	equipped, err := loadEquippedMagicItems(ctx.Sender)
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to load your equipped magic items.")
 	}
-
-	// Return whatever currently occupies that slot to inventory at full
-	// value — swapping a curio shouldn't tax it. Evict from the local map
-	// too, so the attunement count below reflects the post-swap state and
-	// can re-open a slot the prior occupant was holding.
-	var swappedBackName string
-	if prev, exists := equipped[mi.Slot]; exists && prev.Item.ID != "" {
-		back := magicItemSellAt(prev.Item, prev.Temper)
-		back.SkillSource = "magic_item:" + prev.Item.ID
-		if err := addAdvInventoryItem(ctx.Sender, back); err != nil {
-			return p.SendDM(ctx.Sender, "Failed to return your currently-equipped item to inventory.")
-		}
-		swappedBackName = prev.Item.Name
-		delete(equipped, mi.Slot)
-	}
-
-	// Auto-attune when the item needs it and an attunement slot is free.
-	// Otherwise it equips inert until the player frees a slot.
-	attune := false
-	atCap := false
-	if mi.Attunement {
-		if countAttunedMagicItems(equipped) >= dndMagicItemAttuneLimit {
-			atCap = true
-		} else {
-			attune = true
-		}
-	}
-	// Remove the inventory row FIRST, then equip. If equip fails after the
-	// remove succeeded, restore inventory. Doing it in the other order
-	// meant a transient DB error on remove left the item both equipped
-	// *and* still in inventory — a free duplication.
-	if err := removeAdvInventoryItem(it.ID); err != nil {
-		slog.Error("magic-item: failed to remove from inventory before equip",
-			"user", ctx.Sender, "item", mi.ID, "err", err)
-		return p.SendDM(ctx.Sender, "Failed to equip that item.")
-	}
-	if err := equipMagicItem(ctx.Sender, mi.Slot, mi.ID, attune, it.Temper); err != nil {
-		// Roll back: try to put the item back in inventory so the player
-		// doesn't lose it. Best-effort; log if the rollback also fails.
-		restored := magicItemSellAt(mi, it.Temper)
-		restored.Value = it.Value
-		restored.SkillSource = "magic_item:" + mi.ID
-		if rbErr := addAdvInventoryItem(ctx.Sender, restored); rbErr != nil {
-			slog.Error("magic-item: equip failed AND inventory rollback failed",
-				"user", ctx.Sender, "item", mi.ID, "equip_err", err, "rollback_err", rbErr)
-		}
-		return p.SendDM(ctx.Sender, "Failed to equip that item.")
-	}
-
-	eqMI := temperedItem(mi, it.Temper)
 	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("✨ **%s** equipped in your %s slot — %s.",
-		eqMI.Name, eqMI.Slot, magicItemEffectSummary(eqMI)))
-	if swappedBackName != "" {
-		sb.WriteString(fmt.Sprintf("\n📦 **%s** moved back to inventory.", swappedBackName))
+	sb.WriteString("🔮 **Worn magic items** — reply with a number to take one off (it returns to your inventory), or \"cancel\".\n\n")
+	var slots []DnDSlot
+	for _, ds := range dndSlotOrder { // stable numbering across repeated calls
+		e, ok := equipped[ds]
+		if !ok || e.Item.ID == "" {
+			continue
+		}
+		slots = append(slots, ds)
+		mi := e.Effective()
+		status := ""
+		if mi.Attunement {
+			if e.Attuned {
+				status = " — bonded"
+			} else {
+				status = " — _(inert)_"
+			}
+		}
+		sb.WriteString(fmt.Sprintf("%d. **%s** _(%s)_ → %s slot%s\n",
+			len(slots), mi.Name, mi.Rarity, ds, status))
 	}
-	switch {
-	case mi.Attunement && attune:
-		sb.WriteString(fmt.Sprintf("\nBonded (%d/%d bond slots used).",
-			countAttunedMagicItems(equipped)+1, dndMagicItemAttuneLimit))
-	case mi.Attunement && atCap:
-		sb.WriteString(fmt.Sprintf("\n⚠️ All %d bond slots are full — it's worn but **inert** until you free one (`!adventure equip-magic` to swap).",
-			dndMagicItemAttuneLimit))
+	if len(slots) == 0 {
+		return p.SendDM(ctx.Sender, "You aren't wearing any magic items. `!adventure equip-magic` to put one on.")
 	}
+
+	p.pending.Store(string(ctx.Sender), &advPendingInteraction{
+		Type:      "magic_unequip",
+		Data:      &advPendingMagicUnequip{Slots: slots},
+		ExpiresAt: time.Now().Add(advDMResponseWindow),
+	})
 	return p.SendDM(ctx.Sender, sb.String())
 }
+
+func (p *AdventurePlugin) resolveMagicUnequipReply(ctx MessageContext, interaction *advPendingInteraction) error {
+	data := interaction.Data.(*advPendingMagicUnequip)
+	reply := strings.TrimSpace(ctx.Body)
+	if strings.EqualFold(reply, "cancel") {
+		return p.SendDM(ctx.Sender, "Unequip cancelled.")
+	}
+	idx, ok := parseMenuIndex(reply, len(data.Slots))
+	if !ok {
+		p.pending.Store(string(ctx.Sender), interaction)
+		return p.SendDM(ctx.Sender, "Invalid selection. Reply with a number from the list, or \"cancel\".")
+	}
+
+	slot := data.Slots[idx]
+	out, err := applyMagicUnequip(ctx.Sender, slot)
+	if errors.Is(err, errSlotEmpty) {
+		return p.SendDM(ctx.Sender, "That slot is already empty.")
+	}
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Failed to take that item off.")
+	}
+
+	msg := fmt.Sprintf("📦 **%s** taken off your %s slot and returned to inventory.", out.Item.Name, slot)
+	// Freeing a bonded slot may let a worn-but-inert item finally bond.
+	if len(out.Healed) > 0 {
+		msg += fmt.Sprintf("\n🔗 That freed a bond slot — **%s** is now active.",
+			strings.Join(out.Healed, "**, **"))
+	}
+	return p.SendDM(ctx.Sender, msg)
+}
@@ -252,6 +252,152 @@ func TestSwapBackReturnsFullValue(t *testing.T) {
 	}
 }

+// TestReconcileBondsStrandedItem reproduces the player report: an attunement
+// item equipped while at the bond cap sits inert, then a bond slot frees up.
+// The item is worn (not in inventory) so the equip picker can never reach it —
+// reconcile must be what lights it up.
+func TestReconcileBondsStrandedItem(t *testing.T) {
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+
+	user := id.UserID("@stranded:test.invalid")
+
+	// Gather attunement items in distinct slots — need cap+1 of them.
+	seen := map[DnDSlot]bool{}
+	var att []MagicItem
+	for _, ds := range dndSlotOrder {
+		for _, mi := range magicItemRegistry {
+			if mi.Attunement && mi.Slot == ds && !seen[ds] {
+				att = append(att, mi)
+				seen[ds] = true
+			}
+		}
+	}
+	if len(att) < dndMagicItemAttuneLimit+1 {
+		t.Skipf("registry has only %d attunement slots, need %d", len(att), dndMagicItemAttuneLimit+1)
+	}
+
+	// Bond the first `limit` items, then wear one more inert (attuned=false).
+	for i := 0; i < dndMagicItemAttuneLimit; i++ {
+		if err := equipMagicItem(user, att[i].Slot, att[i].ID, true, 0); err != nil {
+			t.Fatalf("bond seed %d: %v", i, err)
+		}
+	}
+	stranded := att[dndMagicItemAttuneLimit]
+	if err := equipMagicItem(user, stranded.Slot, stranded.ID, false, 0); err != nil {
+		t.Fatalf("equip stranded: %v", err)
+	}
+
+	// At cap, reconcile must be a no-op — the stranded item stays inert.
+	if healed, err := reconcileMagicAttunements(user); err != nil || len(healed) != 0 {
+		t.Fatalf("reconcile at cap = %v (err %v), want no change", healed, err)
+	}
+
+	// Free a slot (the player swaps out a bonded item), then reconcile.
+	if err := unequipMagicItem(user, att[0].Slot); err != nil {
+		t.Fatalf("free slot: %v", err)
+	}
+	healed, err := reconcileMagicAttunements(user)
+	if err != nil {
+		t.Fatalf("reconcile after free: %v", err)
+	}
+	if len(healed) != 1 || healed[0] != stranded.Name {
+		t.Fatalf("reconcile healed %v, want [%s]", healed, stranded.Name)
+	}
+
+	equipped, _ := loadEquippedMagicItems(user)
+	if !equipped[stranded.Slot].Attuned {
+		t.Errorf("stranded item still inert after reconcile")
+	}
+	if got := countAttunedMagicItems(equipped); got != dndMagicItemAttuneLimit {
+		t.Errorf("bonded count = %d, want %d", got, dndMagicItemAttuneLimit)
+	}
+
+	// Idempotent: a second pass changes nothing.
+	if healed, _ := reconcileMagicAttunements(user); len(healed) != 0 {
+		t.Errorf("second reconcile healed %v, want none", healed)
+	}
+}
+
+// TestUnequipMagicReturnsToInventoryAndHeals drives the unequip resolver end to
+// end: taking a bonded item off must return it to inventory AND free its bond
+// slot so a worn-but-inert item lights up.
+func TestUnequipMagicReturnsToInventoryAndHeals(t *testing.T) {
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+
+	user := id.UserID("@unequip:test.invalid")
+
+	seen := map[DnDSlot]bool{}
+	var att []MagicItem
+	for _, ds := range dndSlotOrder {
+		for _, mi := range magicItemRegistry {
+			if mi.Attunement && mi.Slot == ds && !seen[ds] {
+				att = append(att, mi)
+				seen[ds] = true
+			}
+		}
+	}
+	if len(att) < dndMagicItemAttuneLimit+1 {
+		t.Skipf("registry has only %d attunement slots, need %d", len(att), dndMagicItemAttuneLimit+1)
+	}
+
+	// Bond the cap, then wear one more inert.
+	for i := 0; i < dndMagicItemAttuneLimit; i++ {
+		if err := equipMagicItem(user, att[i].Slot, att[i].ID, true, 0); err != nil {
+			t.Fatalf("bond seed %d: %v", i, err)
+		}
+	}
+	stranded := att[dndMagicItemAttuneLimit]
+	if err := equipMagicItem(user, stranded.Slot, stranded.ID, false, 0); err != nil {
+		t.Fatalf("equip stranded: %v", err)
+	}
+
+	p := &AdventurePlugin{} // nil Sink/Client → SendDM is a no-op
+	interaction := &advPendingInteraction{
+		Type: "magic_unequip",
+		Data: &advPendingMagicUnequip{Slots: []DnDSlot{att[0].Slot}},
+	}
+	if err := p.resolveMagicUnequipReply(MessageContext{Sender: user, Body: "1"}, interaction); err != nil {
+		t.Fatalf("resolve unequip: %v", err)
+	}
+
+	// The unequipped item is back in inventory as a curio.
+	inv, err := loadAdvInventory(user)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, it := range inv {
+		if it.SkillSource == "magic_item:"+att[0].ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("unequipped item %q not returned to inventory", att[0].ID)
+	}
+
+	// Its slot is empty, and the freed bond slot bonded the stranded item.
+	equipped, _ := loadEquippedMagicItems(user)
+	if _, still := equipped[att[0].Slot]; still {
+		t.Errorf("slot %s still occupied after unequip", att[0].Slot)
+	}
+	if !equipped[stranded.Slot].Attuned {
+		t.Errorf("stranded item did not bond after a slot freed")
+	}
+	if got := countAttunedMagicItems(equipped); got != dndMagicItemAttuneLimit {
+		t.Errorf("bonded count = %d, want %d", got, dndMagicItemAttuneLimit)
+	}
+}
+
 // TestEquippedMagicItemRoundTrip exercises the DB persistence layer: equip,
 // load, attunement counting, unequip.
 func TestEquippedMagicItemRoundTrip(t *testing.T) {
@@ -1,10 +1,9 @@
 package plugin

 import (
-	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"log/slog"
 	"math"
 	"net/http"
@@ -15,6 +14,7 @@ import (
 	"time"

 	"gogobee/internal/db"
+	"gogobee/internal/llm"

 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/id"
@@ -311,9 +311,7 @@ Do not use em dashes. Do not use exclamation marks. Do not offer financial advic
 If markets are closed or data is stale, note it briefly and move on.`

 func (p *MarketPlugin) generateDailySummary(date string) string {
-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-	if host == "" || model == "" {
+	if !llmConfigured() {
 		return ""
 	}

@@ -349,7 +347,7 @@ func (p *MarketPlugin) generateDailySummary(date string) string {
 	}
 	prompt.WriteString("\nWrite a 2-3 sentence summary.")

-	result, err := p.callOllamaChat(host, model, marketSystemPrompt, prompt.String())
+	result, err := p.chatLLM(marketSystemPrompt, prompt.String())
 	if err != nil {
 		slog.Error("market: ollama summary failed", "err", err)
 		return ""
@@ -358,9 +356,7 @@ func (p *MarketPlugin) generateDailySummary(date string) string {
 }

 func (p *MarketPlugin) generateReportSummary(snapsByDate map[string][]marketSnapshot, dateRange string) string {
-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-	if host == "" || model == "" {
+	if !llmConfigured() {
 		return ""
 	}

@@ -395,7 +391,7 @@ func (p *MarketPlugin) generateReportSummary(snapsByDate map[string][]marketSnap
 	}
 	prompt.WriteString("\nDescribe the trend in 2-3 sentences. Note any significant moves or divergences between indices.\nBe sardonic but accurate. Reference the VIX trajectory when relevant.")

-	result, err := p.callOllamaChat(host, model, marketSystemPrompt, prompt.String())
+	result, err := p.chatLLM(marketSystemPrompt, prompt.String())
 	if err != nil {
 		slog.Warn("market: ollama report summary failed", "err", err)
 		return ""
@@ -403,49 +399,14 @@ func (p *MarketPlugin) generateReportSummary(snapsByDate map[string][]marketSnap
 	return result
 }

-// callOllamaChat calls the Ollama /api/chat endpoint with a system and user message.
-// Uses the types already defined in holdem_tips.go (same package).
-func (p *MarketPlugin) callOllamaChat(host, model, systemPrompt, userPrompt string) (string, error) {
-	req := ollamaChatRequest{
-		Model: model,
-		Messages: []chatMessage{
-			{Role: "system", Content: systemPrompt},
-			{Role: "user", Content: userPrompt},
-		},
-		Stream: false,
-	}
-
-	body, err := json.Marshal(req)
-	if err != nil {
-		return "", fmt.Errorf("marshal: %w", err)
-	}
-
-	url := strings.TrimRight(host, "/") + "/api/chat"
-	resp, err := p.httpClient.Post(url, "application/json", bytes.NewReader(body))
-	if err != nil {
-		return "", fmt.Errorf("request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp.Body)
-		return "", fmt.Errorf("status %d: %s", resp.StatusCode, string(respBody))
-	}
-
-	var ollamaResp ollamaChatResponse
-	if err := json.NewDecoder(resp.Body).Decode(&ollamaResp); err != nil {
-		return "", fmt.Errorf("decode: %w", err)
-	}
-
-	text := ollamaResp.Message.Content
-	// Strip <think>...</think> blocks (reasoning models)
-	if i := strings.Index(text, "<think>"); i != -1 {
-		if j := strings.Index(text, "</think>"); j != -1 {
-			text = text[:i] + text[j+len("</think>"):]
-		}
-	}
-
-	return strings.TrimSpace(text), nil
+// chatLLM sends a system+user pair to the configured backend. Both backends
+// map this onto their own chat shape, so the market summaries read the same
+// whichever one is serving.
+func (p *MarketPlugin) chatLLM(systemPrompt, userPrompt string) (string, error) {
+	return llmGenerate(context.Background(), llm.Request{
+		System: systemPrompt,
+		Prompt: userPrompt,
+	})
 }

 // ── DB Helpers ───────────────────────────────────────────────────────────────
@@ -916,12 +877,10 @@ func (p *MarketPlugin) handleVixReport(ctx MessageContext) error {
 	}

 	var summary string
-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-	if host != "" && model != "" {
+	if llmConfigured() {
 		prompt := fmt.Sprintf("VIX (fear index) data over %d days (%s to %s):\n%s\n\nDescribe the fear/greed trajectory in 2-3 sentences. Be sardonic but accurate.",
 			len(entries), entries[0].Date, entries[len(entries)-1].Date, strings.Join(prices, ", "))
-		summary, _ = p.callOllamaChat(host, model, marketSystemPrompt, prompt)
+		summary, _ = p.chatLLM(marketSystemPrompt, prompt)
 	}

 	var sb strings.Builder
@@ -1020,12 +979,10 @@ func (p *MarketPlugin) handleCompare(ctx MessageContext, args []string) error {
 	for _, e := range entries {
 		prices = append(prices, fmt.Sprintf("%.2f", e.Price))
 	}
-	host := os.Getenv("OLLAMA_HOST")
-	model := os.Getenv("OLLAMA_MODEL")
-	if host != "" && model != "" {
+	if llmConfigured() {
 		prompt := fmt.Sprintf("%s over %d days (%s to %s):\n%s\n\nDescribe the trend in 2-3 sentences. Be sardonic but accurate.",
 			idx.DisplayName, len(entries), entries[0].Date, entries[len(entries)-1].Date, strings.Join(prices, ", "))
-		if summary, err := p.callOllamaChat(host, model, marketSystemPrompt, prompt); err == nil && summary != "" {
+		if summary, err := p.chatLLM(marketSystemPrompt, prompt); err == nil && summary != "" {
 			sb.WriteString(summary)
 			sb.WriteString("\n\n")
 		}
@@ -183,6 +183,12 @@ func emitFact(f peteclient.Fact, subjectUser, opponentUser id.UserID) {
 		}
 	}
 	f.Actors = actors
+	// Author the prose in Pete's voice from the FINAL fact, so the names in the
+	// dispatch match the Actors allow-list Pete guards against. Best-effort: an
+	// empty pair (LLM off or authoring failed) just means Pete templates the
+	// fact. Synchronous, like the holdem tip rewrite — news facts are infrequent
+	// and the call is tightly bounded (dispatchLLMTimeout).
+	f.Headline, f.Lede = authorDispatch(f)
 	peteclient.Emit(f)
 }

@@ -273,8 +279,12 @@ func claimRealmFirst(kind, target string) bool {
 // *started* — every dispatch was an outcome — which is why the two live boredom
 // runs produced no news at all.
 //
-// The event_type must be one Pete already knows: an unknown type is a 400, which
-// retries and then parks the bulletin forever. Deploy Pete first.
+// The event_type no longer has to be one Pete already knows. It used to: an
+// unknown type was a 400, which retried to the cap and then parked the bulletin
+// forever, so shipping a new event type meant remembering to deploy Pete first.
+// Pete now publishes an untemplated type on a neutral fallback and counts it for
+// the operator, so the ordering rule is a property of the system rather than
+// something a human has to hold.
 func emitBoredomDeparture(userID id.UserID, zone ZoneDefinition, level int) {
 	if !peteclient.Enabled() || !newsEmissionOn() {
 		return
@@ -333,6 +343,68 @@ func emitZoneClearNews(userID id.UserID, exp *Expedition) {
 		Boss:       zone.Boss.Name,
 		Level:      lvl,
 		Outcome:    "cleared",
+		RunID:      latestRunIDForNews(userID),
+		OccurredAt: ts,
+	}, userID, "")
+}
+
+// treasureRarityWord maps a treasure def's tier to the rarity adjective Pete
+// weaves into a find's dispatch. Story-grade treasures are typically tier 5, so
+// "legendary" is the common case; the lower tiers are here for completeness.
+func treasureRarityWord(tier int) string {
+	switch {
+	case tier >= 5:
+		return "legendary"
+	case tier == 4:
+		return "epic"
+	case tier == 3:
+		return "rare"
+	case tier == 2:
+		return "uncommon"
+	default:
+		return "common"
+	}
+}
+
+// emitTreasureFound files a story-grade treasure find. Only treasures carrying a
+// RoomAnnounce string reach here — the same gate that earns them a public moment
+// — so a copper-piece pickup never becomes news. The realm's first finder of a
+// given treasure is a PRIORITY hoard; a later finder of the same item is a
+// BULLETIN, the first/repeat split zone_first already uses. Character name only;
+// no-op unless the seam is enabled.
+//
+// treasure_found is an event_type Pete's ingest must already know: an unknown
+// type 400s, retries to the cap, then parks the bulletin forever. Deploy Pete
+// first.
+func emitTreasureFound(userID id.UserID, def *AdvTreasureDef, loc *AdvLocation) {
+	if !peteclient.Enabled() || !newsEmissionOn() {
+		return
+	}
+	if def == nil || loc == nil {
+		return
+	}
+	// Claim the realm-first BEFORE the name guard, so an unnamed straggler's
+	// genuine first find still seeds the ledger and the next finder isn't
+	// mis-billed as the first-ever. Mirrors emitZoneClearNews.
+	tier := "bulletin"
+	if claimRealmFirst("treasure", def.Key) {
+		tier = "priority"
+	}
+	name := charName(userID)
+	if name == "" {
+		return
+	}
+	ts := nowUnix()
+	disc := fmt.Sprintf("%s:%d", def.Key, ts)
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("treasure_found:%s:%s:%d", eventToken(userID, disc), def.Key, ts),
+		EventType:  "treasure_found",
+		Tier:       tier,
+		Subject:    name,
+		Zone:       loc.Name,
+		Level:      charLevel(userID),
+		Stakes:     def.Name,
+		Outcome:    treasureRarityWord(def.Tier),
 		OccurredAt: ts,
 	}, userID, "")
 }
@@ -0,0 +1,169 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/peteclient"
+)
+
+// weapon/ring/wondrous helpers build a MagicItem the codified effect formula
+// (magicItemEffectFor) can score without touching the DB.
+func mkItem(kind MagicItemKind, rarity DnDRarity, slot DnDSlot) MagicItem {
+	return MagicItem{ID: string(kind) + "_" + string(rarity), Kind: kind, Rarity: rarity, Slot: slot}
+}
+
+// TestMagicItemDeltasDirection pins the "which way is better" call for each stat,
+// including DamageReductMult where LOWER is the improvement.
+func TestMagicItemDeltasDirection(t *testing.T) {
+	neutral := magicItemEffect{DamageReductMult: 1.0}
+
+	t.Run("more damage is better", func(t *testing.T) {
+		d := magicItemDeltas(magicItemEffect{DamageBonus: 0.15, DamageReductMult: 1.0}, magicItemEffect{DamageBonus: 0.10, DamageReductMult: 1.0})
+		if len(d) != 1 || d[0].Label != "damage" || !d[0].Better || d[0].Text != "+5% damage" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("less damage taken is better", func(t *testing.T) {
+		// cand mult 0.90 (blocks 10%) vs worn neutral 1.0 (blocks nothing).
+		d := magicItemDeltas(magicItemEffect{DamageReductMult: 0.90}, neutral)
+		if len(d) != 1 || d[0].Label != "defense" || !d[0].Better || d[0].Text != "-10% damage taken" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("weaker armor reads as worse", func(t *testing.T) {
+		// cand blocks less than worn: mult rises, damage taken goes up.
+		d := magicItemDeltas(magicItemEffect{DamageReductMult: 0.96}, magicItemEffect{DamageReductMult: 0.90})
+		if len(d) != 1 || d[0].Better || d[0].Text != "+6% damage taken" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("hp and opening damage", func(t *testing.T) {
+		d := magicItemDeltas(
+			magicItemEffect{DamageReductMult: 1.0, MaxHP: 10, FlatDmgStart: 3},
+			magicItemEffect{DamageReductMult: 1.0, MaxHP: 6, FlatDmgStart: 5},
+		)
+		byLabel := map[string]itemDelta{}
+		for _, x := range d {
+			byLabel[x.Label] = itemDelta{x.Better, x.Text}
+		}
+		if v := byLabel["hp"]; v.text != "+4 HP" || !v.better {
+			t.Errorf("hp: %+v", v)
+		}
+		if v := byLabel["opening"]; v.text != "-2 opening damage" || v.better {
+			t.Errorf("opening: %+v", v)
+		}
+	})
+
+	t.Run("sub-percent change is dropped", func(t *testing.T) {
+		// 0.004 fraction = 0.4% → rounds to 0% → not a visible delta.
+		if d := magicItemDeltas(
+			magicItemEffect{DamageBonus: 0.104, DamageReductMult: 1.0},
+			magicItemEffect{DamageBonus: 0.100, DamageReductMult: 1.0},
+		); len(d) != 0 {
+			t.Fatalf("expected no visible delta, got %+v", d)
+		}
+	})
+}
+
+type itemDelta struct {
+	better bool
+	text   string
+}
+
+// TestCompareVerdict pins strict-dominance classification and the overrides.
+func TestCompareVerdict(t *testing.T) {
+	gain := []peteclient.ItemDelta{{Better: true}}
+	loss := []peteclient.ItemDelta{{Better: false}}
+	mixed := []peteclient.ItemDelta{{Better: true}, {Better: false}}
+
+	cases := []struct {
+		name        string
+		deltas      []peteclient.ItemDelta
+		empty, inrt bool
+		want        string
+	}{
+		{"all gains", gain, false, false, "upgrade"},
+		{"all losses", loss, false, false, "downgrade"},
+		{"mixed", mixed, false, false, "sidegrade"},
+		{"no change", nil, false, false, "same"},
+		{"empty slot", gain, true, false, "new"},
+		{"inert overrides upgrade", gain, false, true, "inert"},
+		{"inert overrides new", gain, true, true, "inert"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := compareVerdict(c.deltas, c.empty, c.inrt); got != c.want {
+				t.Errorf("compareVerdict(%s) = %q, want %q", c.name, got, c.want)
+			}
+		})
+	}
+}
+
+// TestMagicItemCompareIntegration drives the whole builder against equipped maps.
+func TestMagicItemCompareIntegration(t *testing.T) {
+	rareWpn := mkItem(MagicItemWeapon, RarityRare, DnDSlotMainHand)    // +15% damage
+	uncWpn := mkItem(MagicItemWeapon, RarityUncommon, DnDSlotMainHand) // +10% damage
+
+	t.Run("upgrade over a weaker worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: uncWpn}}
+		c := magicItemCompare(rareWpn, 0, eq)
+		if c.Verdict != "upgrade" || c.VsName != uncWpn.Name || c.VsSlot != "main_hand" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("downgrade under a stronger worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: rareWpn}}
+		if c := magicItemCompare(uncWpn, 0, eq); c.Verdict != "downgrade" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("same as an identical worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: rareWpn}}
+		c := magicItemCompare(rareWpn, 0, eq)
+		if c.Verdict != "same" || len(c.Deltas) != 0 {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("new into an empty slot names no worn item", func(t *testing.T) {
+		c := magicItemCompare(rareWpn, 0, map[DnDSlot]EquippedMagicItem{})
+		if c.Verdict != "new" || c.VsName != "" || len(c.Deltas) == 0 {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("attunement item with no free bond is inert", func(t *testing.T) {
+		ring := mkItem(MagicItemRing, RarityRare, DnDSlotRing1)
+		ring.Attunement = true
+		// Three bonds spent elsewhere; the ring slot is empty. Wearing it does nothing.
+		eq := map[DnDSlot]EquippedMagicItem{
+			DnDSlotChest:  {Slot: DnDSlotChest, Item: mkItem(MagicItemArmor, RarityRare, DnDSlotChest), Attuned: true},
+			DnDSlotAmulet: {Slot: DnDSlotAmulet, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotAmulet), Attuned: true},
+			DnDSlotCloak:  {Slot: DnDSlotCloak, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotCloak), Attuned: true},
+		}
+		if c := magicItemCompare(ring, 0, eq); c.Verdict != "inert" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("evicting the worn occupant frees its bond, so not inert", func(t *testing.T) {
+		ring := mkItem(MagicItemRing, RarityRare, DnDSlotRing1)
+		ring.Attunement = true
+		wornRing := mkItem(MagicItemRing, RarityUncommon, DnDSlotRing1)
+		wornRing.Attunement = true
+		// Three bonds spent — but one of them is the ring the candidate would replace.
+		eq := map[DnDSlot]EquippedMagicItem{
+			DnDSlotRing1:  {Slot: DnDSlotRing1, Item: wornRing, Attuned: true},
+			DnDSlotChest:  {Slot: DnDSlotChest, Item: mkItem(MagicItemArmor, RarityRare, DnDSlotChest), Attuned: true},
+			DnDSlotAmulet: {Slot: DnDSlotAmulet, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotAmulet), Attuned: true},
+		}
+		if c := magicItemCompare(ring, 0, eq); c.Verdict == "inert" {
+			t.Fatalf("bond freed by eviction, should not be inert: %+v", c)
+		}
+	})
+}
@@ -0,0 +1,280 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The adventurer detail-page push has two halves, matched to two sensitivities:
+// the public sheet (stats + gear) rides the roster snapshot keyed by the
+// anonymous token, and the private self-view (inventory/vault/house/pets) rides
+// its own push keyed by localpart. These tests pin both halves at the gogobee
+// end — that the public detail carries no handle, and that the private detail is
+// keyed so Pete can only ever hand it back to its owner.
+
+// seedDetailPlayer builds a real, playable adventurer: player_meta + tier-0
+// equipment (via createAdvCharacter) plus a confirmed combat sheet. Real rows on
+// purpose — the same modernc scan hazard the roster snapshot dances around.
+func seedDetailPlayer(t *testing.T, uid id.UserID, name string, level int) {
+	t.Helper()
+	if err := createAdvCharacter(uid, name); err != nil {
+		t.Fatalf("createAdvCharacter(%s): %v", uid, err)
+	}
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: level,
+		STR: 16, DEX: 14, CON: 15, INT: 10, WIS: 12, CHA: 8,
+		HPMax: 42, HPCurrent: 30, TempHP: 5, ArmorClass: 17,
+		PendingSetup: false,
+	}); err != nil {
+		t.Fatalf("SaveDnDCharacter(%s): %v", uid, err)
+	}
+}
+
+// TestRosterDetailPublicSheet: buildRosterSnapshot hangs the public sheet on
+// each board entry — HP/AC/abilities/mods and equipped gear — and nothing that
+// could name the player. This is the click-through page's whole payload.
+func TestRosterDetailPublicSheet(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@josie:test")
+	seedDetailPlayer(t, uid, "Josie", 5)
+
+	snap, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(snap.Adventurers) != 1 {
+		t.Fatalf("board has %d adventurers, want 1", len(snap.Adventurers))
+	}
+	e := snap.Adventurers[0]
+	if e.Detail == nil {
+		t.Fatal("board entry carries no detail sheet — the detail page would fall back to the bare row")
+	}
+	d := e.Detail
+	if d.HPMax != 42 || d.HPCurrent != 30 || d.TempHP != 5 || d.ArmorClass != 17 {
+		t.Errorf("detail sheet = %+v, want HP 30/42 (+5 temp), AC 17", d)
+	}
+	if d.Abilities != [6]int{16, 14, 15, 10, 12, 8} {
+		t.Errorf("abilities = %v, want STR..CHA 16,14,15,10,12,8", d.Abilities)
+	}
+	// CON 15 → +2; a mismatched mods slice would misprint the whole sheet.
+	if d.Modifiers[2] != 2 {
+		t.Errorf("CON modifier = %d, want +2", d.Modifiers[2])
+	}
+	// createAdvCharacter seeds tier-0 gear in every slot, so the panel is full.
+	if len(d.Gear) != len(allSlots) {
+		t.Errorf("gear panel has %d pieces, want %d (one per slot)", len(d.Gear), len(allSlots))
+	}
+	for _, g := range d.Gear {
+		if g.Slot == "" || g.Name == "" {
+			t.Errorf("gear piece is unlabelled: %+v", g)
+		}
+	}
+}
+
+// TestRosterDetailExpeditionContext: a player who is out on a run gets the live
+// expedition fields layered onto their sheet — supplies, threat, and the room
+// counter — so the detail page shows where they are, not just who they are.
+func TestRosterDetailExpeditionContext(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@onrun:test")
+	exp := seedMischiefTarget(t, uid, 5, 60) // createAdvCharacter + sheet + live run
+	_ = exp
+
+	snap, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(snap.Adventurers) != 1 {
+		t.Fatalf("board has %d adventurers, want 1", len(snap.Adventurers))
+	}
+	e := snap.Adventurers[0]
+	if e.Status != "expedition" {
+		t.Fatalf("status = %q, want expedition", e.Status)
+	}
+	if e.Detail == nil {
+		t.Fatal("on-run entry carries no detail")
+	}
+	if e.Detail.Room == "" {
+		t.Error("expedition detail has no room counter — the run context didn't layer on")
+	}
+}
+
+// TestDetailSnapshotKeyedByLocalpart is the ownership contract at the source.
+// The private set is keyed by localpart and carries the player's current board
+// token, so Pete can answer "is this signed-in viewer the owner of this page?"
+// by a join — never by reversing the one-way token. And it carries the actual
+// private goods: inventory, vault, house, pets.
+func TestDetailSnapshotKeyedByLocalpart(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@quack:test")
+	seedDetailPlayer(t, uid, "Quack", 7)
+
+	// Backpack + vault: two distinct stashes that must not blur together.
+	if err := addAdvInventoryItem(uid, AdvItem{Name: "Iron Ore", Type: "ore", Tier: 1, Value: 10}); err != nil {
+		t.Fatal(err)
+	}
+	if err := addAdvInventoryItem(uid, AdvItem{Name: "Jeweled Crown", Type: "treasure", Tier: 4, Value: 5000}); err != nil {
+		t.Fatal(err)
+	}
+	if got := vaultStoreItem(uid, "crown"); got == "" {
+		t.Fatal("failed to vault the crown")
+	}
+
+	// House + a pet, through the canonical save path.
+	adv, err := loadAdvCharacter(uid)
+	if err != nil {
+		t.Fatalf("loadAdvCharacter: %v", err)
+	}
+	adv.HouseTier = 2
+	adv.HouseLoanBalance = 1500
+	adv.PetType = "cat"
+	adv.PetName = "Mittens"
+	adv.PetLevel = 3
+	if err := saveAdvCharacter(adv); err != nil {
+		t.Fatalf("saveAdvCharacter: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(snap.Players) != 1 {
+		t.Fatalf("detail set has %d players, want 1", len(snap.Players))
+	}
+	pd := snap.Players[0]
+	if pd.Localpart != "quack" {
+		t.Errorf("localpart = %q, want the lowercase mxid localpart 'quack'", pd.Localpart)
+	}
+	if pd.Token != eventToken(uid, "roster") {
+		t.Error("detail token is not the board token — the ownership join on Pete would never match the page")
+	}
+	// Inventory holds the ore (crown was vaulted out of it); vault holds the crown.
+	if len(pd.Inventory) != 1 || pd.Inventory[0].Name != "Iron Ore" {
+		t.Errorf("inventory = %+v, want just the ore", pd.Inventory)
+	}
+	if len(pd.Vault) != 1 || pd.Vault[0].Name != "Jeweled Crown" {
+		t.Errorf("vault = %+v, want just the crown", pd.Vault)
+	}
+	if pd.House.Tier != 2 || pd.House.LoanBalance != 1500 {
+		t.Errorf("house = %+v, want tier 2 / loan 1500", pd.House)
+	}
+	if len(pd.Pets) != 1 || pd.Pets[0].Name != "Mittens" || pd.Pets[0].Level != 3 {
+		t.Errorf("pets = %+v, want the cat Mittens L3", pd.Pets)
+	}
+}
+
+// TestDetailSnapshotIgnoresOptOut: the news opt-out governs the *public* board,
+// not the private self-view. A player who opted out must still receive their own
+// sheet — Pete only ever serves this back to them — so buildDetailSnapshot must
+// NOT filter on it, unlike buildRosterSnapshot.
+func TestDetailSnapshotIgnoresOptOut(t *testing.T) {
+	newMischiefTestDB(t)
+	shown := id.UserID("@shown:test")
+	hidden := id.UserID("@hidden:test")
+	seedDetailPlayer(t, shown, "Shown", 4)
+	seedDetailPlayer(t, hidden, "Hidden", 4)
+	setNewsOptout(hidden, true)
+
+	// The public board drops the opted-out player...
+	roster, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(roster.Adventurers) != 1 || roster.Adventurers[0].Name != "Shown" {
+		t.Fatalf("public board = %d entries, want just Shown", len(roster.Adventurers))
+	}
+
+	// ...but the private detail set keeps them both.
+	detail, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(detail.Players) != 2 {
+		t.Fatalf("private detail set = %d players, want 2 — opt-out must not deny a player their own self-view", len(detail.Players))
+	}
+	byLP := map[string]bool{}
+	for _, p := range detail.Players {
+		byLP[p.Localpart] = true
+	}
+	if !byLP["hidden"] {
+		t.Error("opted-out player is missing from the private self-view set")
+	}
+}
+
+// TestDetailSnapshotSkipsDeadPlayers: the set is drawn from alive players only.
+// A dead character has no live board page to own, and pushing their stale
+// inventory would leave it standing on Pete after they're gone.
+func TestDetailSnapshotSkipsDeadPlayers(t *testing.T) {
+	newMischiefTestDB(t)
+	alive := id.UserID("@alive:test")
+	dead := id.UserID("@dead:test")
+	seedDetailPlayer(t, alive, "Alive", 4)
+	seedDetailPlayer(t, dead, "Dead", 4)
+	if _, err := db.Get().Exec(`UPDATE player_meta SET alive = 0 WHERE user_id = ?`, string(dead)); err != nil {
+		t.Fatalf("kill player: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(snap.Players) != 1 || snap.Players[0].Localpart != "alive" {
+		t.Fatalf("detail set = %+v, want just the living player", snap.Players)
+	}
+}
+
+// TestPetXPRidesTheCurveNotACopyOfIt pins the unit and the cap, which are the two
+// ways this can go quietly wrong on the web. XP is stored in centi-XP — a pet
+// earns 1.5 points an action and the ledger is an int — so a page that read XP
+// against a whole-number threshold would draw a bar 100x too full. And a capped
+// pet must report 0 needed rather than the next band's number, or its bar sits
+// forever short of a level it can never gain.
+func TestPetXPRidesTheCurveNotACopyOfIt(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@quack:test")
+	seedDetailPlayer(t, uid, "Quack", 7)
+
+	adv, err := loadAdvCharacter(uid)
+	if err != nil {
+		t.Fatalf("loadAdvCharacter: %v", err)
+	}
+	adv.PetType = "cat"
+	adv.PetName = "Mittens"
+	adv.PetLevel = 4
+	adv.PetXP = 750 // 7.5 of the 20 points level 4 wants
+	adv.Pet2Type = "dog"
+	adv.Pet2Name = "Rex"
+	adv.Pet2Level = petMaxLevel
+	adv.Pet2XP = 0
+	if err := saveAdvCharacter(adv); err != nil {
+		t.Fatalf("saveAdvCharacter: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	pets := snap.Players[0].Pets
+	if len(pets) != 2 {
+		t.Fatalf("pets = %+v, want both slots", pets)
+	}
+	byName := map[string]int{}
+	for i, p := range pets {
+		byName[p.Name] = i
+	}
+	mittens := pets[byName["Mittens"]]
+	if mittens.XP != 750 {
+		t.Errorf("Mittens XP = %d, want the stored centi-XP 750", mittens.XP)
+	}
+	if want := petXPToNextLevel(4) * 100; mittens.XPNeeded != want {
+		t.Errorf("Mittens XPNeeded = %d, want %d — the curve is in centi-XP too",
+			mittens.XPNeeded, want)
+	}
+	if rex := pets[byName["Rex"]]; rex.XPNeeded != 0 {
+		t.Errorf("a capped pet needs %d more XP; want 0, meaning nothing left to earn", rex.XPNeeded)
+	}
+}
@@ -0,0 +1,169 @@
+package plugin
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"gogobee/internal/llm"
+	"gogobee/internal/peteclient"
+)
+
+// LLM-authored adventure dispatches. gogobee owns the raw model compute; this is
+// where a structured fact becomes warm-reporter prose for Pete to publish. Pete
+// is still the editor and the safety boundary: it runs its own prose-guard over
+// whatever we send and falls back to its templates on anything it does not like,
+// so authoring here is best-effort by design — every failure path returns an
+// empty pair and Pete templates the fact.
+//
+// The voice must live somewhere, and with no route for Pete to call back into
+// this box (see roster.go in the Pete repo) it lives in the prompt below. Keep
+// it faithful to pete_adventure_news_voice.md; Pete's persona, not gogobee's.
+
+// dispatchLLMTimeout bounds the authoring call. emitFact runs on game-event
+// chokepoints (a party wipe fires one per member), so this is deliberately far
+// tighter than the interactive 120s tip budget: if the model cannot turn a
+// handful of facts into two sentences this fast, it is effectively down, and a
+// template dispatch now beats a voiced one late.
+const dispatchLLMTimeout = 15 * time.Second
+
+// Length ceilings, mirrored from Pete's proseGuard so we never ship prose Pete
+// will reject for length alone. Byte counts, matching Pete's len() check.
+const (
+	maxDispatchHeadline = 200
+	maxDispatchLede     = 800
+)
+
+// authorDispatch turns a fact into a headline+lede in Pete's voice, or returns
+// two empty strings if the model is unconfigured, errors, times out, or produces
+// anything malformed. The fact must already have its FINAL Actors set (post
+// opt-out anonymisation) — that list is the only set of names the prose may use,
+// and it is what Pete's guard checks the output against.
+func authorDispatch(f peteclient.Fact) (headline, lede string) {
+	if !llmConfigured() {
+		return "", ""
+	}
+
+	prompt := buildDispatchPrompt(f)
+	raw, err := callLLMDispatch(dispatchLLMTimeout, prompt)
+	if err != nil {
+		slog.Warn("pete dispatch: LLM authoring failed, Pete will template", "guid", f.GUID, "err", err)
+		return "", ""
+	}
+
+	h, l, ok := parseDispatch(raw)
+	if !ok {
+		slog.Warn("pete dispatch: unparseable LLM output, Pete will template", "guid", f.GUID)
+		return "", ""
+	}
+	// Ship only a complete, in-bounds pair. A half-authored dispatch or an
+	// over-long one is exactly what Pete would reject anyway; catch it here so a
+	// bad generation costs nothing on the wire.
+	if h == "" || l == "" || len(h) > maxDispatchHeadline || len(l) > maxDispatchLede {
+		slog.Warn("pete dispatch: LLM output empty or over length, Pete will template",
+			"guid", f.GUID, "headline_len", len(h), "lede_len", len(l))
+		return "", ""
+	}
+	return h, l
+}
+
+// buildDispatchPrompt renders the persona, the strict rules, and this fact's
+// structured facts into a single prompt. The facts block lists only the fields
+// that are set, each labelled, so the model has the who/what/where and no room
+// to invent the rest.
+func buildDispatchPrompt(f peteclient.Fact) string {
+	var facts strings.Builder
+	add := func(label, val string) {
+		if val != "" {
+			fmt.Fprintf(&facts, "- %s: %s\n", label, val)
+		}
+	}
+	addN := func(label string, n int) {
+		if n != 0 {
+			fmt.Fprintf(&facts, "- %s: %d\n", label, n)
+		}
+	}
+	add("event", f.EventType)
+	add("who this is about (the subject)", f.Subject)
+	add("the other person named", f.Opponent)
+	add("monster or boss", f.Boss)
+	add("dungeon or zone", f.Zone)
+	add("region", f.Region)
+	addN("character level", f.Level)
+	addN("count", f.Count)
+	add("outcome", f.Outcome)
+	add("stakes or item", f.Stakes)
+	add("class and race", f.ClassRace)
+	add("milestone", f.Milestone)
+
+	names := "(none — this is a realm-level event with no named adventurer)"
+	if len(f.Actors) > 0 {
+		names = strings.Join(f.Actors, ", ")
+	}
+
+	return fmt.Sprintf(`You are Pete, a warm, friendly local news reporter for a fantasy adventuring town. Think a beloved local newscaster who genuinely knows everyone and is glad to see them. You have journalistic bones — a clear headline and a who/what/where lede that gets the facts right — delivered with personable, first-person warmth. You root for the community, celebrate wins, mourn losses gently, welcome newcomers. Conversational, never snarky, never a caps-lock hype-man. Warmth carries the register, not exclamation marks.
+
+Write a short news dispatch about the event below.
+
+STRICT RULES — do not violate these:
+- Use ONLY these adventurer names, exactly as written: %s. Never invent a name, never use any other person's name, never use an @-handle.
+- Use ONLY the facts listed. Do not invent numbers, outcomes, items, or events that are not below.
+- The monster/boss, zone, region and item names are game names — you may use them as given.
+- Do not address the reader as "you" unless the event is Pete's own duel.
+- No markdown, no emoji, no quotation marks around the whole thing.
+
+Respond with ONLY a JSON object, no other text:
+{"headline": "one short sentence, a real headline", "lede": "one to three warm sentences with the who/what/where"}
+
+The event:
+%s`, names, facts.String())
+}
+
+// callLLMDispatch posts a single non-streaming generation and returns the raw
+// completion. The timeout is a parameter because the two callers have genuinely
+// different patience: a dispatch is authored on a game chokepoint and must not
+// stall it, while a run summary rides a background ticker and can afford to wait
+// for a bigger model. See runSummaryTimeout.
+func callLLMDispatch(timeout time.Duration, prompt string) (string, error) {
+	return llmGenerate(context.Background(), llm.Request{
+		Prompt:  prompt,
+		NumCtx:  4096,
+		Timeout: timeout,
+	})
+}
+
+// parseDispatch pulls {headline, lede} out of the model's completion, tolerating
+// the usual noise (think blocks, markdown fences, prose around the JSON). ok is
+// false when no JSON object with a headline can be recovered.
+func parseDispatch(raw string) (headline, lede string, ok bool) {
+	s := raw
+	// Drop a Qwen-style reasoning block if present.
+	if i := strings.Index(s, "<think>"); i != -1 {
+		if j := strings.Index(s, "</think>"); j != -1 {
+			s = s[:i] + s[j+len("</think>"):]
+		}
+	}
+	// Isolate the first {...} object so surrounding prose or fences don't break
+	// the decode.
+	start := strings.Index(s, "{")
+	end := strings.LastIndex(s, "}")
+	if start < 0 || end <= start {
+		return "", "", false
+	}
+	var out struct {
+		Headline string `json:"headline"`
+		Lede     string `json:"lede"`
+	}
+	if err := json.Unmarshal([]byte(s[start:end+1]), &out); err != nil {
+		return "", "", false
+	}
+	headline = strings.TrimSpace(out.Headline)
+	lede = strings.TrimSpace(out.Lede)
+	if headline == "" {
+		return "", "", false
+	}
+	return headline, lede, true
+}
@@ -0,0 +1,81 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"gogobee/internal/peteclient"
+)
+
+func TestParseDispatch(t *testing.T) {
+	cases := []struct {
+		name        string
+		raw         string
+		wantOK      bool
+		wantHeadPre string
+	}{
+		{
+			name:        "clean json",
+			raw:         `{"headline": "Josie cleared the Ossuary.", "lede": "Alone, no less."}`,
+			wantOK:      true,
+			wantHeadPre: "Josie cleared",
+		},
+		{
+			name:        "wrapped in prose and fences",
+			raw:         "Sure! Here you go:\n```json\n{\"headline\":\"A win.\",\"lede\":\"Nice one.\"}\n```",
+			wantOK:      true,
+			wantHeadPre: "A win.",
+		},
+		{
+			name:        "think block stripped",
+			raw:         "<think>let me consider the tone</think>\n{\"headline\":\"Held the line.\",\"lede\":\"Proud of you all.\"}",
+			wantOK:      true,
+			wantHeadPre: "Held the line.",
+		},
+		{name: "no json", raw: "I could not write that.", wantOK: false},
+		{name: "empty headline", raw: `{"headline":"","lede":"body"}`, wantOK: false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h, l, ok := parseDispatch(c.raw)
+			if ok != c.wantOK {
+				t.Fatalf("ok = %v, want %v (h=%q l=%q)", ok, c.wantOK, h, l)
+			}
+			if ok && !strings.HasPrefix(h, c.wantHeadPre) {
+				t.Errorf("headline = %q, want prefix %q", h, c.wantHeadPre)
+			}
+		})
+	}
+}
+
+// TestBuildDispatchPrompt pins the two properties the prose-guard depends on:
+// the allowed names are stated verbatim, and only the set facts appear (no empty
+// labels for the model to fill in with invention).
+func TestBuildDispatchPrompt(t *testing.T) {
+	f := peteclient.Fact{
+		EventType: "boss_kill", Subject: "Josie", Boss: "the Bone Warden",
+		Zone: "the Ossuary", Level: 14, Actors: []string{"Josie"},
+	}
+	p := buildDispatchPrompt(f)
+
+	if !strings.Contains(p, "ONLY these adventurer names, exactly as written: Josie") {
+		t.Errorf("prompt does not constrain names to Actors:\n%s", p)
+	}
+	if !strings.Contains(p, "the Bone Warden") || !strings.Contains(p, "the Ossuary") {
+		t.Error("prompt dropped a supplied fact")
+	}
+	// Unset fields must not appear as empty labels.
+	if strings.Contains(p, "region:") || strings.Contains(p, "milestone:") {
+		t.Errorf("prompt lists an unset fact:\n%s", p)
+	}
+}
+
+// TestBuildDispatchPromptRealmEvent: a realm-level fact with no named adventurer
+// still produces a usable prompt that tells the model there is no name to use.
+func TestBuildDispatchPromptRealmEvent(t *testing.T) {
+	f := peteclient.Fact{EventType: "siege_start", Boss: "the Horde", Stakes: "the whole town"}
+	p := buildDispatchPrompt(f)
+	if !strings.Contains(p, "no named adventurer") {
+		t.Errorf("realm event prompt missing the no-name note:\n%s", p)
+	}
+}
--- a/Show More
+++ b/Show More