mischief: a contract that never landed shouldn't protect its target

The 24h cooldown and the one-boss-a-week cap both keyed off any resolved
contract, and a fizzle resolves. So a target could have a friend point a
grunt at them, extract, and buy a day of immunity for the fizzle rake.
Both caps now only count contracts that were actually delivered.

Delivery also ran a full combat against the target's sheet without their
advUserLock. hasActiveCombatSession only sees the turn engine — the
target's own autopilot walk resolves its fights inline under that lock
and reports no session, so a delivery could race it and lose a fight's
worth of HP writes.

Also: don't tell a buyer a rival beat them when the insert simply failed.

cmd/expedition-sim/main.go

@@ -46,7 +46,9 @@ func main() {
 		days    = flag.Int("days", 0, "stop after N synthetic day rollovers (0 = unbounded; the -cap safety net still applies)")
 		dataDir = flag.String("data", "", "data dir for the temp sqlite db (default: OS tempdir; ignored in matrix mode)")
 		userTag = flag.String("user", "@sim:expedition", "synthetic user id (single-run mode)")
-		logFlag = flag.Bool("log", true, "include per-row expedition log in output (single-run default true; matrix default false)")
+
+		realUser = flag.String("real-user", "", "run an EXISTING character loaded from -data's DB instead of building a synthetic one. Pass the real mxid (e.g. @holymachina:parodia.dev). Requires -data to point at a (copy of a) populated gogobee.db dir. Heals the char to full + tops up the bankroll; leaves race/class/level/gear/spells as-is.")
+		logFlag  = flag.Bool("log", true, "include per-row expedition log in output (single-run default true; matrix default false)")
 
 		matrix  = flag.Bool("matrix", false, "matrix mode — sweep over classes × levels × zones × runs")
 		classes = flag.String("classes", "", "comma-separated class ids (matrix mode)")
@@ -60,6 +62,7 @@ func main() {
 
 		party        = flag.Int("party", 1, "seat a party of N (1 = solo, the historical path). Followers are invited on Day 1 and buy their own supplies")
 		partyClasses = flag.String("party-classes", "", "comma-separated classes for the N-1 followers (default: clones of -class)")
+		companion    = flag.String("companion", "", "hire Pete into the party: \"auto\" fills the missing role, or name a class (cleric, fighter, …). Empty = no companion. He takes a seat but no loot/XP.")
 
 		jobs = flag.Int("jobs", 0, "matrix mode — concurrent worker count (each worker is a subprocess so it gets its own sqlite). 0 = runtime.NumCPU()")
 	)
@@ -86,11 +89,51 @@ func main() {
 				includeLog = *logFlag
 			}
 		})
-		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses)
+		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses, *companion)
 		return
 	}
 
-	runSingle(*class, *level, *zone, *userTag, *dataDir, *bank, *cap, *days, *logFlag, followers)
+	if *realUser != "" {
+		if *dataDir == "" {
+			fail("-real-user requires -data pointing at a dir containing a populated gogobee.db")
+		}
+		if *party != 1 {
+			fail("-real-user does not support -party yet (would need every seat to be a real, tier-eligible char)")
+		}
+		runReal(*realUser, *zone, *dataDir, *bank, *cap, *days, *logFlag)
+		return
+	}
+
+	runSingle(*class, *level, *zone, *userTag, *dataDir, *bank, *cap, *days, *logFlag, followers, *companion)
+}
+
+// runReal drives an existing character loaded from dataDir's gogobee.db through
+// a real expedition. dataDir should be a COPY of prod — db.Init runs additive
+// migrations against it, and the run mutates HP/coin/inventory. Never point this
+// at the live prod file or at ./data.
+func runReal(userTag, zone, dataDir string, bank float64, cap, days int, includeLog bool) {
+	runner, err := plugin.NewSimRunner(dataDir)
+	if err != nil {
+		fail("init runner:", err)
+	}
+	defer runner.Close()
+
+	uid := id.UserID(userTag)
+	c, err := runner.PrepareRealCharacter(uid, bank)
+	if err != nil {
+		fail("prepare real character:", err)
+	}
+	res, err := runner.RunExpedition(uid, plugin.ZoneID(zone), cap, days)
+	if res != nil {
+		res.Class = string(c.Class) // real subclass/race aren't in SimResult; class is the useful key
+		if !includeLog {
+			res.Log = nil
+		}
+		emitIndented(res)
+	}
+	if err != nil {
+		fail("run:", err)
+	}
 }
 
 // followerClasses expands -party / -party-classes into the class of each
@@ -119,7 +162,7 @@ func followerClasses(leaderClass string, party int, spec string) []string {
 	return out
 }
 
-func runSingle(class string, level int, zone, userTag, dataDir string, bank float64, cap, days int, includeLog bool, followers []string) {
+func runSingle(class string, level int, zone, userTag, dataDir string, bank float64, cap, days int, includeLog bool, followers []string, companion string) {
 	dir := dataDir
 	if dir == "" {
 		var err error
@@ -130,7 +173,7 @@ func runSingle(class string, level int, zone, userTag, dataDir string, bank floa
 		defer os.RemoveAll(dir)
 	}
 
-	res, err := runOne(dir, id.UserID(userTag), plugin.DnDClass(class), level, plugin.ZoneID(zone), bank, cap, days, followers)
+	res, err := runOne(dir, id.UserID(userTag), plugin.DnDClass(class), level, plugin.ZoneID(zone), bank, cap, days, followers, companion)
 	if err != nil {
 		if res != nil {
 			if !includeLog {
@@ -157,7 +200,7 @@ type matrixJob struct {
 	rep   int
 }
 
-func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses string) {
+func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses, companion string) {
 	cs := splitNonEmpty(classes)
 	ls := parseLevels(levels)
 	zs := splitNonEmpty(zones)
@@ -188,7 +231,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	var wg sync.WaitGroup
 	for i := 0; i < jobs; i++ {
 		wg.Add(1)
-		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses)
+		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses, companion)
 	}
 	go func() {
 		for _, j := range work {
@@ -207,7 +250,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	}
 }
 
-func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses string) {
+func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses, companion string) {
 	defer wg.Done()
 	for j := range in {
 		uid := fmt.Sprintf("@sim:%s-l%d-%s-%d", j.class, j.level, j.zone, j.rep)
@@ -233,6 +276,9 @@ func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult,
 		if partyClasses != "" {
 			args = append(args, "-party-classes", partyClasses)
 		}
+		if companion != "" {
+			args = append(args, "-companion", companion)
+		}
 		if trace {
 			args = append(args, "-trace")
 		}
@@ -272,7 +318,7 @@ func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult,
 	}
 }
 
-func runOne(dataDir string, uid id.UserID, class plugin.DnDClass, level int, zone plugin.ZoneID, bank float64, cap, days int, followers []string) (*plugin.SimResult, error) {
+func runOne(dataDir string, uid id.UserID, class plugin.DnDClass, level int, zone plugin.ZoneID, bank float64, cap, days int, followers []string, companion string) (*plugin.SimResult, error) {
 	runner, err := plugin.NewSimRunner(dataDir)
 	if err != nil {
 		return nil, fmt.Errorf("init runner: %w", err)
@@ -296,6 +342,7 @@ func runOne(dataDir string, uid id.UserID, class plugin.DnDClass, level int, zon
 		runner.Euro.Credit(muid, bank, "expedition-sim bankroll")
 		members = append(members, muid)
 	}
+	runner.Companion = companion
 	return runner.RunPartyExpedition(uid, members, zone, cap, days)
 }
 

internal/bot/appservice.go

@@ -7,7 +7,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"sync"
 	"time"
 
 	"github.com/rs/zerolog"
@@ -107,7 +106,19 @@ func newAppserviceSession(cfg Config) (*Session, error) {
 		return nil, fmt.Errorf("registration sender_localpart resolves to %s but BOT_USER_ID is %s", as.BotMXID(), userID)
 	}
 
+	// Resolve room state (is it encrypted, who is in it) from the server on first
+	// use, since there is no /sync to backfill it. Must be installed before the
+	// first BotClient() call: makeClient copies as.StateStore into the client, and
+	// caches the client.
+	inner, ok := as.StateStore.(innerStateStore)
+	if !ok {
+		return nil, fmt.Errorf("appservice state store %T does not implement crypto.StateStore", as.StateStore)
+	}
+	store := newLazyStateStore(inner)
+	as.StateStore = store
+
 	client := as.BotClient() // as_token auth + SetAppServiceUserID (?user_id=) assertion
+	store.client = client
 	// Assert the device via ?org.matrix.msc3202.device_id= on E2EE requests, and
 	// satisfy cryptohelper.Init's syncer check: with this set, Init permits a nil
 	// Syncer (we drive the crypto machine from transactions, not /sync). The param
@@ -172,29 +183,6 @@ func newAppserviceSession(cfg Config) (*Session, error) {
 		mach.HandleMemberEvent(ctx, evt)
 	})
 
-	// Without /sync there is no state backfill, so the client's StateStore starts
-	// empty. Before we hand off a decrypted event (whose reply may need to be
-	// encrypted), resolve the room once: mark it encrypted and populate its member
-	// list. Otherwise outbound sends go plaintext (IsEncrypted=false) and, worse,
-	// the group session is shared to nobody (GetRoomJoinedOrInvitedMembers empty)
-	// so recipients can't decrypt the bot's replies.
-	var resolved sync.Map // roomID -> struct{}, resolved once
-	resolveRoom := func(ctx context.Context, roomID id.RoomID) {
-		if _, done := resolved.LoadOrStore(roomID, struct{}{}); done {
-			return
-		}
-		var enc event.EncryptionEventContent
-		if err := client.StateEvent(ctx, roomID, event.StateEncryption, "", &enc); err == nil && enc.Algorithm != "" {
-			_ = as.StateStore.SetEncryptionEvent(ctx, roomID, &enc)
-		}
-		if members, err := client.Members(ctx, roomID); err == nil {
-			_ = as.StateStore.ReplaceCachedMembers(ctx, roomID, members.Chunk)
-		} else {
-			slog.Warn("appservice: failed to fetch room members; will retry", "room", roomID, "err", err)
-			resolved.Delete(roomID) // allow a later event to retry
-		}
-	}
-
 	// recoverSession handles an event whose megolm session we don't have yet. The
 	// keys are often merely in flight (a to-device m.room_key racing the room
 	// event), so wait briefly; if they never land, ask the sender to re-share and
@@ -236,7 +224,6 @@ func newAppserviceSession(cfg Config) (*Session, error) {
 	// Decrypt inbound encrypted room events and re-dispatch the plaintext so the
 	// normal message/reaction handlers fire (mirrors cryptohelper.HandleEncrypted).
 	ep.On(event.EventEncrypted, func(ctx context.Context, evt *event.Event) {
-		resolveRoom(ctx, evt.RoomID)
 		decrypted, err := ch.Decrypt(ctx, evt)
 		if err != nil {
 			if errors.Is(err, cryptohelper.NoSessionFound) {

internal/bot/statestore.go

@@ -0,0 +1,164 @@
+package bot
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/appservice"
+	"maunium.net/go/mautrix/crypto"
+	"maunium.net/go/mautrix/event"
+	"maunium.net/go/mautrix/id"
+)
+
+// lazyStateStore resolves room state from the homeserver on first use instead of
+// waiting for it to arrive over a sync.
+//
+// The appservice has no /sync, so the state store only ever learns a room is
+// encrypted from an m.room.encryption event pushed in a transaction — which for
+// an already-configured room never happens again. Anything the bot says on its
+// own initiative (ambient DMs, expedition beats, briefings) therefore reached
+// SendMessageEvent with IsEncrypted=false and went out as plaintext into an
+// encrypted room. The state store being in-memory made every restart a fresh
+// chance to leak.
+//
+// Both reads the send path depends on are resolved here on the first miss and
+// cached: whether the room is encrypted, and who to share the group session with
+// (an empty member list encrypts to nobody, which is its own outage). Neither
+// read is allowed to fail open — a lookup that cannot be resolved returns an
+// error, which aborts the send. A failed message is recoverable; a plaintext one
+// that has already landed in an encrypted room is not.
+type lazyStateStore struct {
+	// Embeds both interfaces the store is consumed through: the appservice
+	// dispatches state updates through the first, and the crypto machine type-
+	// asserts the client's store to the second (cryptohelper.NewCryptoHelper
+	// rejects a store that fails the assertion). Embedding only the appservice
+	// interface silently drops crypto's extra methods from the concrete type.
+	innerStateStore
+
+	client *mautrix.Client
+
+	mu    sync.Mutex
+	locks map[id.RoomID]*sync.Mutex
+	// Rooms whose m.room.encryption state we have asked the server about. The
+	// underlying store cannot distinguish "not encrypted" from "never heard of
+	// it", so the distinction is tracked here.
+	encryptionResolved map[id.RoomID]bool
+}
+
+// innerStateStore is the full method set the wrapped store must provide.
+type innerStateStore interface {
+	appservice.StateStore
+	crypto.StateStore
+}
+
+// The wrapper is consumed through both, and losing either one is a startup
+// failure rather than a build failure without these.
+var (
+	_ appservice.StateStore = (*lazyStateStore)(nil)
+	_ crypto.StateStore     = (*lazyStateStore)(nil)
+)
+
+func newLazyStateStore(inner innerStateStore) *lazyStateStore {
+	return &lazyStateStore{
+		innerStateStore:    inner,
+		locks:              make(map[id.RoomID]*sync.Mutex),
+		encryptionResolved: make(map[id.RoomID]bool),
+	}
+}
+
+// lockRoom serialises resolution per room so a burst of sends into a cold room
+// makes one request rather than one per message.
+func (s *lazyStateStore) lockRoom(roomID id.RoomID) func() {
+	s.mu.Lock()
+	lock, ok := s.locks[roomID]
+	if !ok {
+		lock = &sync.Mutex{}
+		s.locks[roomID] = lock
+	}
+	s.mu.Unlock()
+
+	lock.Lock()
+	return lock.Unlock
+}
+
+func (s *lazyStateStore) isEncryptionResolved(roomID id.RoomID) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.encryptionResolved[roomID]
+}
+
+func (s *lazyStateStore) markEncryptionResolved(roomID id.RoomID) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.encryptionResolved[roomID] = true
+}
+
+// IsEncrypted answers from the underlying store once the room's encryption state
+// has been resolved, fetching it from the server the first time.
+func (s *lazyStateStore) IsEncrypted(ctx context.Context, roomID id.RoomID) (bool, error) {
+	if !s.isEncryptionResolved(roomID) {
+		unlock := s.lockRoom(roomID)
+		defer unlock()
+
+		if !s.isEncryptionResolved(roomID) {
+			var enc event.EncryptionEventContent
+			err := s.client.StateEvent(ctx, roomID, event.StateEncryption, "", &enc)
+			switch {
+			case err == nil:
+				if enc.Algorithm != "" {
+					if err := s.innerStateStore.SetEncryptionEvent(ctx, roomID, &enc); err != nil {
+						return false, fmt.Errorf("cache encryption state for %s: %w", roomID, err)
+					}
+				}
+			case errors.Is(err, mautrix.MNotFound):
+				// No m.room.encryption at all: the room really is unencrypted.
+			default:
+				// Unresolved. Refuse rather than guess "unencrypted" and leak.
+				return false, fmt.Errorf("resolve encryption state for %s: %w", roomID, err)
+			}
+			s.markEncryptionResolved(roomID)
+		}
+	}
+	return s.innerStateStore.IsEncrypted(ctx, roomID)
+}
+
+// GetEncryptionEvent is how the crypto machine reads a room's megolm settings
+// (session rotation period, etc). It needs the same resolution as IsEncrypted,
+// since an unresolved room would otherwise report no encryption event.
+func (s *lazyStateStore) GetEncryptionEvent(ctx context.Context, roomID id.RoomID) (*event.EncryptionEventContent, error) {
+	if _, err := s.IsEncrypted(ctx, roomID); err != nil {
+		return nil, err
+	}
+	return s.innerStateStore.GetEncryptionEvent(ctx, roomID)
+}
+
+// GetRoomJoinedOrInvitedMembers backs megolm session sharing. Without a sync
+// there is no member backfill, so an unfetched room would report zero members
+// and the bot would encrypt to an audience of nobody.
+func (s *lazyStateStore) GetRoomJoinedOrInvitedMembers(ctx context.Context, roomID id.RoomID) ([]id.UserID, error) {
+	fetched, err := s.innerStateStore.HasFetchedMembers(ctx, roomID)
+	if err != nil {
+		return nil, fmt.Errorf("check member cache for %s: %w", roomID, err)
+	}
+	if !fetched {
+		unlock := s.lockRoom(roomID)
+		defer unlock()
+
+		if fetched, err := s.innerStateStore.HasFetchedMembers(ctx, roomID); err != nil {
+			return nil, fmt.Errorf("check member cache for %s: %w", roomID, err)
+		} else if !fetched {
+			members, err := s.client.Members(ctx, roomID)
+			if err != nil {
+				return nil, fmt.Errorf("fetch members of %s: %w", roomID, err)
+			}
+			// No membership filter, so this also marks the room as fetched.
+			if err := s.innerStateStore.ReplaceCachedMembers(ctx, roomID, members.Chunk); err != nil {
+				return nil, fmt.Errorf("cache members of %s: %w", roomID, err)
+			}
+		}
+	}
+	return s.innerStateStore.GetRoomJoinedOrInvitedMembers(ctx, roomID)
+}

internal/bot/statestore_test.go

@@ -0,0 +1,195 @@
+package bot
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/crypto/cryptohelper"
+	"maunium.net/go/mautrix/id"
+)
+
+// fakeHS serves the two endpoints the lazy store resolves against, counting hits
+// so we can assert it caches instead of re-asking on every send.
+type fakeHS struct {
+	encryptionStatus int
+	encryptionBody   string
+	membersBody      string
+
+	encryptionHits atomic.Int32
+	memberHits     atomic.Int32
+}
+
+func (f *fakeHS) start(t *testing.T) *mautrix.Client {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.Contains(r.URL.Path, "/state/m.room.encryption"):
+			f.encryptionHits.Add(1)
+			w.WriteHeader(f.encryptionStatus)
+			_, _ = w.Write([]byte(f.encryptionBody))
+		case strings.HasSuffix(r.URL.Path, "/members"):
+			f.memberHits.Add(1)
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(f.membersBody))
+		default:
+			t.Errorf("unexpected request to %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	client, err := mautrix.NewClient(srv.URL, "@bot:example.org", "token")
+	if err != nil {
+		t.Fatalf("new client: %v", err)
+	}
+	return client
+}
+
+func newTestStore(t *testing.T, hs *fakeHS) *lazyStateStore {
+	t.Helper()
+	store := newLazyStateStore(mautrix.NewMemoryStateStore().(innerStateStore))
+	store.client = hs.start(t)
+	return store
+}
+
+// The store is handed to the crypto helper, which type-asserts it and refuses to
+// start if it comes up short. That assertion is the whole bot's startup path, so
+// pin it here rather than discovering it as a crash loop in prod.
+func TestStoreSatisfiesCryptoHelper(t *testing.T) {
+	store := newTestStore(t, &fakeHS{})
+
+	client := store.client
+	client.StateStore = store
+
+	dir := t.TempDir()
+	if _, err := cryptohelper.NewCryptoHelper(client, []byte("test"), filepath.Join(dir, "crypto.db")); err != nil {
+		t.Fatalf("crypto helper rejected the state store, so the bot would not start: %v", err)
+	}
+}
+
+const roomID = id.RoomID("!room:example.org")
+
+// The regression: a room configured as encrypted before the process started. No
+// transaction ever re-announces it, so the store must go ask.
+func TestIsEncryptedResolvesFromServer(t *testing.T) {
+	hs := &fakeHS{
+		encryptionStatus: http.StatusOK,
+		encryptionBody:   `{"algorithm":"m.megolm.v1.aes-sha2"}`,
+	}
+	store := newTestStore(t, hs)
+
+	enc, err := store.IsEncrypted(context.Background(), roomID)
+	if err != nil {
+		t.Fatalf("IsEncrypted: %v", err)
+	}
+	if !enc {
+		t.Fatal("room is encrypted on the server but IsEncrypted said false — this is the plaintext leak")
+	}
+}
+
+// A room with no m.room.encryption really is plaintext, and must not re-fetch.
+func TestIsEncryptedCachesUnencrypted(t *testing.T) {
+	hs := &fakeHS{
+		encryptionStatus: http.StatusNotFound,
+		encryptionBody:   `{"errcode":"M_NOT_FOUND","error":"Event not found."}`,
+	}
+	store := newTestStore(t, hs)
+
+	for i := 0; i < 3; i++ {
+		enc, err := store.IsEncrypted(context.Background(), roomID)
+		if err != nil {
+			t.Fatalf("IsEncrypted: %v", err)
+		}
+		if enc {
+			t.Fatal("unencrypted room reported as encrypted")
+		}
+	}
+	if got := hs.encryptionHits.Load(); got != 1 {
+		t.Errorf("expected the M_NOT_FOUND to be cached, got %d fetches", got)
+	}
+}
+
+// The important half: an unresolvable room must fail the send, not quietly
+// answer "not encrypted" and let the message out in the clear.
+func TestIsEncryptedFailsClosed(t *testing.T) {
+	hs := &fakeHS{
+		encryptionStatus: http.StatusInternalServerError,
+		encryptionBody:   `{"errcode":"M_UNKNOWN","error":"oops"}`,
+	}
+	store := newTestStore(t, hs)
+
+	if _, err := store.IsEncrypted(context.Background(), roomID); err == nil {
+		t.Fatal("a failed lookup returned no error; the send would proceed in plaintext")
+	}
+	// The failure must not poison the cache: a later send has to retry.
+	hs.encryptionStatus = http.StatusOK
+	hs.encryptionBody = `{"algorithm":"m.megolm.v1.aes-sha2"}`
+	enc, err := store.IsEncrypted(context.Background(), roomID)
+	if err != nil {
+		t.Fatalf("IsEncrypted after recovery: %v", err)
+	}
+	if !enc {
+		t.Fatal("store did not retry after a transient failure")
+	}
+}
+
+// A burst of proactive sends into a cold room should resolve it once.
+func TestIsEncryptedResolvesOncePerRoom(t *testing.T) {
+	hs := &fakeHS{
+		encryptionStatus: http.StatusOK,
+		encryptionBody:   `{"algorithm":"m.megolm.v1.aes-sha2"}`,
+	}
+	store := newTestStore(t, hs)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if _, err := store.IsEncrypted(context.Background(), roomID); err != nil {
+				t.Errorf("IsEncrypted: %v", err)
+			}
+		}()
+	}
+	wg.Wait()
+
+	if got := hs.encryptionHits.Load(); got != 1 {
+		t.Errorf("expected 1 state fetch for 20 concurrent sends, got %d", got)
+	}
+}
+
+// Encrypting to an empty member list would share the group session with nobody,
+// so members must be resolved too.
+func TestMembersResolveFromServer(t *testing.T) {
+	hs := &fakeHS{
+		encryptionStatus: http.StatusOK,
+		encryptionBody:   `{"algorithm":"m.megolm.v1.aes-sha2"}`,
+		membersBody: `{"chunk":[
+			{"type":"m.room.member","room_id":"!room:example.org","state_key":"@alice:example.org","sender":"@alice:example.org","content":{"membership":"join"}},
+			{"type":"m.room.member","room_id":"!room:example.org","state_key":"@bot:example.org","sender":"@bot:example.org","content":{"membership":"join"}}
+		]}`,
+	}
+	store := newTestStore(t, hs)
+
+	members, err := store.GetRoomJoinedOrInvitedMembers(context.Background(), roomID)
+	if err != nil {
+		t.Fatalf("GetRoomJoinedOrInvitedMembers: %v", err)
+	}
+	if len(members) != 2 {
+		t.Fatalf("expected 2 members, got %d (%v) — the group session would be shared to nobody", len(members), members)
+	}
+
+	if _, err := store.GetRoomJoinedOrInvitedMembers(context.Background(), roomID); err != nil {
+		t.Fatalf("second call: %v", err)
+	}
+	if got := hs.memberHits.Load(); got != 1 {
+		t.Errorf("expected members to be cached after one fetch, got %d", got)
+	}
+}

internal/db/db.go

@@ -306,6 +306,18 @@ func runMigrations(d *sql.DB) error {
 		`ALTER TABLE player_meta ADD COLUMN title TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE player_meta ADD COLUMN treasures_locked INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE player_meta ADD COLUMN crafts_succeeded INTEGER NOT NULL DEFAULT 0`,
+		// Bored adventurers (gogobee_boredom_plan.md §1). The idle clock for
+		// autonomous expedition starts. Deliberately NOT last_active_at: that
+		// one is auto-bumped by saveAdvCharacter, so the autopilot's own writes
+		// would refresh a bored character's idle clock and it would never
+		// qualify again. Written only by markPlayerAction, from a real player
+		// action against Adventure (any interface, not just Matrix chatter).
+		`ALTER TABLE player_meta ADD COLUMN last_player_action_at DATETIME`,
+		`ALTER TABLE player_meta ADD COLUMN last_boredom_at DATETIME`,
+		// Marks an expedition the adventurer started by itself. The idle reaper
+		// reads it: an expedition nobody asked for must not shield its player
+		// from the shame DM or hold their streak (gogobee_boredom_plan.md §6).
+		`ALTER TABLE dnd_expedition ADD COLUMN boredom INTEGER NOT NULL DEFAULT 0`,
 		// Adv 2.0 Phase G1 — branching zone graph run-state columns.
 		// current_node / visited_nodes / node_choices live alongside the
 		// legacy current_room / room_seq_json during the migration; the
@@ -357,6 +369,85 @@ func runMigrations(d *sql.DB) error {
 		// row and no bootstrap backfill is needed. The column is a read guard:
 		// loadCombatParticipants is skipped entirely when it reads 1.
 		`ALTER TABLE combat_session ADD COLUMN roster_size INTEGER NOT NULL DEFAULT 1`,
+		// N4/E1 housing vault (gogobee_engagement_plan.md §E1). A Tier-4 Estate
+		// unlocks a 10-slot vault that shelters items from sale/use. Rather than a
+		// parallel table, a stowed item keeps its identity (id, temper, everything)
+		// and flips in_vault=1; loadAdvInventory filters it back out, so a vaulted
+		// item drops out of sell/craft/combat readers as one flag change. DEFAULT 0
+		// = "in play", correct for every pre-existing row, so no bootstrap backfill.
+		`ALTER TABLE adventure_inventory ADD COLUMN in_vault INTEGER NOT NULL DEFAULT 0`,
+		// N4/E1 second pet slot (gogobee_engagement_plan.md §E1). A Tier-4 Estate
+		// unlocks a second companion. It lives in a parallel pet2_* column set
+		// rather than a rows table so the single-pet path (and its combat golden)
+		// is untouched: absent pet2_type == "no second pet", DEFAULT '' is correct
+		// for every pre-existing row, so no bootstrap backfill. Pet 2 carries only
+		// what it needs — identity, level, barding — and deliberately skips the
+		// supply-shop unlock (a pet-1 mechanic) and morning-defense flag.
+		`ALTER TABLE player_meta ADD COLUMN pet2_type TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_name TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_xp INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_level INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_armor_tier INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_flags_json TEXT NOT NULL DEFAULT '{}'`,
+		`ALTER TABLE player_meta ADD COLUMN pet2_level_10_date TEXT NOT NULL DEFAULT ''`,
+		// N5/D1 the Hollow King campaign (gogobee_engagement_plan.md §D1). Found
+		// journal pages are a bitmask (bit i == page i+1 discovered), granted one at
+		// a time from elite kills and secret rooms. A single INTEGER rather than a
+		// rows table: pages are static content, only found/not-found is per-player,
+		// and grants are an atomic bitwise-OR so a page can't be lost to a stale
+		// character save. DEFAULT 0 == "no pages found", correct for every
+		// pre-existing row, so no bootstrap backfill.
+		`ALTER TABLE player_meta ADD COLUMN journal_pages INTEGER NOT NULL DEFAULT 0`,
+		// N5/D1c the Hollow King finale (gogobee_engagement_plan.md §D1). Set once,
+		// the first time a player closes the account — the reward (unique title +
+		// one Legendary) drops only on that first clear; later rematches are
+		// flavour-only. Written by a dedicated atomic UPDATE, never the bulk
+		// character save, so a monotonic false→true flag can't be clobbered.
+		// DEFAULT 0 correct for every pre-existing row, so no bootstrap.
+		`ALTER TABLE player_meta ADD COLUMN epilogue_cleared INTEGER NOT NULL DEFAULT 0`,
+		// N7/B2 Renown (gogobee_engagement_plan.md §B2). At the L20 cap, overflow
+		// XP that grantDnDXP used to drop instead accumulates here as cumulative
+		// prestige XP. renown_xp is monotonic and written by an atomic += (the
+		// journal_pages pattern), never the bulk character save; renown_level is
+		// DERIVED from it (renown_xp / renownXPPerLevel) rather than stored, so
+		// there is no read-modify-write race and no second field to disagree.
+		// DEFAULT 0 == "no renown", correct for every pre-existing row, no bootstrap.
+		`ALTER TABLE player_meta ADD COLUMN renown_xp INTEGER NOT NULL DEFAULT 0`,
+
+		// The hireable companion (pete_adventure_news_plan.md, "Pete as a
+		// character"). Pete's roster seat records the class and level he was
+		// hired at, so a party that levels mid-expedition doesn't silently
+		// re-roll its hireling into a different class three rooms in. Both are
+		// empty/0 on every player row and are only ever read for the one seat
+		// where isCompanionSeat holds — a player's row never consults them.
+		`ALTER TABLE expedition_party ADD COLUMN companion_class TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE expedition_party ADD COLUMN companion_level INTEGER NOT NULL DEFAULT 0`,
+
+		// The companion's spell-slot ledger, "used" per slot level, as a compact
+		// CSV of six ints (index 0 unused; cantrips cost nothing).
+		//
+		// It has to live on the *expedition*, next to the class and level it is a
+		// pool for. A human caster's slots are dnd_spell_slots rows that persist
+		// across every fight of the run and only come back at camp, so rationing a
+		// pool across a 30-room day IS the caster's game. The first cut of this
+		// parked the companion's ledger on his combat seat instead — and a seat is
+		// per-session, so he walked into every single fight with a full pool. The
+		// sim caught it: a level-penalized, gearless hireling out-cleared a human
+		// cleric of the leader's own level by 15pp.
+		`ALTER TABLE expedition_party ADD COLUMN companion_slots_used TEXT NOT NULL DEFAULT ''`,
+
+		// The companion's body, carried across the run. -1 means "unset" — he is
+		// at full, which is what a fresh hire is.
+		//
+		// He used to re-seat at full max HP for *every* fight, because he has no
+		// dnd_character row for his HP to persist onto and the close-out skipped
+		// him ("he arrives fresh next time"). That is an infinite body: a player
+		// bleeds across a 30-room run and only heals at camp, while the hireling
+		// soaked half the incoming damage and reset. Measured, it is most of why a
+		// gearless, level-penalized hireling out-cleared a human cleric of the
+		// leader's own level — his party fled 5 runs out of 640 where the human
+		// party fled 56.
+		`ALTER TABLE expedition_party ADD COLUMN companion_hp INTEGER NOT NULL DEFAULT -1`,
 	}
 	for _, stmt := range columnMigrations {
 		if _, err := d.Exec(stmt); err != nil {
@@ -572,6 +663,15 @@ func RunMaintenance() {
 		{"urban_cache", `DELETE FROM urban_cache WHERE cached_at < ?`, []interface{}{cutoff30d}},
 		{"url_cache", `DELETE FROM url_cache WHERE cached_at < ?`, []interface{}{cutoff30d}},
 
+		// Pete adventure-news queue — reap delivered rows (kept only for
+		// idempotency); undelivered rows stay so the sender can retry/park them.
+		{"pete_emit_queue", `DELETE FROM pete_emit_queue WHERE sent_at IS NOT NULL AND sent_at < ?`, []interface{}{cutoff7d}},
+		// ...and reap permanently-parked rows: the sender exhausts its retries
+		// within a few hours, so anything still unsent after 30 days is dead
+		// weight the drain query already skips — drop it so a durable outage
+		// can't accrete rows forever.
+		{"pete_emit_queue_parked", `DELETE FROM pete_emit_queue WHERE sent_at IS NULL AND created_at < ?`, []interface{}{cutoff30d}},
+
 		// Rate limits — purge entries older than today
 		{"rate_limits", `DELETE FROM rate_limits WHERE date < ?`, []interface{}{today}},
 
@@ -903,6 +1003,46 @@ CREATE TABLE IF NOT EXISTS shade_optout (
 	user_id TEXT PRIMARY KEY
 );
 
+-- Pete adventure-news seam: durable outbound queue of game-event facts sent to
+-- the Pete news bot. Emit enqueues (INSERT OR IGNORE on guid = idempotency); a
+-- background sender drains rows where sent_at IS NULL. Keyed on the fact guid so
+-- retries and duplicate emits collapse to one row.
+CREATE TABLE IF NOT EXISTS pete_emit_queue (
+	guid            TEXT PRIMARY KEY,
+	payload         TEXT NOT NULL,
+	created_at      INTEGER NOT NULL DEFAULT (unixepoch()),
+	attempts        INTEGER NOT NULL DEFAULT 0,
+	next_attempt_at INTEGER NOT NULL DEFAULT 0,
+	sent_at         INTEGER
+);
+
+-- Players who opted out of being named in Pete's adventure news. Enforced at
+-- emit time (anonymize, never delete). Mirrors shade_optout.
+CREATE TABLE IF NOT EXISTS news_optout (
+	user_id      TEXT PRIMARY KEY,
+	opted_out_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+-- Realm-first ledger for adventure news: the first (kind,target) occurrence
+-- across all players. INSERT OR IGNORE returns rows-affected>0 exactly once, so
+-- the first clear of a zone/boss fires as a PRIORITY realm-first and everyone
+-- after as a BULLETIN personal clear. Seeded by the cold-start backfill so a
+-- fresh deploy doesn't re-flag historically-cleared content as first-ever.
+CREATE TABLE IF NOT EXISTS news_realm_firsts (
+	kind     TEXT NOT NULL,
+	target   TEXT NOT NULL,
+	first_at INTEGER NOT NULL,
+	PRIMARY KEY (kind, target)
+);
+
+-- Durable runtime config for adventure news (e.g. the emission kill-switch).
+-- Deliberately NOT stored in api_cache: RunMaintenance prunes that table after
+-- 7 days, which would silently revert an operator's !news off back to on.
+CREATE TABLE IF NOT EXISTS news_config (
+	key   TEXT PRIMARY KEY,
+	value TEXT NOT NULL
+);
+
 -- Birthdays
 CREATE TABLE IF NOT EXISTS birthdays (
 	user_id TEXT PRIMARY KEY,
@@ -1376,6 +1516,21 @@ CREATE TABLE IF NOT EXISTS adventure_activity_log (
 );
 CREATE INDEX IF NOT EXISTS idx_adv_log_user ON adventure_activity_log(user_id, logged_at);
 
+-- N4/E2 item gifting. One row per gift; the sender's row count for the current
+-- UTC day enforces the daily cap (twink-funnel guard), and the full log is an
+-- audit trail. gift_day is the UTC date string the cap counts against, kept
+-- alongside given_at so the count is a plain equality match, not a range scan.
+CREATE TABLE IF NOT EXISTS adventure_gift_log (
+	id         INTEGER PRIMARY KEY AUTOINCREMENT,
+	sender     TEXT NOT NULL,
+	recipient  TEXT NOT NULL,
+	item_name  TEXT NOT NULL,
+	value      INTEGER NOT NULL DEFAULT 0,
+	gift_day   TEXT NOT NULL,
+	given_at   DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_adv_gift_sender_day ON adventure_gift_log(sender, gift_day);
+
 CREATE TABLE IF NOT EXISTS adventure_treasures (
 	id           INTEGER PRIMARY KEY AUTOINCREMENT,
 	user_id      TEXT NOT NULL,
@@ -1559,12 +1714,64 @@ CREATE TABLE IF NOT EXISTS adventure_rival_challenges (
 );
 CREATE INDEX IF NOT EXISTS idx_rival_challenges_user ON adventure_rival_challenges(challenged_id, expires_at);
 
+-- Duels (N6/C2): player-initiated, staked, no-death combat bouts. Both stakes
+-- are escrowed while the row lives; expiry/decline refunds the challenger. W/L
+-- history reuses adventure_rival_records. No bootstrap — absent row == no duel.
+CREATE TABLE IF NOT EXISTS adventure_duel_challenges (
+	challenge_id  TEXT PRIMARY KEY,
+	challenger_id TEXT NOT NULL,
+	challenged_id TEXT NOT NULL,
+	stake         INTEGER NOT NULL,
+	expires_at    DATETIME NOT NULL,
+	created_at    DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_duel_challenges_user ON adventure_duel_challenges(challenged_id, expires_at);
+CREATE INDEX IF NOT EXISTS idx_duel_challenges_expiry ON adventure_duel_challenges(expires_at);
+
 CREATE TABLE IF NOT EXISTS community_pot (
 	id         INTEGER PRIMARY KEY DEFAULT 1,
 	balance    INTEGER NOT NULL DEFAULT 0,
 	updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
+-- Mischief Makers: a paid monster hit on a player who is out on an expedition.
+-- The buyer's euros are debited at placement (paid); fee is the payout basis the
+-- target's survival purse is a percentage of — the sign surcharge is a pure sink
+-- and never inflates the purse, which is what keeps a payout strictly below what
+-- the buyer spent (collusion loses to !baltransfer, which is free).
+--
+-- Lifecycle: open → delivering → delivered (outcome survived|downed) | fizzled.
+-- Every transition is a conditional UPDATE, so a double-fire of the ticker or a
+-- restart mid-delivery can never pay twice. No bootstrap — absent row == no
+-- contract in flight.
+CREATE TABLE IF NOT EXISTS mischief_contracts (
+	contract_id      TEXT PRIMARY KEY,
+	buyer_id         TEXT NOT NULL,
+	target_id        TEXT NOT NULL,
+	tier             TEXT NOT NULL,
+	fee              INTEGER NOT NULL,
+	paid             INTEGER NOT NULL,
+	status           TEXT NOT NULL,
+	signed           INTEGER NOT NULL DEFAULT 0,
+	escalation_count INTEGER NOT NULL DEFAULT 0,
+	blessing_count   INTEGER NOT NULL DEFAULT 0,
+	source           TEXT NOT NULL DEFAULT 'matrix',
+	outcome          TEXT,
+	created_at       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	window_ends_at   DATETIME NOT NULL,
+	resolved_at      DATETIME
+);
+-- One live contract per target, enforced by the database rather than by a
+-- read-then-write check. The placement path holds only the BUYER's lock, so two
+-- different buyers racing to hit the same person would both pass an in-code
+-- "is one already live?" test. This partial unique index is what actually stops
+-- the second insert; the loser is refunded.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_mischief_one_live_per_target
+	ON mischief_contracts(target_id) WHERE status IN ('open', 'delivering');
+CREATE INDEX IF NOT EXISTS idx_mischief_target ON mischief_contracts(target_id, status);
+CREATE INDEX IF NOT EXISTS idx_mischief_buyer ON mischief_contracts(buyer_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_mischief_due ON mischief_contracts(status, window_ends_at);
+
 -- Babysitting Service
 CREATE TABLE IF NOT EXISTS adventure_babysit_log (
 	id            INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -2164,6 +2371,73 @@ CREATE TABLE IF NOT EXISTS expedition_invite (
 );
 CREATE INDEX IF NOT EXISTS idx_expedition_invite_user
     ON expedition_invite(user_id);
+
+-- ── N6/D3 — the Shadow: a simulated rival adventurer ──────────────────────
+-- One row per player, born lazily the first midnight after their character
+-- exists. The Shadow "runs" the same zone progression on a simulated schedule
+-- (~1.3x the player's own clear pace), advanced once per UTC day by the
+-- midnight ticker. Pure theatre: no combat, no punishment — only race
+-- pressure surfaced in the morning briefing and a payoff at each zone clear.
+--
+-- Absent == the player has no Shadow yet, which is true of every row that
+-- existed before N6, so there is nothing to backfill. The ticker mints the
+-- row on first advance. This table is deliberately NOT part of the
+-- player_meta save fan-out: the ticker owns it, so a character save can never
+-- clobber the Shadow's advance (the same isolation journal_pages earns by
+-- being grant-only, made structural here).
+--
+-- name:          the rival's proper name, seeded deterministically from the
+--                player's display name at birth.
+-- progress:      cumulative zone-units the Shadow has run (fractional, so a
+--                slow player still sees it creep between clears).
+-- zones_cleared: floor(progress) at the last advance — the committed count,
+--                stored so the next advance can tell which zones were newly
+--                finished.
+-- pending_mask:  zones (by progression index bit) the Shadow cleared before
+--                the player did — a journal page waits in each until the
+--                player clears that zone's boss.
+-- crowed_mask:   zones the player beat the Shadow to and has already been
+--                crowed a bonus for — set-once, so re-running a zone the
+--                Shadow hasn't reached can't farm the crow XP.
+-- day_counter:   the Shadow's own day count, for flavour variety.
+-- last_advanced: UTC date of the last advance; the per-day idempotency guard.
+CREATE TABLE IF NOT EXISTS adventure_shadow (
+    user_id       TEXT PRIMARY KEY,
+    name          TEXT NOT NULL,
+    progress      REAL NOT NULL DEFAULT 0,
+    zones_cleared INTEGER NOT NULL DEFAULT 0,
+    pending_mask  INTEGER NOT NULL DEFAULT 0,
+    crowed_mask   INTEGER NOT NULL DEFAULT 0,
+    day_counter   INTEGER NOT NULL DEFAULT 0,
+    last_advanced TEXT NOT NULL DEFAULT '',
+    born_at       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- World boss (N6/C3) — the monthly communal "Siege". One event at a time is
+-- live (status='active'); the ticker resolves it at hp_current<=0 (defeated) or
+-- after ends_at (survived). History rows are retained (autoincrement id), so
+-- world_boss_contrib keys on boss_id. Deliberately its own tables, outside the
+-- player_meta save fan-out, so a character save can't clobber the shared pool.
+CREATE TABLE IF NOT EXISTS world_boss (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    name       TEXT    NOT NULL,
+    tier       INTEGER NOT NULL DEFAULT 5,
+    hp_max     INTEGER NOT NULL,
+    hp_current INTEGER NOT NULL,
+    status     TEXT    NOT NULL DEFAULT 'active',
+    starts_at  DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    ends_at    DATETIME NOT NULL,
+    resolved_at DATETIME
+);
+
+CREATE TABLE IF NOT EXISTS world_boss_contrib (
+    boss_id         INTEGER NOT NULL,
+    user_id         TEXT    NOT NULL,
+    fights          INTEGER NOT NULL DEFAULT 0,
+    damage          INTEGER NOT NULL DEFAULT 0,
+    last_fight_date TEXT    NOT NULL DEFAULT '',
+    PRIMARY KEY (boss_id, user_id)
+);
 `
 
 // SeedSchedulerDefaults inserts default scheduler jobs if they don't exist.

internal/flavor/twinbee_expedition_flavor.go

@@ -25,6 +25,25 @@ var ExpeditionStart = []string{
 	"Like the opening screen of a long RPG — the kind that asks for your name and warns you to find a comfortable position because this is going to take a while. I've found a comfortable position. I suggest you do the same.",
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// EXPEDITION START — BOREDOM (the adventurer left without you)
+//
+// Fired by the boredom ticker after a long silence. The player is not
+// reading this live; it's a note left on the table. Deadpan, faintly
+// reproachful, never cruel — and never pretending the gear got checked,
+// because it didn't (gogobee_boredom_plan.md §5).
+// ─────────────────────────────────────────────────────────────────────────────
+
+var ExpeditionBoredomStart = []string{
+	"You didn't come. That's alright — it happens, and I'm not going to make it a thing. But the sword was getting heavy on the wall and I've packed what we had. Which was not much. Noted for the record, not as a complaint.",
+	"I waited. Then I waited past the point where waiting was the sensible option, and somewhere in there the waiting turned into leaving. We're going. Same kit as last time, because last time is when you last touched it.",
+	"Here's the situation: there's a dungeon, there's daylight, and there's nobody telling me not to. I've made a decision. I hope it was the one you'd have made, though I concede I have no way of checking.",
+	"Supplies: the cheapest available. Equipment: whatever was already on the rack. Plan: walk in, see what happens. I'm aware of how that sounds. I'm going anyway.",
+	"The gear hasn't moved since you left it. I checked. I checked twice, actually, in case the first check was wrong, and it wasn't. So we go as we are — which is to say, as we were.",
+	"Restlessness is not a stat I can show you on the sheet, but it accumulates, and it has. Off we go. Lightly provisioned and unimproved, but off.",
+	"I've done the arithmetic on standing still and it doesn't come out well. So: a dungeon, one supply pack, and the same armour that's been good enough up to now. 'Good enough' is doing a lot of work in that sentence.",
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // MORNING BRIEFINGS — Generic
 // ─────────────────────────────────────────────────────────────────────────────

internal/peteclient/client.go

@@ -0,0 +1,275 @@
+// Package peteclient is gogobee's outbound seam to the Pete news bot.
+//
+// gogobee is the source of game-event *facts* and owns delivery; Pete owns
+// voice, authoring, and publishing. This package carries structured facts (not
+// prose) to Pete's ingest endpoint over the tailnet, bearer-authed.
+//
+// Delivery is durable: Emit writes the fact to a SQLite queue and returns
+// immediately, so a game-loop hook never blocks on the network and a Pete
+// restart loses nothing. A background sender drains the queue with retry.
+// Idempotency is on the fact GUID, so retries and duplicate emits are no-ops.
+package peteclient
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+)
+
+// Fact is the flat, pre-sanitized payload gogobee POSTs to Pete. Names must be
+// character names only (never Matrix handles); Actors is the allow-list of the
+// only names permitted to appear in Pete's rendered output. See
+// pete_adventure_news_voice.md for the field contract.
+type Fact struct {
+	GUID       string   `json:"guid"` // stable idempotency key, e.g. "death:<token>:<ts>"; prefix == event_type
+	EventType  string   `json:"event_type"`
+	Tier       string   `json:"tier"` // "priority" | "bulletin"
+	Actors     []string `json:"actors"`
+	Subject    string   `json:"subject,omitempty"`
+	Opponent   string   `json:"opponent,omitempty"`
+	Boss       string   `json:"boss,omitempty"`
+	Zone       string   `json:"zone,omitempty"`
+	Region     string   `json:"region,omitempty"`
+	Level      int      `json:"level,omitempty"`
+	Count      int      `json:"count,omitempty"`
+	Outcome    string   `json:"outcome,omitempty"`
+	Stakes     string   `json:"stakes,omitempty"`
+	ClassRace  string   `json:"class_race,omitempty"`
+	Milestone  string   `json:"milestone,omitempty"`
+	OccurredAt int64    `json:"occurred_at"`
+	NoPush     bool     `json:"no_push,omitempty"` // backfill: suppress Pete web-push
+}
+
+// Config controls the seam. Enabled=false makes Emit a durable no-op (nothing
+// queued), matching the FEATURE_PETE_NEWS master switch that kills emission at
+// the source.
+type Config struct {
+	IngestURL string
+	Token     string
+	Enabled   bool
+}
+
+// Client is the transport half. It is a package singleton initialized by Init,
+// so emit hooks scattered across plugins (and free functions like
+// markAdventureDead) can call Emit without threading a handle through.
+type Client struct {
+	cfg  Config
+	http *http.Client
+}
+
+var std *Client
+
+// Tuning for the background sender.
+const (
+	senderTick    = 15 * time.Second
+	senderBatch   = 20
+	maxAttempts   = 8 // ~ up to a few hours of backoff, then park
+	backoffBase   = 30 * time.Second
+	backoffCapSec = 3600
+	sendTimeout   = 15 * time.Second
+)
+
+// Init wires the singleton from the environment. Mirrors the per-plugin config
+// pattern (email_nag.go): PETE_INGEST_URL, PETE_INGEST_TOKEN, FEATURE_PETE_NEWS.
+func Init() {
+	cfg := Config{
+		IngestURL: strings.TrimRight(os.Getenv("PETE_INGEST_URL"), "/"),
+		Token:     os.Getenv("PETE_INGEST_TOKEN"),
+		Enabled:   strings.EqualFold(os.Getenv("FEATURE_PETE_NEWS"), "true"),
+	}
+	if cfg.Enabled && (cfg.IngestURL == "" || cfg.Token == "") {
+		slog.Warn("peteclient: FEATURE_PETE_NEWS=true but PETE_INGEST_URL/PETE_INGEST_TOKEN unset — disabling")
+		cfg.Enabled = false
+	}
+	std = &Client{cfg: cfg, http: &http.Client{Timeout: sendTimeout}}
+	if cfg.Enabled {
+		slog.Info("peteclient: adventure news emission enabled", "ingest", cfg.IngestURL)
+	} else {
+		slog.Info("peteclient: adventure news emission disabled (set FEATURE_PETE_NEWS=true)")
+	}
+}
+
+// Enabled reports whether emission is on. Callers can skip building an
+// (expensive) fact when it would be dropped anyway.
+func Enabled() bool { return std != nil && std.cfg.Enabled }
+
+// Emit durably queues a fact for delivery to Pete. It never blocks on the
+// network. A no-op (but safe) when the seam is disabled or the GUID was already
+// queued — idempotency is on the GUID primary key.
+func Emit(f Fact) {
+	if !Enabled() {
+		return
+	}
+	if f.GUID == "" {
+		slog.Error("peteclient: refusing to queue fact with empty guid", "event_type", f.EventType)
+		return
+	}
+	payload, err := json.Marshal(f)
+	if err != nil {
+		slog.Error("peteclient: marshal fact", "guid", f.GUID, "err", err)
+		return
+	}
+	// OR IGNORE gives GUID-idempotency: a re-emit of the same event is dropped.
+	db.Exec("pete emit enqueue",
+		`INSERT OR IGNORE INTO pete_emit_queue (guid, payload, created_at, attempts, next_attempt_at)
+		 VALUES (?, ?, unixepoch(), 0, 0)`,
+		f.GUID, string(payload))
+}
+
+// StartSender launches the background drain loop. It runs until ctx is
+// canceled. Safe to call when disabled — it simply idles.
+func StartSender(ctx context.Context) {
+	if std == nil {
+		return
+	}
+	go func() {
+		t := time.NewTicker(senderTick)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				if std.cfg.Enabled {
+					std.drain(ctx)
+				}
+			}
+		}
+	}()
+}
+
+// drain sends up to senderBatch due rows, one at a time.
+func (c *Client) drain(ctx context.Context) {
+	rows, err := db.Get().Query(
+		`SELECT guid, payload FROM pete_emit_queue
+		 WHERE sent_at IS NULL AND attempts < ? AND next_attempt_at <= unixepoch()
+		 ORDER BY created_at LIMIT ?`,
+		maxAttempts, senderBatch)
+	if err != nil {
+		slog.Error("peteclient: drain query", "err", err)
+		return
+	}
+	type item struct{ guid, payload string }
+	var batch []item
+	for rows.Next() {
+		var it item
+		if err := rows.Scan(&it.guid, &it.payload); err != nil {
+			slog.Error("peteclient: drain scan", "err", err)
+			continue
+		}
+		batch = append(batch, it)
+	}
+	rows.Close()
+
+	for _, it := range batch {
+		if ctx.Err() != nil {
+			return
+		}
+		if err := c.send(ctx, []byte(it.payload)); err != nil {
+			if ctx.Err() != nil {
+				// Shutdown canceled the in-flight send — Pete didn't reject
+				// anything. Don't burn a durable retry attempt; the row is picked
+				// up on the next boot's drain.
+				return
+			}
+			db.Exec("pete emit retry",
+				`UPDATE pete_emit_queue
+				 SET attempts = attempts + 1, next_attempt_at = unixepoch() + ?
+				 WHERE guid = ?`,
+				backoffSec(it.guid), it.guid)
+			slog.Warn("peteclient: emit failed, will retry", "guid", it.guid, "err", err)
+			continue
+		}
+		db.Exec("pete emit sent",
+			`UPDATE pete_emit_queue SET sent_at = unixepoch() WHERE guid = ?`, it.guid)
+	}
+}
+
+// RosterEntry is one adventurer's currently-true state for Pete's live board.
+// Unlike a Fact, nothing here is an event — it is what is true right now.
+type RosterEntry struct {
+	Token     string `json:"token"` // stable per-player board token, never a Matrix handle
+	Name      string `json:"name"`  // character name only
+	Level     int    `json:"level"`
+	ClassRace string `json:"class_race,omitempty"`
+	Status    string `json:"status"` // "expedition" | "idle"
+	Zone      string `json:"zone,omitempty"`
+	Region    string `json:"region,omitempty"`
+	Day       int    `json:"day,omitempty"`
+	IdleHours int    `json:"idle_hours,omitempty"`
+}
+
+// RosterSnapshot is the complete board. Complete is load-bearing: Pete replaces
+// its whole board with this, so anyone omitted (opted out, no character) drops
+// off the public page. A partial snapshot would silently strand people on it.
+type RosterSnapshot struct {
+	SnapshotAt  int64         `json:"snapshot_at"`
+	Adventurers []RosterEntry `json:"adventurers"`
+}
+
+// PushRoster sends the board to Pete, synchronously, and drops it on failure.
+//
+// Deliberately NOT on the durable queue that carries Facts. A fact is history —
+// losing "Josie died" loses it forever, so it retries. A snapshot is a
+// photograph of the present, and a retried one is a *lie*: by the time it lands,
+// Josie has moved. The next tick carries the truth anyway, so a failed push is
+// simply forgotten. That is also what lets Pete's staleness timer work — if we
+// stay down, nothing arrives, and the board correctly stops claiming to be live.
+func PushRoster(ctx context.Context, snap RosterSnapshot) error {
+	if !Enabled() {
+		return nil
+	}
+	payload, err := json.Marshal(snap)
+	if err != nil {
+		return err
+	}
+	return std.post(ctx, "/api/ingest/roster", payload)
+}
+
+// send POSTs one payload to Pete's ingest endpoint with bearer auth. Mirrors the
+// bearer-POST pattern in email_nag.go:sendCode.
+func (c *Client) send(ctx context.Context, payload []byte) error {
+	return c.post(ctx, "/api/ingest/adventure", payload)
+}
+
+func (c *Client) post(ctx context.Context, path string, payload []byte) error {
+	url := c.cfg.IngestURL + path
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.cfg.Token)
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	if resp.StatusCode/100 != 2 {
+		return fmt.Errorf("pete ingest status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
+
+// backoffSec computes the retry delay for a row. It re-reads the current attempt
+// count so the delay grows geometrically without needing it passed in.
+func backoffSec(guid string) int {
+	var attempts int
+	_ = db.Get().QueryRow(`SELECT attempts FROM pete_emit_queue WHERE guid = ?`, guid).Scan(&attempts)
+	// attempts is the count *before* this failure's increment; delay off it.
+	delay := int(backoffBase.Seconds()) << attempts
+	if delay > backoffCapSec {
+		delay = backoffCapSec
+	}
+	return delay
+}

internal/peteclient/client_test.go

@@ -0,0 +1,91 @@
+package peteclient
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"gogobee/internal/db"
+)
+
+// TestEmitDrainRoundTrip proves the durable path: Emit queues a fact, the sender
+// POSTs it to Pete with bearer auth, and the row is marked sent (so it won't
+// re-send), while a duplicate GUID collapses to one delivery.
+func TestEmitDrainRoundTrip(t *testing.T) {
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+
+	var mu sync.Mutex
+	var got []Fact
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/ingest/adventure" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		body, _ := io.ReadAll(r.Body)
+		var f Fact
+		_ = json.Unmarshal(body, &f)
+		mu.Lock()
+		got = append(got, f)
+		gotAuth = r.Header.Get("Authorization")
+		mu.Unlock()
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	std = &Client{cfg: Config{IngestURL: srv.URL, Token: "tok", Enabled: true}, http: srv.Client()}
+
+	Emit(Fact{GUID: "death:a:1", EventType: "death", Tier: "priority", Subject: "Brannigan", OccurredAt: 1})
+	Emit(Fact{GUID: "death:a:1", EventType: "death", Tier: "priority", Subject: "Brannigan", OccurredAt: 1}) // dup guid
+
+	std.drain(context.Background())
+
+	mu.Lock()
+	defer mu.Unlock()
+	if len(got) != 1 {
+		t.Fatalf("delivered %d facts, want 1 (dup should collapse)", len(got))
+	}
+	if got[0].Subject != "Brannigan" {
+		t.Errorf("subject = %q", got[0].Subject)
+	}
+	if gotAuth != "Bearer tok" {
+		t.Errorf("auth header = %q", gotAuth)
+	}
+
+	var pending int
+	if err := db.Get().QueryRow(`SELECT count(*) FROM pete_emit_queue WHERE sent_at IS NULL`).Scan(&pending); err != nil {
+		t.Fatal(err)
+	}
+	if pending != 0 {
+		t.Errorf("%d rows still pending after successful drain", pending)
+	}
+
+	// A second drain re-sends nothing.
+	std.drain(context.Background())
+	if len(got) != 1 {
+		t.Errorf("re-drained a sent row: %d deliveries", len(got))
+	}
+}
+
+// TestEmitDisabledNoQueue: when disabled, Emit is a durable no-op.
+func TestEmitDisabledNoQueue(t *testing.T) {
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	std = &Client{cfg: Config{Enabled: false}, http: http.DefaultClient}
+	Emit(Fact{GUID: "disabled-guid", EventType: "death", OccurredAt: 1})
+	var n int
+	// db.Init is a process singleton, so this may share state with other tests;
+	// scope the check to this fact's guid.
+	if err := db.Get().QueryRow(`SELECT count(*) FROM pete_emit_queue WHERE guid = 'disabled-guid'`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Errorf("disabled Emit queued %d rows, want 0", n)
+	}
+}

internal/plugin/achievements.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
 
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/id"
@@ -101,7 +102,7 @@ func (p *AchievementsPlugin) checkAndGrant(userID id.UserID) {
 }
 
 func (p *AchievementsPlugin) grant(d *sql.DB, userID id.UserID, achievementID string) {
-	_, err := d.Exec(
+	res, err := d.Exec(
 		`INSERT INTO achievements (user_id, achievement_id) VALUES (?, ?) ON CONFLICT DO NOTHING`,
 		string(userID), achievementID,
 	)
@@ -109,7 +110,43 @@ func (p *AchievementsPlugin) grant(d *sql.DB, userID id.UserID, achievementID st
 		slog.Error("achievements: grant", "user", userID, "achievement", achievementID, "err", err)
 		return
 	}
+	// Only a genuinely new grant is news; a re-check conflict (rows==0) is not.
+	if n, _ := res.RowsAffected(); n == 0 {
+		return
+	}
 	slog.Info("achievements: granted", "user", userID, "achievement", achievementID)
+	p.emitMilestoneNews(d, userID, achievementID)
+}
+
+// emitMilestoneNews files a BULLETIN milestone to Pete for RARE achievements
+// only — rarity-gated to a single holder (per the news selection thresholds) so
+// routine unlocks don't flood the feed. Character name only; no-op unless the
+// seam is enabled.
+func (p *AchievementsPlugin) emitMilestoneNews(d *sql.DB, userID id.UserID, achievementID string) {
+	var holders int
+	if err := d.QueryRow(`SELECT count(*) FROM achievements WHERE achievement_id = ?`, achievementID).Scan(&holders); err != nil || holders != 1 {
+		return
+	}
+	name := charName(userID)
+	if name == "" {
+		return
+	}
+	label := achievementID
+	for _, a := range p.achievements {
+		if a.ID == achievementID {
+			label = a.Name
+			break
+		}
+	}
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("milestone:%s:%s", eventToken(userID, achievementID), achievementID),
+		EventType:  "milestone",
+		Tier:       "bulletin",
+		Subject:    name,
+		Milestone:  label,
+		OccurredAt: ts,
+	}, userID, "")
 }
 
 func (p *AchievementsPlugin) handleAchievements(ctx MessageContext) error {
@@ -1206,9 +1243,39 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 				return false
 			},
 		},
+		// N7/B4 — the Renown wing (gogobee_engagement_plan.md §B4). Passive checks
+		// against the derived Renown level (N7/B2); no event hook needed.
+		{
+			ID: "renown_1", Name: "Beyond the Cap", Description: "Earned your first level of Renown. The story was supposed to be over.",
+			Emoji: "✦",
+			Check: func(d *sql.DB, u id.UserID) bool { return renownAtLeast(d, u, 1) },
+		},
+		{
+			ID: "renown_5", Name: "Storied", Description: "Reached Renown 5. They tell versions of your runs that never happened.",
+			Emoji: "✦",
+			Check: func(d *sql.DB, u id.UserID) bool { return renownAtLeast(d, u, 5) },
+		},
+		{
+			ID: "renown_10", Name: "Fabled", Description: "Reached Renown 10. Somewhere a bard is getting rich off your name.",
+			Emoji: "✦",
+			Check: func(d *sql.DB, u id.UserID) bool { return renownAtLeast(d, u, 10) },
+		},
 	}
 }
 
+// renownAtLeast reports whether the player's derived Renown level (N7/B2) has
+// reached level, reading player_meta.renown_xp through the passed handle.
+func renownAtLeast(d *sql.DB, userID id.UserID, level int) bool {
+	var xp int
+	if err := d.QueryRow(
+		`SELECT renown_xp FROM player_meta WHERE user_id = ?`,
+		string(userID),
+	).Scan(&xp); err != nil {
+		return false
+	}
+	return renownLevelFor(xp) >= level
+}
+
 // ── Expedition achievement helpers ──────────────────────────────────────────
 
 // clearedZoneIDs returns the zones this player has beaten outright. Boss-

internal/plugin/adventure.go

@@ -169,6 +169,8 @@ func (p *AdventurePlugin) Commands() []CommandDef {
 		{Name: "rest", Description: "Rest up (`short`: quick breather, 1h cooldown — `long`: full night, 24h, needs housing or inn)", Usage: "!rest short|long", Category: "Games"},
 		{Name: "arm", Description: "Ready an ability so it fires the moment your next fight starts", Usage: "!arm <ability>", Category: "Games"},
 		{Name: "roll", Description: "Roll dice (NdN+M format, e.g. 2d6+3, d20, 4d6-1)", Usage: "!roll <dice>", Category: "Games"},
+		{Name: "duel", Description: "Challenge another adventurer to a staked, no-death bout", Usage: "!duel @user [stake]", Category: "Games"},
+		{Name: "mischief", Description: "Pay to send a monster after an adventurer who's out on an expedition", Usage: "!mischief send <tier> @user", Category: "Games"},
 		{Name: "stats", Description: "Show your ability scores", Usage: "!stats", Category: "Games"},
 		{Name: "level", Description: "Show your level and XP progress", Usage: "!level", Category: "Games"},
 		{Name: "cast", Description: "Cast a spell (queues for next combat, or resolves now if out of combat)", Usage: "!cast <spell> [--upcast N] [--target @user]", Category: "Games"},
@@ -179,6 +181,11 @@ func (p *AdventurePlugin) Commands() []CommandDef {
 		{Name: "sell", Description: "Sell your hauled materials, fish, and items to Thom Krooke after an expedition (a smooth pitch can land a better price)", Usage: "!sell [list|all|<item>]", Category: "Games"},
 		{Name: "craft", Description: "Craft a discovered recipe at Thom Krooke (consumes ingredients)", Usage: "!craft [list|<recipe>]", Category: "Games"},
 		{Name: "lore", Description: "Dig through Thom Krooke's lore stacks for a new recipe (sharp minds turn up more)", Usage: "!lore", Category: "Games"},
+		{Name: "give", Description: "Gift a consumable or non-magic item to another adventurer (5% handling fee to the community pot; 3/day)", Usage: "!give <item> @user", Category: "Games"},
+		{Name: "town", Description: "Town registry — civic pride, housing street, and the pet showcase", Usage: "!town", Category: "Games"},
+		{Name: "graveyard", Description: "Recent deaths across the guild", Usage: "!graveyard", Category: "Games"},
+		{Name: "rivals", Description: "Your rival duel record, or `!rivals board` for room-wide standings", Usage: "!rivals [board]", Category: "Games"},
+		{Name: "news", Description: "Pete's Adventure News — opt out of being named, or opt back in", Usage: "!news [optout|optin]", Category: "Games"},
 	}
 }
 
@@ -242,6 +249,10 @@ func (p *AdventurePlugin) Init() error {
 	// arrival roll. Both idempotent via JobCompleted gates.
 	bootstrapCasterSpellBackfill()
 	bootstrapGrantStarterPet()
+	// Pete adventure-news cold-start: replay the back-catalogue (realm-firsts,
+	// deaths, single-holder achievements) the first boot the seam is live, so
+	// launch doesn't open onto an empty section. One-shot, kept (see gap #7).
+	p.bootstrapPeteNewsBackfill()
 	// Phase R1 orphan-archive used to run here on every Init, but it
 	// over-archived: it treats any active dnd_zone_run row not linked to
 	// an active expedition as a legacy `!adventure dungeon` orphan, which
@@ -253,6 +264,11 @@ func (p *AdventurePlugin) Init() error {
 	// Revive any characters whose DeadUntil has expired
 	p.catchUpRespawns(chars)
 
+	// Seed the boredom idle clock before the ticker that reads it can wake:
+	// an unseeded column reads as "idle since character creation" for every
+	// pre-existing player.
+	bootstrapBoredomClock()
+
 	// Start schedulers — single shared stopCh allows graceful shutdown.
 	if p.stopCh == nil {
 		p.stopCh = make(chan struct{})
@@ -270,9 +286,16 @@ func (p *AdventurePlugin) Init() error {
 	go p.expeditionRecapTicker()
 	go p.expeditionAmbientTicker()
 	go p.expeditionAutoRunTicker()
+	go p.peteRosterTicker()
+	go p.expeditionExtractionSweepTicker()
+	go p.expeditionBoredomTicker()
+	go p.mischiefTicker()
 
 	// Auto-cashout any arena runs left in 'awaiting' from a prior restart
 	p.arenaCleanupStaleRuns()
+	// Extractions that lapsed while the bot was down: the roster they hold is
+	// blocking those members right now, not an hour from now.
+	p.sweepLapsedExtractions(time.Now().UTC())
 
 	return nil
 }
@@ -307,6 +330,15 @@ func (p *AdventurePlugin) OnMessage(ctx MessageContext) error {
 	// expedition.
 	p.maybeDeliverDeferredBriefing(ctx.Sender, time.Now().UTC())
 
+	// Bored adventurers (gogobee_boredom_plan.md §1) — the idle clock that
+	// decides when a character gives up waiting and leaves on its own. Stamped
+	// only for a real action against Adventure: idle chatter in a room is not
+	// tending your adventurer, and no ticker or autopilot path may touch this,
+	// or a bored character would refresh its own clock and never qualify again.
+	if p.isPlayerAdventureAction(ctx) {
+		markPlayerAction(ctx.Sender)
+	}
+
 	// 0. D&D layer commands (Phase 1 — work in rooms and DMs)
 	if p.IsCommand(ctx.Body, "setup") {
 		return p.handleDnDSetupCmd(ctx, p.GetArgs(ctx.Body, "setup"))
@@ -329,6 +361,12 @@ func (p *AdventurePlugin) OnMessage(ctx MessageContext) error {
 	if p.IsCommand(ctx.Body, "rest") {
 		return p.handleDnDRestCmd(ctx, p.GetArgs(ctx.Body, "rest"))
 	}
+	if p.IsCommand(ctx.Body, "duel") {
+		return p.handleDuelCmd(ctx, p.GetArgs(ctx.Body, "duel"))
+	}
+	if p.IsCommand(ctx.Body, "mischief") {
+		return p.handleMischiefCmd(ctx, p.GetArgs(ctx.Body, "mischief"))
+	}
 	if p.IsCommand(ctx.Body, "arm") {
 		return p.handleDnDArmCmd(ctx, p.GetArgs(ctx.Body, "arm"))
 	}
@@ -412,6 +450,23 @@ func (p *AdventurePlugin) OnMessage(ctx MessageContext) error {
 	if p.IsCommand(ctx.Body, "lore") {
 		return p.handleLoreCmd(ctx)
 	}
+	if p.IsCommand(ctx.Body, "give") {
+		return p.handleGiveCmd(ctx)
+	}
+
+	// 0b. Town registries (E3) — read-only social boards (rooms and DMs)
+	if p.IsCommand(ctx.Body, "town") {
+		return p.handleTownCmd(ctx)
+	}
+	if p.IsCommand(ctx.Body, "graveyard") {
+		return p.handleGraveyardCmd(ctx)
+	}
+	if p.IsCommand(ctx.Body, "rivals") {
+		return p.handleRivalsTopCmd(ctx, p.GetArgs(ctx.Body, "rivals"))
+	}
+	if p.IsCommand(ctx.Body, "news") {
+		return p.handleNewsCmd(ctx)
+	}
 
 	// 1. Arena commands (work in rooms and DMs)
 	if p.IsCommand(ctx.Body, "bail") {
@@ -491,6 +546,10 @@ func (p *AdventurePlugin) dispatchCommand(ctx MessageContext) error {
 		return p.SendDM(ctx.Sender, advHelpText)
 	case lower == "rivals":
 		return p.handleRivalsCmd(ctx)
+	case lower == "duel" || strings.HasPrefix(lower, "duel "):
+		return p.handleDuelCmd(ctx, strings.TrimSpace(args[len("duel"):]))
+	case lower == "mischief" || strings.HasPrefix(lower, "mischief "):
+		return p.handleMischiefCmd(ctx, strings.TrimSpace(args[len("mischief"):]))
 	case lower == "babysit" || strings.HasPrefix(lower, "babysit "):
 		return p.handleBabysitCmd(ctx, strings.TrimSpace(strings.TrimPrefix(lower, "babysit")))
 	case lower == "blacksmith" || lower == "repair":
@@ -509,6 +568,16 @@ func (p *AdventurePlugin) dispatchCommand(ctx MessageContext) error {
 		return p.handleMasteryCmd(ctx)
 	case lower == "treasures" || strings.HasPrefix(lower, "treasures "):
 		return p.handleTreasuresCmd(ctx, strings.TrimSpace(strings.TrimPrefix(lower, "treasures")))
+	case lower == "vault" || strings.HasPrefix(lower, "vault "):
+		return p.handleVaultCmd(ctx, strings.TrimSpace(args[len("vault"):]))
+	case lower == "journal":
+		return p.handleJournalCmd(ctx)
+	case lower == "shadow":
+		return p.handleShadowCmd(ctx)
+	case lower == "worldboss" || strings.HasPrefix(lower, "worldboss "):
+		return p.handleWorldBossCmd(ctx, strings.TrimSpace(args[len("worldboss"):]))
+	case lower == "siege" || strings.HasPrefix(lower, "siege "):
+		return p.handleWorldBossCmd(ctx, strings.TrimSpace(args[len("siege"):]))
 	}
 
 	return p.SendDM(ctx.Sender, "Unknown command. Type `!adventure help` to see available commands.")
@@ -526,9 +595,11 @@ const advHelpText = `**Adventure Commands**
 ` + "`!adventure equip-magic`" + ` — Equip magic items (curios) into your D&D slots
 ` + "`!adventure sell <item>`" + ` — Sell an inventory item (or ` + "`sell all`" + `)
 ` + "`!adventure inventory`" + ` — View your inventory
+` + "`!adventure vault`" + ` — Store items safely (Tier-4 Established home; ` + "`vault store/take <item>`" + `)
 ` + "`!adventure leaderboard`" + ` — View the leaderboard
 ` + "`!adventure respond`" + ` — Respond to a mid-day event
 ` + "`!adventure rivals`" + ` — View rival duel records
+` + "`!duel @user [stake]`" + ` — Challenge another adventurer to a staked, no-death bout (` + "`!duel accept`" + `/` + "`decline`" + `/` + "`status`" + `)
 ` + "`!adventure babysit`" + ` — Adventurer Babysitting Service
 ` + "`!adventure babysit auto`" + ` — Toggle auto-babysit (protects streaks on missed days)
 ` + "`!adventure babysit focus <skill>`" + ` — Pick the skill auto-babysit trains (mining/fishing/foraging)
@@ -539,6 +610,9 @@ const advHelpText = `**Adventure Commands**
 ` + "`!adventure recipes`" + ` — List crafting recipes known at your current Foraging level
 ` + "`!adventure mastery`" + ` — Per-slot equipment mastery progress and active bonus
 ` + "`!adventure treasures`" + ` — List your treasures · ` + "`treasures lock`" + ` to refuse swaps
+` + "`!adventure journal`" + ` — Read the campaign pages you've recovered
+` + "`!adventure shadow`" + ` — See how your rival's run compares to yours
+` + "`!adventure worldboss`" + ` — The monthly Siege: one communal bout a day (` + "`fight`" + ` to join)
 ` + "`!hospital`" + ` — Visit St. Guildmore's Memorial Hospital (same-day revival when dead)
 ` + "`!thom`" + ` — Visit Thom Krooke (housing and loans)
 ` + "`!adventure help`" + ` — This message
@@ -603,6 +677,7 @@ func (p *AdventurePlugin) handleMenu(ctx MessageContext) error {
 	treasures, _ := loadAdvTreasureBonuses(char.UserID)
 	buffs, _ := loadAdvActiveBuffs(char.UserID)
 	bonuses := computeAdvBonuses(treasures, buffs, char.CurrentStreak, false)
+	applyRenownBonuses(bonuses, char.RenownLevel()) // N7/B2 — activity path only, never combat
 	balance := p.euro.GetBalance(char.UserID)
 
 	text := renderAdvMorningDM(char.UserID, equip, balance, bonuses, holName)
@@ -753,6 +828,7 @@ func (p *AdventurePlugin) handleLeaderboard(ctx MessageContext) error {
 			ForagingSkill: c.ForagingSkill,
 			FishingSkill:  c.FishingSkill,
 			CurrentStreak: c.CurrentStreak,
+			Renown:        renownLevelForUser(c.UserID),
 		})
 	}
 	text := renderAdvLeaderboard(entries)
@@ -890,9 +966,9 @@ func (p *AdventurePlugin) resolvePendingInteraction(ctx MessageContext, interact
 	case "npc_encounter":
 		return p.resolveNPCEncounter(ctx, interaction)
 	case "pet_arrival":
-		return p.resolvePetArrival(ctx)
+		return p.resolvePetArrival(ctx, interaction)
 	case "pet_type":
-		return p.resolvePetType(ctx)
+		return p.resolvePetType(ctx, interaction)
 	case "pet_name":
 		return p.resolvePetName(ctx, interaction)
 	}
@@ -1122,7 +1198,7 @@ func (p *AdventurePlugin) checkTreasureDrop(userID id.UserID, char *AdventureCha
 		return
 	}
 
-	if count < advMaxTreasures {
+	if count < maxTreasuresForTier(char.HouseTier) {
 		// Directly save
 		if err := advSaveTreasure(userID, drop.Def); err != nil {
 			slog.Error("adventure: failed to save treasure", "user", userID, "err", err)
@@ -1507,7 +1583,7 @@ func (p *AdventurePlugin) handleRecipesCmd(ctx MessageContext) error {
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to load your character.")
 	}
-	return p.SendDM(ctx.Sender, renderRecipesKnown(char.ForagingSkill))
+	return p.SendDM(ctx.Sender, renderRecipesKnown(char.ForagingSkill, homeWorkshopCraftBonus(char.HouseTier)))
 }
 
 func (p *AdventurePlugin) handleTreasuresCmd(ctx MessageContext, arg string) error {

internal/plugin/adventure_arena.go

@@ -531,6 +531,12 @@ func (p *AdventurePlugin) arenaCompleteSession(userID id.UserID, run *ArenaRun,
 	}
 	totalXP := int(float64(run.XPAccumulated) * xpMult)
 
+	// N7/B3 the Omen — a payout-boosting week scales gross earnings before the
+	// pot tax, so both the player's cut and the pot's rake grow proportionally.
+	if m := activeOmen().ArenaPayoutMult; m > 1.0 {
+		run.Earnings = int64(float64(run.Earnings) * m)
+	}
+
 	// Arena tax: 10% of earnings to community pot.
 	arenaTax := int64(math.Round(float64(run.Earnings) * 0.1))
 	arenaNet := run.Earnings - arenaTax

internal/plugin/adventure_babysit.go

@@ -36,22 +36,15 @@ func (p *AdventurePlugin) runBabysitDailyTrickle(char *AdventureCharacter) {
 	if !char.BabysitActive {
 		return
 	}
+	// Both companions share the sitter's attention and gain the flat trickle.
+	// (Combat only ever reads their *averaged* procs, so leveling both is not a
+	// power spike.)
 	leveled := false
-	if char.HasPet() && char.PetLevel < 10 {
-		// Bypass petGrantXP's per-action constant — we want a flat trickle.
-		char.PetXP += petXPPerBabysitDay * 100
-		for char.PetLevel < 10 {
-			needed := petXPToNextLevel(char.PetLevel) * 100
-			if char.PetXP < needed {
-				break
-			}
-			char.PetXP -= needed
-			char.PetLevel++
-			leveled = true
-		}
-		if char.PetLevel >= 10 && char.PetLevel10Date == "" {
-			char.PetLevel10Date = time.Now().UTC().Format("2006-01-02")
-		}
+	if char.HasPet() {
+		leveled = advancePetLevelsFromXP(&char.PetXP, &char.PetLevel, &char.PetLevel10Date, petXPPerBabysitDay*100) || leveled
+	}
+	if char.HasPet2() {
+		leveled = advancePetLevelsFromXP(&char.Pet2XP, &char.Pet2Level, &char.Pet2Level10Date, petXPPerBabysitDay*100) || leveled
 	}
 	outcome := "pet_care"
 	if leveled {

internal/plugin/adventure_character.go

@@ -1,6 +1,9 @@
 package plugin
 
 import (
+	"database/sql"
+	"errors"
+	"strings"
 	"time"
 
 	"gogobee/internal/db"
@@ -92,13 +95,44 @@ type AdventureCharacter struct {
 	PetSupplyShopUnlocked bool
 	PetLevel10Date        string
 	PetMorningDefense     bool
-	AutoBabysit           bool
-	AutoBabysitFocus      string // mining|fishing|foraging — preferred skill for auto-babysit; "" defaults to weakest
-	TreasuresLocked       bool   // when true, treasure drops at cap are refused instead of auto-swapping
-	StreakDecayed         bool
-	CraftsSucceeded       int
-	DeathSource           string // "adventure" | "arena" | "" (legacy/unknown — treated as adventure)
-	DeathLocation         string // human-readable location of last death; cleared on revive is not required
+	// Second pet (N4/E1, Tier-4 Estate). A parallel slot, not a rewrite of the
+	// pet-1 fields above — see HasPet2. Carries only identity/level/barding; the
+	// morning-defense, ditch-recovery and supply-shop mechanics stay pet-1-only.
+	Pet2Type         string
+	Pet2Name         string
+	Pet2XP           int
+	Pet2Level        int
+	Pet2ArmorTier    int
+	Pet2ChasedAway   bool
+	Pet2Reactivated  bool
+	Pet2Arrived      bool
+	Pet2Level10Date  string
+	AutoBabysit      bool
+	AutoBabysitFocus string // mining|fishing|foraging — preferred skill for auto-babysit; "" defaults to weakest
+	TreasuresLocked  bool   // when true, treasure drops at cap are refused instead of auto-swapping
+	StreakDecayed    bool
+	CraftsSucceeded  int
+	DeathSource      string // "adventure" | "arena" | "" (legacy/unknown — treated as adventure)
+	DeathLocation    string // human-readable location of last death; cleared on revive is not required
+	// N5/D1 the Hollow King campaign. Bitmask of discovered journal pages (bit i
+	// == page i+1). Read-only overlay from player_meta.journal_pages; writes go
+	// through the atomic grantJournalPageDB, never the bulk character save.
+	JournalPages int64
+	// N5/D1c the finale reward-once flag. True after the first finale clear;
+	// overlay-read, written by the atomic markEpilogueClearedDB.
+	EpilogueCleared bool
+	// N7/B2 Renown — cumulative overflow XP earned past the L20 cap. Overlay-read
+	// from player_meta.renown_xp, written by the atomic addRenownXP, never the
+	// bulk character save. RenownLevel() derives the prestige level from it.
+	RenownXP int
+}
+
+// RenownLevel is the derived prestige level (renown_xp / renownXPPerLevel).
+func (c *AdventureCharacter) RenownLevel() int {
+	if c == nil {
+		return 0
+	}
+	return renownLevelFor(c.RenownXP)
 }
 
 type AdvEquipment struct {
@@ -270,6 +304,11 @@ func (c *AdventureCharacter) HasPet() bool {
 	return c.PetType != "" && c.PetArrived && !c.PetChasedAway
 }
 
+// HasPet2 returns true if the player has an active second pet.
+func (c *AdventureCharacter) HasPet2() bool {
+	return c.Pet2Type != "" && c.Pet2Arrived && !c.Pet2ChasedAway
+}
+
 // HasHouse returns true if the player has purchased at least a base house.
 func (c *AdventureCharacter) HasHouse() bool {
 	return c.HouseTier > 0 || c.HouseLoanBalance > 0
@@ -500,6 +539,41 @@ func createAdvCharacter(userID id.UserID, displayName string) error {
 	return tx.Commit()
 }
 
+// ensurePlayerMetaSeed guarantees the canonical player_meta seed row (and tier-0
+// equipment) exists for userID, creating it only when absent. The auto-migration
+// path (ensureDnDCharacterForCombat) writes a confirmed dnd_character without
+// touching the legacy layer; without this, a brand-new player whose first-ever
+// action auto-migrates — e.g. !rest or !cast before !setup — ends up with a
+// player_meta-less character that fails every legacy-layer command with
+// "sql: no rows" (the camcast straggler). Conditional on absence and thus
+// idempotent: legacy players who already have player_meta keep their equipment
+// untouched — createAdvCharacter's tier-0 equipment insert has no conflict guard
+// and would otherwise duplicate their gear.
+func ensurePlayerMetaSeed(userID id.UserID) error {
+	d := db.Get()
+	var one int
+	err := d.QueryRow(`SELECT 1 FROM player_meta WHERE user_id = ?`, string(userID)).Scan(&one)
+	if err == nil {
+		return nil // already seeded
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+	return createAdvCharacter(userID, localpartOf(userID))
+}
+
+// localpartOf returns the mxid localpart (between @ and :) as a display-name
+// fallback — matches Base.DisplayName's offline behavior. The seed's display
+// name is overlaid by later player_meta upserts; this is just a sane default
+// for a character born without a Matrix client in reach.
+func localpartOf(userID id.UserID) string {
+	s := string(userID)
+	if i := strings.Index(s, ":"); i > 0 {
+		return s[1:i]
+	}
+	return strings.TrimPrefix(s, "@")
+}
+
 // saveAdvCharacter persists every mutable AdventureCharacter field to
 // player_meta. Phase L5h: the legacy adventure_characters UPDATE has been
 // retired — the row is now read-only after createAdvCharacter seeds it,
@@ -562,7 +636,7 @@ func loadAdvInventory(userID id.UserID) ([]AdvItem, error) {
 	d := db.Get()
 	rows, err := d.Query(`
 		SELECT id, name, item_type, tier, value, slot, skill_source, temper
-		FROM adventure_inventory WHERE user_id = ?
+		FROM adventure_inventory WHERE user_id = ? AND in_vault = 0
 		ORDER BY tier DESC, value DESC`, string(userID))
 	if err != nil {
 		return nil, err
@@ -613,7 +687,10 @@ func clearAdvInventory(userID id.UserID) ([]AdvItem, error) {
 		return nil, err
 	}
 	d := db.Get()
-	_, err = d.Exec(`DELETE FROM adventure_inventory WHERE user_id = ?`, string(userID))
+	// Delete only what loadAdvInventory returned — vaulted rows are out of play
+	// and must survive a bulk clear, or the vault's whole promise (safe from
+	// !sell all) breaks the moment any caller routes sell-all through here.
+	_, err = d.Exec(`DELETE FROM adventure_inventory WHERE user_id = ? AND in_vault = 0`, string(userID))
 	if err != nil {
 		return nil, err
 	}
@@ -623,10 +700,62 @@ func clearAdvInventory(userID id.UserID) ([]AdvItem, error) {
 func advInventoryCount(userID id.UserID) int {
 	d := db.Get()
 	var count int
-	_ = d.QueryRow(`SELECT COUNT(*) FROM adventure_inventory WHERE user_id = ?`, string(userID)).Scan(&count)
+	_ = d.QueryRow(`SELECT COUNT(*) FROM adventure_inventory WHERE user_id = ? AND in_vault = 0`, string(userID)).Scan(&count)
 	return count
 }
 
+// loadAdvVault returns the items the player has stowed in their housing vault
+// (N4/E1). These are excluded from loadAdvInventory — a vaulted item is out of
+// play (unsellable, uncraftable, unusable in combat) until it is taken back.
+func loadAdvVault(userID id.UserID) ([]AdvItem, error) {
+	d := db.Get()
+	rows, err := d.Query(`
+		SELECT id, name, item_type, tier, value, slot, skill_source, temper
+		FROM adventure_inventory WHERE user_id = ? AND in_vault = 1
+		ORDER BY tier DESC, value DESC`, string(userID))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var items []AdvItem
+	for rows.Next() {
+		var it AdvItem
+		var slot string
+		if err := rows.Scan(&it.ID, &it.Name, &it.Type, &it.Tier, &it.Value, &slot, &it.SkillSource, &it.Temper); err != nil {
+			return nil, err
+		}
+		it.Slot = EquipmentSlot(slot)
+		items = append(items, it)
+	}
+	return items, rows.Err()
+}
+
+// advVaultCount returns how many of a user's items are stowed in the vault.
+func advVaultCount(userID id.UserID) int {
+	d := db.Get()
+	var count int
+	_ = d.QueryRow(`SELECT COUNT(*) FROM adventure_inventory WHERE user_id = ? AND in_vault = 1`, string(userID)).Scan(&count)
+	return count
+}
+
+// setItemVaulted flips a single inventory row's vault flag. Scoped to the
+// owning user so a mistyped id can never move another player's item.
+func setItemVaulted(userID id.UserID, itemID int64, vaulted bool) (bool, error) {
+	v := 0
+	if vaulted {
+		v = 1
+	}
+	res, err := db.Get().Exec(
+		`UPDATE adventure_inventory SET in_vault = ? WHERE id = ? AND user_id = ?`,
+		v, itemID, string(userID))
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n > 0, nil
+}
+
 func loadAllAdvCharacters() ([]AdventureCharacter, error) {
 	d := db.Get()
 	rows, err := d.Query(`SELECT user_id FROM player_meta`)

internal/plugin/adventure_companion.go

@@ -0,0 +1,702 @@
+package plugin
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Pete, the realm's embedded correspondent — the hireable NPC companion.
+// (pete_adventure_news_plan.md, "Pete as a character", surface 2.)
+//
+// A leader short a body can hire Pete into an expedition party. He fills the
+// role the party is missing, fights on autopilot, and files a dispatch about it
+// afterwards.
+//
+// The load-bearing rule, and the reason this file exists rather than a
+// player_meta row for @pete: **Pete is not a player and must never become one.**
+// He has no player_meta, no dnd_character, no inventory, no euros, and no DM
+// room. Mint him a player_meta row and ensureDnDCharacterForCombat will happily
+// auto-build him a real character on his first swing, at which point he shows up
+// in the graveyard, the leaderboards, the news as a subject, and the daily event
+// rolls — all of which would be a bot reporting on itself.
+//
+// So his seat is synthesized: companionCombatant builds a Combatant in memory
+// from the same tuned layers a player's sheet goes through, and every seam that
+// assumes a seat is a person is guarded by isCompanionSeat. The guards live at
+// four chokepoints, which between them cover the whole blast radius:
+//
+//   - expeditionAudience  — he is never in the DM fan-out (and so never in the
+//     per-member pet-arrival rolls or the daily event rolls that ride it)
+//   - partySize           — he is not a mouth: he doesn't inflate the supply
+//     burn he never bought packs for, and an NPC-only roster doesn't lock the
+//     leader out of their next expedition
+//   - partyCombatantsForSession / the seat builders — synthesize, don't load
+//   - the close-out loops  — no XP, no loot, no death row, no achievements
+//
+// He does count toward the enemy-HP scalar, because he is a body in the fight
+// and the boss can feel him.
+
+// companionUserIDDefault is Pete's real Matrix account. He is an independent bot
+// (his own repo, his own voice); gogobee already ignores him as a sender via
+// IGNORED_BOTS, so seating him here can never round-trip into command handling.
+// PETE_USER_ID overrides for a differently-homed deployment.
+const companionUserIDDefault = "@pete:parodia.dev"
+
+// companionDisplayName is what the party sees on his seat. gogobee names him but
+// does NOT voice him: his hire banter and his dispatch are written by his own
+// bot from the fact emitted below (project_pete_bot_architecture).
+const companionDisplayName = "Pete"
+
+// Hire pricing. The plan files cost as an open tuning question; this is the
+// first answer, not the final one. It scales with both the level he shows up at
+// and the tier he's walking into, so hiring him for a T5 boss run is not the
+// same 300 coins as a T1 stroll. Supply packs are 50/90 coins for reference —
+// he is deliberately a real expense, not a rounding error.
+//
+// PROD WATCH: at endgame coin balances this is likely too cheap to be a sink.
+// Raise companionHireCoinsPerLevel before raising the base — the base is what a
+// low-level player short a friend has to find.
+const (
+	companionHireBaseCoins     = 300
+	companionHireCoinsPerLevel = 60
+)
+
+// companionLevelPenalty is what makes him help rather than carry. He arrives one
+// level below the party's average — a competent below-median member, per the
+// difficulty plan's standing rule: lift the trailing case, never nerf the
+// leaders and never touch monster scaling.
+const companionLevelPenalty = 1
+
+var (
+	ErrCompanionAlreadyHired = errors.New("pete is already with this party")
+	ErrCompanionOnAssignment = errors.New("pete is out on assignment")
+	ErrCompanionNotHired     = errors.New("pete is not with this party")
+)
+
+// companionUserID resolves Pete's Matrix id.
+func companionUserID() id.UserID {
+	if v := strings.TrimSpace(os.Getenv("PETE_USER_ID")); v != "" {
+		return id.UserID(v)
+	}
+	return id.UserID(companionUserIDDefault)
+}
+
+// isCompanionSeat reports whether a roster seat / combat seat is Pete rather
+// than a player. This is the predicate every guard in the codebase keys on.
+func isCompanionSeat(userID id.UserID) bool { return userID == companionUserID() }
+
+// isCompanionUser is the string-keyed form, for the many seams that carry a raw
+// user_id out of the database.
+func isCompanionUser(userID string) bool { return id.UserID(userID) == companionUserID() }
+
+// companionHireCost is what the leader pays to bring him along, in coins.
+func companionHireCost(level int, tier ZoneTier) int {
+	if level < 1 {
+		level = 1
+	}
+	t := int(tier)
+	if t < 1 {
+		t = 1
+	}
+	return (companionHireBaseCoins + companionHireCoinsPerLevel*level) * t
+}
+
+// ── who he shows up as ───────────────────────────────────────────────────────
+
+// companionRoleFill picks the class Pete plays. He is role-fluid — that is the
+// whole point of hiring him — so by default he fills the hole in the roster: no
+// healer, he's a Cleric; no damage, he's a Mage; nobody up front, he's a
+// Fighter. A leader who knows better can override.
+//
+// The order of the checks is the priority order: a party with neither a healer
+// nor a front line gets the healer, because a party that cannot heal is the one
+// that dies.
+func companionRoleFill(partyClasses []DnDClass) DnDClass {
+	var hasHealer, hasFront, hasDamage bool
+	for _, c := range partyClasses {
+		switch c {
+		case ClassCleric, ClassDruid, ClassBard:
+			hasHealer = true
+		case ClassPaladin:
+			// The one chassis that answers two questions at once.
+			hasHealer, hasFront = true, true
+		case ClassFighter:
+			hasFront = true
+		case ClassMage, ClassSorcerer, ClassWarlock, ClassRogue, ClassRanger:
+			hasDamage = true
+		}
+	}
+	switch {
+	case !hasHealer:
+		return ClassCleric
+	case !hasFront:
+		return ClassFighter
+	case !hasDamage:
+		return ClassMage
+	default:
+		// A complete party that hires him anyway gets a second pair of hands up
+		// front — the least redundant thing he can be.
+		return ClassFighter
+	}
+}
+
+// parseCompanionClass resolves an explicit `!expedition hire cleric` override.
+// Empty (or unknown) means auto-fill.
+func parseCompanionClass(arg string) (DnDClass, bool) {
+	arg = strings.ToLower(strings.TrimSpace(arg))
+	if arg == "" || arg == "auto" {
+		return "", false
+	}
+	for _, ci := range dndClasses {
+		if !ci.Playable {
+			continue
+		}
+		if string(ci.Key) == arg || strings.EqualFold(ci.Display, arg) {
+			return ci.Key, true
+		}
+	}
+	return "", false
+}
+
+// companionHumans is every *player* on the expedition — the roster if one exists,
+// and otherwise the owner alone.
+//
+// The fallback is the whole point. A solo expedition has NO expedition_party rows
+// (see partyMembers: absence means solo, and the roster only materializes on the
+// first successful invite). Reading the roster alone therefore answers "nobody" for
+// exactly the player this feature exists for: the one with no friends around, who
+// is hiring Pete *because* they are alone.
+//
+// Getting this wrong is not a small error. It hired every solo player a **level-1**
+// Pete — in a tier-4 zone, against a boss that had just gained 15% HP and a full
+// extra set of actions to account for him. He died on contact and left the leader
+// fighting an inflated boss alone. A 1500-run sweep measured it: solo 65% clear,
+// two humans 87%, solo+Pete 33%. The companion was worse than no companion, and
+// this line is why.
+func companionHumans(expeditionID string) []*DnDCharacter {
+	var owner string
+	if err := db.Get().QueryRow(
+		`SELECT user_id FROM dnd_expedition WHERE expedition_id = ?`,
+		expeditionID).Scan(&owner); err != nil {
+		return nil
+	}
+	seats, err := partyHumans(expeditionID, owner)
+	if err != nil {
+		return nil
+	}
+	out := make([]*DnDCharacter, 0, len(seats))
+	for _, s := range seats {
+		if dc, _ := LoadDnDCharacter(s.UserID); dc != nil {
+			out = append(out, dc)
+		}
+	}
+	return out
+}
+
+// companionPartyLevel is the level he arrives at: the party's average, less
+// companionLevelPenalty, floored at 1.
+func companionPartyLevel(expeditionID string) int {
+	chars := companionHumans(expeditionID)
+	if len(chars) == 0 {
+		return 1
+	}
+	sum := 0
+	for _, dc := range chars {
+		sum += dc.Level
+	}
+	lvl := sum/len(chars) - companionLevelPenalty
+	if lvl < 1 {
+		lvl = 1
+	}
+	return lvl
+}
+
+// companionPartyClasses reads the classes already on the expedition, for the role
+// fill. Solo resolves to the owner's class, so a lone fighter gets a healer rather
+// than the empty-party default.
+func companionPartyClasses(expeditionID string) []DnDClass {
+	chars := companionHumans(expeditionID)
+	out := make([]DnDClass, 0, len(chars))
+	for _, dc := range chars {
+		out = append(out, dc.Class)
+	}
+	return out
+}
+
+// ── his sheet, which lives only in memory ────────────────────────────────────
+
+// companionSheet synthesizes the DnDCharacter Pete fights as. It is built, used,
+// and thrown away inside a single combat build — it is never saved, and
+// SaveDnDCharacter must never be called on it.
+//
+// Stats come from the same class-priority + race-mod pipeline autoBuildCharacter
+// uses for a real character, so he is statted like a player of his level rather
+// than by a bespoke NPC table that would drift away from the tuned math. Human
+// is deliberate: the +1-to-all is the most neutral race in the book, so his
+// class is doing the work rather than a race pick nobody chose.
+func companionSheet(class DnDClass, level int) *DnDCharacter {
+	if level < 1 {
+		level = 1
+	}
+	scores := applyRaceMods(RaceHuman, classStatPriority(class))
+	c := &DnDCharacter{
+		UserID: companionUserID(),
+		Race:   RaceHuman,
+		Class:  class,
+		Level:  level,
+		STR:    scores[0], DEX: scores[1], CON: scores[2],
+		INT: scores[3], WIS: scores[4], CHA: scores[5],
+		CreatedAt: time.Now().UTC(),
+		UpdatedAt: time.Now().UTC(),
+	}
+	c.HPMax = computeMaxHP(c.Class, abilityModifier(c.CON), c.Level)
+	c.HPCurrent = c.HPMax
+	return c
+}
+
+// companionAdvCharacter is the AdventureCharacter half of the synthetic sheet:
+// the shim DerivePlayerStats needs. CombatLevel round-trips back to the D&D
+// level through dndLevelFromCombatLevel (level*5), so the two halves agree.
+func companionAdvCharacter(level int) *AdventureCharacter {
+	return &AdventureCharacter{
+		UserID:      companionUserID(),
+		DisplayName: companionDisplayName,
+		CombatLevel: level * 5,
+		Alive:       true,
+	}
+}
+
+// companionGearTier maps his level onto the equipment tier a player of that
+// level would plausibly be carrying: 1–4 → T1, 5–8 → T2, and so on to T5.
+func companionGearTier(level int) int {
+	t := (level + 3) / 4
+	if t < 1 {
+		t = 1
+	}
+	if t > 5 {
+		t = 5
+	}
+	return t
+}
+
+// companionGear is the kit he walks in with — a working reporter's kit, bought
+// with expenses and kept in serviceable shape.
+//
+// He has to have one. The gear layer is not decoration: unarmored, stats.AC is
+// never set at all (computeArmorAC only fires when armor exists) and he walks in
+// at AC 3, hit by everything; weaponless, stats.Weapon stays nil and he swings
+// for a flat 5 at every level, which by L14 is nothing. "No gear" is not a
+// below-median player, it is a broken one.
+//
+// The below-median comes from everywhere else: he is a level down, his gear is
+// never Masterwork, and he carries no magic items, no subclass and no armed
+// ability. The weapon names are chosen to hit the right branch of
+// synthesizeWeaponProfile for the class — it best-fits off the name.
+func companionGear(class DnDClass, level int) map[EquipmentSlot]*AdvEquipment {
+	tier := companionGearTier(level)
+
+	weapon := "Service Mace"
+	switch class {
+	case ClassFighter, ClassPaladin:
+		weapon = "Service Sword"
+	case ClassRogue:
+		weapon = "Service Dagger"
+	case ClassRanger:
+		weapon = "Service Bow"
+	case ClassMage, ClassSorcerer, ClassWarlock, ClassDruid, ClassBard:
+		weapon = "Service Staff"
+	}
+
+	return map[EquipmentSlot]*AdvEquipment{
+		SlotWeapon: {Slot: SlotWeapon, Tier: tier, Condition: 100, Name: weapon},
+		SlotArmor:  {Slot: SlotArmor, Tier: tier, Condition: 100, Name: "Service Kit"},
+	}
+}
+
+// companionCombatant builds Pete's seat for a fight, mirroring buildZoneCombatants
+// but sourcing the sheet from memory instead of the database. He carries no
+// equipment, no treasure bonuses, no magic items, no chat level and no streak —
+// the three layers a player accumulates and he never will. That absence *is* the
+// below-median: he is a bare class chassis at a level below yours, and the gap
+// between him and a geared player of the same level is exactly the gear.
+func (p *AdventurePlugin) companionCombatant(
+	class DnDClass, level int, monster DnDMonsterTemplate, tier int, dmMood int,
+) (Combatant, Combatant, *DnDCharacter) {
+	tilt := dmMoodCombatTilt(dmMood)
+	char := companionAdvCharacter(level)
+	dc := companionSheet(class, level)
+
+	// The layer order is buildZoneCombatants', deliberately — a companion statted
+	// by a different pipeline would drift away from the tuned math the moment
+	// anyone touched one and not the other.
+	//
+	// What he does NOT get is the subclass layer, magic items, and an armed
+	// ability: three of the things a player accumulates and a hireling never will.
+	// Those absences, plus the level penalty and gear that is never Masterwork,
+	// are the "below median" — see companionGear for why the gear itself is not
+	// one of the things we take away.
+	gear := companionGear(class, level)
+	stats, mods := DerivePlayerStats(char, gear, &AdvBonusSummary{}, 0, 0, false)
+	applyDnDPlayerLayer(&stats, dc)
+	applyDnDEquipmentLayer(&stats, dc, gear)
+	applyDnDHPScaling(&stats, dc)
+	applyClassPassives(&stats, &mods, dc)
+	applyRacePassives(&stats, &mods, dc)
+
+	enemyStats, enemyMods := monster.toCombatStats()
+	if tier > 1 {
+		if floorAC := dndDungeonACBase + tier; enemyStats.AC < floorAC {
+			enemyStats.AC = floorAC
+		}
+		if floorAB := dndDungeonAtkBase + tier; enemyStats.AttackBonus < floorAB {
+			enemyStats.AttackBonus = floorAB
+		}
+	}
+	enemyStats.Attack += tilt.EnemyAttackDelta
+	if enemyStats.Attack < 1 {
+		enemyStats.Attack = 1
+	}
+	mods.InitiativeBias += tilt.InitiativeBias
+
+	player := Combatant{
+		Name:     companionDisplayName,
+		Stats:    stats,
+		Mods:     mods,
+		IsPlayer: true,
+	}
+	enemy := Combatant{
+		Name:    monster.Name,
+		Stats:   enemyStats,
+		Mods:    enemyMods,
+		Ability: monster.Ability,
+	}
+	return player, enemy, dc
+}
+
+// companionRosterLine is how he reads on `!expedition party`. DisplayName would
+// come back empty for him — he has no player_meta row to hold a name — so the
+// roster names him here, along with what he is currently playing, because "Pete
+// (member)" tells the leader nothing about the hole they paid to fill.
+func companionRosterLine(expeditionID string) string {
+	class, level := companionLoadout(expeditionID)
+	ci, _ := classInfo(class)
+	return fmt.Sprintf("**%s** _(hired — level %d %s)_\n", companionDisplayName, level, ci.Display)
+}
+
+// ── the hire, persisted on the roster ────────────────────────────────────────
+
+// companionLoadout reads back the class and level he was hired at. It is stored
+// on the roster row rather than re-derived per fight, so a party that levels
+// mid-expedition doesn't quietly re-roll their hireling into a different class
+// three rooms in.
+func companionLoadout(expeditionID string) (DnDClass, int) {
+	var class string
+	var level int
+	err := db.Get().QueryRow(`
+		SELECT companion_class, companion_level
+		  FROM expedition_party
+		 WHERE expedition_id = ? AND user_id = ?`,
+		expeditionID, string(companionUserID())).Scan(&class, &level)
+	if err != nil || class == "" {
+		return ClassFighter, 1
+	}
+	return DnDClass(class), level
+}
+
+// ── his spell slots, which live on the expedition ────────────────────────────
+//
+// A human caster's slots are dnd_spell_slots rows: one pool, spent across every
+// fight of the run, refilled only at camp. Rationing it is the caster's game. The
+// companion has no rows, so his pool lives on his roster row — the same row his
+// class and level live on, and with the same lifetime.
+//
+// It must NOT live on his combat seat. A seat is per-session and every fight opens
+// a new one, so a seat-scoped pool refills itself between fights: an infinite
+// caster. That is not a theory — the first cut did exactly that, and the sim
+// measured a gearless, level-penalized hireling out-clearing a human cleric of the
+// leader's own level by 15pp.
+
+// companionSlotsCSV encodes/decodes the ledger. CSV of six ints rather than JSON
+// because it is six ints.
+func companionSlotsDecode(s string) [6]int {
+	var out [6]int
+	for i, f := range strings.Split(s, ",") {
+		if i >= len(out) {
+			break
+		}
+		n, err := strconv.Atoi(strings.TrimSpace(f))
+		if err != nil || n < 0 {
+			continue
+		}
+		out[i] = n
+	}
+	return out
+}
+
+func companionSlotsEncode(used [6]int) string {
+	parts := make([]string, len(used))
+	for i, n := range used {
+		parts[i] = strconv.Itoa(n)
+	}
+	return strings.Join(parts, ",")
+}
+
+// companionSlotsForRun reads the ledger for the companion on the expedition that
+// owns runID. A run with no companion (or no expedition) reads as an empty pool,
+// which is the correct answer: nobody spent anything.
+func companionSlotsForRun(runID string) [6]int {
+	var raw string
+	err := db.Get().QueryRow(`
+		SELECT p.companion_slots_used
+		  FROM expedition_party p
+		  JOIN dnd_expedition e ON e.expedition_id = p.expedition_id
+		 WHERE e.run_id = ? AND p.user_id = ?`,
+		runID, string(companionUserID())).Scan(&raw)
+	if err != nil {
+		return [6]int{}
+	}
+	return companionSlotsDecode(raw)
+}
+
+// setCompanionSlotsForRun writes it back.
+func setCompanionSlotsForRun(runID string, used [6]int) error {
+	_, err := db.Get().Exec(`
+		UPDATE expedition_party
+		   SET companion_slots_used = ?
+		 WHERE user_id = ?
+		   AND expedition_id = (SELECT expedition_id FROM dnd_expedition WHERE run_id = ?)`,
+		companionSlotsEncode(used), string(companionUserID()), runID)
+	return err
+}
+
+// refreshCompanionSlots empties the ledger — his half of the camp rest that calls
+// refreshSpellSlots for every human. Keyed by expedition, because camp is.
+func refreshCompanionSlots(expeditionID string) error {
+	_, err := db.Get().Exec(`
+		UPDATE expedition_party SET companion_slots_used = ''
+		 WHERE expedition_id = ? AND user_id = ?`,
+		expeditionID, string(companionUserID()))
+	return err
+}
+
+// ── his body, which is also carried across the run ───────────────────────────
+//
+// companionUnsetHP is "no wound recorded" — a fresh hire, or a companion who has
+// just broken camp. Seating reads it as full.
+const companionUnsetHP = -1
+
+// companionHPFor reads the HP he carries into his next fight, or companionUnsetHP
+// when he is unhurt. A run with no companion reads unset, which is harmless: there
+// is nobody to seat.
+func companionHPFor(expeditionID string) int {
+	hp := companionUnsetHP
+	err := db.Get().QueryRow(`
+		SELECT companion_hp FROM expedition_party
+		 WHERE expedition_id = ? AND user_id = ?`,
+		expeditionID, string(companionUserID())).Scan(&hp)
+	if err != nil {
+		return companionUnsetHP
+	}
+	return hp
+}
+
+// companionSeatHP is what he actually sits down with: his carried wound, clamped
+// into [1, maxHP].
+//
+// The floor of 1 is deliberate. He can be dropped *inside* a fight — the engine
+// counts him out like any other seat — but he does not stay dead between them,
+// because there is no companion-death mechanic and inventing one here would be a
+// second feature smuggled into a bug fix. Coming back on 1 HP is a real penalty
+// (one hit and he is down again) without pretending to be a corpse rule.
+func companionSeatHP(expeditionID string, maxHP int) int {
+	hp := companionHPFor(expeditionID)
+	if hp == companionUnsetHP || hp > maxHP {
+		return maxHP
+	}
+	if hp < 1 {
+		return 1
+	}
+	return hp
+}
+
+// setCompanionHP records the HP he walked out of a fight with.
+func setCompanionHP(expeditionID string, hp int) error {
+	_, err := db.Get().Exec(`
+		UPDATE expedition_party SET companion_hp = ?
+		 WHERE expedition_id = ? AND user_id = ?`,
+		hp, expeditionID, string(companionUserID()))
+	return err
+}
+
+// setCompanionHPForRun is setCompanionHP for the turn-based close-out, which
+// holds a run id rather than an expedition id.
+func setCompanionHPForRun(runID string, hp int) error {
+	_, err := db.Get().Exec(`
+		UPDATE expedition_party
+		   SET companion_hp = ?
+		 WHERE user_id = ?
+		   AND expedition_id = (SELECT expedition_id FROM dnd_expedition WHERE run_id = ?)`,
+		hp, string(companionUserID()), runID)
+	return err
+}
+
+// refreshCompanionHP is his half of the camp heal: back to full, like every human
+// at a standard rest.
+func refreshCompanionHP(expeditionID string) error {
+	_, err := db.Get().Exec(`
+		UPDATE expedition_party SET companion_hp = ?
+		 WHERE expedition_id = ? AND user_id = ?`,
+		companionUnsetHP, expeditionID, string(companionUserID()))
+	return err
+}
+
+// companionLoadoutForRun is companionLoadout keyed by the zone run instead of
+// the expedition. A CombatSession carries a RunID, not an expedition id, and the
+// per-turn rebuild is the hottest caller — so the join lives here rather than
+// making every caller resolve the expedition first.
+//
+// A run with no expedition (a standalone !zone run, which can have no companion)
+// finds no row and falls back, which is the correct reading.
+func companionLoadoutForRun(runID string) (DnDClass, int) {
+	var class string
+	var level int
+	err := db.Get().QueryRow(`
+		SELECT p.companion_class, p.companion_level
+		  FROM expedition_party p
+		  JOIN dnd_expedition e ON e.expedition_id = p.expedition_id
+		 WHERE e.run_id = ? AND p.user_id = ?`,
+		runID, string(companionUserID())).Scan(&class, &level)
+	if err != nil || class == "" {
+		return ClassFighter, 1
+	}
+	return DnDClass(class), level
+}
+
+// companionExpeditionFor resolves the expedition a leader is running, for the
+// seat builder — which has the roster but not the expedition id. Empty string
+// when there is none, which companionLoadout reads as "no row" and falls back.
+func companionExpeditionFor(leader id.UserID) string {
+	e, _, err := activeExpeditionFor(leader)
+	if err != nil || e == nil {
+		return ""
+	}
+	return e.ID
+}
+
+// companionSeated reports whether Pete is on this roster.
+func companionSeated(expeditionID string) bool {
+	var one int
+	err := db.Get().QueryRow(`
+		SELECT 1 FROM expedition_party WHERE expedition_id = ? AND user_id = ?`,
+		expeditionID, string(companionUserID())).Scan(&one)
+	return err == nil
+}
+
+// hireCompanion seats Pete. The seat check, the availability check and the
+// insert share a transaction, so two leaders racing for him cannot both win.
+//
+// He is globally exclusive — one party at a time. That is not a limitation to
+// route around: "Pete is out on assignment" is the scarcity knob the plan asks
+// for, and it is also why he cannot be the answer to every run.
+func hireCompanion(expeditionID string, class DnDClass, level int) error {
+	tx, err := db.Get().Begin()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+
+	if err := seatLeader(tx, expeditionID); err != nil {
+		return err
+	}
+
+	// Is he already out with somebody? Scoped to live expeditions, so a roster
+	// row stranded by a crash cannot make him unhireable forever.
+	var busyOn string
+	err = tx.QueryRow(`
+		SELECT p.expedition_id
+		  FROM expedition_party p
+		  JOIN dnd_expedition e ON e.expedition_id = p.expedition_id
+		 WHERE p.user_id = ? AND e.status IN ('active', 'extracting')
+		 LIMIT 1`, string(companionUserID())).Scan(&busyOn)
+	switch {
+	case err == nil && busyOn == expeditionID:
+		return ErrCompanionAlreadyHired
+	case err == nil:
+		return ErrCompanionOnAssignment
+	case !errors.Is(err, sql.ErrNoRows):
+		return err
+	}
+
+	var n int
+	if err := tx.QueryRow(
+		`SELECT COUNT(*) FROM expedition_party WHERE expedition_id = ?`,
+		expeditionID).Scan(&n); err != nil {
+		return err
+	}
+	if n >= expeditionPartyMax {
+		return ErrPartyFull
+	}
+
+	if _, err := tx.Exec(`
+		INSERT INTO expedition_party (expedition_id, user_id, role, companion_class, companion_level)
+		VALUES (?, ?, 'member', ?, ?)`,
+		expeditionID, string(companionUserID()), string(class), level); err != nil {
+		return fmt.Errorf("seat companion: %w", err)
+	}
+	return tx.Commit()
+}
+
+// dismissCompanion sends him home. Unlike a player member he can be removed
+// mid-run — he is staff, not a guest — but the fee is not refunded: he already
+// walked in.
+func dismissCompanion(expeditionID string) error {
+	res, err := db.Get().Exec(`
+		DELETE FROM expedition_party
+		 WHERE expedition_id = ? AND user_id = ?`,
+		expeditionID, string(companionUserID()))
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrCompanionNotHired
+	}
+	return nil
+}
+
+// ── the dispatch ─────────────────────────────────────────────────────────────
+
+// emitCompanionHireFact tells Pete's bot he has been hired. gogobee states the
+// fact; Pete writes the sentence. Bulletin, not priority: a hire is a diary
+// entry, not a bulletin-interrupting event.
+//
+// The subject is the *leader*, so the leader's news opt-out is honoured — Pete
+// reporting "filled in as cleric for <someone who asked not to be named>" would
+// be exactly the leak the opt-out exists to prevent. Pete himself is never a
+// subject: he has no opt-out row and needs none.
+func emitCompanionHireFact(leader id.UserID, class DnDClass, level int, zone ZoneDefinition) {
+	name := charName(leader)
+	if name == "" {
+		return
+	}
+	ci, _ := classInfo(class)
+	emitFact(peteclient.Fact{
+		GUID:       "companion_hire:" + eventToken(leader, "companion_hire") + ":" + fmt.Sprint(time.Now().UTC().Unix()),
+		EventType:  "companion_hire",
+		Tier:       "bulletin",
+		Subject:    name,
+		Zone:       zone.Display,
+		Level:      level,
+		ClassRace:  ci.Display,
+		OccurredAt: time.Now().UTC().Unix(),
+	}, leader, "")
+}

internal/plugin/adventure_companion_test.go

@@ -0,0 +1,309 @@
+package plugin
+
+import (
+	"errors"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The companion's whole contract is "he fights, and he is not a player". These
+// tests pin both halves — and specifically the seams where an NPC seat would
+// otherwise be silently treated as a person.
+
+func TestCompanion_HiredSeatIsNotAMouth(t *testing.T) {
+	setupEmptyTestDB(t)
+	owner := id.UserID("@leader:example.org")
+	seedExpedition(t, "exp-hire", owner, "active")
+	seatLeaderFixture(t, "exp-hire")
+
+	if err := hireCompanion("exp-hire", ClassCleric, 4); err != nil {
+		t.Fatalf("hireCompanion: %v", err)
+	}
+
+	// The roster holds two seats...
+	members, err := partyMembers("exp-hire")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(members) != 2 {
+		t.Fatalf("roster has %d seats, want 2 (leader + companion)", len(members))
+	}
+
+	// ...but only one of them eats. partySize feeds the daily supply burn and the
+	// "your party is still waiting on you" lock-out; counting the companion would
+	// bill the leader for rations he never bought, and strand him out of his next
+	// expedition behind a party of one bot.
+	n, err := partySize("exp-hire")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 1 {
+		t.Errorf("partySize = %d, want 1 — the companion is not a mouth", n)
+	}
+}
+
+func TestCompanion_GetsNoMailButTakesASeat(t *testing.T) {
+	setupEmptyTestDB(t)
+	owner := id.UserID("@leader2:example.org")
+	seedExpedition(t, "exp-mail", owner, "active")
+	seatLeaderFixture(t, "exp-mail")
+	if err := hireCompanion("exp-mail", ClassFighter, 3); err != nil {
+		t.Fatalf("hireCompanion: %v", err)
+	}
+	exp, err := getExpedition("exp-mail")
+	if err != nil || exp == nil {
+		t.Fatalf("getExpedition: %v", err)
+	}
+
+	// Mail and seats are different sets. Every DM seam reads the audience; the
+	// combat roster reads the seats. Getting this backwards either DMs a bot or
+	// charges a leader for a body that never sits down.
+	for _, uid := range expeditionAudience(exp) {
+		if isCompanionSeat(uid) {
+			t.Fatal("companion is in the DM audience — he does not get mail")
+		}
+	}
+	var seated bool
+	for _, uid := range expeditionSeats(exp) {
+		if isCompanionSeat(uid) {
+			seated = true
+		}
+	}
+	if !seated {
+		t.Fatal("companion is not in the fight roster — he was paid for and never sat down")
+	}
+}
+
+func TestCompanion_IsGloballyExclusive(t *testing.T) {
+	setupEmptyTestDB(t)
+	for _, e := range []struct {
+		id    string
+		owner id.UserID
+	}{{"exp-a", "@a:example.org"}, {"exp-b", "@b:example.org"}} {
+		seedExpedition(t, e.id, e.owner, "active")
+		seatLeaderFixture(t, e.id)
+	}
+
+	if err := hireCompanion("exp-a", ClassMage, 5); err != nil {
+		t.Fatalf("first hire: %v", err)
+	}
+	// He is one person. A second party cannot have him — "out on assignment" is
+	// the scarcity knob, not a bug to route around.
+	if err := hireCompanion("exp-b", ClassMage, 5); !errors.Is(err, ErrCompanionOnAssignment) {
+		t.Errorf("second hire err = %v, want ErrCompanionOnAssignment", err)
+	}
+	// Re-hiring him into the party he's already with is its own answer.
+	if err := hireCompanion("exp-a", ClassMage, 5); !errors.Is(err, ErrCompanionAlreadyHired) {
+		t.Errorf("re-hire err = %v, want ErrCompanionAlreadyHired", err)
+	}
+
+	// Dismissed, he's available again.
+	if err := dismissCompanion("exp-a"); err != nil {
+		t.Fatalf("dismiss: %v", err)
+	}
+	if err := hireCompanion("exp-b", ClassMage, 5); err != nil {
+		t.Errorf("hire after dismiss: %v, want success", err)
+	}
+}
+
+// The bug that made the whole feature worse than useless: a SOLO expedition has
+// no expedition_party rows at all (the roster only materializes on the first
+// invite), so reading the roster to size the companion answered "nobody" for
+// exactly the player who is hiring him — the one with no friends around. Every
+// solo hire got a level-1 Pete, in whatever tier the leader was actually in.
+func TestCompanion_SoloLeaderSizesHimCorrectly(t *testing.T) {
+	setupEmptyTestDB(t)
+	owner := id.UserID("@lonely:example.org")
+	seedExpedition(t, "exp-solo-hire", owner, "active")
+
+	// A level-12 fighter, adventuring alone. No roster rows exist.
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: owner, Race: RaceHuman, Class: ClassFighter, Level: 12,
+		STR: 18, DEX: 14, CON: 16, INT: 10, WIS: 10, CHA: 10,
+		HPMax: 120, HPCurrent: 120, ArmorClass: 18,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := companionPartyLevel("exp-solo-hire"); got != 11 {
+		t.Errorf("companionPartyLevel = %d, want 11 (the lone leader's 12, less the below-median step). "+
+			"A level-1 companion in the leader's zone is worse than no companion at all.", got)
+	}
+	// And he fills the hole the lone fighter actually has, rather than defaulting
+	// as if the party were empty.
+	if got := companionRoleFill(companionPartyClasses("exp-solo-hire")); got != ClassCleric {
+		t.Errorf("role fill for a lone fighter = %v, want cleric", got)
+	}
+}
+
+// §4 — asking for "the party" must never answer "nobody".
+//
+// A solo expedition has no expedition_party rows (absence means solo; the roster
+// materializes on the first invite). Every consumer that read the roster table
+// directly therefore got an empty list for a solo player and fell back to
+// whatever looked reasonable locally. That is how the companion was hired at
+// level 1 for exactly the player the feature exists for.
+//
+// expeditionParty always includes the owner. If this test ever fails, that
+// guarantee is gone and the same class of bug is back.
+func TestParty_SoloExpeditionStillHasAParty(t *testing.T) {
+	setupEmptyTestDB(t)
+	owner := id.UserID("@alone:example.org")
+	seedExpedition(t, "exp-alone", owner, "active")
+
+	// No roster rows exist at all.
+	rows, err := partyMembers("exp-alone")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 0 {
+		t.Fatalf("solo expedition has %d roster rows; the premise of this test is gone", len(rows))
+	}
+
+	// And yet the party is not empty.
+	seats, err := expeditionParty("exp-alone", string(owner))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(seats) != 1 || seats[0].UserID != owner || seats[0].Kind != SeatLeader {
+		t.Fatalf("expeditionParty on a solo run = %+v, want exactly the owner as leader. "+
+			"An empty answer here is what hires a level-1 companion.", seats)
+	}
+	humans, err := partyHumans("exp-alone", string(owner))
+	if err != nil || len(humans) != 1 {
+		t.Fatalf("partyHumans on a solo run = %+v (err %v), want the owner", humans, err)
+	}
+}
+
+func TestCompanion_RoleFillTakesTheHole(t *testing.T) {
+	tests := []struct {
+		name  string
+		party []DnDClass
+		want  DnDClass
+	}{
+		{"no healer", []DnDClass{ClassFighter, ClassRogue}, ClassCleric},
+		{"no front line", []DnDClass{ClassCleric, ClassMage}, ClassFighter},
+		{"no damage", []DnDClass{ClassCleric, ClassFighter}, ClassMage},
+		// A paladin covers healer AND front line, so paladin+rogue has no hole at
+		// all — it falls through to the default, a second body up front.
+		{"a complete party gets the default", []DnDClass{ClassPaladin, ClassRogue}, ClassFighter},
+		{"a paladin still leaves the damage hole", []DnDClass{ClassPaladin}, ClassMage},
+		{"solo fighter needs the medic first", []DnDClass{ClassFighter}, ClassCleric},
+		{"empty party", nil, ClassCleric},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := companionRoleFill(tc.party); got != tc.want {
+				t.Errorf("companionRoleFill(%v) = %v, want %v", tc.party, got, tc.want)
+			}
+		})
+	}
+}
+
+// §3 — an engine-driven seat's latch is permanent, and no command can take it.
+//
+// This is the invariant that, when it did not exist, made the companion stand in
+// fights doing nothing. The expedition autopilot drives a party by dispatching
+// each seat's turn AS that seat; his own auto-played move therefore arrived at
+// beginCombatTurn looking exactly like a human returning to the keyboard, and the
+// "they typed, so they're here" branch cleared the latch that was moving him.
+// After round 1 he never acted again — while the boss he had inflated by 15% HP
+// killed the party. The sweep measured it at -27pp clear rate.
+//
+// Autopilot is provisional (a human is away; a keystroke ends it). EngineDriven is
+// not (there is nobody to come back). They must never collapse into one flag.
+func TestCompanion_EngineSeatKeepsTheWheel(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	uid := id.UserID("@lead:example.org")
+
+	monster := dndBestiary["goblin"]
+	c, _, _ := p.companionCombatant(ClassFighter, 8, monster, 2, 0)
+	enemy := Combatant{Name: "x", Stats: CombatStats{MaxHP: 500, AC: 12, Attack: 4, AttackBonus: 4}}
+
+	sess, err := p.startPartyCombatSession("run-e", "enc", "goblin", &enemy, []CombatSeatSetup{
+		{UserID: uid, HP: 200, HPMax: 200, Mods: c.Mods, C: &c},
+		{UserID: companionUserID(), HP: 120, HPMax: 120, Mods: c.Mods, C: &c, EngineDriven: true},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !sess.seatIsEngineDriven(1) {
+		t.Fatal("companion seat is not engine-driven")
+	}
+	if sess.seatIsEngineDriven(0) {
+		t.Fatal("the human's seat came out engine-driven")
+	}
+	// The engine drives it without waiting on anybody...
+	if !sess.seatIsAutopiloted(1) || !sess.seatNeedsNoHuman(1) {
+		t.Fatal("an engine seat must resolve without waiting for a human")
+	}
+	// ...and the human's seat still waits for its human.
+	if sess.seatIsAutopiloted(0) {
+		t.Fatal("the human's seat was latched onto autopilot at seating")
+	}
+
+	// The wheel cannot be taken back, because there is nobody to take it. This is
+	// the exact line that used to strand him: a "keystroke" from his own id.
+	sess.actorStatusesPtr(1).Autopilot = false
+	if !sess.seatIsAutopiloted(1) {
+		t.Fatal("clearing Autopilot stranded the engine seat — EngineDriven must keep it moving")
+	}
+}
+
+// The one that actually matters: he has to FIGHT. Every other guard in this
+// file is about keeping him out of things, and a companion synthesized down to
+// zeroed stats would pass all of them while standing in the fight doing nothing
+// — a hire that silently buys the leader an empty chair.
+func TestCompanion_ActuallySwings(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+
+	monster := dndBestiary["goblin"]
+	tank := monster
+	tank.HP = 5000 // outlast the phase clock, so a real swing has time to land
+
+	pete, _, _ := p.companionCombatant(ClassFighter, 6, tank, 2, 0)
+
+	if pete.Stats.MaxHP <= 0 || pete.Stats.Attack <= 0 || pete.Stats.AC <= 0 {
+		t.Fatalf("companion built with dead stats (%d HP / %d atk / %d AC) — he'd stand in the fight and do nothing",
+			pete.Stats.MaxHP, pete.Stats.Attack, pete.Stats.AC)
+	}
+
+	enemy := Combatant{Name: tank.Name, Stats: CombatStats{MaxHP: 5000, AC: 10, Attack: 1, AttackBonus: 1}}
+	res := simulatePartyWithRNG([]Combatant{pete}, enemy, dungeonCombatPhases, seededRNG(7))
+
+	var swings int
+	for _, e := range res.Events {
+		if e.Actor == "player" && e.Seat == 0 && e.Roll > 0 {
+			swings++
+		}
+	}
+	if swings == 0 {
+		t.Fatal("the companion never swung — he was hired, seated, and did nothing")
+	}
+}
+
+func TestCompanion_SheetIsBelowMedianAndNeverPersisted(t *testing.T) {
+	setupEmptyTestDB(t)
+
+	// He is statted like a player of his level, so he never drifts from the tuned
+	// math — but he arrives a level down, which is the whole "help, never a carry"
+	// rule expressed in one number.
+	dc := companionSheet(ClassFighter, 7)
+	if dc.Level != 7 || dc.HPMax <= 0 {
+		t.Fatalf("companionSheet = level %d / %d HP, want a real level-7 chassis", dc.Level, dc.HPMax)
+	}
+
+	// And he leaves no trace: a player_meta row is the thing that would turn him
+	// into a real character everywhere (graveyard, news, XP, leaderboards), so the
+	// synthesis must not have written one.
+	if c, _ := LoadDnDCharacter(companionUserID()); c != nil {
+		t.Fatal("companion has a persisted dnd_character row — he is a player now, which is the one thing he must never be")
+	}
+	if _, err := loadAdvCharacter(companionUserID()); err == nil {
+		t.Fatal("companion has a persisted player_meta row — ensureDnDCharacterForCombat will auto-build him a character on his first swing")
+	}
+}

internal/plugin/adventure_consumables.go

@@ -346,15 +346,34 @@ var craftingRecipes = []CraftingRecipe{
 	{Result: "Voidstone Shard", Ingredients: []string{"Voidstone", "Mythril Ore"}, MinForaging: 30, Tier: 5},
 }
 
-// craftingSuccessRate returns the success chance for a recipe given foraging level.
-// Base rate is 50% at minimum level, +3% per 5 levels above minimum, capped at 95%.
-func craftingSuccessRate(foragingLevel, minForaging int) float64 {
+// houseTierWorkshop is the T3 "Comfortable" house that unlocks the workshop —
+// a flat craft-success bonus while crafting at home.
+const houseTierWorkshop = 3
+
+// homeWorkshopCraftBonus returns the additive craft-success bonus from a T3+
+// home workshop. Tier 1/2 and no house grant none.
+func homeWorkshopCraftBonus(houseTier int) float64 {
+	if houseTier >= houseTierWorkshop {
+		return 0.05
+	}
+	return 0
+}
+
+// craftingSuccessRate returns the success chance for a recipe given foraging
+// level. Base rate is 50% at minimum level, +3% per 5 levels above minimum,
+// capped at 95%. A T3+ home workshop adds workshopBonus on top and lifts the
+// cap to 98%, so a maxed forager still gains a little from the bench.
+func craftingSuccessRate(foragingLevel, minForaging int, workshopBonus float64) float64 {
 	base := 0.50
 	levelsAbove := foragingLevel - minForaging
 	bonus := float64(levelsAbove) / 5.0 * 0.03
-	rate := base + bonus
-	if rate > 0.95 {
-		return 0.95
+	rate := base + bonus + workshopBonus
+	cap := 0.95
+	if workshopBonus > 0 {
+		cap = 0.98
+	}
+	if rate > cap {
+		return cap
 	}
 	return rate
 }
@@ -369,7 +388,7 @@ type CraftResult struct {
 // their current foraging level, plus a teaser line for the next unlock
 // threshold. Hides exact ingredient lists for recipes the player hasn't
 // unlocked — only the count of locked recipes is shown.
-func renderRecipesKnown(foragingLevel int) string {
+func renderRecipesKnown(foragingLevel int, workshopBonus float64) string {
 	var sb strings.Builder
 	sb.WriteString(fmt.Sprintf("🧪 **Crafting Recipes** — Foraging Lv.%d\n\n", foragingLevel))
 
@@ -377,6 +396,9 @@ func renderRecipesKnown(foragingLevel int) string {
 		sb.WriteString("_Auto-crafting unlocks at Foraging Lv.10. Keep gathering._")
 		return sb.String()
 	}
+	if workshopBonus > 0 {
+		sb.WriteString(fmt.Sprintf("_🔨 Home workshop: +%.0f%% craft success._\n\n", workshopBonus*100))
+	}
 
 	// Group recipes by tier, list those known.
 	known := map[int][]CraftingRecipe{}
@@ -402,7 +424,7 @@ func renderRecipesKnown(foragingLevel int) string {
 		}
 		sb.WriteString(fmt.Sprintf("**Tier %d** (Foraging %d+)\n", tier, recipes[0].MinForaging))
 		for _, r := range recipes {
-			rate := craftingSuccessRate(foragingLevel, r.MinForaging) * 100
+			rate := craftingSuccessRate(foragingLevel, r.MinForaging, workshopBonus) * 100
 			sb.WriteString(fmt.Sprintf("  • %s — %s (%.0f%% success)\n",
 				r.Result, strings.Join(r.Ingredients, " + "), rate))
 		}
@@ -433,7 +455,7 @@ var craftXPFailure = map[int]int{1: 3, 2: 5, 3: 8, 4: 12, 5: 18}
 //
 // Side effects: grants foraging XP per attempt (success > failure) and bumps
 // the player's CraftsSucceeded counter on each success.
-func autoCraftConsumables(userID id.UserID, items []AdvItem, foragingLevel int) ([]CraftResult, []AdvItem) {
+func autoCraftConsumables(userID id.UserID, items []AdvItem, foragingLevel int, workshopBonus float64) ([]CraftResult, []AdvItem) {
 	if foragingLevel < 10 {
 		return nil, items
 	}
@@ -452,7 +474,7 @@ func autoCraftConsumables(userID id.UserID, items []AdvItem, foragingLevel int)
 			break
 		}
 
-		rate := craftingSuccessRate(foragingLevel, bestRecipe.MinForaging)
+		rate := craftingSuccessRate(foragingLevel, bestRecipe.MinForaging, workshopBonus)
 		success := rand.Float64() < rate
 
 		if success {

internal/plugin/adventure_duel.go

@@ -0,0 +1,718 @@
+package plugin
+
+// C2 — player-initiated duels (engagement plan N6).
+//
+// `!duel @user [stake]` — a staked, no-death arena bout between two real
+// characters, resolved through the auto-resolve combat engine. Both players
+// escrow the stake on accept; the winner takes 70% of the pooled 2×stake and
+// the community pot rakes the remaining 30% (a real pot sink). Records land in
+// adventure_rival_records, so one W/L history and one 7-day per-pair cooldown
+// covers both duel kinds (the bot-driven RPS rival and this).
+//
+// Why this is a wrapper and not a combat-engine change: the turn engine is an
+// N-players-vs-1-monster model — there is no seat for a second real character
+// on the enemy side (see the C2 feasibility note in the engagement plan). So a
+// duel does not seat two PCs against each other. Instead each fighter is built
+// as their real player Combatant (full kit: weapon, subclass passives, extra
+// attacks, race traits) and the *opponent* is synthesised as a monster-shaped
+// enemy stat block from their own sheet. That is asymmetric — the "player" side
+// runs its full kit while the synthesised enemy is a flat stat block — so a
+// single bout would systematically favour whoever is the attacker. The duel
+// runs the bout in BOTH orientations and decides on the aggregate HP margin,
+// which cancels that edge symmetrically. To-hit is faithful either way (both
+// sides roll d20 + AttackBonus vs AC); only damage-per-hit is folded into the
+// synthesised enemy's flat Attack. Class-vs-class PvP balance is explicitly out
+// of scope (bragging rights, capped stakes).
+
+import (
+	"fmt"
+	"math"
+	"math/rand/v2"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"github.com/google/uuid"
+	"maunium.net/go/mautrix/id"
+)
+
+const (
+	duelMinLevel     = 3              // both duellists must be at least this level
+	duelAcceptWindow = 24 * time.Hour // an unanswered challenge expires and refunds
+	duelStakePerLvl  = 500            // stake cap = challenger level × this
+	duelMinStake     = 100            // floor so a "duel" always has something on it
+	duelWinnerPct    = 0.70           // winner's cut of the pooled 2×stake; pot rakes the rest
+)
+
+// advDuelChallenge is one outstanding duel invitation. Unlike the RPS rival
+// challenge it carries no per-round score — a combat duel resolves in a single
+// step on accept. The challenger's stake is already escrowed (debited) when the
+// row exists; the challenged player's is debited on accept.
+type advDuelChallenge struct {
+	ChallengeID  string
+	ChallengerID id.UserID
+	ChallengedID id.UserID
+	Stake        int
+	ExpiresAt    time.Time
+	CreatedAt    time.Time
+}
+
+// ── Persistence ──────────────────────────────────────────────────────────────
+
+func insertDuelChallenge(c *advDuelChallenge) {
+	db.Exec("duel: insert challenge",
+		`INSERT INTO adventure_duel_challenges
+		 (challenge_id, challenger_id, challenged_id, stake, expires_at)
+		 VALUES (?, ?, ?, ?, ?)`,
+		c.ChallengeID, string(c.ChallengerID), string(c.ChallengedID), c.Stake, c.ExpiresAt,
+	)
+}
+
+func deleteDuelChallenge(challengeID string) {
+	db.Exec("duel: delete challenge",
+		`DELETE FROM adventure_duel_challenges WHERE challenge_id = ?`, challengeID)
+}
+
+// claimDuelChallenge atomically deletes the row and reports whether THIS caller
+// is the one that removed it. It is the single serialization point for a
+// challenge's terminal fate: accept, decline and the expiry ticker all race to
+// claim it, and exactly one wins. Only the winner moves euros — that is what
+// stops a stake being both resolved and refunded across the 24h boundary, or a
+// double `!duel decline` double-refunding. Mirrors communityPotDebit's
+// RowsAffected gate.
+func claimDuelChallenge(challengeID string) bool {
+	res := db.ExecResult("duel: claim challenge",
+		`DELETE FROM adventure_duel_challenges WHERE challenge_id = ?`, challengeID)
+	if res == nil {
+		return false
+	}
+	n, _ := res.RowsAffected()
+	return n == 1
+}
+
+func scanDuelChallenge(row interface{ Scan(...any) error }) (*advDuelChallenge, error) {
+	c := &advDuelChallenge{}
+	err := row.Scan(&c.ChallengeID, &c.ChallengerID, &c.ChallengedID, &c.Stake, &c.ExpiresAt, &c.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// pendingDuelForChallenged returns the live (unexpired) challenge awaiting this
+// player's answer, or nil. Expired rows are ignored here and swept by the
+// ticker, so a player is never shown a challenge they can no longer accept.
+func pendingDuelForChallenged(userID id.UserID) *advDuelChallenge {
+	c := &advDuelChallenge{}
+	err := db.Get().QueryRow(`
+		SELECT challenge_id, challenger_id, challenged_id, stake, expires_at, created_at
+		FROM adventure_duel_challenges
+		WHERE challenged_id = ? AND expires_at > CURRENT_TIMESTAMP
+		ORDER BY created_at DESC LIMIT 1`, string(userID)).Scan(
+		&c.ChallengeID, &c.ChallengerID, &c.ChallengedID, &c.Stake, &c.ExpiresAt, &c.CreatedAt)
+	if err != nil {
+		return nil
+	}
+	return c
+}
+
+// duelInvolves reports whether the player has any live challenge in flight, as
+// challenger or challenged. Used to enforce one duel at a time per player — the
+// escrow makes overlapping challenges a way to double-commit the same euros.
+func duelInvolves(userID id.UserID) bool {
+	var n int
+	db.Get().QueryRow(`
+		SELECT COUNT(*) FROM adventure_duel_challenges
+		WHERE (challenger_id = ? OR challenged_id = ?) AND expires_at > CURRENT_TIMESTAMP`,
+		string(userID), string(userID)).Scan(&n)
+	return n > 0
+}
+
+func loadExpiredDuelChallenges() []advDuelChallenge {
+	rows, err := db.Get().Query(`
+		SELECT challenge_id, challenger_id, challenged_id, stake, expires_at, created_at
+		FROM adventure_duel_challenges WHERE expires_at <= CURRENT_TIMESTAMP`)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var out []advDuelChallenge
+	for rows.Next() {
+		if c, err := scanDuelChallenge(rows); err == nil {
+			out = append(out, *c)
+		}
+	}
+	return out
+}
+
+// ── Stake / gating ───────────────────────────────────────────────────────────
+
+// duelMaxStake caps the stake at level × duelStakePerLvl so a strong player
+// can't farm a runaway pot off a weaker one, per the plan's imbalance cap.
+func duelMaxStake(level int) int { return level * duelStakePerLvl }
+
+// duelPayout splits the pooled 2×stake: the winner takes duelWinnerPct, the
+// community pot rakes the remainder. Both fighters escrowed stake, so the
+// winner's net gain is winnerShare − stake and the pot is a real sink.
+func duelPayout(stake int) (winnerShare, potShare int) {
+	pool := stake * 2
+	winnerShare = int(math.Round(float64(pool) * duelWinnerPct))
+	potShare = pool - winnerShare
+	return
+}
+
+// duelEligible reports whether a character can duel at all: alive, set up, and
+// at least duelMinLevel. Returns a player-facing reason when it can't.
+func (p *AdventurePlugin) duelEligible(char *AdventureCharacter) (int, string) {
+	if char == nil {
+		return 0, "no adventurer"
+	}
+	if !char.Alive {
+		return 0, "dead"
+	}
+	lvl := rivalLevelForUser(char)
+	if lvl < duelMinLevel {
+		return lvl, fmt.Sprintf("below level %d", duelMinLevel)
+	}
+	return lvl, ""
+}
+
+// ── Combat synthesis ─────────────────────────────────────────────────────────
+
+// buildDuelist derives a fighter's full player Combatant — the same build a
+// zone encounter uses, so weapon, subclass passives, extra attacks and race
+// traits all apply — then resets it to full health. A duel is a fresh arena
+// bout, not a continuation of a wounded expedition, so wound carry-over is
+// dropped (StartHP=0 = "enter at MaxHP"). Mood 50 is the neutral band: no
+// initiative bias, no enemy-attack tilt.
+//
+// The armed-ability slot is left empty: actively-armed one-shots (a Berserker's
+// rage) don't fire, but always-on passives (Extra Attack, Sneak Attack, Divine
+// Strike, race traits) still layer in via the class/subclass passive builders.
+func (p *AdventurePlugin) buildDuelist(userID id.UserID) (Combatant, error) {
+	var noMonster DnDMonsterTemplate
+	player, _, _, err := p.buildZoneCombatants(userID, noMonster, 1, 50, "")
+	if err != nil {
+		return Combatant{}, err
+	}
+	player.Stats.StartHP = 0
+	return player, nil
+}
+
+// duelPerHitDamage is a fighter's expected damage on a single landed hit, used
+// to size the flat Attack of their synthesised enemy stat block. It mirrors the
+// player damage path's terms that the enemy path can't express: weapon dice
+// average (or the legacy flat Attack for a weaponless build), the always-on
+// per-hit riders (Divine Strike, Sneak Attack, Hunter's Mark, rage), then the
+// multiplicative damage bonus. Crit chance and once-per-fight openers are not
+// modelled — a coarse mean is enough for a capped-stakes bout decided over two
+// orientations.
+func duelPerHitDamage(pc Combatant) float64 {
+	base := float64(pc.Stats.Attack)
+	if w := pc.Stats.Weapon; w != nil {
+		if pc.Stats.TwoHandedMode && w.HasProperty(PropVersatile) && w.VersaCount > 0 {
+			base = float64(w.VersaCount)*(float64(w.VersaSides)+1)/2 +
+				float64(pc.Stats.AbilityModForDamage) + float64(w.MagicBonus)
+		} else {
+			base = avgWeaponDamage(w, pc.Stats.AbilityModForDamage)
+		}
+	}
+	riders := float64(pc.Mods.DivineStrikePerHit)
+	riders += float64(pc.Mods.SneakAttackDie) * 3.5
+	riders += float64(pc.Mods.HuntersMarkDie) * 3.5
+	if pc.Mods.BerserkerRage {
+		riders += float64(pc.Mods.RageMeleeDmg)
+	}
+	perHit := (base + riders) * (1 + pc.Mods.DamageBonus)
+	if perHit < 1 {
+		perHit = 1
+	}
+	return perHit
+}
+
+// duelPerRoundProcDamage is the expected per-round damage from a fighter's
+// companion strikes — a Cleric's spiritual weapon and a Beastmaster's pet —
+// which land once per round on a proc roll rather than per weapon hit. The live
+// fighter rolls these natively in the engine; folding their expectation into the
+// synth enemy's round damage keeps both orientations comparable for those
+// builds (each formula is Dmg + d5, mean +3).
+func duelPerRoundProcDamage(pc Combatant) float64 {
+	dmg := pc.Mods.SpiritWeaponProc * (float64(pc.Mods.SpiritWeaponDmg) + 3)
+	dmg += pc.Mods.PetAttackProc * (float64(pc.Mods.PetAttackDmg) + 3)
+	return dmg
+}
+
+// synthDuelEnemy turns a fighter's player Combatant into the monster-shaped
+// enemy the opposite fighter faces. HP, AC and AttackBonus carry over verbatim
+// (to-hit stays faithful — the enemy rolls d20 + AttackBonus vs the attacker's
+// AC exactly as the player does). DamageReduct carries over too, so a
+// Barbarian's / Monk's flat mitigation is as tanky as the enemy as it is as the
+// live PC. Offense is the lossy term: the enemy path deals a flat Attack, so a
+// whole round — weapon swings (per-hit × (1 + extra attacks)) plus the expected
+// companion-strike damage — is folded into one enemy Attack, preserving expected
+// round damage while widening variance (a wash across the two orientations).
+//
+// Deliberately NOT modelled on the enemy side (accepted scope — the plan frames
+// duels as bragging rights and puts class-vs-class PvP balance explicitly out of
+// scope): reactive one-shots the enemy engine has no channel for — heal items,
+// wards, the Sovereign death-save, the arcane ward buffer — and spell damage,
+// which buildZoneCombatants never wires for the live caster either, so a caster
+// fights weapon-only in both orientations. Defense is dropped: the weapon-damage
+// path players use reads DamageReduct, not the enemy's Defense stat.
+func synthDuelEnemy(pc Combatant) Combatant {
+	swings := 1 + pc.Mods.ExtraAttacks
+	roundDmg := duelPerHitDamage(pc)*float64(swings) + duelPerRoundProcDamage(pc)
+	return Combatant{
+		Name:     pc.Name,
+		IsPlayer: false,
+		Stats: CombatStats{
+			MaxHP:       pc.Stats.MaxHP,
+			AC:          pc.Stats.AC,
+			AttackBonus: pc.Stats.AttackBonus,
+			Attack:      int(math.Round(roundDmg)),
+		},
+		Mods: CombatModifiers{DamageReduct: pc.Mods.DamageReduct},
+	}
+}
+
+// duelResult is the two-orientation verdict. challengerMargin/challengedMargin
+// are aggregate remaining-HP fractions across both bouts (0..2 each); the higher
+// wins. decisive is true when one fighter won both orientations outright — pure
+// narration, the margin is what decides.
+type duelResult struct {
+	challengerWins bool
+	draw           bool
+	decisive       bool
+	challengerFrac float64
+	challengedFrac float64
+}
+
+func hpFraction(end, start int) float64 {
+	if start <= 0 {
+		return 0
+	}
+	if end < 0 {
+		end = 0
+	}
+	return float64(end) / float64(start)
+}
+
+// resolveDuel runs the bout both ways and decides on the aggregate HP margin.
+// Orientation 1 seats the challenger as the live fighter against the challenged
+// player's stat block; orientation 2 swaps them. Each fighter's margin sums the
+// HP fraction they kept as the live fighter in one bout and as the stat block in
+// the other, so the attacker's-kit advantage is applied to both fighters once
+// and cancels. rng is threaded for the seeded characterization/unit tests; nil
+// is production (package-global RNG).
+func resolveDuel(challenger, challenged Combatant, rng *rand.Rand) duelResult {
+	r1 := simulateCombatWithRNG(challenger, synthDuelEnemy(challenged), defaultCombatPhases, rng)
+	r2 := simulateCombatWithRNG(challenged, synthDuelEnemy(challenger), defaultCombatPhases, rng)
+
+	cFrac := hpFraction(r1.PlayerEndHP, r1.PlayerStartHP) + hpFraction(r2.EnemyEndHP, r2.EnemyStartHP)
+	dFrac := hpFraction(r1.EnemyEndHP, r1.EnemyStartHP) + hpFraction(r2.PlayerEndHP, r2.PlayerStartHP)
+
+	res := duelResult{challengerFrac: cFrac, challengedFrac: dFrac}
+	switch {
+	case cFrac > dFrac:
+		res.challengerWins = true
+	case dFrac > cFrac:
+		res.challengerWins = false
+	default:
+		res.draw = true
+	}
+	// Decisive = the winner also took both orientations outright.
+	if !res.draw {
+		if res.challengerWins {
+			res.decisive = r1.PlayerWon && !r2.PlayerWon
+		} else {
+			res.decisive = r2.PlayerWon && !r1.PlayerWon
+		}
+	}
+	return res
+}
+
+// ── Command surface ──────────────────────────────────────────────────────────
+
+func (p *AdventurePlugin) handleDuelCmd(ctx MessageContext, args string) error {
+	args = strings.TrimSpace(args)
+	fields := strings.Fields(args)
+	if len(fields) == 0 {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"⚔️ **Duels** — challenge another adventurer to a staked, no-death bout.\n"+
+				"`!duel @user [stake]` — throw down · `!duel accept` / `!duel decline` · `!duel status`")
+	}
+	switch strings.ToLower(fields[0]) {
+	case "accept":
+		return p.acceptDuel(ctx)
+	case "decline":
+		return p.declineDuel(ctx)
+	case "status":
+		return p.duelStatusCmd(ctx)
+	default:
+		return p.issueDuel(ctx, fields)
+	}
+}
+
+func (p *AdventurePlugin) issueDuel(ctx MessageContext, fields []string) error {
+	targetID, ok := p.ResolveUser(fields[0], ctx.RoomID)
+	if !ok {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Could not resolve that user. Usage: `!duel @user [stake]`")
+	}
+	if targetID == ctx.Sender {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You can't duel yourself.")
+	}
+
+	// Serialise the one-duel gate, balance check and escrow so two rapid `!duel`
+	// from the same challenger can't both pass duelInvolves and double-debit.
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	challenger, err := loadAdvCharacter(ctx.Sender)
+	if err != nil || challenger == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You have no adventurer. Type `!adventure` to create one.")
+	}
+	lvl, reason := p.duelEligible(challenger)
+	if reason != "" {
+		return p.SendReply(ctx.RoomID, ctx.EventID, duelIneligibleSelf(reason))
+	}
+
+	challenged, err := loadAdvCharacter(targetID)
+	if err != nil || challenged == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf("%s has no adventurer to duel.", p.DisplayName(targetID)))
+	}
+	if _, reason := p.duelEligible(challenged); reason != "" {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("%s can't duel right now (%s).", p.DisplayName(targetID), reason))
+	}
+	if challenged.BabysitActive {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("%s left word with the Babysitting Service — no duels while they're away.", p.DisplayName(targetID)))
+	}
+
+	// One duel at a time per player, either side — the escrow makes overlaps a
+	// double-commit of the same euros.
+	if duelInvolves(ctx.Sender) {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You already have a duel in flight. Resolve it first.")
+	}
+	if duelInvolves(targetID) {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf("%s already has a duel in flight.", p.DisplayName(targetID)))
+	}
+
+	// Shared 7-day per-pair cooldown across both duel kinds (records table).
+	if last := lastDuelBetween(ctx.Sender, targetID); !last.IsZero() && time.Since(last) < rivalSamePairCooldown {
+		wait := rivalSamePairCooldown - time.Since(last)
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("You've dueled %s too recently. Try again %s.", p.DisplayName(targetID), formatDuration(wait)))
+	}
+
+	stake, err := p.parseDuelStake(fields, lvl)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, err.Error())
+	}
+	if bal := p.euro.GetBalance(ctx.Sender); int(bal) < stake {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("You can't cover a €%d stake — you have €%d.", stake, int(bal)))
+	}
+
+	// Escrow the challenger's stake now (debited to nowhere; the pot/winner split
+	// redistributes it on resolution, and expiry/decline refunds it).
+	if !p.euro.Debit(ctx.Sender, float64(stake), "duel_escrow") {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't hold your stake. Try again.")
+	}
+
+	ch := &advDuelChallenge{
+		ChallengeID:  uuid.NewString(),
+		ChallengerID: ctx.Sender,
+		ChallengedID: targetID,
+		Stake:        stake,
+		ExpiresAt:    time.Now().UTC().Add(duelAcceptWindow),
+	}
+	insertDuelChallenge(ch)
+
+	p.SendDM(targetID, fmt.Sprintf(
+		"⚔️ **%s challenges you to a duel!**\n\nStake: €%d each — winner takes 70%% of the pot.\n"+
+			"No death, no hospital bill. Just bragging rights.\n\n`!duel accept` or `!duel decline` — you have 24 hours.",
+		p.DisplayName(ctx.Sender), stake))
+
+	return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+		"⚔️ You throw down the gauntlet before **%s** for €%d. They have 24 hours to answer.",
+		p.DisplayName(targetID), stake))
+}
+
+// parseDuelStake reads the optional stake argument, defaulting to the cap for
+// the challenger's level and clamping into [duelMinStake, duelMaxStake].
+func (p *AdventurePlugin) parseDuelStake(fields []string, level int) (int, error) {
+	maxStake := duelMaxStake(level)
+	if len(fields) < 2 {
+		return maxStake, nil
+	}
+	raw := strings.TrimPrefix(fields[1], "€")
+	stake := 0
+	if _, err := fmt.Sscanf(raw, "%d", &stake); err != nil || stake <= 0 {
+		return 0, fmt.Errorf("that's not a valid stake. Usage: `!duel @user [stake]`")
+	}
+	if stake < duelMinStake {
+		return 0, fmt.Errorf("minimum stake is €%d", duelMinStake)
+	}
+	if stake > maxStake {
+		return 0, fmt.Errorf("your stake is capped at €%d (level %d × €%d)", maxStake, level, duelStakePerLvl)
+	}
+	return stake, nil
+}
+
+func (p *AdventurePlugin) acceptDuel(ctx MessageContext) error {
+	// Serialise a player's own accept so a double-submit can't debit twice.
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	ch := pendingDuelForChallenged(ctx.Sender)
+	if ch == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You have no pending duel to accept.")
+	}
+	// Cheap validation first — these leave the challenge open (the player can
+	// revive/earn and retry, or decline to release the challenger's escrow).
+	challenged, err := loadAdvCharacter(ctx.Sender)
+	if err != nil || challenged == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You have no adventurer.")
+	}
+	if _, reason := p.duelEligible(challenged); reason != "" {
+		return p.SendReply(ctx.RoomID, ctx.EventID, duelIneligibleSelf(reason))
+	}
+	if bal := p.euro.GetBalance(ctx.Sender); int(bal) < ch.Stake {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("You can't cover the €%d stake — you have €%d. `!duel decline` to back out.", ch.Stake, int(bal)))
+	}
+
+	// The challenger may have died or dropped below the gate during the 24h
+	// window. If so, cancel the duel: claim the row (so the ticker/decline can't
+	// also refund) and hand the challenger their escrow back.
+	challenger, cerr := loadAdvCharacter(ch.ChallengerID)
+	if cerr != nil || challenger == nil {
+		if claimDuelChallenge(ch.ChallengeID) {
+			p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_challenger_gone")
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Your challenger is no longer available. The duel is off.")
+	}
+	if _, reason := p.duelEligible(challenger); reason != "" {
+		if claimDuelChallenge(ch.ChallengeID) {
+			p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_challenger_ineligible")
+			p.SendDM(ch.ChallengerID, fmt.Sprintf(
+				"⚔️ Your duel with **%s** was called off — you can't fight right now. Your €%d stake is refunded.",
+				p.DisplayName(ctx.Sender), ch.Stake))
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			fmt.Sprintf("**%s** can't duel right now (%s). The challenge is off.", p.DisplayName(ch.ChallengerID), reason))
+	}
+
+	// Build both fighters BEFORE debiting the challenged player, so the deep
+	// sheet-loading / combat code (the panic-prone part) runs while nobody but
+	// the challenger is committed. A build failure refunds only the challenger.
+	challengerC, err1 := p.buildDuelist(ch.ChallengerID)
+	challengedC, err2 := p.buildDuelist(ctx.Sender)
+	if err1 != nil || err2 != nil {
+		if claimDuelChallenge(ch.ChallengeID) {
+			p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_error")
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID, "The duel couldn't be staged. The challenger's stake is refunded.")
+	}
+
+	// Commit: claim the row (exactly one path wins), then take the challenged
+	// player's stake. From here both stakes are held and resolution is pure
+	// arithmetic — no further build or DB read that could panic mid-payout.
+	if !claimDuelChallenge(ch.ChallengeID) {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "That duel is no longer available.")
+	}
+	if !p.euro.Debit(ctx.Sender, float64(ch.Stake), "duel_escrow") {
+		p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_error")
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't hold your stake. The duel is off.")
+	}
+
+	return p.settleDuel(ctx, ch, challengerC, challengedC)
+}
+
+func (p *AdventurePlugin) declineDuel(ctx MessageContext) error {
+	// Same lock as accept so a player's own accept/decline can't interleave; the
+	// claim is the real guard, but the lock keeps the read→claim window tight.
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	ch := pendingDuelForChallenged(ctx.Sender)
+	if ch == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You have no pending duel to decline.")
+	}
+	if !claimDuelChallenge(ch.ChallengeID) {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "You have no pending duel to decline.")
+	}
+	p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_declined")
+	p.SendDM(ch.ChallengerID, fmt.Sprintf(
+		"🛡️ **%s** declined your duel. Your €%d stake is refunded.", p.DisplayName(ctx.Sender), ch.Stake))
+	return p.SendReply(ctx.RoomID, ctx.EventID, "You decline the duel. No harm done.")
+}
+
+func (p *AdventurePlugin) duelStatusCmd(ctx MessageContext) error {
+	if ch := pendingDuelForChallenged(ctx.Sender); ch != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"⚔️ **%s** has challenged you for €%d. `!duel accept` / `!duel decline` (expires %s).",
+			p.DisplayName(ch.ChallengerID), ch.Stake, formatDuration(time.Until(ch.ExpiresAt))))
+	}
+	// Any challenge we issued that's still pending?
+	c := &advDuelChallenge{}
+	err := db.Get().QueryRow(`
+		SELECT challenge_id, challenger_id, challenged_id, stake, expires_at, created_at
+		FROM adventure_duel_challenges
+		WHERE challenger_id = ? AND expires_at > CURRENT_TIMESTAMP
+		ORDER BY created_at DESC LIMIT 1`, string(ctx.Sender)).Scan(
+		&c.ChallengeID, &c.ChallengerID, &c.ChallengedID, &c.Stake, &c.ExpiresAt, &c.CreatedAt)
+	if err == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"⚔️ You've challenged **%s** for €%d. Waiting on their answer (expires %s).",
+			p.DisplayName(c.ChallengedID), c.Stake, formatDuration(time.Until(c.ExpiresAt))))
+	}
+	return p.SendReply(ctx.RoomID, ctx.EventID, "You have no duels in flight. `!duel @user [stake]` to start one.")
+}
+
+// ── Resolution ───────────────────────────────────────────────────────────────
+
+// settleDuel resolves the two-orientation bout, splits the pooled 2×stake,
+// records the result, and DMs both players. By the time it runs the challenge
+// row is claimed, both fighters are built, and both stakes are held — so from
+// here it is pure arithmetic and message sends, nothing that can panic and
+// strand the pool. On an exact HP-margin tie both stakes are refunded.
+func (p *AdventurePlugin) settleDuel(ctx MessageContext, ch *advDuelChallenge, challengerC, challengedC Combatant) error {
+	res := resolveDuel(challengerC, challengedC, nil)
+
+	if res.draw {
+		// Exact HP-margin tie: refund both, record nothing, no cooldown burned.
+		p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_draw")
+		p.euro.Credit(ch.ChallengedID, float64(ch.Stake), "duel_refund_draw")
+		draw := fmt.Sprintf("⚔️ **%s** and **%s** fought to a standstill. Both stakes refunded.",
+			p.DisplayName(ch.ChallengerID), p.DisplayName(ch.ChallengedID))
+		p.SendDM(ch.ChallengerID, draw)
+		p.SendDM(ch.ChallengedID, draw)
+		return p.SendReply(ctx.RoomID, ctx.EventID, draw)
+	}
+
+	winnerID, loserID := ch.ChallengedID, ch.ChallengerID
+	if res.challengerWins {
+		winnerID, loserID = ch.ChallengerID, ch.ChallengedID
+	}
+
+	winnerShare, potShare := duelPayout(ch.Stake)
+	p.euro.Credit(winnerID, float64(winnerShare), "duel_win")
+	if potShare > 0 {
+		communityPotAdd(potShare)
+		// The rake came out of a pool both funded; attribute it half each.
+		trackTaxPaid(winnerID, potShare/2)
+		trackTaxPaid(loserID, potShare-potShare/2)
+	}
+
+	upsertRivalRecord(winnerID, loserID, true)
+	upsertRivalRecord(loserID, winnerID, false)
+
+	// One BULLETIN dispatch per settled duel (from the winner's side, so it
+	// fires once). Character names only; no-op unless the seam is enabled.
+	if wn, ln := charName(winnerID), charName(loserID); wn != "" && ln != "" {
+		ts := nowUnix()
+		disc := fmt.Sprintf("rival:%d", ts)
+		emitFact(peteclient.Fact{
+			GUID:       fmt.Sprintf("rival_result:%s:%s:%d", eventToken(winnerID, disc), eventToken(loserID, disc), ts),
+			EventType:  "rival_result",
+			Tier:       "bulletin",
+			Subject:    wn,
+			Opponent:   ln,
+			Outcome:    "won",
+			OccurredAt: ts,
+		}, winnerID, loserID)
+	}
+
+	p.announceDuel(ctx, winnerID, loserID, ch.Stake, winnerShare, potShare, res.decisive)
+	return nil
+}
+
+func (p *AdventurePlugin) announceDuel(ctx MessageContext, winnerID, loserID id.UserID, stake, winnerShare, potShare int, decisive bool) {
+	winName, loseName := p.DisplayName(winnerID), p.DisplayName(loserID)
+	flair := pickDuelFlavor(duelWinFlavor)
+	if decisive {
+		flair = pickDuelFlavor(duelDecisiveFlavor)
+	}
+
+	p.SendDM(winnerID, fmt.Sprintf(
+		"⚔️ **You beat %s!**\n\n*%s*\n\nYou take €%d (net +€%d). €%d went to the community pot.",
+		loseName, flair, winnerShare, winnerShare-stake, potShare))
+	p.SendDM(loserID, fmt.Sprintf(
+		"⚔️ **%s bested you.**\n\n*%s*\n\nYou're down €%d — but you walk away, no worse for wear.",
+		winName, pickDuelFlavor(duelLossFlavor), stake))
+
+	// Broadcast the result to the games room for bragging rights — unless the
+	// duel was accepted there, in which case the SendReply below already covers
+	// it and a second line would just be noise.
+	if gr := gamesRoom(); gr != "" && gr != ctx.RoomID {
+		verb := "defeated"
+		if decisive {
+			verb = "decisively defeated"
+		}
+		p.SendMessage(gr, fmt.Sprintf("⚔️ **%s** %s **%s** in a duel for €%d.", winName, verb, loseName, stake))
+	}
+	// Confirm in the room the challenge was accepted from too.
+	p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf("⚔️ **%s** wins the duel, taking €%d.", winName, winnerShare))
+}
+
+// expireDuelChallenges refunds and clears any challenge whose 24h window lapsed.
+// Rides the 1-minute event ticker (no new goroutine); only the challenger was
+// escrowed, so only they are refunded.
+func (p *AdventurePlugin) expireDuelChallenges() {
+	for _, ch := range loadExpiredDuelChallenges() {
+		// Claim before refunding: if an accept/decline already took this row at
+		// the 24h boundary, we must not also refund the challenger.
+		if !claimDuelChallenge(ch.ChallengeID) {
+			continue
+		}
+		p.euro.Credit(ch.ChallengerID, float64(ch.Stake), "duel_refund_expired")
+		p.SendDM(ch.ChallengerID, fmt.Sprintf(
+			"⌛ **%s** never answered your duel. Your €%d stake is refunded.",
+			p.DisplayName(ch.ChallengedID), ch.Stake))
+	}
+}
+
+func duelIneligibleSelf(reason string) string {
+	switch reason {
+	case "dead":
+		return "You can't duel while dead. Visit `!hospital` first."
+	case "no adventurer":
+		return "You have no adventurer. Type `!adventure` to create one."
+	default:
+		return fmt.Sprintf("You need to be at least level %d to duel.", duelMinLevel)
+	}
+}
+
+// ── Flavor ───────────────────────────────────────────────────────────────────
+
+var duelWinFlavor = []string{
+	"Steel rang, and the crowd knew its champion.",
+	"A clean finish — you left them nothing to answer with.",
+	"They fought well. You fought better.",
+}
+
+var duelDecisiveFlavor = []string{
+	"It was over before it began. Utterly one-sided.",
+	"You never gave them a foothold. A rout.",
+	"The arena barely had time to hush.",
+}
+
+var duelLossFlavor = []string{
+	"You'll want that one back. Next time.",
+	"A hard lesson — but only your pride is bleeding.",
+	"Close, in places. Not close enough.",
+}
+
+func pickDuelFlavor(pool []string) string {
+	if len(pool) == 0 {
+		return ""
+	}
+	return pool[rand.IntN(len(pool))]
+}

internal/plugin/adventure_duel_test.go

@@ -0,0 +1,274 @@
+package plugin
+
+import (
+	"math"
+	"math/rand/v2"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newDuelTestDB(t *testing.T) {
+	t.Helper()
+	db.Close()
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+// duelSeed builds a deterministic RNG so the two-orientation resolver is
+// reproducible across runs — the production path passes nil (global RNG).
+func duelSeed(i uint64) *rand.Rand { return rand.New(rand.NewPCG(0x1d4e11, i)) }
+
+func TestDuelPayout(t *testing.T) {
+	// Both escrow 2000 → pool 4000 → winner 70% (2800), pot 30% (1200).
+	w, pot := duelPayout(2000)
+	if w != 2800 || pot != 1200 {
+		t.Fatalf("duelPayout(2000) = (%d, %d), want (2800, 1200)", w, pot)
+	}
+	// The pot always gets exactly what the winner doesn't; nothing is minted
+	// or lost against the pooled 2×stake.
+	for _, stake := range []int{100, 137, 999, 6000} {
+		w, pot := duelPayout(stake)
+		if w+pot != stake*2 {
+			t.Errorf("duelPayout(%d): winner+pot = %d, want pool %d", stake, w+pot, stake*2)
+		}
+		if w <= pot {
+			t.Errorf("duelPayout(%d): winner %d should exceed pot %d", stake, w, pot)
+		}
+	}
+}
+
+func TestDuelMaxStake(t *testing.T) {
+	if got := duelMaxStake(5); got != 2500 {
+		t.Fatalf("duelMaxStake(5) = %d, want 2500", got)
+	}
+}
+
+func TestDuelPerHitDamage(t *testing.T) {
+	// 1d8 (avg 4.5) + ability mod 3 = 7.5 base, + Divine Strike 2 = 9.5,
+	// × (1 + 0.25 damage bonus) = 11.875.
+	pc := Combatant{
+		Stats: CombatStats{
+			Weapon:              &WeaponProfile{DamageCount: 1, DamageSides: 8},
+			AbilityModForDamage: 3,
+		},
+		Mods: CombatModifiers{DivineStrikePerHit: 2, DamageBonus: 0.25},
+	}
+	got := duelPerHitDamage(pc)
+	if math.Abs(got-11.875) > 1e-9 {
+		t.Fatalf("duelPerHitDamage = %v, want 11.875", got)
+	}
+
+	// Weaponless build falls back to the flat Attack stat.
+	bare := Combatant{Stats: CombatStats{Attack: 9}}
+	if got := duelPerHitDamage(bare); got != 9 {
+		t.Fatalf("weaponless duelPerHitDamage = %v, want 9", got)
+	}
+
+	// A build that computes to <1 is floored to 1 (a fight always deals damage).
+	weak := Combatant{Stats: CombatStats{Attack: 0}}
+	if got := duelPerHitDamage(weak); got != 1 {
+		t.Fatalf("floored duelPerHitDamage = %v, want 1", got)
+	}
+}
+
+func TestSynthDuelEnemy(t *testing.T) {
+	pc := Combatant{
+		Name:     "Aria",
+		IsPlayer: true,
+		Stats: CombatStats{
+			MaxHP:               123,
+			AC:                  17,
+			AttackBonus:         8,
+			Defense:             5,
+			Weapon:              &WeaponProfile{DamageCount: 1, DamageSides: 8},
+			AbilityModForDamage: 3,
+		},
+		Mods: CombatModifiers{ExtraAttacks: 1}, // two swings/round
+	}
+	e := synthDuelEnemy(pc)
+
+	if e.IsPlayer {
+		t.Error("synthesised enemy must not be flagged IsPlayer")
+	}
+	if e.Ability != nil {
+		t.Error("v1 synth enemy carries no MonsterAbility")
+	}
+	// HP / AC / to-hit carry over verbatim: to-hit stays faithful both ways.
+	if e.Stats.MaxHP != 123 || e.Stats.AC != 17 || e.Stats.AttackBonus != 8 {
+		t.Errorf("stat carryover wrong: got HP=%d AC=%d AB=%d", e.Stats.MaxHP, e.Stats.AC, e.Stats.AttackBonus)
+	}
+	// Damage: per-hit (7.5) × swings (2) folded into one flat Attack = 15.
+	if e.Stats.Attack != 15 {
+		t.Errorf("folded Attack = %d, want 15 (7.5 × 2 swings)", e.Stats.Attack)
+	}
+}
+
+// TestResolveDuel_StrongerWinsRegardlessOfRole pins that a clearly superior
+// build wins whether it issues or receives the challenge — the two-orientation
+// resolver must not hand the win to the attacker seat.
+func TestResolveDuel_StrongerWinsRegardlessOfRole(t *testing.T) {
+	strong := Combatant{
+		Name: "Champion", IsPlayer: true,
+		Stats: CombatStats{
+			MaxHP: 220, AC: 19, AttackBonus: 12,
+			Weapon: &WeaponProfile{DamageCount: 2, DamageSides: 8}, AbilityModForDamage: 5, WeaponProficient: true,
+		},
+	}
+	weak := Combatant{
+		Name: "Novice", IsPlayer: true,
+		Stats: CombatStats{
+			MaxHP: 45, AC: 11, AttackBonus: 3,
+			Weapon: &WeaponProfile{DamageCount: 1, DamageSides: 4}, AbilityModForDamage: 0, WeaponProficient: true,
+		},
+	}
+
+	for i := uint64(0); i < 50; i++ {
+		if r := resolveDuel(strong, weak, duelSeed(i)); r.draw || !r.challengerWins {
+			t.Fatalf("seed %d: strong-as-challenger should win, got %+v", i, r)
+		}
+		if r := resolveDuel(weak, strong, duelSeed(i)); r.draw || r.challengerWins {
+			t.Fatalf("seed %d: strong-as-challenged should win, got %+v", i, r)
+		}
+	}
+}
+
+// TestResolveDuel_IdenticalFightersAreUnbiased is the fairness guarantee that
+// justifies running both orientations: with two identical builds neither the
+// challenger nor the challenged seat may have a systematic edge. A single-
+// orientation model (attacker uses full kit, defender is a stat block) would
+// skew hard toward the challenger; the both-orientations margin cancels it.
+func TestResolveDuel_IdenticalFightersAreUnbiased(t *testing.T) {
+	fighter := Combatant{
+		Name: "Mirror", IsPlayer: true,
+		Stats: CombatStats{
+			MaxHP: 110, AC: 15, AttackBonus: 7,
+			Weapon: &WeaponProfile{DamageCount: 1, DamageSides: 8}, AbilityModForDamage: 3, WeaponProficient: true,
+		},
+	}
+
+	const n = 1200
+	challengerWins, draws := 0, 0
+	for i := uint64(0); i < n; i++ {
+		r := resolveDuel(fighter, fighter, duelSeed(i))
+		switch {
+		case r.draw:
+			draws++
+		case r.challengerWins:
+			challengerWins++
+		}
+	}
+	decided := n - draws
+	if decided == 0 {
+		t.Fatal("all identical-fighter duels drew — resolver isn't discriminating")
+	}
+	// Unbiased by construction (challenger wins iff D1 > D2 for iid D); allow a
+	// generous ±10% band so this stays a bias check, not a flaky coin-count.
+	rate := float64(challengerWins) / float64(decided)
+	if rate < 0.40 || rate > 0.60 {
+		t.Fatalf("challenger win rate %.3f over %d decided duels — systematic bias (want ~0.5)", rate, decided)
+	}
+}
+
+// TestClaimDuelChallenge pins the serialization primitive that guards every
+// euro path: exactly one caller may claim a challenge, so accept/decline/expire
+// can never both move money for the same row.
+func TestClaimDuelChallenge(t *testing.T) {
+	newDuelTestDB(t)
+	ch := &advDuelChallenge{
+		ChallengeID:  "duel-1",
+		ChallengerID: id.UserID("@a:x"),
+		ChallengedID: id.UserID("@b:x"),
+		Stake:        1000,
+		ExpiresAt:    time.Now().UTC().Add(time.Hour),
+	}
+	insertDuelChallenge(ch)
+
+	if pendingDuelForChallenged(id.UserID("@b:x")) == nil {
+		t.Fatal("challenge should be pending for the challenged player before any claim")
+	}
+	if !duelInvolves(id.UserID("@a:x")) || !duelInvolves(id.UserID("@b:x")) {
+		t.Fatal("duelInvolves should see both parties while the challenge is live")
+	}
+
+	if !claimDuelChallenge("duel-1") {
+		t.Fatal("first claim must succeed")
+	}
+	if claimDuelChallenge("duel-1") {
+		t.Fatal("second claim must fail — the row is gone, so no double refund/payout")
+	}
+	if pendingDuelForChallenged(id.UserID("@b:x")) != nil {
+		t.Fatal("claimed challenge must no longer be pending")
+	}
+}
+
+func TestLoadExpiredDuelChallenges(t *testing.T) {
+	newDuelTestDB(t)
+	insertDuelChallenge(&advDuelChallenge{
+		ChallengeID: "live", ChallengerID: "@a:x", ChallengedID: "@b:x",
+		Stake: 500, ExpiresAt: time.Now().UTC().Add(time.Hour),
+	})
+	insertDuelChallenge(&advDuelChallenge{
+		ChallengeID: "stale", ChallengerID: "@c:x", ChallengedID: "@d:x",
+		Stake: 500, ExpiresAt: time.Now().UTC().Add(-time.Hour),
+	})
+	got := loadExpiredDuelChallenges()
+	if len(got) != 1 || got[0].ChallengeID != "stale" {
+		t.Fatalf("loadExpiredDuelChallenges = %+v, want only the stale one", got)
+	}
+}
+
+// TestSynthDuelEnemy_PortsDefenseAndProcs pins the fidelity carry-overs added
+// after review: a tank's DamageReduct rides onto the synth enemy, and companion
+// procs fold their expected damage into its round Attack.
+func TestSynthDuelEnemy_PortsDefenseAndProcs(t *testing.T) {
+	pc := Combatant{
+		Stats: CombatStats{
+			MaxHP: 100, AC: 15, AttackBonus: 6,
+			Weapon: &WeaponProfile{DamageCount: 1, DamageSides: 8}, AbilityModForDamage: 2, // 6.5/hit
+		},
+		Mods: CombatModifiers{
+			DamageReduct:     0.6,                     // Barbarian-style mitigation
+			SpiritWeaponProc: 0.5, SpiritWeaponDmg: 4, // expected 0.5×(4+3)=3.5/round
+		},
+	}
+	e := synthDuelEnemy(pc)
+	if e.Mods.DamageReduct != 0.6 {
+		t.Errorf("DamageReduct not ported: got %v, want 0.6", e.Mods.DamageReduct)
+	}
+	// One swing (6.5) + proc expectation (3.5) = 10 → rounded 10.
+	if e.Stats.Attack != 10 {
+		t.Errorf("folded Attack = %d, want 10 (6.5 weapon + 3.5 proc)", e.Stats.Attack)
+	}
+}
+
+func TestParseDuelStake(t *testing.T) {
+	p := &AdventurePlugin{}
+	const level = 5 // cap = 2500
+
+	// No stake → default to the cap.
+	if got, err := p.parseDuelStake([]string{"@u"}, level); err != nil || got != 2500 {
+		t.Fatalf("default stake = (%d, %v), want (2500, nil)", got, err)
+	}
+	// Explicit in-band stake, with and without the € prefix.
+	if got, err := p.parseDuelStake([]string{"@u", "€1500"}, level); err != nil || got != 1500 {
+		t.Fatalf("€1500 stake = (%d, %v), want (1500, nil)", got, err)
+	}
+	// Over the cap is rejected.
+	if _, err := p.parseDuelStake([]string{"@u", "9999"}, level); err == nil {
+		t.Error("stake above cap should error")
+	}
+	// Below the floor is rejected.
+	if _, err := p.parseDuelStake([]string{"@u", "10"}, level); err == nil {
+		t.Error("stake below the minimum should error")
+	}
+	// Garbage is rejected.
+	if _, err := p.parseDuelStake([]string{"@u", "lots"}, level); err == nil {
+		t.Error("non-numeric stake should error")
+	}
+}

internal/plugin/adventure_events.go

@@ -32,10 +32,23 @@ type advActiveEvent struct {
 //
 // The per-anchor chances below put a player who hits all three at ~1 event
 // per week; see TestAnchoredEventWeeklyRate.
+//
+// K — the three social/economic anchors miss the pure grind loop: a player who
+// only mines/forages/fishes (now automatic, done by walking) and clears
+// single-day dungeons, but never sells, never enters the arena, and never runs
+// a multi-day expedition to a Night camp, would roll for zero events. The
+// fourth anchor, ZoneClear, fires on a foreground single-day zone clear — the
+// climax DM that player *is* reading — so they get the same rough cadence.
+// Autopilot walks and mid-zone region clears deliberately do not fire it (see
+// zoneCmdAdvance / the full-clear branch of advanceOnceWithOpts). The per-day
+// slot still caps everyone at one event, so a player who happens to hit two
+// anchors in a day can't double up. This rate is the tuning knob for item K —
+// bump it if telemetry shows the grind-loop player still sees too few.
 const (
-	advEventChanceDigest = 0.08
-	advEventChanceSell   = 0.05
-	advEventChanceArena  = 0.05
+	advEventChanceDigest    = 0.08
+	advEventChanceSell      = 0.05
+	advEventChanceArena     = 0.05
+	advEventChanceZoneClear = 0.08
 )
 
 var (
@@ -107,6 +120,14 @@ func (p *AdventurePlugin) eventTicker() {
 			// Reclaim invites nobody answered (N3/P6b). Every read already
 			// filters on the TTL; this just stops the rows accumulating.
 			purgeExpiredInvites()
+
+			// World boss (N6/C3): auto-spawn the monthly Siege on the 1st and
+			// resolve one whose 72h window has lapsed. Own dedup inside.
+			p.worldBossTick()
+
+			// Duels (N6/C2): refund and clear any challenge whose 24h accept
+			// window lapsed.
+			p.expireDuelChallenges()
 		}
 	}
 }

internal/plugin/adventure_events_test.go

@@ -44,6 +44,43 @@ func TestAnchoredEventWeeklyRate(t *testing.T) {
 	}
 }
 
+// TestZoneClearAnchorRate pins item K's fourth anchor for the population the
+// other three miss: a grind-loop player who never sells, never enters the
+// arena, and never runs a multi-day expedition, but clears single-day zones.
+// Modelled at two foreground clears per active day (a plausible dungeon
+// session) they should land in the same ~1 event/week band as the fully-
+// engaged player — that is the whole point of adding the anchor. The clears/day
+// assumption and advEventChanceZoneClear are the two tuning knobs; see the K
+// note in adventure_events.go.
+func TestZoneClearAnchorRate(t *testing.T) {
+	const clearsPerDay = 2
+
+	const weeks = 20000
+	rng := rand.New(rand.NewPCG(0x5EED, 0x2C)) // "ZC"
+	events := 0
+	for range weeks {
+		for range 7 {
+			firedToday := false
+			for range clearsPerDay {
+				if firedToday {
+					break // one event per player per UTC day
+				}
+				if rng.Float64() < advEventChanceZoneClear {
+					firedToday = true
+				}
+			}
+			if firedToday {
+				events++
+			}
+		}
+	}
+
+	perWeek := float64(events) / weeks
+	if perWeek < 0.8 || perWeek > 1.5 {
+		t.Errorf("zone-clear anchor = %.3f/week, want ~1 (0.8–1.5)", perWeek)
+	}
+}
+
 // TestClaimDailyEventSlot_OnePerDay guards the cap the rate test assumes.
 func TestClaimDailyEventSlot_OnePerDay(t *testing.T) {
 	uid := id.UserID("@events-slot:example")

internal/plugin/adventure_flavor_campaign.go

@@ -0,0 +1,519 @@
+package plugin
+
+import (
+	"fmt"
+	"log/slog"
+	"math/rand/v2"
+	"strings"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The Hollow King campaign (N5/D1). A light serialized story threaded through
+// the zones by way of collectible journal pages. "The Hollow King" is already
+// the Forest Shadows (T2) boss; this frames him as a realm-spanning antagonist
+// whose fragments turn up wherever players fight elites and open secret rooms.
+//
+// The fragments are in-world found artifacts — journal entries, torn letters,
+// stone inscriptions — not TwinBee's voice. TwinBee's own reactions (D1b) obey
+// the first-person voice rules; this text does not.
+
+type journalPage struct {
+	Title string
+	Text  string
+}
+
+// journalPages is the ordered campaign. Reading the discovered pages top to
+// bottom tells the fall of a kingdom to the thing its king became. Order is the
+// story order; players find them out of sequence, which is why the viewer marks
+// gaps.
+var journalPages = []journalPage{
+	{"The Long Winter", "A crown is only a circle of gold until a man decides never to take it off. Ours decided in a winter that would not end, and the frost took its cue from him."},
+	{"The Last Physician", "The court healers were sent home one by one, each promising the king had years left. The last was not sent home. We heard him thank the king for the honour."},
+	{"On Shadows", "He stopped casting a shadow before he stopped casting a reflection. The steward struck both from the list of things a servant may notice aloud."},
+	{"The Quiet Ledger", "Grain still left the granaries; no mouths were fed. I stopped auditing the difference the night the number began to feel like a name."},
+	{"A Bargain Overheard", "Through the chapel door: the king's voice, and a second that used his own words a breath before he did. Only one of them was asking."},
+	{"The Hollowing", "They call it a coronation in the records. Those of us who carried the braziers call it what it was. A king was emptied so a crown could keep wearing him."},
+	{"The First Knights", "His honour guard did not die. That was the mercy offered and the price paid. They stand at the old gate yet, and they still salute a throne no living thing sits on."},
+	{"Letters Home, Unsent", "\"Tell mother the pay is good and the work is guarding.\" The satchel held forty such letters, every hand different, every promise the same, none of them sent."},
+	{"The Map Redrawn", "The kingdom did not fall so much as come apart at the seams — a warren here, a drowned temple there, each piece keeping a splinter of him like a tooth in a wound."},
+	{"Root and Rot", "The forest north of the manor grew wrong and grew fast. The woodsmen say the trees lean toward the ruin at dusk. The woodsmen no longer go at dusk."},
+	{"The Warren Below", "Even the goblins gave the deep tunnels to him and asked nothing back. When a scavenger yields ground for free, ask what it saw down there."},
+	{"Water That Remembers", "The temple sank in a single night with the bells still ringing. Divers say the bells ring still, slow, as if something below is counting."},
+	{"The Manor's Long Guest", "Blackspire changed hands nine times in a decade. Every deed names a different owner. Every household names the same tenant, and none will write it down."},
+	{"The Forge Unbanked", "The underforge keeps a heat with no fuel and no smith. What it makes, no one has seen leave. What it makes, we are told, was promised elsewhere long ago."},
+	{"Descent", "The deep roads were a trade route once. Now they are a throat. Everything the surface loses is swallowed the same direction, and the direction has a door at the end."},
+	{"The Bright Country", "Past the crossing the colours are too kind and the days too long. It is the most beautiful place I have run from. He is patient there; he can afford to be."},
+	{"What the Dragon Keeps", "The wyrm hoards more than gold. Deep in the lair, behind the coin, a single crown sits on no head and is guarded better than the hoard."},
+	{"The Portal's Arithmetic", "The abyss gate opens outward. Everyone assumes a door lets things in. This one was built by someone who only ever intended to leave through it."},
+	{"The Regent's Confession", "I ruled in his name for thirty years and never once saw him rule. I signed what the crown wanted signed. I am writing this so that one honest page exists."},
+	{"The Names of the Guard", "I have set down every knight's name here so that when this is read, they are grieved as men and not feared as things. It is the only rescue left to attempt."},
+	{"The Flaw in the Bargain", "The second voice took the king's life and his death both — and a thing that cannot die also cannot be finished. He is not immortal. He is unpaid, and waiting to collect."},
+	{"How to Call Him", "He answers only where his fragments gather and only to one who has gathered them. Do not do this to avenge us. Do it to end the account. Come with the whole ledger or do not come."},
+	{"The Empty Throne", "I have seen the seat at the heart of it all. It is not empty. It is occupied by the shape of a man who left, kept warm against his return."},
+	{"Last Page", "If you are reading in order, you have walked the ruin of everything he emptied to stay. One page is missing from every telling — the one you write by going in. Bring a light. He hates the light. It is the one thing he could never hollow out."},
+}
+
+// journalTotalPages is the campaign length; the drop/viewer/finale all read it
+// so the story can grow by appending to journalPages alone.
+var journalTotalPages = len(journalPages)
+
+// journalPageDropChance is the per-elite-kill probability that a page turns up.
+// Deliberately modest: 24 pages is a long-horizon collection, and secret rooms
+// (D4) grant pages on top of this. Tunable.
+const journalPageDropChance = 0.22
+
+// setJournalPageBit is the in-memory twin of grantJournalPageDB's bitwise OR —
+// the single definition of "page N lives in bit N-1". Out-of-range pages are a
+// no-op.
+func setJournalPageBit(mask int64, page int) int64 {
+	if page < 1 || page > 63 {
+		return mask
+	}
+	return mask | (int64(1) << (page - 1))
+}
+
+func journalPageFound(mask int64, page int) bool {
+	if page < 1 || page > 63 {
+		return false
+	}
+	return mask&(int64(1)<<(page-1)) != 0
+}
+
+func journalPageCount(mask int64) int {
+	n := 0
+	for i := 1; i <= journalTotalPages; i++ {
+		if journalPageFound(mask, i) {
+			n++
+		}
+	}
+	return n
+}
+
+func journalComplete(mask int64) bool {
+	return journalPageCount(mask) >= journalTotalPages
+}
+
+// pickUnfoundJournalPage returns a random not-yet-found page number, or 0 when
+// the campaign is already complete.
+func pickUnfoundJournalPage(mask int64, rng *rand.Rand) int {
+	var missing []int
+	for i := 1; i <= journalTotalPages; i++ {
+		if !journalPageFound(mask, i) {
+			missing = append(missing, i)
+		}
+	}
+	if len(missing) == 0 {
+		return 0
+	}
+	return missing[rngIntN(rng, len(missing))]
+}
+
+// maybeDropJournalPage rolls a page reward for an elite kill or secret room and,
+// on a hit, grants a random unfound page and returns its narration line. Empty
+// string means no drop (missed the roll, DB error, or campaign already
+// complete). The roll draws from the same RNG the surrounding loot rolls use
+// and never touches SimulateCombat's stream, so the combat golden is unmoved.
+func (p *AdventurePlugin) maybeDropJournalPage(userID id.UserID, rng *rand.Rand) string {
+	if rngFloat(rng) >= journalPageDropChance {
+		return ""
+	}
+	return p.grantJournalPage(userID, rng)
+}
+
+// grantJournalPage grants a random unfound page unconditionally (used by secret
+// rooms, which award a page for certain). Returns "" when already complete or on
+// error.
+func (p *AdventurePlugin) grantJournalPage(userID id.UserID, rng *rand.Rand) string {
+	mask, err := loadJournalPages(userID)
+	if err != nil {
+		return ""
+	}
+	page := pickUnfoundJournalPage(mask, rng)
+	if page == 0 {
+		return ""
+	}
+	if err := grantJournalPageDB(userID, page); err != nil {
+		return ""
+	}
+	// If the page turned up mid-expedition, drop a log beat so the end-of-day
+	// digest can have TwinBee react to it. No expedition (legacy !zone, or a
+	// secret room opened outside a run) simply means no digest to react in.
+	if exp, err := getActiveExpedition(userID); err == nil && exp != nil {
+		_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "journal",
+			journalPages[page-1].Title, fmt.Sprintf("page %d", page))
+	}
+	return fmt.Sprintf("📖 A torn journal page — _%s_ (page %d of %d). See `!adventure journal`.",
+		journalPages[page-1].Title, page, journalTotalPages)
+}
+
+// --- N5/D4 secret content pass ---------------------------------------------
+//
+// Every NodeKindSecret room resolves as a no-combat treasure cache (see
+// resolveSecretRoom in dnd_zone_combat.go). Finding it — via the perception /
+// stat check on the fork, or a cross-zone key — is the reward: a guaranteed
+// journal page, a LootBias-weighted treasure roll, and a guaranteed consumable
+// cache. The flavor and the key catalog live here with the rest of the
+// campaign; the resolution mechanics live next to the other room resolvers.
+
+// secretRoomCacheCount is how many zone-tier consumables a secret room always
+// hands over, so the room pays out something visible even for a player who has
+// every page and misses the treasure roll.
+const secretRoomCacheCount = 2
+
+// crossZoneKey pairs a source secret room with the key item it grants. The key
+// is a plain inventory item; a LockKey edge in the destination zone matches its
+// lower-cased Name against lock_data.key_id (see evaluateEdgeLock). Keys persist
+// in inventory, so the unlock is permanent once earned.
+type crossZoneKey struct {
+	item       AdvItem
+	unlocksIn  ZoneID // destination zone, for the grant narration
+	unlockHint string // what the key opens, surfaced when it's granted
+}
+
+// secretRoomKeys — the two cross-zone keys (N5/D4). A Sunken Temple sigil opens
+// a sealed reliquary in Manor Blackspire; an Underforge seal opens a vault deep
+// in the Underdark throne approach. Keyed by the source secret's node ID.
+var secretRoomKeys = map[string]crossZoneKey{
+	"sunken_temple.coral_reliquary": {
+		item:       AdvItem{Name: "Sunken Sigil", Type: "key", Tier: 2},
+		unlocksIn:  ZoneManorBlackspire,
+		unlockHint: "a drowned god's mark — Blackspire has a door that remembers it",
+	},
+	"underforge.forge_vault": {
+		item:       AdvItem{Name: "Underforge Seal", Type: "key", Tier: 3},
+		unlocksIn:  ZoneUnderdark,
+		unlockHint: "the forge's own brand — something in the deep roads was promised its work",
+	},
+}
+
+// grantSecretRoomKey hands over the cross-zone key a secret room carries, if it
+// carries one and the player isn't already holding it. Idempotent: re-finding
+// the room on a later run won't stack duplicate keys. Returns the narration line
+// (empty when the room grants no key, the player already has it, or on error).
+func (p *AdventurePlugin) grantSecretRoomKey(userID id.UserID, node ZoneNode) string {
+	key, ok := secretRoomKeys[node.NodeID]
+	if !ok {
+		return ""
+	}
+	items, err := loadAdvInventory(userID)
+	if err != nil {
+		return ""
+	}
+	want := strings.ToLower(key.item.Name)
+	for _, it := range items {
+		if strings.ToLower(it.Name) == want {
+			return "" // already earned — don't stack it
+		}
+	}
+	if err := addAdvInventoryItem(userID, key.item); err != nil {
+		slog.Error("secret room: grant key", "user", userID, "key", key.item.Name, "err", err)
+		return ""
+	}
+	return fmt.Sprintf("🗝 **%s** — %s.", key.item.Name, key.unlockHint)
+}
+
+// secretRoomDiscovery is the bespoke in-world discovery line for a secret room,
+// keyed by node ID. Not TwinBee's voice — the same in-world register the journal
+// pages use. Nodes without an entry fall back to a generic line built from the
+// node label.
+var secretRoomDiscovery = map[string]string{
+	"crypt_valdris.secret_chamber":      "🔍 **A sealed chamber.** The other grave-robbers pried at the wrong wall. This one gives — Valdris kept something back even from his own tomb.",
+	"forest_shadows.sapling_shrine":     "🔍 **The Sapling Shrine.** A ring of young antlers grown from the dirt, and something votive left at the centre — an offering the King's shell never came back to claim.",
+	"sunken_temple.coral_reliquary":     "🔍 **The Coral Reliquary.** Behind a lattice of living coral, a niche the flood sealed rather than drowned. What the temple hid, it hid well.",
+	"manor_blackspire.hidden_oratory":   "🔍 **The Hidden Oratory.** A chapel with no door in the floor plan, kept for a tenant the deeds refuse to name.",
+	"manor_blackspire.sealed_reliquary": "🔍 **The Sealed Reliquary.** The drowned god's sigil bites into the lock and turns. Blackspire kept a piece of the temple's secret behind a door only the temple could open.",
+	"underforge.forge_vault":            "🔍 **The Forge Vault.** A strongroom off the unbanked heat, its ledger of commissions all addressed elsewhere and long overdue.",
+	"underdark.lost_reliquary":          "🔍 **A lost reliquary.** A shrine the deep roads swallowed whole, still lit, still waiting on a procession that stopped coming a long age ago.",
+	"underdark.sealed_forge_vault":      "🔍 **The Sealed Vault.** The Underforge's brand fits the seam, and the deep-road door gives up what the forge sent ahead — payment on the old account.",
+	"feywild_crossing.illusion_garden":  "🔍 **The Illusion Garden.** A too-kind grove that isn't there when you look straight at it. He can afford beauty here; it costs him nothing to keep.",
+	"dragons_lair.hoard_pillar":         "🔍 **A pillar of hoard.** Coin drifted to the ceiling around a single column the wyrm guards more than gold — as if something at its heart were worth more.",
+	"abyss_portal.reality_seam":         "🔍 **A seam in the real.** The gate's arithmetic frays here, and through the frayed place a hand once reached to leave a thing behind on the way out.",
+}
+
+// secretRoomDiscoveryLine returns the discovery flavor for a secret room,
+// falling back to a label-driven generic when the node has no bespoke entry.
+func secretRoomDiscoveryLine(node ZoneNode) string {
+	if line, ok := secretRoomDiscovery[node.NodeID]; ok {
+		return line
+	}
+	label := node.Label
+	if label == "" {
+		label = "a hidden room"
+	}
+	return fmt.Sprintf("🔍 **%s** — a room the others walked past. Something was left here for whoever looked closer.", label)
+}
+
+// bossEpilogues ties each zone boss's death to the Hollow King arc: a 2-3
+// sentence capstone appended to the boss-down moment. Forest of Shadows is the
+// King himself — but what falls there is a shell he shed, which is why the arc
+// (and the finale) outlives it. In-world narration, not TwinBee's voice.
+var bossEpilogues = map[ZoneID]string{
+	ZoneGoblinWarrens: "Grol dies clutching a coin no goblin minted — a king's face worn smooth by handling. Whatever paid the warren to give up its deep tunnels, it paid in a currency older than these hills.",
+	ZoneCryptValdris: "Valdris tried to cheat the grave and managed only to furnish it. In his last rattle he says a name that isn't his — _hollow, hollow_ — as if warning you of a colleague who did it better.",
+	ZoneForestShadows: "The Hollow King falls without weight, a coat slipped from its peg — and the woods do not go quiet. What you felled here was a thing he shed, not the thing he is. Somewhere, the account he owes goes on accruing.",
+	ZoneSunkenTemple: "The Aboleth's dream breaks and the drowned bells still at last. In the silence you understand what they were counting toward — and that the count did not begin with this temple, and does not end with it.",
+	ZoneManorBlackspire: "Aldric was hollowed the same way, by the same hand, and made a poor imitation: a lord kept past his death to hold a house for a guest who never came. He thanks you. It is the first thing he has meant in a century.",
+	ZoneUnderforge: "Thyrak's fires gutter out, and the half-made things on the anvils cool into what they were always going to be — regalia, and soldiers, and a crown with no head to fit. The forge was filling an order placed a long time ago.",
+	ZoneUnderdark: "Ilvaras ruled the throat that swallows everything downward, toward the door at the bottom of the world. She dies certain she served a queen. She served a direction, and the direction has a name it never told her.",
+	ZoneFeywildCrossing: "The Thornmother's garden was the loveliest cage on the road, tended for a patient guest. He can afford patience; you are learning why. She wilts, and the too-kind light dims by exactly one degree.",
+	ZoneDragonsLair: "Behind Infernax's hoard, past the last of the gold, a single crown rests on no head — guarded better than the treasure, because it was the one thing here he was ever paid to keep. The dragon dies never knowing what it was.",
+	ZoneAbyssPortal: "Belaxath guarded a door that opens outward, built by someone who only ever meant to leave through it. As the demon falls, the gate does not close. It was never meant to keep things out — only to let one thing come home.",
+}
+
+// bossEpilogueLine returns the campaign capstone for a zone boss, or "" for
+// zones with none (and for the synthetic arena, which has no ZoneID entry).
+func bossEpilogueLine(zoneID ZoneID) string {
+	return bossEpilogues[zoneID]
+}
+
+// writeBossEpilogue appends a zone's campaign capstone (if any) to a
+// victory narration. Shared by every boss-down render path — the manual
+// turn-based finishes (finishCombatSession, finishPartyWin) and the compact
+// autopilot boss resolve — so the D1b epilogue fires no matter how the boss
+// was cleared. Caller gates on "this was a boss, not an elite".
+func writeBossEpilogue(b *strings.Builder, zoneID ZoneID) {
+	if ep := bossEpilogueLine(zoneID); ep != "" {
+		b.WriteString("\n" + ep + "\n")
+	}
+}
+
+// twinBeeJournalReactions are TwinBee's morning/digest reactions to pages found
+// during the day — first-person, implicit subject, he/him, one line, curious,
+// never expository (feedback_twinbee_voice, feedback_twinbee_is_male). Picked
+// deterministically so a re-rendered digest reads the same.
+var twinBeeJournalReactions = []string{
+	"📖 Found a torn page in your kit tonight — been reading it by the fire while you sleep. This king of theirs was not a well man.",
+	"📖 Another page. Keep turning them up and I keep piecing him together, and I do not much like the shape.",
+	"📖 Read the new page twice. Whoever wrote it was frightened of something patient. I think we are walking toward it.",
+	"📖 Slipped the day's page into the others. The story's filling in at the edges, and none of the edges are kind.",
+}
+
+// twinBeeJournalReaction picks one reaction line deterministically from the day
+// and the number of pages found, so the digest is stable across re-renders.
+func twinBeeJournalReaction(day, pagesToday int) string {
+	if len(twinBeeJournalReactions) == 0 || pagesToday <= 0 {
+		return ""
+	}
+	idx := (day + pagesToday) % len(twinBeeJournalReactions)
+	if idx < 0 {
+		idx = -idx
+	}
+	return twinBeeJournalReactions[idx]
+}
+
+// handleJournalCmd renders the player's collected campaign pages.
+func (p *AdventurePlugin) handleJournalCmd(ctx MessageContext) error {
+	char, _, err := p.ensureCharacter(ctx.Sender)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Failed to load your character. Try `!adventure` to create one first.")
+	}
+	return p.SendDM(ctx.Sender, renderJournal(char.JournalPages))
+}
+
+// renderJournal builds the `!adventure journal` view: discovered pages in story
+// order, with runs of missing pages collapsed to a single "…".
+func renderJournal(mask int64) string {
+	found := journalPageCount(mask)
+	var b strings.Builder
+	b.WriteString(fmt.Sprintf("📖 **The Hollow King** — Journal (%d / %d pages)\n",
+		found, journalTotalPages))
+
+	if found == 0 {
+		b.WriteString("\nYou carry no pages yet. They surface where the realm's fragments gather — in the hands of elites, and behind doors most adventurers walk past.")
+		return b.String()
+	}
+
+	b.WriteString("\n")
+	gapOpen := false
+	for i := 1; i <= journalTotalPages; i++ {
+		if journalPageFound(mask, i) {
+			gapOpen = false
+			jp := journalPages[i-1]
+			b.WriteString(fmt.Sprintf("\n**%s. %s**\n%s\n", romanNumeral(i), jp.Title, jp.Text))
+		} else if !gapOpen {
+			gapOpen = true
+			b.WriteString("\n…\n")
+		}
+	}
+
+	if journalComplete(mask) {
+		b.WriteString("\nThe ledger is whole. Clear both Tier-5 zones and you can follow him to the end — `!expedition start epilogue`.")
+	} else {
+		b.WriteString(fmt.Sprintf("\n_%d pages still scattered._", journalTotalPages-found))
+	}
+	return b.String()
+}
+
+// romanNumeral renders 1..24 as upper-case Roman numerals for the page headers.
+// The campaign never exceeds a couple dozen pages, so a small table beats a
+// general algorithm here.
+func romanNumeral(n int) string {
+	if n < 1 || n > len(romanNumerals) {
+		return fmt.Sprintf("%d", n)
+	}
+	return romanNumerals[n-1]
+}
+
+// ── D1c: the finale ─────────────────────────────────────────────────────────
+
+// finaleTitle is the unique role awarded for the first finale clear.
+const finaleTitle = "Kingsbane"
+
+const epilogueEntryFlavor = "You bring the whole ledger to the Empty Throne. The shape kept warm against his return stirs, and stands, and is finally, fully here."
+
+// hollowKingFinaleMonster is the finale stat block: Belaxath's block — the abyss
+// boss whose gate "was meant to let one thing come home" — re-dressed as the
+// King returned in full, with HP bumped for a capstone. A variant stat block
+// with no new mechanics, per the plan. Built on the fly (not registered in
+// dndBestiary) because runZoneCombat takes the template directly, exactly as the
+// arena bosses do.
+func hollowKingFinaleMonster() DnDMonsterTemplate {
+	m := dndBestiary["boss_belaxath"]
+	m.ID = "boss_hollow_king_finale"
+	m.Name = "The Hollow King, Unhoused"
+	m.HP = int(float64(m.HP) * 1.25)
+	m.Notes = "Finale encounter — the Hollow King returned in full through the abyss gate. Variant of the Balor stat block; no new mechanics."
+	return m
+}
+
+// epilogueUnlocked gates the finale on the whole ledger plus both Tier-5 clears.
+func (p *AdventurePlugin) epilogueUnlocked(char *AdventureCharacter) (bool, string) {
+	if !journalComplete(char.JournalPages) {
+		return false, fmt.Sprintf(
+			"The trail runs cold. You've recovered **%d of %d** journal pages — find them all before you can follow him to the end. (`!adventure journal`)",
+			journalPageCount(char.JournalPages), journalTotalPages)
+	}
+	if !clearedEveryZoneOfTier(db.Get(), char.UserID, ZoneTier(5)) {
+		return false, "You hold the whole ledger, but not the standing to use it. Clear **both** Tier-5 zones — the Dragon's Lair and the Abyss Portal — then come back to the throne."
+	}
+	return true, ""
+}
+
+// handleEpilogueEncounter runs the finale: a single auto-resolved boss fight
+// against the Hollow King's true form, reached via `!expedition start epilogue`.
+// Reward drops only on the first clear (reward-once); later clears are a
+// flavour-only rematch. A loss costs a death, as any boss fight does.
+func (p *AdventurePlugin) handleEpilogueEncounter(ctx MessageContext) error {
+	char, _, err := p.ensureCharacter(ctx.Sender)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Failed to load your character. Try `!adventure` first.")
+	}
+	if !char.Alive {
+		return p.SendDM(ctx.Sender, "You're in no shape to face him. Mend at `!hospital` first.")
+	}
+	if ok, why := p.epilogueUnlocked(char); !ok {
+		return p.SendDM(ctx.Sender, why)
+	}
+	// Busy guards — the finale is a synchronous auto-resolved fight, so refuse if
+	// anything else is in flight and could collide on HP or run state.
+	if exp, _ := getActiveExpedition(ctx.Sender); exp != nil {
+		return p.SendDM(ctx.Sender, "Finish your expedition before you walk to the Empty Throne.")
+	}
+	if run, _ := getActiveZoneRun(ctx.Sender); run != nil {
+		return p.SendDM(ctx.Sender, "Finish your current zone run first.")
+	}
+	if sess, _ := getActiveCombatSession(ctx.Sender); sess != nil {
+		return p.SendDM(ctx.Sender, "You're already in a fight. Finish it first.")
+	}
+
+	monster := hollowKingFinaleMonster()
+	displayName, _ := loadDisplayName(ctx.Sender)
+	if displayName == "" {
+		displayName = "You"
+	}
+
+	preHP, _ := dndHPSnapshot(ctx.Sender)
+	result, err := p.runZoneCombat(ctx.Sender, monster, 5, bossCombatPhases, 50)
+	if err != nil {
+		slog.Error("epilogue: combat failed", "user", ctx.Sender, "err", err)
+		return p.SendDM(ctx.Sender, "Something went wrong at the throne. Try again in a moment.")
+	}
+	postHP, maxHP := dndHPSnapshot(ctx.Sender)
+	nat20s, nat1s := countNat20sAnd1s(result)
+
+	intro := fmt.Sprintf("👑 **The Empty Throne — %s** (HP %d, AC %d)\n_%s_",
+		monster.Name, monster.HP, monster.AC, epilogueEntryFlavor)
+	phases := RenderCombatLog(result, displayName, monster.Name)
+	outcome := renderBossOutcome(BossOutcomeInputs{
+		// Synthetic ZoneArena keeps twinBeeLine's deterministic pickers off any
+		// real zone's pool, exactly as the arena does.
+		ZoneID:          ZoneArena,
+		RunID:           "epilogue-" + string(ctx.Sender),
+		RoomIdx:         0,
+		Monster:         monster,
+		Result:          result,
+		PreHP:           preHP,
+		PostHP:          postHP,
+		MaxHP:           maxHP,
+		PhaseTwoAt:      0.40,
+		Nat20s:          nat20s,
+		Nat1s:           nat1s,
+		DefeatHeadline:  "💀 The Hollow King folds you into the quiet he keeps. The account goes unpaid a while longer.",
+		VictoryHeadline: fmt.Sprintf("🏆 **The Hollow King falls — and this time stays down.** You finished at **%d/%d HP**.", postHP, maxHP),
+	})
+
+	var tail string
+	if !result.PlayerWon {
+		markAdventureDead(ctx.Sender, "adventure", "the Empty Throne")
+	} else {
+		tail = p.finishEpilogueWin(ctx.Sender, char.EpilogueCleared)
+	}
+
+	_ = p.sendZoneCombatMessages(ctx.Sender, append([]string{intro}, phases...), joinLootLines(outcome, tail))
+	return nil
+}
+
+// finishEpilogueWin grants the reward on a first clear and returns the reward
+// narration; a repeat clear is flavour only. The character is reloaded before
+// the title write so runZoneCombat's post-fight HP persist isn't clobbered.
+func (p *AdventurePlugin) finishEpilogueWin(userID id.UserID, alreadyCleared bool) string {
+	if alreadyCleared {
+		return "_The throne stays empty. You came to be sure. You are sure._"
+	}
+
+	// Latch the once-only flag BEFORE handing out the Legendary + title, so a
+	// failed write (or a crash) can never leave the reward repeatable. If the
+	// latch fails, skip the grant entirely — the player re-enters uncleared and
+	// can try again, rather than pocketing a second Legendary on the retry.
+	if err := markEpilogueClearedDB(userID); err != nil {
+		slog.Error("epilogue: mark cleared failed", "user", userID, "err", err)
+		return "_The account won't quite close — the ledger jams. Try `!expedition start epilogue` again._"
+	}
+
+	var b strings.Builder
+	b.WriteString("🎖️ **The account is closed.** You are named **" + finaleTitle + "** — the one who unhoused the Hollow King.\n")
+	if mi, ok := pickMagicItemForRarity(RarityLegendary, nil); ok {
+		if line := p.dropMagicItemLoot(userID, mi, LootTierLegendary); line != "" {
+			b.WriteString(line + "\n")
+		}
+	} else {
+		slog.Error("epilogue: no legendary in registry", "user", userID)
+	}
+
+	if fresh, err := loadAdvCharacter(userID); err == nil && fresh != nil {
+		if fresh.Title != finaleTitle {
+			fresh.Title = finaleTitle
+			if err := saveAdvCharacter(fresh); err != nil {
+				slog.Error("epilogue: title save failed", "user", userID, "err", err)
+			}
+		}
+	}
+
+	if gr := gamesRoom(); gr != "" {
+		if dn, _ := loadDisplayName(userID); dn != "" {
+			p.SendMessage(id.RoomID(gr), fmt.Sprintf(
+				"👑 **%s** carried the whole ledger to the Empty Throne and closed the account. The Hollow King is ended. **%s.**",
+				dn, finaleTitle))
+		}
+	}
+	return b.String()
+}
+
+var romanNumerals = []string{
+	"I", "II", "III", "IV", "V", "VI", "VII", "VIII", "IX", "X",
+	"XI", "XII", "XIII", "XIV", "XV", "XVI", "XVII", "XVIII", "XIX", "XX",
+	"XXI", "XXII", "XXIII", "XXIV", "XXV", "XXVI", "XXVII", "XXVIII", "XXIX", "XXX",
+}

internal/plugin/adventure_flavor_campaign_test.go

@@ -0,0 +1,300 @@
+package plugin
+
+import (
+	"math/rand/v2"
+	"strings"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func TestJournalGrant_DBRoundTripIsAtomicOR(t *testing.T) {
+	townTestDB(t)
+	u := id.UserID("@page:test.invalid")
+
+	// No row yet → zero pages.
+	if mask, err := loadJournalPages(u); err != nil || mask != 0 {
+		t.Fatalf("fresh player: mask=%d err=%v, want 0/nil", mask, err)
+	}
+
+	// First grant creates the row (ON CONFLICT INSERT path).
+	if err := grantJournalPageDB(u, 5); err != nil {
+		t.Fatalf("grant page 5: %v", err)
+	}
+	// Second grant ORs into the existing row without clobbering the first.
+	if err := grantJournalPageDB(u, 2); err != nil {
+		t.Fatalf("grant page 2: %v", err)
+	}
+	// Re-granting a found page is idempotent.
+	if err := grantJournalPageDB(u, 5); err != nil {
+		t.Fatalf("re-grant page 5: %v", err)
+	}
+
+	mask, err := loadJournalPages(u)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if !journalPageFound(mask, 2) || !journalPageFound(mask, 5) {
+		t.Fatalf("pages 2 and 5 should be found, mask=%b", mask)
+	}
+	if journalPageCount(mask) != 2 {
+		t.Fatalf("count=%d, want 2 (mask=%b)", journalPageCount(mask), mask)
+	}
+
+	// Overlay populates the character field the viewer reads.
+	var c AdventureCharacter
+	c.UserID = u
+	applyPlayerMetaOverlay(&c)
+	if c.JournalPages != mask {
+		t.Fatalf("overlay JournalPages=%b, want %b", c.JournalPages, mask)
+	}
+}
+
+func TestJournalCatalog_WellFormed(t *testing.T) {
+	if journalTotalPages != len(journalPages) {
+		t.Fatalf("journalTotalPages %d != len(journalPages) %d", journalTotalPages, len(journalPages))
+	}
+	if journalTotalPages < 1 || journalTotalPages > 63 {
+		t.Fatalf("journal must fit an int64 bitmask (1..63); got %d", journalTotalPages)
+	}
+	if journalTotalPages > len(romanNumerals) {
+		t.Fatalf("more pages (%d) than roman numerals (%d)", journalTotalPages, len(romanNumerals))
+	}
+	seen := map[string]bool{}
+	for i, jp := range journalPages {
+		if strings.TrimSpace(jp.Title) == "" {
+			t.Errorf("page %d has empty title", i+1)
+		}
+		if strings.TrimSpace(jp.Text) == "" {
+			t.Errorf("page %d (%q) has empty text", i+1, jp.Title)
+		}
+		if seen[jp.Title] {
+			t.Errorf("duplicate page title %q", jp.Title)
+		}
+		seen[jp.Title] = true
+	}
+}
+
+func TestJournalBitmask_GrantQueryCount(t *testing.T) {
+	var mask int64
+	if journalPageCount(mask) != 0 {
+		t.Fatalf("empty mask should count 0")
+	}
+	if journalPageFound(mask, 1) {
+		t.Fatalf("page 1 should be unfound on empty mask")
+	}
+	mask = setJournalPageBit(mask, 3)
+	mask = setJournalPageBit(mask, 1)
+	if !journalPageFound(mask, 3) || !journalPageFound(mask, 1) {
+		t.Fatalf("pages 1 and 3 should be found")
+	}
+	if journalPageFound(mask, 2) {
+		t.Fatalf("page 2 should still be unfound")
+	}
+	if got := journalPageCount(mask); got != 2 {
+		t.Fatalf("count = %d, want 2", got)
+	}
+	// Re-setting a found page is idempotent.
+	if again := setJournalPageBit(mask, 3); again != mask {
+		t.Fatalf("re-granting page 3 changed the mask")
+	}
+}
+
+func TestPickUnfoundJournalPage_ExhaustsToZero(t *testing.T) {
+	rng := rand.New(rand.NewPCG(1, 2))
+	var mask int64
+	found := map[int]bool{}
+	for i := 0; i < journalTotalPages; i++ {
+		page := pickUnfoundJournalPage(mask, rng)
+		if page < 1 || page > journalTotalPages {
+			t.Fatalf("pick %d out of range", page)
+		}
+		if found[page] {
+			t.Fatalf("pick returned already-found page %d", page)
+		}
+		found[page] = true
+		mask = setJournalPageBit(mask, page)
+	}
+	if !journalComplete(mask) {
+		t.Fatalf("mask should be complete after %d picks", journalTotalPages)
+	}
+	if page := pickUnfoundJournalPage(mask, rng); page != 0 {
+		t.Fatalf("pick on complete mask = %d, want 0", page)
+	}
+}
+
+func TestRenderJournal_EmptyPartialFull(t *testing.T) {
+	// Empty.
+	empty := renderJournal(0)
+	if !strings.Contains(empty, "0 / ") {
+		t.Errorf("empty journal should show 0 found:\n%s", empty)
+	}
+	if strings.Contains(empty, "…") {
+		t.Errorf("empty journal should not render a gap marker:\n%s", empty)
+	}
+
+	// Partial with a gap: pages 1 and 3 found, 2 missing → exactly one "…".
+	var partial int64
+	partial = setJournalPageBit(partial, 1)
+	partial = setJournalPageBit(partial, 3)
+	pv := renderJournal(partial)
+	if !strings.Contains(pv, journalPages[0].Title) || !strings.Contains(pv, journalPages[2].Title) {
+		t.Errorf("partial journal missing a found page title:\n%s", pv)
+	}
+	if strings.Contains(pv, journalPages[1].Title) {
+		t.Errorf("partial journal leaked an unfound page's text:\n%s", pv)
+	}
+	if !strings.Contains(pv, "…") {
+		t.Errorf("partial journal with a gap should render '…':\n%s", pv)
+	}
+
+	// Full: every title present, no gap, completion line.
+	var full int64
+	for i := 1; i <= journalTotalPages; i++ {
+		full = setJournalPageBit(full, i)
+	}
+	fv := renderJournal(full)
+	if strings.Contains(fv, "…") {
+		t.Errorf("complete journal should have no gaps:\n%s", fv)
+	}
+	for _, jp := range journalPages {
+		if !strings.Contains(fv, jp.Title) {
+			t.Errorf("complete journal missing page %q", jp.Title)
+		}
+	}
+	if !journalComplete(full) {
+		t.Fatalf("full mask should be complete")
+	}
+}
+
+func TestJournalDropChance_Sane(t *testing.T) {
+	if journalPageDropChance <= 0 || journalPageDropChance >= 1 {
+		t.Fatalf("drop chance %v out of (0,1)", journalPageDropChance)
+	}
+}
+
+func TestBossEpilogues_EveryRegisteredZoneHasOne(t *testing.T) {
+	for _, z := range allZones() {
+		if strings.TrimSpace(bossEpilogueLine(z.ID)) == "" {
+			t.Errorf("zone %s (%s) has no boss epilogue", z.ID, z.Display)
+		}
+	}
+	// The synthetic arena is not a campaign zone — it must have none.
+	if bossEpilogueLine(ZoneArena) != "" {
+		t.Errorf("arena should have no boss epilogue")
+	}
+	if bossEpilogueLine(ZoneID("nonexistent")) != "" {
+		t.Errorf("unknown zone should have no epilogue")
+	}
+}
+
+func TestHollowKingFinaleMonster_ClonesBelaxathWithBump(t *testing.T) {
+	base := dndBestiary["boss_belaxath"]
+	if base.ID == "" {
+		t.Fatal("boss_belaxath missing from bestiary — finale clones it")
+	}
+	m := hollowKingFinaleMonster()
+	if m.ID != "boss_hollow_king_finale" {
+		t.Errorf("finale ID = %q", m.ID)
+	}
+	if m.Name == base.Name || m.Name == "" {
+		t.Errorf("finale name should differ from Belaxath: %q", m.Name)
+	}
+	if m.HP <= base.HP {
+		t.Errorf("finale HP %d should exceed base %d (capstone bump)", m.HP, base.HP)
+	}
+	// No new mechanics: the ability and defensive profile carry over unchanged.
+	if m.Ability != base.Ability {
+		t.Errorf("finale ability pointer changed — should reuse Belaxath's, no new mechanics")
+	}
+	if m.AC != base.AC || m.CR != base.CR {
+		t.Errorf("finale AC/CR drifted from base: AC %d/%d CR %v/%v", m.AC, base.AC, m.CR, base.CR)
+	}
+}
+
+func TestEpilogueRewardOnce_FlagRoundTrip(t *testing.T) {
+	townTestDB(t)
+	u := id.UserID("@finale:test.invalid")
+
+	if got, err := loadEpilogueCleared(u); err != nil || got {
+		t.Fatalf("fresh player: cleared=%v err=%v, want false/nil", got, err)
+	}
+	if err := markEpilogueClearedDB(u); err != nil {
+		t.Fatalf("mark cleared: %v", err)
+	}
+	if got, err := loadEpilogueCleared(u); err != nil || !got {
+		t.Fatalf("after mark: cleared=%v err=%v, want true/nil", got, err)
+	}
+	// Idempotent.
+	if err := markEpilogueClearedDB(u); err != nil {
+		t.Fatalf("re-mark: %v", err)
+	}
+
+	var c AdventureCharacter
+	c.UserID = u
+	applyPlayerMetaOverlay(&c)
+	if !c.EpilogueCleared {
+		t.Fatalf("overlay did not carry EpilogueCleared")
+	}
+}
+
+func TestEpilogueUnlocked_Gates(t *testing.T) {
+	townTestDB(t)
+	p := &AdventurePlugin{}
+
+	// Incomplete journal → refused, page-count message.
+	partial := &AdventureCharacter{UserID: id.UserID("@u1:test.invalid")}
+	partial.JournalPages = setJournalPageBit(0, 1)
+	ok, why := p.epilogueUnlocked(partial)
+	if ok {
+		t.Fatalf("incomplete journal should not unlock")
+	}
+	if !strings.Contains(why, "journal pages") {
+		t.Errorf("expected page-count refusal, got: %s", why)
+	}
+
+	// Complete journal but no Tier-5 clears → refused, T5 message.
+	full := &AdventureCharacter{UserID: id.UserID("@u2:test.invalid")}
+	for i := 1; i <= journalTotalPages; i++ {
+		full.JournalPages = setJournalPageBit(full.JournalPages, i)
+	}
+	ok, why = p.epilogueUnlocked(full)
+	if ok {
+		t.Fatalf("no T5 clears should not unlock")
+	}
+	if !strings.Contains(why, "Tier-5") {
+		t.Errorf("expected Tier-5 refusal, got: %s", why)
+	}
+}
+
+func TestFinishEpilogueWin_RepeatIsFlavorOnly(t *testing.T) {
+	// The already-cleared branch is pure flavour: no reward, no client calls.
+	p := &AdventurePlugin{}
+	repeat := p.finishEpilogueWin(id.UserID("@u:test.invalid"), true)
+	if strings.Contains(repeat, finaleTitle) {
+		t.Errorf("a repeat clear must not re-award the title: %s", repeat)
+	}
+	if strings.TrimSpace(repeat) == "" {
+		t.Errorf("a repeat clear should still say something")
+	}
+}
+
+func TestTwinBeeJournalReaction_DeterministicAndGuarded(t *testing.T) {
+	if twinBeeJournalReaction(3, 0) != "" {
+		t.Errorf("zero pages should produce no reaction")
+	}
+	first := twinBeeJournalReaction(3, 2)
+	if first == "" {
+		t.Fatalf("a found page should produce a reaction")
+	}
+	if again := twinBeeJournalReaction(3, 2); again != first {
+		t.Errorf("reaction not deterministic: %q vs %q", first, again)
+	}
+	// Voice guard: TwinBee never speaks of himself in the third person
+	// (feedback_twinbee_voice). None of the pooled lines may contain "TwinBee".
+	for _, line := range twinBeeJournalReactions {
+		if strings.Contains(line, "TwinBee") {
+			t.Errorf("third-person TwinBee reference in reaction: %q", line)
+		}
+	}
+}

internal/plugin/adventure_flavor_npcs.go

@@ -24,6 +24,31 @@ var mistyAcceptLines = []string{
 
 const mistyDeclineLine = "She nods once and walks away. She doesn't look back."
 
+// ── Misty — Arc Beats (D2) ─────────────────────────────────────────────────
+//
+// Three deepening dialogue beats keyed to MistyEncounterCount (5 / 15 / 30),
+// prepended to the encounter opening the one time the counter lands on a
+// threshold. Fiction only: nothing here connects a donation to a combat
+// outcome — the arena effects are a hidden discovery mechanic and stay hidden.
+var mistyArcBeats = map[int]string{
+	5: "It's you again. I was hoping it would be. I know your face now -- you're one of the few who ever stops. " +
+		"Most people look right through me. You never have.",
+
+	15: "Can I tell you something? I wasn't always out here asking strangers on the road. " +
+		"I had a home once. A garden that got away from me every summer. Someone who used to wait up. " +
+		"It's gone now, all of it. But you keep reminding me there are still kind people in the world. That's not nothing.",
+
+	30: "I don't think of you as a stranger anymore. Is it strange to say that? " +
+		"I catch myself watching the road for you now -- not for the gold, though I won't pretend it doesn't help. " +
+		"Just to see you're still standing. Whatever's out there, I hope it knows better than to take you from me too.",
+}
+
+// mistyArcBeat returns the deepening dialogue for the exact encounter count at
+// which a Misty stage lands, or "" for every other encounter.
+func mistyArcBeat(encounterCount int) string {
+	return mistyArcBeats[encounterCount]
+}
+
 // ── Arina — Opening Lines ──────────────────────────────────────────────────
 
 var arinaOpenings = []string{

internal/plugin/adventure_flavor_robbie.go

@@ -40,6 +40,11 @@ var robbieMasterworkAlreadyHas = "Oh. I see you already have one of these. Excel
 var robbieAllShopGear = "Nothing fancy today but that's alright. Clean inventory is its own reward. " +
 	"Well. The €%d is the reward. The clean inventory is a bonus. Cheerio!"
 
+// robbieLeftConsumable is appended when Robbie leaves a little something on his
+// every-10th-visit (D2). Takes the item name.
+var robbieLeftConsumable = "Oh -- one more thing. I tucked a %s into your bag on the way out. " +
+	"You've had me round enough times now that it felt rude not to. For the trouble, eh? _winks_"
+
 // ── Room Announcements ───────────────────────────────────────────────────────
 
 var robbieRoomStandard = "🎩 Robbie paid %s a visit and collected %d item(s) from their inventory. " +

internal/plugin/adventure_gifting.go

@@ -0,0 +1,200 @@
+package plugin
+
+import (
+	"fmt"
+	"math"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// N4/E2 item gifting. `!give <item> @user` hands a consumable or non-magic gear
+// item to another adventurer. The sender pays a 5% handling fee (of item value)
+// to the community pot — the same civic tax every payout pays — and is capped at
+// a few gifts a day so the feature can't become a twink-funnel for a fresh alt.
+// Magic items are deliberately non-giftable: attunement and the BiS economy stay
+// personal (gogobee_engagement_plan.md §E2).
+const (
+	giftDailyCap = 3
+	giftTaxRate  = 0.05
+)
+
+// giftableTypes is the allowlist of AdvItem.Type values a player may gift.
+// Everything in adventure_inventory is unequipped by definition (equipped gear
+// lives in adventure_equipment / magic_item_equipped), so "unequipped" needs no
+// separate check. Magic items ("magic_item") and raw materials are excluded.
+var giftableTypes = map[string]bool{
+	"consumable":     true,
+	"MasterworkGear": true,
+	"ArenaGear":      true,
+}
+
+// isGiftableItem reports whether an inventory item may be gifted, and a reason
+// when it may not.
+func isGiftableItem(it AdvItem) (bool, string) {
+	if it.Type == "magic_item" {
+		return false, "Magic items stay personal — attunement doesn't transfer. Try a consumable or a piece of gear."
+	}
+	if !giftableTypes[it.Type] {
+		return false, "You can only gift consumables and non-magic gear. Raw materials and treasures aren't giftable."
+	}
+	return true, ""
+}
+
+// pickGiftableItem resolves the item a `!give` query names, preferring a giftable
+// match so a non-giftable item (a magic item, raw materials) that also matches
+// can't shadow a giftable one and block the gift — the way plain findInventoryMatch
+// would, since it returns the first match across the whole inventory. Returns
+// (item, "") on success; (nil, "") when nothing matches at all; and (nil, reason)
+// when only non-giftable items match, so the caller can explain why.
+func pickGiftableItem(inv []AdvItem, query string) (*AdvItem, string) {
+	match := findInventoryMatch(inv, query)
+	if match == nil {
+		return nil, ""
+	}
+	if ok, _ := isGiftableItem(*match); ok {
+		return match, ""
+	}
+	giftables := make([]AdvItem, 0, len(inv))
+	for _, it := range inv {
+		if ok, _ := isGiftableItem(it); ok {
+			giftables = append(giftables, it)
+		}
+	}
+	if alt := findInventoryMatch(giftables, query); alt != nil {
+		return alt, ""
+	}
+	_, reason := isGiftableItem(*match)
+	return nil, reason
+}
+
+// giftCountToday returns how many gifts the sender has already sent on the given
+// UTC day. The cap is enforced against the persisted log, so a restart can't
+// reset someone's daily allowance.
+func giftCountToday(sender id.UserID, day string) int {
+	var n int
+	_ = db.Get().QueryRow(
+		`SELECT COUNT(*) FROM adventure_gift_log WHERE sender = ? AND gift_day = ?`,
+		string(sender), day).Scan(&n)
+	return n
+}
+
+// logGift records a completed gift for the daily cap and the audit trail.
+func logGift(sender, recipient id.UserID, itemName string, value int64, day string) error {
+	_, err := db.Get().Exec(
+		`INSERT INTO adventure_gift_log (sender, recipient, item_name, value, gift_day)
+		 VALUES (?, ?, ?, ?, ?)`,
+		string(sender), string(recipient), itemName, value, day)
+	return err
+}
+
+// transferInventoryItem moves one inventory row from one owner to another. Scoped
+// to the current owner so a stale id can't move a row that has already changed
+// hands, and forces in_vault=0 so a gift always lands in the recipient's active
+// pack rather than a phantom vault slot.
+func transferInventoryItem(itemID int64, from, to id.UserID) (bool, error) {
+	res, err := db.Get().Exec(
+		`UPDATE adventure_inventory SET user_id = ?, in_vault = 0 WHERE id = ? AND user_id = ?`,
+		string(to), itemID, string(from))
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n > 0, nil
+}
+
+// handleGiveCmd routes `!give <item> @user`.
+func (p *AdventurePlugin) handleGiveCmd(ctx MessageContext) error {
+	args := strings.TrimSpace(p.GetArgs(ctx.Body, "give"))
+
+	// Serialize a sender's own gifts so two near-simultaneous !give commands
+	// can't both clear the daily cap or double-spend the same item row.
+	userMu := p.advUserLock(ctx.Sender)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	char, _, err := p.ensureCharacter(ctx.Sender)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Failed to load your character. Try `!adventure` to create one first.")
+	}
+	if !char.Alive {
+		return p.SendDM(ctx.Sender, "You're dead. Your things stay where they are for now.")
+	}
+
+	// The target is the trailing token; everything before it is the item name.
+	fields := strings.Fields(args)
+	if len(fields) < 2 {
+		return p.SendDM(ctx.Sender, "Usage: `!give <item> @user` — e.g. `!give Health Potion @alex`.")
+	}
+	targetRaw := fields[len(fields)-1]
+	itemQuery := strings.TrimSpace(strings.TrimSuffix(args, targetRaw))
+
+	target, ok := p.ResolveUser(targetRaw, ctx.RoomID)
+	if !ok {
+		return p.SendDM(ctx.Sender, fmt.Sprintf("Couldn't find a user matching %q. Mention them or use their exact name.", targetRaw))
+	}
+	if target == ctx.Sender {
+		return p.SendDM(ctx.Sender, "Regifting to yourself? That's just moving things around.")
+	}
+
+	// Recipient must have completed !setup.
+	rc, rerr := LoadDnDCharacter(target)
+	if rerr != nil || rc == nil || rc.PendingSetup {
+		name := p.DisplayName(target)
+		return p.SendDM(ctx.Sender, fmt.Sprintf("%s hasn't set up an adventurer yet — they need to run `!setup` before they can receive gifts.", name))
+	}
+
+	day := time.Now().UTC().Format("2006-01-02")
+	if sent := giftCountToday(ctx.Sender, day); sent >= giftDailyCap {
+		return p.SendDM(ctx.Sender, fmt.Sprintf("You've already sent %d gifts today (the daily limit). Try again tomorrow.", sent))
+	}
+
+	inv, err := loadAdvInventory(ctx.Sender)
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Couldn't reach your inventory. Try again in a moment.")
+	}
+	match, reason := pickGiftableItem(inv, itemQuery)
+	if match == nil {
+		if reason == "" {
+			return p.SendDM(ctx.Sender, fmt.Sprintf("No inventory item matches %q. Check `!adventure inventory`.", itemQuery))
+		}
+		return p.SendDM(ctx.Sender, reason)
+	}
+
+	tax := int(math.Round(float64(match.Value) * giftTaxRate))
+	if tax > 0 {
+		if bal := p.euro.GetBalance(ctx.Sender); bal < float64(tax) {
+			return p.SendDM(ctx.Sender, fmt.Sprintf("Gifting **%s** carries a €%d handling fee (5%% of its value), and you only have €%.0f.", match.Name, tax, bal))
+		}
+		if !p.euro.Debit(ctx.Sender, float64(tax), "adventure_gift_tax") {
+			return p.SendDM(ctx.Sender, "Transaction failed. The economy is having a moment.")
+		}
+	}
+
+	moved, err := transferInventoryItem(match.ID, ctx.Sender, target)
+	if err != nil || !moved {
+		if tax > 0 {
+			p.euro.Credit(ctx.Sender, float64(tax), "adventure_gift_refund")
+		}
+		return p.SendDM(ctx.Sender, "Couldn't hand the item over. Nothing changed — try again in a moment.")
+	}
+	if tax > 0 {
+		communityPotAdd(tax)
+		trackTaxPaid(ctx.Sender, tax)
+	}
+	_ = logGift(ctx.Sender, target, match.Name, match.Value, day)
+
+	senderName := p.DisplayName(ctx.Sender)
+	recipName := p.DisplayName(target)
+	_ = p.SendDM(target, fmt.Sprintf("🎁 **%s** sent you **%s**! It's in your inventory now — `!adventure inventory` to take a look.", senderName, match.Name))
+
+	remaining := giftDailyCap - giftCountToday(ctx.Sender, day)
+	feeNote := ""
+	if tax > 0 {
+		feeNote = fmt.Sprintf(" (€%d handling fee to the community pot)", tax)
+	}
+	return p.SendDM(ctx.Sender, fmt.Sprintf("🎁 Sent **%s** to %s%s. %d gift(s) left today.", match.Name, recipName, feeNote, remaining))
+}

internal/plugin/adventure_gifting_test.go

@@ -0,0 +1,145 @@
+package plugin
+
+import (
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func TestIsGiftableItem(t *testing.T) {
+	cases := []struct {
+		typ  string
+		want bool
+	}{
+		{"consumable", true},
+		{"MasterworkGear", true},
+		{"ArenaGear", true},
+		{"magic_item", false},
+		{"treasure", false},
+		{"ore", false},
+		{"card", false},
+	}
+	for _, c := range cases {
+		got, reason := isGiftableItem(AdvItem{Type: c.typ, Name: "X"})
+		if got != c.want {
+			t.Errorf("isGiftableItem(%q) = %v, want %v (reason %q)", c.typ, got, c.want, reason)
+		}
+		if !got && reason == "" {
+			t.Errorf("isGiftableItem(%q) rejected with no reason", c.typ)
+		}
+	}
+}
+
+// TestPickGiftableItem: a non-giftable item must not shadow a giftable one that
+// also matches the query.
+func TestPickGiftableItem(t *testing.T) {
+	inv := []AdvItem{
+		{ID: 1, Name: "Dragon Scale", Type: "material", Tier: 5, Value: 9000},
+		{ID: 2, Name: "Dragon Draught", Type: "consumable", Tier: 1, Value: 200},
+	}
+	// "dragon" matches the Scale first (higher tier), but the Draught is the
+	// giftable one — pick it, don't refuse.
+	got, reason := pickGiftableItem(inv, "dragon")
+	if got == nil {
+		t.Fatalf("pickGiftableItem returned nil (reason %q), want the giftable Draught", reason)
+	}
+	if got.Name != "Dragon Draught" {
+		t.Errorf("picked %q, want Dragon Draught", got.Name)
+	}
+
+	// Only a non-giftable match → refuse with a reason.
+	onlyMagic := []AdvItem{{ID: 3, Name: "Ring of Power", Type: "magic_item", Value: 5000}}
+	got, reason = pickGiftableItem(onlyMagic, "ring")
+	if got != nil || reason == "" {
+		t.Errorf("magic-only match: got=%v reason=%q, want nil with a refusal reason", got, reason)
+	}
+
+	// No match at all → nil, empty reason.
+	got, reason = pickGiftableItem(inv, "nonexistent")
+	if got != nil || reason != "" {
+		t.Errorf("no match: got=%v reason=%q, want nil/empty", got, reason)
+	}
+}
+
+// TestTransferInventoryItem: an item moves owners exactly, and a wrong-owner
+// transfer is a no-op.
+func TestTransferInventoryItem(t *testing.T) {
+	vaultTestDB(t)
+	alice := id.UserID("@alice:test.invalid")
+	bob := id.UserID("@bob:test.invalid")
+	if err := addAdvInventoryItem(alice, AdvItem{Name: "Health Potion", Type: "consumable", Tier: 1, Value: 200}); err != nil {
+		t.Fatal(err)
+	}
+	inv, _ := loadAdvInventory(alice)
+	if len(inv) != 1 {
+		t.Fatalf("setup: alice has %d items, want 1", len(inv))
+	}
+	itemID := inv[0].ID
+
+	// Wrong owner can't move it.
+	if moved, err := transferInventoryItem(itemID, bob, alice); err != nil || moved {
+		t.Fatalf("wrong-owner transfer moved=%v err=%v, want no-op", moved, err)
+	}
+
+	// Real owner moves it to bob.
+	moved, err := transferInventoryItem(itemID, alice, bob)
+	if err != nil || !moved {
+		t.Fatalf("transfer moved=%v err=%v, want success", moved, err)
+	}
+	if a, _ := loadAdvInventory(alice); len(a) != 0 {
+		t.Errorf("alice still has %d items after gifting", len(a))
+	}
+	b, _ := loadAdvInventory(bob)
+	if len(b) != 1 || b[0].Name != "Health Potion" {
+		t.Errorf("bob's inventory = %+v, want the potion", b)
+	}
+}
+
+// TestTransferUnvaultsItem: gifting a currently-vaulted item lands it in the
+// recipient's active pack, not a phantom vault slot.
+func TestTransferUnvaultsItem(t *testing.T) {
+	vaultTestDB(t)
+	alice := id.UserID("@alice2:test.invalid")
+	bob := id.UserID("@bob2:test.invalid")
+	if err := addAdvInventoryItem(alice, AdvItem{Name: "Elixir", Type: "consumable", Tier: 1, Value: 100}); err != nil {
+		t.Fatal(err)
+	}
+	inv, _ := loadAdvInventory(alice)
+	if _, err := setItemVaulted(alice, inv[0].ID, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := transferInventoryItem(inv[0].ID, alice, bob); err != nil {
+		t.Fatal(err)
+	}
+	// Bob sees it in active inventory (not vault).
+	if b, _ := loadAdvInventory(bob); len(b) != 1 {
+		t.Errorf("bob active inventory = %d, want 1 (item un-vaulted on gift)", len(b))
+	}
+	if bv, _ := loadAdvVault(bob); len(bv) != 0 {
+		t.Errorf("bob vault = %d, want 0", len(bv))
+	}
+}
+
+// TestGiftDailyCapCounting: logGift increments the day's count and the count is
+// day-scoped.
+func TestGiftDailyCapCounting(t *testing.T) {
+	vaultTestDB(t)
+	sender := id.UserID("@giver:test.invalid")
+	recip := id.UserID("@taker:test.invalid")
+
+	if n := giftCountToday(sender, "2026-07-10"); n != 0 {
+		t.Fatalf("initial count = %d, want 0", n)
+	}
+	for i := 0; i < giftDailyCap; i++ {
+		if err := logGift(sender, recip, "Potion", 100, "2026-07-10"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if n := giftCountToday(sender, "2026-07-10"); n != giftDailyCap {
+		t.Errorf("count = %d, want %d", n, giftDailyCap)
+	}
+	// A different day is a fresh allowance.
+	if n := giftCountToday(sender, "2026-07-11"); n != 0 {
+		t.Errorf("next-day count = %d, want 0", n)
+	}
+}

internal/plugin/adventure_housing.go

@@ -99,12 +99,16 @@ type advPendingHouseDownPayment struct {
 
 type advPendingHouseAutopay struct{}
 
-type advPendingPetArrival struct{}
+// Slot is the pet slot the arrival conversation is filling: 1 (the first pet)
+// or 2 (the Tier-4 Estate's second companion). Zero-value 1 keeps every
+// existing single-pet interaction unchanged.
+type advPendingPetArrival struct{ Slot int }
 
-type advPendingPetType struct{}
+type advPendingPetType struct{ Slot int }
 
 type advPendingPetName struct {
 	PetType string
+	Slot    int
 }
 
 // ── Thom Krooke Greeting ───────────────────────────────────────────────────
@@ -142,6 +146,18 @@ var thomFreezePet = "Ten missed payments. I've stopped trying for now. The house
 var thomPaidOffNoPet = "Paid off. Noted. The next tier is available when you're ready. I'll be here."
 var thomPaidOffPet = "Paid off. Good. Come in when you're ready for the next tier. I've been thinking about what %s would need in a better space. I have thoughts."
 
+// thomPetTreatItem is the keepsake Thom leaves for the pet on the final
+// mortgage payoff. Inert (Type "card" like the medical-debt card): not a
+// consumable, not gear, and Robbie's sweep skips it.
+func thomPetTreatItem() AdvItem {
+	return AdvItem{
+		Name:  "Krooke's Finest Pet Treat",
+		Type:  "card",
+		Tier:  0,
+		Value: 0,
+	}
+}
+
 // thomGreeting returns an appropriate greeting based on pet state.
 func thomGreeting(char *AdventureCharacter) string {
 	if char.HasPet() && char.PetLevel >= 10 {
@@ -221,11 +237,19 @@ func thomShopView(char *AdventureCharacter, balance float64) string {
 		}
 	}
 
-	// Pet supply shop (unlocks 1 week after pet level 10)
-	if char.PetSupplyShopUnlocked && char.HasPet() {
+	// Pet supply shop (unlocks 1 week after pet level 10). The unlock is a
+	// pet-1 mechanic but covers barding for both companions. Each pet's block is
+	// gated on its own presence so a chased-away pet-1 doesn't hide pet-2's shop.
+	if char.PetSupplyShopUnlocked && (char.HasPet() || char.HasPet2()) {
 		sb.WriteString("\n---\n")
-		sb.WriteString(fmt.Sprintf("🐾 **Pet Supplies** — for %s\n\n", char.PetName))
-		sb.WriteString(petArmorShopView(char))
+		if char.HasPet() {
+			sb.WriteString(fmt.Sprintf("🐾 **Pet Supplies** — for %s\n\n", char.PetName))
+			sb.WriteString(petArmorShopView(char.PetType, char.PetArmorTier, "petbuy"))
+		}
+		if char.HasPet2() {
+			sb.WriteString(fmt.Sprintf("\n🐾 **Pet Supplies** — for %s\n\n", char.Pet2Name))
+			sb.WriteString(petArmorShopView(char.Pet2Type, char.Pet2ArmorTier, "pet2buy"))
+		}
 	}
 
 	return sb.String()
@@ -269,8 +293,11 @@ func (p *AdventurePlugin) handleThomCmd(ctx MessageContext) error {
 	case lower == "buy" || strings.HasPrefix(lower, "buy "):
 		return p.handleThomBuy(ctx, char, balance, strings.TrimSpace(strings.TrimPrefix(lower, "buy")))
 
+	case strings.HasPrefix(lower, "pet2buy "):
+		return p.petArmorBuyForSlot(ctx, strings.TrimSpace(args[8:]), 2)
+
 	case strings.HasPrefix(lower, "petbuy "):
-		return p.handlePetArmorBuy(ctx, char, strings.TrimSpace(args[7:]))
+		return p.petArmorBuyForSlot(ctx, strings.TrimSpace(args[7:]), 1)
 
 	default:
 		return p.SendDM(ctx.Sender, "Unknown command. Type `!thom` to visit Krooke Realty.")
@@ -538,11 +565,22 @@ func (p *AdventurePlugin) processMortgagePayments() {
 				freshChar.HouseLoanBalance = 0
 				freshChar.HouseMissedPayments = 0
 				_ = saveAdvCharacter(freshChar)
+				// The last house: no next tier means Thom is done with this
+				// player. A letter, and a treat in the bag if they keep a pet.
+				finalPayoff := houseNextTier(freshChar.HouseTier) == nil
+				if finalPayoff && freshChar.HasPet() {
+					_ = addAdvInventoryItem(freshChar.UserID, thomPetTreatItem())
+				}
 				userMu.Unlock()
-				// Paid off!
-				if freshChar.HasPet() {
+				switch {
+				case finalPayoff && freshChar.HasPet():
+					letter := strings.ReplaceAll(thomFinalLetterPet, "{pet}", freshChar.PetName)
+					_ = p.SendDM(freshChar.UserID, "🏠 "+letter)
+				case finalPayoff:
+					_ = p.SendDM(freshChar.UserID, "🏠 "+thomFinalLetterNoPet)
+				case freshChar.HasPet():
 					_ = p.SendDM(freshChar.UserID, fmt.Sprintf("🏠 %s", fmt.Sprintf(thomPaidOffPet, freshChar.PetName)))
-				} else {
+				default:
 					_ = p.SendDM(freshChar.UserID, fmt.Sprintf("🏠 %s", thomPaidOffNoPet))
 				}
 				continue
@@ -673,18 +711,18 @@ func petArmorDefs(petType string) []PetArmorDef {
 	return petCatArmor
 }
 
-func petArmorShopView(char *AdventureCharacter) string {
+func petArmorShopView(petType string, armorTier int, buyCmd string) string {
 	var sb strings.Builder
-	defs := petArmorDefs(char.PetType)
+	defs := petArmorDefs(petType)
 
-	if char.PetArmorTier >= 5 {
+	if armorTier >= 5 {
 		sb.WriteString("✨ Max pet armor tier reached. There is nothing left to buy.\n")
 		return sb.String()
 	}
 
 	for _, def := range defs {
-		if def.Tier <= char.PetArmorTier {
-			if def.Tier == char.PetArmorTier {
+		if def.Tier <= armorTier {
+			if def.Tier == armorTier {
 				sb.WriteString(fmt.Sprintf("🟢 %s (T%d) — Currently equipped\n", def.Name, def.Tier))
 			}
 			continue
@@ -692,11 +730,14 @@ func petArmorShopView(char *AdventureCharacter) string {
 		indicator := "⬆️"
 		sb.WriteString(fmt.Sprintf("%s %s (T%d) — €%d — +%.1f%% deflect\n", indicator, def.Name, def.Tier, def.Price, def.DeflectBonus*100))
 	}
-	sb.WriteString(fmt.Sprintf("\nTo buy: `!thom petbuy <tier>` (e.g., `!thom petbuy %d`)", char.PetArmorTier+1))
+	sb.WriteString(fmt.Sprintf("\nTo buy: `!thom %s <tier>` (e.g., `!thom %s %d`)", buyCmd, buyCmd, armorTier+1))
 	return sb.String()
 }
 
-func (p *AdventurePlugin) handlePetArmorBuy(ctx MessageContext, char *AdventureCharacter, tierStr string) error {
+// petArmorBuyForSlot buys the next barding tier for the given pet slot. The
+// supply-shop unlock is shared (a pet-1 mechanic), but each pet's armor tier is
+// tracked and purchased independently.
+func (p *AdventurePlugin) petArmorBuyForSlot(ctx MessageContext, tierStr string, slot int) error {
 	userMu := p.advUserLock(ctx.Sender)
 	userMu.Lock()
 	defer userMu.Unlock()
@@ -706,8 +747,16 @@ func (p *AdventurePlugin) handlePetArmorBuy(ctx MessageContext, char *AdventureC
 		return p.SendDM(ctx.Sender, "Failed to load your character.")
 	}
 
-	if !char.HasPet() {
-		return p.SendDM(ctx.Sender, "You don't have a pet.")
+	// Slot accessors keep the pet-1 and pet-2 field sets isolated.
+	hasPet, petType, petName, curTier := char.HasPet(), char.PetType, char.PetName, char.PetArmorTier
+	buyCmd := "petbuy"
+	if slot == 2 {
+		hasPet, petType, petName, curTier = char.HasPet2(), char.Pet2Type, char.Pet2Name, char.Pet2ArmorTier
+		buyCmd = "pet2buy"
+	}
+
+	if !hasPet {
+		return p.SendDM(ctx.Sender, "You don't have that pet.")
 	}
 	if !char.PetSupplyShopUnlocked {
 		return p.SendDM(ctx.Sender, "Pet supplies aren't available yet.")
@@ -716,19 +765,19 @@ func (p *AdventurePlugin) handlePetArmorBuy(ctx MessageContext, char *AdventureC
 	tier := 0
 	for _, c := range tierStr {
 		if c < '0' || c > '9' {
-			return p.SendDM(ctx.Sender, "Usage: `!thom petbuy <tier>`")
+			return p.SendDM(ctx.Sender, fmt.Sprintf("Usage: `!thom %s <tier>`", buyCmd))
 		}
 		tier = tier*10 + int(c-'0')
 	}
 
-	if tier != char.PetArmorTier+1 {
-		if tier <= char.PetArmorTier {
+	if tier != curTier+1 {
+		if tier <= curTier {
 			return p.SendDM(ctx.Sender, "That's not an upgrade.")
 		}
-		return p.SendDM(ctx.Sender, fmt.Sprintf("You need to buy tier %d first.", char.PetArmorTier+1))
+		return p.SendDM(ctx.Sender, fmt.Sprintf("You need to buy tier %d first.", curTier+1))
 	}
 
-	defs := petArmorDefs(char.PetType)
+	defs := petArmorDefs(petType)
 	var def *PetArmorDef
 	for i := range defs {
 		if defs[i].Tier == tier {
@@ -742,18 +791,26 @@ func (p *AdventurePlugin) handlePetArmorBuy(ctx MessageContext, char *AdventureC
 
 	balance := p.euro.GetBalance(ctx.Sender)
 	if balance < float64(def.Price) {
-		return p.SendDM(ctx.Sender, fmt.Sprintf("%s deserves better, but you can't afford €%d. Balance: €%.0f.", char.PetName, def.Price, balance))
+		return p.SendDM(ctx.Sender, fmt.Sprintf("%s deserves better, but you can't afford €%d. Balance: €%.0f.", petName, def.Price, balance))
 	}
 
-	if !p.euro.Debit(ctx.Sender, float64(def.Price), "pet_armor_"+tierStr) {
+	reason := "pet_armor_" + tierStr
+	if slot == 2 {
+		reason = "pet2_armor_" + tierStr
+	}
+	if !p.euro.Debit(ctx.Sender, float64(def.Price), reason) {
 		return p.SendDM(ctx.Sender, "Transaction failed.")
 	}
 
-	char.PetArmorTier = tier
+	if slot == 2 {
+		char.Pet2ArmorTier = tier
+	} else {
+		char.PetArmorTier = tier
+	}
 	if err := saveAdvCharacter(char); err != nil {
 		p.euro.Credit(ctx.Sender, float64(def.Price), "pet_armor_refund")
 		return p.SendDM(ctx.Sender, "Failed to save. Refunded.")
 	}
 
-	return p.SendDM(ctx.Sender, fmt.Sprintf("🐾 **%s** equipped on %s.\n\n+%.1f%% deflect bonus. %s looks... objectively better than you.", def.Name, char.PetName, def.DeflectBonus*100, char.PetName))
+	return p.SendDM(ctx.Sender, fmt.Sprintf("🐾 **%s** equipped on %s.\n\n+%.1f%% deflect bonus. %s looks... objectively better than you.", def.Name, petName, def.DeflectBonus*100, petName))
 }

internal/plugin/adventure_housing_test.go

@@ -285,8 +285,7 @@ func TestPetArmorDefs_BothTypes(t *testing.T) {
 }
 
 func TestPetArmorShopView_HasUpgrades(t *testing.T) {
-	char := &AdventureCharacter{PetType: "dog", PetName: "Rex", PetArrived: true, PetArmorTier: 0}
-	text := petArmorShopView(char)
+	text := petArmorShopView("dog", 0, "petbuy")
 
 	if !strings.Contains(text, "⬆️") {
 		t.Error("should show upgrade indicators")
@@ -297,8 +296,7 @@ func TestPetArmorShopView_HasUpgrades(t *testing.T) {
 }
 
 func TestPetArmorShopView_MaxTier(t *testing.T) {
-	char := &AdventureCharacter{PetType: "cat", PetName: "Luna", PetArrived: true, PetArmorTier: 5}
-	text := petArmorShopView(char)
+	text := petArmorShopView("cat", 5, "petbuy")
 
 	if !strings.Contains(text, "Max pet armor") {
 		t.Error("should show max tier message")

internal/plugin/adventure_masterwork.go

@@ -435,18 +435,8 @@ func (p *AdventurePlugin) handleMasterworkEquipReply(ctx MessageContext, interac
 		return p.SendDM(ctx.Sender, "Equip cancelled.")
 	}
 
-	// Parse number
-	idx := 0
-	for _, c := range reply {
-		if c >= '0' && c <= '9' {
-			idx = idx*10 + int(c-'0')
-		} else {
-			break
-		}
-	}
-	idx-- // 1-indexed to 0-indexed
-
-	if idx < 0 || idx >= len(data.Items) {
+	idx, ok := parseMenuIndex(reply, len(data.Items))
+	if !ok {
 		return p.SendDM(ctx.Sender, "Invalid selection. Reply with a number from the list, or \"cancel\".")
 	}
 
@@ -502,8 +492,33 @@ func (p *AdventurePlugin) handleMasterworkEquipConfirm(ctx MessageContext, inter
 		return p.SendDM(ctx.Sender, "Equip cancelled.")
 	}
 
+	// Serialize against the sender's own !give: MasterworkGear/ArenaGear are
+	// giftable (N4/E2), so the item captured at prompt time may have changed
+	// hands before this confirmation. The lock makes gift-vs-confirm atomic,
+	// and the re-load below refuses an item that is no longer ours — otherwise
+	// equipping the captured copy would mint a duplicate the gift already
+	// handed to the recipient.
+	userMu := p.advUserLock(ctx.Sender)
+	userMu.Lock()
+	defer userMu.Unlock()
+
 	selected := data.Item
 
+	inv, err := loadAdvInventory(ctx.Sender)
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Failed to load your inventory.")
+	}
+	stillOwned := false
+	for _, it := range inv {
+		if it.ID == selected.ID {
+			stillOwned = true
+			break
+		}
+	}
+	if !stillOwned {
+		return p.SendDM(ctx.Sender, fmt.Sprintf("**%s** isn't in your inventory anymore. Equip cancelled.", selected.Name))
+	}
+
 	equip, err := loadAdvEquipment(ctx.Sender)
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to load equipment.")

internal/plugin/adventure_mischief.go

@@ -0,0 +1,773 @@
+package plugin
+
+// Mischief Makers (M1) — paid monster hits on live expeditions.
+//
+// A buyer spends euros to send a monster at an adventurer who is out in a
+// dungeon right now. The games room hears the contract is out; a window later
+// the monster is delivered mid-run. Surviving it pays the target and unseals
+// the buyer in Pete's bulletin. See gogobee_mischief_plan.md.
+//
+// Three properties the design leans on, all of them enforced here rather than
+// trusted:
+//
+//   - The monster is priced against the TARGET, not the dungeon they happen to
+//     be standing in. It comes from the zone pool of the target's own level
+//     bracket (mischiefBracketZones), which is the corpus the difficulty pass is
+//     calibrated on. The arena ladder is deliberately NOT the source: its
+//     BaseLethality is a legacy flat death chance and arena T5 one-shots a level
+//     20, which would collapse every tier into an execution.
+//
+//   - The payout basis is the BASE fee, never what the buyer actually paid. The
+//     +25% sign surcharge is a pure sink. With the per-tier percentages below
+//     capped at 75%, a survival purse is always strictly less than the buyer's
+//     outlay — so two players colluding to move money this way lose to
+//     `!baltransfer`, which is free. That cap is the whole anti-collusion story;
+//     no danger multiplier is needed.
+//
+//   - Mischief maims, it does not murder. The delivery close-out floors every
+//     seat at 1 HP and force-extracts the expedition. A purchased attack that
+//     lands while the victim is asleep must not be able to delete their
+//     character — see mischiefResolveDowned.
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+	"math"
+	"math/rand/v2"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"github.com/google/uuid"
+	"maunium.net/go/mautrix/id"
+)
+
+const (
+	// mischiefWindow — how long the games room has to react before the monster
+	// is delivered. Long enough for a bless/escalate scramble (M2), short
+	// enough that a contract resolves inside one sitting.
+	mischiefWindow = 60 * time.Minute
+
+	// mischiefMinLevel — a level 1-2 adventurer is nobody's idea of a fair
+	// target, and the bracket-1 pool is the only thing we could send anyway.
+	mischiefMinLevel = 3
+
+	// mischiefTargetCooldown — a target gets a breather after one resolves, so
+	// a buyer with money can't chain-maim someone out of the game.
+	mischiefTargetCooldown = 24 * time.Hour
+
+	// mischiefBuyerDailyCap — contracts one buyer may place per rolling day.
+	mischiefBuyerDailyCap = 2
+
+	// mischiefBossPerTargetWindow — boss tier is "end this expedition" against a
+	// caster (0-14% survival in the M0 sweep). One per target per week, on top of
+	// the cooldown and the buyer cap.
+	mischiefBossPerTargetWindow = 7 * 24 * time.Hour
+
+	// mischiefSignSurcharge — the buyer pays this much on top to put their name
+	// on the contract from the start. Pure sink; see the payout-basis note above.
+	mischiefSignSurcharge = 0.25
+
+	// Fizzle: the expedition ended before the monster could find them.
+	mischiefFizzleRefund = 0.90
+)
+
+// Contract statuses. `delivering` is the claimed-but-unresolved state a CAS
+// moves through, so a ticker double-fire finds nothing left to claim.
+const (
+	mischiefStatusOpen       = "open"
+	mischiefStatusDelivering = "delivering"
+	mischiefStatusDelivered  = "delivered"
+	mischiefStatusFizzled    = "fizzled"
+)
+
+const (
+	mischiefOutcomeSurvived = "survived"
+	mischiefOutcomeDowned   = "downed"
+)
+
+// ── Tiers ────────────────────────────────────────────────────────────────────
+
+// mischiefTier is one rung of the grunt→boss ladder. Fee and PayoutPct come
+// from the M0 pricing sweep (n=2000/cell against the real combat engine) read
+// against the live prod economy — see the tier table in the plan doc.
+type mischiefTier struct {
+	Key       string
+	Display   string
+	Fee       int     // base fee; also the payout basis
+	PayoutPct float64 // survival purse as a fraction of Fee. Capped at 0.75.
+	Blurb     string
+}
+
+var mischiefTiers = []mischiefTier{
+	{Key: "grunt", Display: "Grunt", Fee: 40, PayoutPct: 0.40,
+		Blurb: "One of the local nasties. Mostly theatre — it'll cost them blood, not the run."},
+	{Key: "mob", Display: "Mob", Fee: 100, PayoutPct: 0.50,
+		Blurb: "Three of them, back to back. Attrition, and a real dent in the supplies."},
+	{Key: "elite", Display: "Elite", Fee: 350, PayoutPct: 0.65,
+		Blurb: "Something that hunts on purpose, and it opens with a free swing. A coin-flip at their level."},
+	{Key: "boss", Display: "Boss", Fee: 1200, PayoutPct: 0.75,
+		Blurb: "The worst thing in their bracket, with the drop on them. This ends expeditions."},
+}
+
+func mischiefTierByKey(key string) (mischiefTier, bool) {
+	for _, t := range mischiefTiers {
+		if t.Key == strings.ToLower(strings.TrimSpace(key)) {
+			return t, true
+		}
+	}
+	return mischiefTier{}, false
+}
+
+// mischiefSignedFee is what a buyer pays to put their name on the contract up
+// front. The extra is a sink — mischiefPurse never sees it.
+func mischiefSignedFee(fee int) int {
+	return int(math.Round(float64(fee) * (1 + mischiefSignSurcharge)))
+}
+
+// mischiefPurse is the target's cut for surviving: a percentage of the BASE fee
+// (which escalations raise, and the sign surcharge does not). Hard-capped at 75%
+// so no combination of tier + escalation can pay out more than three-quarters of
+// what was spent.
+func mischiefPurse(fee int, pct float64) int {
+	if pct > 0.75 {
+		pct = 0.75
+	}
+	return int(math.Round(float64(fee) * pct))
+}
+
+// ── Monster selection ────────────────────────────────────────────────────────
+
+// mischiefBracketZones — the zone whose enemy pool a target of each level
+// bracket draws its attacker from. The target's *current* dungeon is not used:
+// a level 20 slumming in a tier 1 zone should still be sent something that can
+// find them, and a level 4 who wandered into a tier 4 zone should not be sent
+// its boss.
+var mischiefBracketZones = map[int]ZoneID{
+	1: ZoneGoblinWarrens,
+	2: ZoneSunkenTemple,
+	3: ZoneManorBlackspire,
+	4: ZoneUnderdark,
+	5: ZoneDragonsLair,
+}
+
+func mischiefBracketForLevel(level int) int {
+	switch {
+	case level <= 3:
+		return 1
+	case level <= 7:
+		return 2
+	case level <= 12:
+		return 3
+	case level <= 17:
+		return 4
+	}
+	return 5
+}
+
+// mischiefBracketZone resolves the zone a target's attacker is drawn from.
+func mischiefBracketZone(level int) ZoneDefinition {
+	zone, _ := getZone(mischiefBracketZones[mischiefBracketForLevel(level)])
+	return zone
+}
+
+func mischiefPickEnemy(zone ZoneDefinition, elite bool, rng *rand.Rand) DnDMonsterTemplate {
+	var pool []ZoneEnemy
+	for _, e := range zone.Enemies {
+		if e.IsElite == elite {
+			pool = append(pool, e)
+		}
+	}
+	if len(pool) == 0 {
+		pool = zone.Enemies
+	}
+	if len(pool) == 0 {
+		return DnDMonsterTemplate{}
+	}
+	return dndBestiary[pool[rng.IntN(len(pool))].BestiaryID]
+}
+
+// mischiefMonsters returns the fight chain a tier sends, and whether the first
+// monster gets the ambush (the attacker's privilege — it was lying in wait).
+// This IS the shape the M0 sweep priced; changing it invalidates the fee table.
+//
+//	grunt = one non-elite zone enemy, no ambush
+//	mob   = three non-elite zone enemies back to back (HP carries), no ambush
+//	elite = one elite zone enemy, ambush
+//	boss  = the zone boss, ambush
+func mischiefMonsters(tierKey string, zone ZoneDefinition, rng *rand.Rand) (chain []DnDMonsterTemplate, ambush bool) {
+	switch tierKey {
+	case "grunt":
+		return []DnDMonsterTemplate{mischiefPickEnemy(zone, false, rng)}, false
+	case "mob":
+		return []DnDMonsterTemplate{
+			mischiefPickEnemy(zone, false, rng),
+			mischiefPickEnemy(zone, false, rng),
+			mischiefPickEnemy(zone, false, rng),
+		}, false
+	case "elite":
+		return []DnDMonsterTemplate{mischiefPickEnemy(zone, true, rng)}, true
+	case "boss":
+		return []DnDMonsterTemplate{dndBestiary[zone.Boss.BestiaryID]}, true
+	}
+	return nil, false
+}
+
+// ── Model + persistence ──────────────────────────────────────────────────────
+
+type mischiefContract struct {
+	ID              string
+	BuyerID         id.UserID
+	TargetID        id.UserID
+	Tier            string
+	Fee             int // payout basis (base fee + escalations)
+	Paid            int // what the buyer actually parted with
+	Status          string
+	Signed          bool
+	EscalationCount int
+	BlessingCount   int
+	Source          string
+	Outcome         string
+	CreatedAt       time.Time
+	WindowEndsAt    time.Time
+}
+
+const mischiefCols = `contract_id, buyer_id, target_id, tier, fee, paid, status, signed,
+	escalation_count, blessing_count, source, COALESCE(outcome, ''), created_at, window_ends_at`
+
+func scanMischief(row interface{ Scan(...any) error }) (*mischiefContract, error) {
+	c := &mischiefContract{}
+	err := row.Scan(&c.ID, &c.BuyerID, &c.TargetID, &c.Tier, &c.Fee, &c.Paid, &c.Status,
+		&c.Signed, &c.EscalationCount, &c.BlessingCount, &c.Source, &c.Outcome,
+		&c.CreatedAt, &c.WindowEndsAt)
+	if err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// insertMischiefContract writes the contract, and FAILS if one is already live
+// against this target (idx_mischief_one_live_per_target). That error is the
+// serialization point for two buyers racing at the same victim — the caller must
+// refund on it, not ignore it.
+//
+// Every timestamp is bound as a Go time.Time rather than left to
+// CURRENT_TIMESTAMP: created_at and window_ends_at are both compared against
+// bound Go times later (the daily cap, the due sweep), and mixing SQLite's own
+// text stamp with the driver's encoding is how you get a comparison that is
+// lexicographic-by-accident.
+func insertMischiefContract(c *mischiefContract) error {
+	_, err := db.Get().Exec(
+		`INSERT INTO mischief_contracts
+		 (contract_id, buyer_id, target_id, tier, fee, paid, status, signed, source,
+		  created_at, window_ends_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		c.ID, string(c.BuyerID), string(c.TargetID), c.Tier, c.Fee, c.Paid,
+		c.Status, c.Signed, c.Source, c.CreatedAt, c.WindowEndsAt)
+	return err
+}
+
+// claimMischiefForDelivery moves open → delivering and reports whether THIS
+// caller won the race. Exactly one delivery per contract, whatever the ticker
+// does across a restart.
+func claimMischiefForDelivery(contractID string) bool {
+	res := db.ExecResult("mischief: claim delivery",
+		`UPDATE mischief_contracts SET status = ?
+		 WHERE contract_id = ? AND status = ?`,
+		mischiefStatusDelivering, contractID, mischiefStatusOpen)
+	if res == nil {
+		return false
+	}
+	n, _ := res.RowsAffected()
+	return n == 1
+}
+
+// resolveMischiefContract stamps the terminal state. Called only by the
+// delivery path, which already holds the claim.
+func resolveMischiefContract(contractID, status, outcome string) {
+	db.Exec("mischief: resolve contract",
+		`UPDATE mischief_contracts
+		    SET status = ?, outcome = ?, resolved_at = ?
+		  WHERE contract_id = ?`,
+		status, outcome, time.Now().UTC(), contractID)
+}
+
+// fizzleMischiefContract claims an open contract straight to fizzled — the
+// target's expedition ended before the monster found them. Same CAS discipline
+// as delivery, so a fizzle and a delivery can never both fire.
+func fizzleMischiefContract(contractID string) bool {
+	return casMischiefStatus("mischief: fizzle contract", contractID,
+		mischiefStatusOpen, mischiefStatusFizzled, mischiefStatusFizzled)
+}
+
+// abandonStaleMischief releases a stuck delivery. CAS off `delivering`, so a
+// delivery that is merely slow (a long fight) cannot be swept out from under
+// itself and double-refunded.
+func abandonStaleMischief(contractID string) bool {
+	return casMischiefStatus("mischief: abandon stale delivery", contractID,
+		mischiefStatusDelivering, mischiefStatusFizzled, mischiefStatusFizzled)
+}
+
+// casMischiefStatus is the one status transition every terminal path takes: move
+// from → to only if the row is still in `from`, and report whether THIS caller
+// won. Every transition is conditional, which is what makes a ticker double-fire
+// or a restart mid-delivery unable to pay (or refund) twice.
+func casMischiefStatus(label, contractID, from, to, outcome string) bool {
+	res := db.ExecResult(label,
+		`UPDATE mischief_contracts
+		    SET status = ?, outcome = ?, resolved_at = ?
+		  WHERE contract_id = ? AND status = ?`,
+		to, outcome, time.Now().UTC(), contractID, from)
+	if res == nil {
+		return false
+	}
+	n, _ := res.RowsAffected()
+	return n == 1
+}
+
+// loadStaleMischiefDeliveries returns contracts stuck in `delivering` — claimed
+// by a delivery that then crashed, or was killed mid-fight by a restart. Without
+// this sweep the row lives forever: the target can never be targeted again (the
+// live-contract check counts `delivering`) and the buyer's money is simply gone.
+func loadStaleMischiefDeliveries(before time.Time) []mischiefContract {
+	return loadMischiefByStatus(mischiefStatusDelivering, before)
+}
+
+// loadMischiefDue returns open contracts whose window has closed.
+func loadMischiefDue(now time.Time) []mischiefContract {
+	return loadMischiefByStatus(mischiefStatusOpen, now)
+}
+
+func loadMischiefByStatus(status string, dueBy time.Time) []mischiefContract {
+	rows, err := db.Get().Query(
+		`SELECT `+mischiefCols+` FROM mischief_contracts
+		  WHERE status = ? AND window_ends_at <= ?`,
+		status, dueBy)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var out []mischiefContract
+	for rows.Next() {
+		if c, err := scanMischief(rows); err == nil {
+			out = append(out, *c)
+		}
+	}
+	return out
+}
+
+// liveMischiefForTarget returns the contract already in flight against a target,
+// or nil. One at a time: two monsters converging on the same person turns a
+// mischief into a mugging.
+func liveMischiefForTarget(targetID id.UserID) *mischiefContract {
+	row := db.Get().QueryRow(
+		`SELECT `+mischiefCols+` FROM mischief_contracts
+		  WHERE target_id = ? AND status IN (?, ?)
+		  ORDER BY created_at DESC LIMIT 1`,
+		string(targetID), mischiefStatusOpen, mischiefStatusDelivering)
+	c, err := scanMischief(row)
+	if err != nil {
+		return nil
+	}
+	return c
+}
+
+// mischiefTargetCoolingDown reports whether the target survived (or was floored
+// by) a delivered contract too recently to be sent another.
+//
+// Only a DELIVERED contract cools a target down. A fizzle never reached them,
+// and a crash-swept stranding never happened at all — counting either would sell
+// cheap immunity: a target whose friend places a grunt and who then extracts pays
+// 10% of a grunt fee for a full day of being untargetable.
+func mischiefTargetCoolingDown(targetID id.UserID, now time.Time) (bool, time.Duration) {
+	var resolved time.Time
+	err := db.Get().QueryRow(
+		`SELECT resolved_at FROM mischief_contracts
+		  WHERE target_id = ? AND status = ? AND resolved_at IS NOT NULL
+		  ORDER BY resolved_at DESC LIMIT 1`,
+		string(targetID), mischiefStatusDelivered).Scan(&resolved)
+	if err != nil {
+		return false, 0 // no row (or unreadable stamp) == not cooling down
+	}
+	if wait := mischiefTargetCooldown - now.Sub(resolved.UTC()); wait > 0 {
+		return true, wait
+	}
+	return false, 0
+}
+
+// mischiefBuyerCountSince is how many contracts this buyer has placed in the
+// window — the anti-spam cap. Fizzled ones count: the limit is on how often you
+// may point a monster at someone, not on how often it connects.
+func mischiefBuyerCountSince(buyerID id.UserID, since time.Time) int {
+	var n int
+	_ = db.Get().QueryRow(
+		`SELECT COUNT(*) FROM mischief_contracts WHERE buyer_id = ? AND created_at > ?`,
+		string(buyerID), since).Scan(&n)
+	return n
+}
+
+// mischiefBossCountSince counts boss-tier contracts aimed at a target inside the
+// window, from anyone. Boss is the "end their expedition" button; one a week.
+//
+// Fizzled ones do NOT count, and that asymmetry with the buyer cap is deliberate:
+// the buyer cap limits how often you may POINT a monster at someone, but this cap
+// protects the target from being boss'd, and a boss that never found them is not
+// something they need protecting from. Counting it would let a friendly buyer burn
+// the target's weekly boss slot for the price of a fizzle rake.
+func mischiefBossCountSince(targetID id.UserID, since time.Time) int {
+	var n int
+	_ = db.Get().QueryRow(
+		`SELECT COUNT(*) FROM mischief_contracts
+		  WHERE target_id = ? AND tier = 'boss' AND created_at > ? AND status != ?`,
+		string(targetID), since, mischiefStatusFizzled).Scan(&n)
+	return n
+}
+
+// ── Eligibility ──────────────────────────────────────────────────────────────
+
+// mischiefTargetable reports why a target can't be sent a monster, or "" if they
+// can. The active expedition is the whole premise: the monster has to have
+// somewhere to walk in from.
+func (p *AdventurePlugin) mischiefTargetable(targetID id.UserID, tier mischiefTier, now time.Time) string {
+	dndChar, err := LoadDnDCharacter(targetID)
+	if err != nil || dndChar == nil {
+		return fmt.Sprintf("%s has no adventurer.", p.DisplayName(targetID))
+	}
+	// A dead character can still own an 'active' expedition row — that drift is
+	// exactly what the ambient ticker keeps a run-liveness net for. Don't sell a
+	// hit on a corpse.
+	if advChar, err := loadAdvCharacter(targetID); err != nil || advChar == nil || !advChar.Alive {
+		return fmt.Sprintf("%s is in no state to be attacked. Leave them be.", p.DisplayName(targetID))
+	}
+	if dndChar.Level < mischiefMinLevel {
+		return fmt.Sprintf("%s is only level %d — nobody's putting a price on a rookie's head (level %d+).",
+			p.DisplayName(targetID), dndChar.Level, mischiefMinLevel)
+	}
+	exp, err := getActiveExpedition(targetID)
+	if err != nil || exp == nil {
+		return fmt.Sprintf("%s isn't out on an expedition. Monsters don't do house calls.",
+			p.DisplayName(targetID))
+	}
+	if c := liveMischiefForTarget(targetID); c != nil {
+		return fmt.Sprintf("Somebody already has coin on %s. Wait for it to land.", p.DisplayName(targetID))
+	}
+	if cooling, wait := mischiefTargetCoolingDown(targetID, now); cooling {
+		return fmt.Sprintf("%s has only just shaken one off. Try again %s.",
+			p.DisplayName(targetID), formatDuration(wait))
+	}
+	if tier.Key == "boss" && mischiefBossCountSince(targetID, now.Add(-mischiefBossPerTargetWindow)) > 0 {
+		return fmt.Sprintf("%s has already had a boss sent after them this week. Once is plenty.",
+			p.DisplayName(targetID))
+	}
+	return ""
+}
+
+// ── Command surface ──────────────────────────────────────────────────────────
+
+func (p *AdventurePlugin) handleMischiefCmd(ctx MessageContext, args string) error {
+	fields := strings.Fields(strings.TrimSpace(args))
+	if len(fields) == 0 {
+		return p.SendReply(ctx.RoomID, ctx.EventID, p.mischiefBoard())
+	}
+	switch strings.ToLower(fields[0]) {
+	case "board", "tiers", "help":
+		return p.SendReply(ctx.RoomID, ctx.EventID, p.mischiefBoard())
+	case "status":
+		return p.mischiefStatusCmd(ctx)
+	case "send":
+		return p.mischiefSendCmd(ctx, fields[1:])
+	default:
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"Unknown option. `!mischief` for the board · `!mischief send <tier> @user` · `!mischief status`")
+	}
+}
+
+func (p *AdventurePlugin) mischiefBoard() string {
+	var b strings.Builder
+	b.WriteString("😈 **Mischief Makers** — put coin on an adventurer's head while they're out in a dungeon.\n")
+	b.WriteString("The monster comes from their own bracket, so it's always a fight worth watching. ")
+	b.WriteString("If they survive it, they keep a cut of your money — and the town finds out it was you.\n\n")
+	for _, t := range mischiefTiers {
+		b.WriteString(fmt.Sprintf("· **%s** — %s (signed: %s) — survivor keeps %s\n   _%s_\n",
+			t.Display, fmtEuro(t.Fee), fmtEuro(mischiefSignedFee(t.Fee)),
+			fmtEuro(mischiefPurse(t.Fee, t.PayoutPct)), t.Blurb))
+	}
+	b.WriteString("\n`!mischief send <tier> @user` — anonymous · add `signed` to put your name on it up front.\n")
+	b.WriteString(fmt.Sprintf("_They have to be out on an expedition, level %d+. It lands about %s later._",
+		mischiefMinLevel, formatDuration(mischiefWindow)))
+	return b.String()
+}
+
+func (p *AdventurePlugin) mischiefStatusCmd(ctx MessageContext) error {
+	if c := liveMischiefForTarget(ctx.Sender); c != nil {
+		t, _ := mischiefTierByKey(c.Tier)
+		who := "Someone"
+		if c.Signed {
+			who = "**" + p.DisplayName(c.BuyerID) + "**"
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"😈 %s has paid for a **%s** to find you. It arrives %s. Survive it and you keep %s.",
+			who, strings.ToLower(t.Display), formatDuration(time.Until(c.WindowEndsAt)),
+			fmtEuro(mischiefPurse(c.Fee, t.PayoutPct))))
+	}
+	rows, err := db.Get().Query(
+		`SELECT `+mischiefCols+` FROM mischief_contracts
+		  WHERE buyer_id = ? AND status IN (?, ?) ORDER BY created_at DESC`,
+		string(ctx.Sender), mischiefStatusOpen, mischiefStatusDelivering)
+	if err == nil {
+		defer rows.Close()
+		var lines []string
+		for rows.Next() {
+			if c, err := scanMischief(rows); err == nil {
+				lines = append(lines, fmt.Sprintf("· a **%s** for **%s**, landing %s",
+					c.Tier, p.DisplayName(c.TargetID), formatDuration(time.Until(c.WindowEndsAt))))
+			}
+		}
+		if len(lines) > 0 {
+			return p.SendReply(ctx.RoomID, ctx.EventID,
+				"😈 **Your contracts in flight**\n"+strings.Join(lines, "\n"))
+		}
+	}
+	return p.SendReply(ctx.RoomID, ctx.EventID,
+		"Nothing out on you, and nothing out from you. `!mischief` for the board.")
+}
+
+func (p *AdventurePlugin) mischiefSendCmd(ctx MessageContext, fields []string) error {
+	if len(fields) < 2 {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"Usage: `!mischief send <grunt|mob|elite|boss> @user [signed]`")
+	}
+	tier, ok := mischiefTierByKey(fields[0])
+	if !ok {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"That's not a tier. Try `grunt`, `mob`, `elite` or `boss` — `!mischief` for the board.")
+	}
+	targetID, ok := p.ResolveUser(fields[1], ctx.RoomID)
+	if !ok {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"Could not resolve that user. Usage: `!mischief send <tier> @user`")
+	}
+	if targetID == ctx.Sender {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"You can't put a price on your own head. Get help elsewhere.")
+	}
+	signed := len(fields) > 2 && strings.EqualFold(fields[2], "signed")
+
+	// Serialise this buyer's placement so a double-submit can't pass the daily
+	// cap twice and double-debit — same discipline as the duel escrow.
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	now := time.Now().UTC()
+	if n := mischiefBuyerCountSince(ctx.Sender, now.Add(-24*time.Hour)); n >= mischiefBuyerDailyCap {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"You've already sent %d monsters today. Even mischief keeps office hours.", n))
+	}
+	if reason := p.mischiefTargetable(targetID, tier, now); reason != "" {
+		return p.SendReply(ctx.RoomID, ctx.EventID, reason)
+	}
+
+	price := tier.Fee
+	if signed {
+		price = mischiefSignedFee(tier.Fee)
+	}
+	if bal := p.euro.GetBalance(ctx.Sender); int(bal) < price {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"A %s runs %s — you have %s.", strings.ToLower(tier.Display), fmtEuro(price), fmtEuro(int(bal))))
+	}
+	if !p.euro.Debit(ctx.Sender, float64(price), "mischief_contract") {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't take your money. Try again.")
+	}
+
+	c := &mischiefContract{
+		ID:           uuid.NewString(),
+		BuyerID:      ctx.Sender,
+		TargetID:     targetID,
+		Tier:         tier.Key,
+		Fee:          tier.Fee,
+		Paid:         price,
+		Status:       mischiefStatusOpen,
+		Signed:       signed,
+		Source:       "matrix",
+		CreatedAt:    now,
+		WindowEndsAt: now.Add(mischiefWindow),
+	}
+	// The one-live-contract-per-target index is the real guard: the check above
+	// ran under this buyer's lock, and another buyer could have slipped a contract
+	// onto the same target since. Losing that race costs the buyer nothing.
+	if err := insertMischiefContract(c); err != nil {
+		p.euro.Credit(ctx.Sender, float64(price), "mischief_refund_contested")
+		slog.Warn("mischief: contract insert rejected",
+			"buyer", ctx.Sender, "target", targetID, "err", err)
+		// Refund either way, but don't tell a buyer a rival outbid them when the
+		// write simply failed — they'd stop retrying and believe in a contract that
+		// does not exist. The index is the only thing that legitimately rejects here.
+		if liveMischiefForTarget(targetID) != nil {
+			return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+				"Somebody beat you to **%s** — there's already a monster on the way. You've been refunded.",
+				p.DisplayName(targetID)))
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"The contract didn't take — something went wrong on our end. You've been refunded; try again.")
+	}
+
+	p.announceMischiefContract(c, tier)
+	emitMischiefContractNews(c, tier)
+
+	return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+		"😈 Done. A **%s** is on its way to **%s** — it finds them in about %s.\n%s",
+		strings.ToLower(tier.Display), p.DisplayName(targetID), formatDuration(mischiefWindow),
+		mischiefBuyerNote(signed)))
+}
+
+func mischiefBuyerNote(signed bool) string {
+	if signed {
+		return "_Your name is on it. Everyone already knows._"
+	}
+	return "_Nobody knows it was you — unless they walk away from it._"
+}
+
+// ── Announcements ────────────────────────────────────────────────────────────
+
+// announceMischiefContract tells the games room a hit is out. The buyer is named
+// only if they paid to sign it; otherwise this is the whole point of the window —
+// the room knows someone did it and doesn't know who.
+func (p *AdventurePlugin) announceMischiefContract(c *mischiefContract, tier mischiefTier) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	who := "**Someone in town**"
+	if c.Signed {
+		who = fmt.Sprintf("**%s**", p.DisplayName(c.BuyerID))
+	}
+	p.SendMessage(gr, fmt.Sprintf(
+		"😈 %s has put %s on **%s**'s head — a **%s** is already looking for them out there.\n"+
+			"It finds them in about %s. If they walk away from it, they keep %s of that money — and we all find out who paid.",
+		who, fmtEuro(c.Paid), p.DisplayName(c.TargetID), strings.ToLower(tier.Display),
+		formatDuration(time.Until(c.WindowEndsAt)), fmtEuro(mischiefPurse(c.Fee, tier.PayoutPct))))
+}
+
+func (p *AdventurePlugin) announceMischiefSurvived(c *mischiefContract, monsterName string, purse int) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	// The unseal. Anonymity is the buyer's to lose, and losing it is what makes
+	// a survival worth announcing.
+	p.SendMessage(gr, fmt.Sprintf(
+		"🛡️ **%s walked away from it.** The **%s** that came for them is dead, and %s is %s richer for the trouble.\n"+
+			"The coin came from **%s**.",
+		p.DisplayName(c.TargetID), monsterName, p.DisplayName(c.TargetID), fmtEuro(purse),
+		p.DisplayName(c.BuyerID)))
+}
+
+func (p *AdventurePlugin) announceMischiefDowned(c *mischiefContract, monsterName string) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	who := "Whoever paid for it"
+	if c.Signed {
+		who = fmt.Sprintf("**%s**, who paid for it,", p.DisplayName(c.BuyerID))
+	}
+	p.SendMessage(gr, fmt.Sprintf(
+		"💀 **%s didn't walk away.** A **%s** found them mid-run and put them on the floor. "+
+			"They're being carried home — expedition over, pockets lighter.\n%s keeps nothing: the money's gone to the community pot.",
+		p.DisplayName(c.TargetID), monsterName, who))
+}
+
+// ── Pete news ────────────────────────────────────────────────────────────────
+//
+// Deploy Pete BEFORE gogobee whenever these types change: Pete 400s an unknown
+// event_type, gogobee retries, and the bulletin parks forever.
+
+func emitMischiefContractNews(c *mischiefContract, tier mischiefTier) {
+	target := charName(c.TargetID)
+	if target == "" {
+		return
+	}
+	buyer := ""
+	buyerUser := id.UserID("")
+	if c.Signed {
+		buyer = charName(c.BuyerID)
+		buyerUser = c.BuyerID
+	}
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("mischief_contract:%s:%d", eventToken(c.TargetID, "mischief:"+c.ID), ts),
+		EventType:  "mischief_contract",
+		Tier:       "priority",
+		Subject:    target,
+		Opponent:   buyer,
+		Boss:       tier.Display,
+		Stakes:     fmtEuro(c.Paid),
+		Level:      charLevel(c.TargetID),
+		OccurredAt: ts,
+	}, c.TargetID, buyerUser)
+}
+
+// emitMischiefResolvedNews files the survival or the maiming. On a survival the
+// buyer is named whether or not they signed — that is the unseal, and it is the
+// only brake on casual griefing. (`!news optout` still anonymizes them to "an
+// adventurer", as it does everywhere else.)
+func emitMischiefResolvedNews(c *mischiefContract, monsterName, outcome string, purse int) {
+	target := charName(c.TargetID)
+	if target == "" {
+		return
+	}
+	eventType := "mischief_downed"
+	buyer, buyerUser := "", id.UserID("")
+	if outcome == mischiefOutcomeSurvived {
+		eventType = "mischief_survived"
+		buyer, buyerUser = charName(c.BuyerID), c.BuyerID
+	} else if c.Signed {
+		buyer, buyerUser = charName(c.BuyerID), c.BuyerID
+	}
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("%s:%s:%d", eventType, eventToken(c.TargetID, "mischief:"+c.ID), ts),
+		EventType:  eventType,
+		Tier:       "priority",
+		Subject:    target,
+		Opponent:   buyer,
+		Boss:       monsterName,
+		Stakes:     fmtEuro(purse),
+		Level:      charLevel(c.TargetID),
+		Outcome:    outcome,
+		OccurredAt: ts,
+	}, c.TargetID, buyerUser)
+}
+
+func emitMischiefFizzledNews(c *mischiefContract, refund int) {
+	target := charName(c.TargetID)
+	if target == "" {
+		return
+	}
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("mischief_fizzled:%s:%d", eventToken(c.TargetID, "mischief:"+c.ID), ts),
+		EventType:  "mischief_fizzled",
+		Tier:       "bulletin",
+		Subject:    target,
+		Stakes:     fmtEuro(refund),
+		Outcome:    "fizzled",
+		OccurredAt: ts,
+	}, c.TargetID, "")
+}
+
+// mischiefContractByID is the test/ops read path.
+func mischiefContractByID(contractID string) (*mischiefContract, error) {
+	row := db.Get().QueryRow(
+		`SELECT `+mischiefCols+` FROM mischief_contracts WHERE contract_id = ?`, contractID)
+	c, err := scanMischief(row)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	return c, err
+}

internal/plugin/adventure_mischief_deliver.go

@@ -0,0 +1,445 @@
+package plugin
+
+// Mischief Makers (M1) — delivery.
+//
+// The sibling of the ambient ticker: once a contract's window closes, the
+// monster has to actually find the target mid-run. runMischiefInterrupt is
+// modelled line-for-line on runHarvestInterrupt (pick enemy → ambush nick →
+// runZoneCombatRoster → close out), with two deliberate departures:
+//
+//   - It never calls recordZoneKill and never advances zone state. The fight is
+//     extrinsic to the dungeon: somebody bought it, the dungeon didn't send it.
+//     Crediting it as a zone kill would let a buyer unlock a target's
+//     RequiresKill resource gates for them.
+//
+//   - It never marks anybody dead. runHarvestInterrupt's loss path perma-kills;
+//     a *purchased* attack that lands while its victim is asleep must not be
+//     able to delete their character. Mischief maims: floor at 1 HP,
+//     force-extract, take a bite out of the un-banked coins.
+
+import (
+	"fmt"
+	"log/slog"
+	"math/rand/v2"
+	"strings"
+	"time"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// mischiefTickInterval — how often we look for contracts whose window has
+// closed. The window itself is the pacing; the tick just has to be fine-grained
+// enough that "about an hour" isn't a lie.
+const mischiefTickInterval = time.Minute
+
+// mischiefDeliveryGrace — how long past its window a contract may sit in
+// `delivering` before the sweep calls it stranded. Comfortably longer than any
+// chain of auto-resolved fights takes, so a slow delivery is never swept out
+// from under itself (and the CAS in abandonStaleMischief is the backstop if it
+// somehow is).
+const mischiefDeliveryGrace = 15 * time.Minute
+
+// mischiefTreasureWeight / mischiefRenownXP — the survival extras. Deliberately
+// modest: the purse is the reward, this is the garnish.
+const (
+	mischiefTreasureWeight = 1.0
+	mischiefEliteRenownXP  = 40
+	mischiefBossRenownXP   = 120
+	mischiefBossCacheSize  = 2
+)
+
+func (p *AdventurePlugin) mischiefTicker() {
+	ticker := time.NewTicker(mischiefTickInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-ticker.C:
+			p.fireMischiefDeliveries(time.Now().UTC())
+		}
+	}
+}
+
+// fireMischiefDeliveries walks contracts whose window has closed and either
+// delivers the monster or fizzles the contract.
+//
+// The gates mirror the ambient ticker's, for the same reason: a mid-run event
+// that talks over a live turn-based fight, or lands on top of the 06:00
+// briefing, reads as a bug even when it isn't. A blocked contract is NOT
+// fizzled — it simply waits for the next tick. The only thing that fizzles a
+// contract is the expedition ending, which is what the buyer was actually
+// betting against.
+func (p *AdventurePlugin) fireMischiefDeliveries(now time.Time) {
+	if inAmbientQuietWindow(now) {
+		return
+	}
+	p.sweepStaleMischief(now)
+	for _, c := range loadMischiefDue(now) {
+		contract := c
+		p.fireOneMischiefDelivery(&contract)
+	}
+}
+
+// fireOneMischiefDelivery resolves a single due contract under the TARGET's lock.
+//
+// The lock is not optional. hasActiveCombatSession only sees the turn-based
+// engine; the target's own `!explore` / autopilot walk resolves its fights
+// inline (runHarvestInterrupt → runZoneCombatRoster) under advUserLock and
+// reports no session. Without taking that same lock, a delivery can run a second
+// combat against the same character sheet concurrently — two LoadDnDCharacter →
+// mutate → SaveDnDCharacter writers, last write wins, and a whole fight's HP cost
+// vanishes. The boredom ticker takes this lock for exactly this reason.
+//
+// Everything below the lock runs on the auto-resolve path, which takes no user
+// locks of its own, so there is nothing here to deadlock against.
+func (p *AdventurePlugin) fireOneMischiefDelivery(contract *mischiefContract) {
+	target := contract.TargetID
+
+	lock := p.advUserLock(target)
+	lock.Lock()
+	defer lock.Unlock()
+
+	// Re-read under the lock: whatever the due-sweep saw, the expedition may have
+	// ended while we were queuing behind the target's own command.
+	exp, err := getActiveExpedition(target)
+	if err != nil || exp == nil || exp.Status != ExpeditionStatusActive {
+		p.fizzleMischief(contract)
+		return
+	}
+	// Same safety net the ambient ticker keeps: the expedition row can still
+	// say 'active' after the player has functionally left the dungeon.
+	if exp.RunID != "" {
+		if run, _ := getZoneRun(exp.RunID); run == nil || !run.IsActive() {
+			p.fizzleMischief(contract)
+			return
+		}
+	}
+	if hasActiveCombatSession(target) {
+		return // they're mid-fight; the monster can wait a minute
+	}
+	if !claimMischiefForDelivery(contract.ID) {
+		return // another tick (or another process) already has it
+	}
+	if err := p.deliverMischief(contract, exp); err != nil {
+		slog.Error("mischief: delivery failed",
+			"contract", contract.ID, "target", target, "err", err)
+	}
+}
+
+// sweepStaleMischief releases contracts stranded in `delivering` — the process
+// died between the claim and the close-out (a restart mid-fight, a panic). The
+// row would otherwise be immortal: the target can never be targeted again, and
+// the buyer's money never comes back.
+//
+// The buyer is made whole in full rather than rake-charged. A stranded delivery
+// is our crash, not a bet they lost.
+func (p *AdventurePlugin) sweepStaleMischief(now time.Time) {
+	for _, c := range loadStaleMischiefDeliveries(now.Add(-mischiefDeliveryGrace)) {
+		contract := c
+		if !abandonStaleMischief(contract.ID) {
+			continue
+		}
+		p.euro.Credit(contract.BuyerID, float64(contract.Paid), "mischief_refund_stranded")
+		p.SendDM(contract.BuyerID, fmt.Sprintf(
+			"😾 Your **%s** never reached **%s** — something went wrong on our end. Fully refunded: %s.",
+			contract.Tier, p.DisplayName(contract.TargetID), fmtEuro(contract.Paid)))
+		slog.Warn("mischief: swept stranded delivery",
+			"contract", contract.ID, "target", contract.TargetID)
+	}
+}
+
+// fizzleMischief refunds the buyer (minus the rake) when the monster arrives to
+// an empty dungeon. The CAS is what makes the refund safe: a contract that was
+// simultaneously claimed for delivery cannot also be refunded here.
+func (p *AdventurePlugin) fizzleMischief(c *mischiefContract) {
+	if !fizzleMischiefContract(c.ID) {
+		return
+	}
+	refund := int(float64(c.Paid) * mischiefFizzleRefund)
+	rake := c.Paid - refund
+	if refund > 0 {
+		p.euro.Credit(c.BuyerID, float64(refund), "mischief_fizzle_refund")
+	}
+	if rake > 0 {
+		communityPotAdd(rake)
+		trackTaxPaid(c.BuyerID, rake)
+	}
+	p.SendDM(c.BuyerID, fmt.Sprintf(
+		"😾 Your **%s** got to the dungeon and found nobody home — **%s** was already out of there.\n"+
+			"You're refunded %s. The other %s stays with the town, for its trouble.",
+		c.Tier, p.DisplayName(c.TargetID), fmtEuro(refund), fmtEuro(rake)))
+	emitMischiefFizzledNews(c, refund)
+}
+
+// deliverMischief runs the purchased fight and closes it out. By the time this
+// is called the contract is claimed, so it resolves exactly once.
+func (p *AdventurePlugin) deliverMischief(c *mischiefContract, exp *Expedition) error {
+	tier, ok := mischiefTierByKey(c.Tier)
+	if !ok {
+		return fmt.Errorf("unknown mischief tier %q", c.Tier)
+	}
+	target := c.TargetID
+
+	dndChar, err := LoadDnDCharacter(target)
+	if err != nil || dndChar == nil {
+		// The target evaporated between claim and delivery. Nothing to attack —
+		// treat it as a fizzle so the buyer isn't charged for a no-show.
+		p.refundClaimedMischief(c, "target has no character")
+		return nil
+	}
+
+	// The attacker comes from the target's own bracket, not the dungeon they are
+	// standing in. See mischiefBracketZones.
+	bracket := mischiefBracketZone(dndChar.Level)
+	rng := rand.New(rand.NewPCG(rand.Uint64(), rand.Uint64()))
+	chain, ambush := mischiefMonsters(tier.Key, bracket, rng)
+	// Every link, not just the first: a zone-pool entry with no bestiary row
+	// yields a zero-value template, and a nameless 0-HP monster as fight 2 of a
+	// mob would read as the attack inexplicably giving up halfway.
+	if len(chain) == 0 {
+		p.refundClaimedMischief(c, "no monster available")
+		return nil
+	}
+	for _, m := range chain {
+		if m.Name == "" {
+			p.refundClaimedMischief(c, "bestiary miss in the "+bracket.Display+" pool")
+			return nil
+		}
+	}
+
+	narration, monsterName, survived := p.runMischiefInterrupt(target, exp, bracket, chain, ambush)
+
+	if survived {
+		p.resolveMischiefSurvived(c, tier, exp, bracket, monsterName, narration)
+	} else {
+		p.resolveMischiefDowned(c, exp, monsterName, narration)
+	}
+	return nil
+}
+
+// refundClaimedMischief unwinds a contract that was already claimed for delivery
+// but couldn't be staged. The buyer gets everything back — this is our fault,
+// not a fizzle they gambled on.
+func (p *AdventurePlugin) refundClaimedMischief(c *mischiefContract, reason string) {
+	resolveMischiefContract(c.ID, mischiefStatusFizzled, mischiefStatusFizzled)
+	p.euro.Credit(c.BuyerID, float64(c.Paid), "mischief_refund_unstageable")
+	p.SendDM(c.BuyerID, fmt.Sprintf(
+		"😾 Your **%s** never made it out of the gate. Fully refunded: %s.", c.Tier, fmtEuro(c.Paid)))
+	slog.Warn("mischief: contract unstageable", "contract", c.ID, "reason", reason)
+}
+
+// runMischiefInterrupt fights the whole chain and reports whether the target was
+// still standing at the end.
+//
+// Survival is read off the target's HP, not off PlayerWon. The engine's timeout
+// is a retreat, not a lethal blow — a target who ran out the clock with HP left
+// held the thing off, and a bought monster that merely *outlasted* them has not
+// earned a maiming. The chain continues while they stand: a mob is three
+// attackers, and beating the first two doesn't mean the third goes home.
+func (p *AdventurePlugin) runMischiefInterrupt(
+	target id.UserID,
+	exp *Expedition,
+	bracket ZoneDefinition,
+	chain []DnDMonsterTemplate,
+	ambush bool,
+) (narration, monsterName string, survived bool) {
+	var b strings.Builder
+	last := chain[len(chain)-1].Name
+
+	for i, monster := range chain {
+		// The ambush is the attacker's privilege — it was lying in wait, and the
+		// target had no reason to expect it. Same one-free-swing approximation the
+		// harvest interrupt uses, with the same wounded-entrant clamp so it can't
+		// pre-empt the fight outright.
+		if ambush && i == 0 {
+			if dc, _ := LoadDnDCharacter(target); dc != nil {
+				nick := clampSurpriseNick(
+					surpriseRoundNick(monster, int(bracket.Tier)), dc.HPCurrent, dc.HPMax)
+				if nick > 0 {
+					dc.HPCurrent -= nick
+					_ = SaveDnDCharacter(dc)
+					b.WriteString(fmt.Sprintf(
+						"_It was waiting for you. **%s** opens with a free swing — %d HP._\n",
+						monster.Name, nick))
+				}
+			}
+		}
+
+		preHP, _ := dndHPSnapshot(target)
+		pres, _, err := p.runZoneCombatRoster(
+			fightRoster(target), monster, int(bracket.Tier), dungeonCombatPhases, exp.DMMood)
+		if err != nil {
+			// Mid-chain build failure. The target keeps whatever HP they had; treat
+			// them as having survived rather than maiming them on our bug.
+			slog.Error("mischief: combat error", "target", target, "err", err)
+			b.WriteString(fmt.Sprintf("_(The %s never quite arrives.)_\n", monster.Name))
+			return b.String(), last, true
+		}
+		postHP, maxHP := dndHPSnapshot(target)
+
+		b.WriteString(fmt.Sprintf("⚔️ **%s** (HP %d, AC %d)\n", monster.Name, monster.HP, monster.AC))
+		switch {
+		case pres.Seats[0].PlayerWon:
+			b.WriteString(fmt.Sprintf("✅ **%s** down — %d→%d / %d HP.\n",
+				monster.Name, preHP, postHP, maxHP))
+		case postHP > 0:
+			// The engine's timeout: they held it off without killing it. That still
+			// pays — but say so plainly, or a stalemate reads as a clean kill and the
+			// player wonders why the thing is still following them.
+			b.WriteString(fmt.Sprintf("⏳ **%s** breaks off, still breathing. You're at %d / %d HP.\n",
+				monster.Name, postHP, maxHP))
+		}
+		if postHP <= 0 {
+			return b.String(), monster.Name, false
+		}
+		if i < len(chain)-1 {
+			b.WriteString("_And it isn't alone._\n")
+		}
+	}
+	return b.String(), last, true
+}
+
+// floorMischiefRoster raises every seat the delivery put on the floor back to
+// 1 HP. It runs on BOTH outcomes, and that is not belt-and-braces: the leader
+// can win a fight their friend went down in, and a mischief delivery
+// deliberately skips closeOutZoneWin/closeOutZoneLoss (which is what normally
+// marks a 0-HP seat dead). Without this, a dropped party member is left alive at
+// 0 HP — a state nothing else in the game produces, and one the gates that read
+// `HPCurrent <= 0` (expedition autorun, for one) treat as broken rather than
+// dead. Nobody dies for money; nobody gets stuck at zero for it either.
+func (p *AdventurePlugin) floorMischiefRoster(target id.UserID) {
+	for _, uid := range fightRoster(target) {
+		if isCompanionSeat(uid) {
+			continue // he takes no wounds home; he has no rows to floor
+		}
+		floorHPAtOne(uid)
+	}
+}
+
+// resolveMischiefSurvived pays the target and unseals the buyer.
+//
+// The purse is a percentage of the base fee — never of what the buyer paid — so
+// it is always strictly less than the buyer's outlay. See mischiefPurse.
+func (p *AdventurePlugin) resolveMischiefSurvived(
+	c *mischiefContract, tier mischiefTier, exp *Expedition, bracket ZoneDefinition,
+	monsterName, narration string,
+) {
+	// The leader lived; a friend of theirs may not have. See floorMischiefRoster.
+	p.floorMischiefRoster(c.TargetID)
+
+	purse := mischiefPurse(c.Fee, tier.PayoutPct)
+	p.euro.Credit(c.TargetID, float64(purse), "mischief_survived")
+
+	// Everything the buyer spent that isn't the purse — the rake, plus the whole
+	// sign surcharge — is a sink. That is what makes the payout cap bite.
+	if rake := c.Paid - purse; rake > 0 {
+		communityPotAdd(rake)
+		trackTaxPaid(c.BuyerID, rake)
+	}
+
+	// Extras by tier. Treasure rolls against the zone they're actually in — the
+	// loot is scavenged off a corpse in that dungeon, wherever the thing came from.
+	var extras []string
+	switch tier.Key {
+	case "mob":
+		p.rollZoneTreasure(c.TargetID, exp.ZoneID, mischiefTreasureWeight)
+	case "elite":
+		p.rollZoneTreasure(c.TargetID, exp.ZoneID, mischiefTreasureWeight)
+		if before, after, err := addRenownXP(c.TargetID, mischiefEliteRenownXP); err == nil {
+			p.announceRenown(c.TargetID, renownLevelFor(before), renownLevelFor(after))
+			extras = append(extras, "The story of it is already going round town.")
+		}
+	case "boss":
+		p.rollZoneTreasure(c.TargetID, exp.ZoneID, mischiefTreasureWeight)
+		if before, after, err := addRenownXP(c.TargetID, mischiefBossRenownXP); err == nil {
+			p.announceRenown(c.TargetID, renownLevelFor(before), renownLevelFor(after))
+			extras = append(extras, "People are going to be telling this one for a while.")
+		}
+		for _, item := range consumableCache(int(bracket.Tier), mischiefBossCacheSize) {
+			it := item
+			p.grantZoneItem(c.TargetID, &it, "🧪")
+		}
+	}
+
+	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeSurvived)
+
+	var dm strings.Builder
+	dm.WriteString("😈 **Somebody paid for that.**\n\n")
+	dm.WriteString(narration)
+	dm.WriteString(fmt.Sprintf(
+		"\n🛡️ You're still standing, and the coin was never really theirs. **%s** is yours.\n",
+		fmtEuro(purse)))
+	dm.WriteString(fmt.Sprintf("It was **%s** who paid to have you killed. Do with that what you like.",
+		p.DisplayName(c.BuyerID)))
+	for _, e := range extras {
+		dm.WriteString("\n_" + e + "_")
+	}
+	p.SendDM(c.TargetID, dm.String())
+
+	p.SendDM(c.BuyerID, fmt.Sprintf(
+		"🛡️ **%s walked away from your %s.** They keep %s of your money, and the town knows your name now.",
+		p.DisplayName(c.TargetID), c.Tier, fmtEuro(purse)))
+
+	p.announceMischiefSurvived(c, monsterName, purse)
+	emitMischiefResolvedNews(c, monsterName, mischiefOutcomeSurvived, purse)
+}
+
+// resolveMischiefDowned maims the target: HP floored at 1, expedition
+// force-extracted, un-banked coins docked. Nobody dies for money.
+//
+// The whole fee goes to the community pot — never back to the buyer. A
+// successful hit buys glory, not a rebate; refunding it would make repeat
+// contracts free and turn the cap into a rounding error.
+func (p *AdventurePlugin) resolveMischiefDowned(
+	c *mischiefContract, exp *Expedition, monsterName, narration string,
+) {
+	// Every seat, not just the leader: a party that went down with them went down
+	// to a bought monster too, and the no-perma-death rule is about the purchase,
+	// not about who was holding the torch. Must run BEFORE the extract, which
+	// releases the party and would leave us nobody to floor.
+	p.floorMischiefRoster(c.TargetID)
+
+	// forcedExtractExpedition retires the region runs and releases the party itself;
+	// only the zone run has to be closed here.
+	_ = abandonZoneRun(c.TargetID)
+	_, tax, err := forcedExtractExpedition(exp.ID, "mischief contract")
+	if err != nil {
+		slog.Warn("mischief: force extract failed", "expedition", exp.ID, "err", err)
+	}
+	// The un-banked-coin loss. forcedExtractExpedition computes the 20% cut and
+	// leaves the debit to the caller; for a maiming, this is the caller.
+	if tax > 0 {
+		p.euro.Debit(c.TargetID, float64(tax), "mischief_downed_loss")
+	}
+
+	communityPotAdd(c.Paid)
+	trackTaxPaid(c.BuyerID, c.Paid)
+
+	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeDowned)
+
+	var dm strings.Builder
+	dm.WriteString("😈 **Somebody paid for that.**\n\n")
+	dm.WriteString(narration)
+	dm.WriteString(fmt.Sprintf(
+		"\n💀 **%s** put you down. You wake up on a cart headed home — alive, which is more than the contract asked for.\n",
+		monsterName))
+	dm.WriteString("Your expedition is over.")
+	if tax > 0 {
+		dm.WriteString(fmt.Sprintf(" Whatever you hadn't banked yet is gone — %s of it.", fmtEuro(tax)))
+	}
+	if c.Signed {
+		dm.WriteString(fmt.Sprintf("\n\nThe contract was signed: **%s** paid for it.", p.DisplayName(c.BuyerID)))
+	} else {
+		dm.WriteString("\n\nNobody's saying who paid.")
+	}
+	p.SendDM(c.TargetID, dm.String())
+
+	p.SendDM(c.BuyerID, fmt.Sprintf(
+		"💀 Your **%s** found **%s** and put them on the floor. Their expedition is over.\n"+
+			"_You get nothing back — %s went to the community pot. You did this for the story._",
+		c.Tier, p.DisplayName(c.TargetID), fmtEuro(c.Paid)))
+
+	p.announceMischiefDowned(c, monsterName)
+	emitMischiefResolvedNews(c, monsterName, mischiefOutcomeDowned, 0)
+}

internal/plugin/adventure_mischief_test.go

@@ -0,0 +1,564 @@
+package plugin
+
+import (
+	"math/rand/v2"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"github.com/google/uuid"
+	"maunium.net/go/mautrix/id"
+)
+
+func newMischiefTestDB(t *testing.T) {
+	t.Helper()
+	db.Close()
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+func seedContract(t *testing.T, buyer, target id.UserID, tier string, signed bool) *mischiefContract {
+	t.Helper()
+	td, ok := mischiefTierByKey(tier)
+	if !ok {
+		t.Fatalf("unknown tier %q", tier)
+	}
+	paid := td.Fee
+	if signed {
+		paid = mischiefSignedFee(td.Fee)
+	}
+	c := &mischiefContract{
+		ID:           uuid.NewString(),
+		BuyerID:      buyer,
+		TargetID:     target,
+		Tier:         td.Key,
+		Fee:          td.Fee,
+		Paid:         paid,
+		Status:       mischiefStatusOpen,
+		Signed:       signed,
+		Source:       "matrix",
+		CreatedAt:    time.Now().UTC(),
+		WindowEndsAt: time.Now().UTC().Add(mischiefWindow),
+	}
+	if err := insertMischiefContract(c); err != nil {
+		t.Fatalf("seed contract (%s → %s): %v", buyer, target, err)
+	}
+	return c
+}
+
+// The anti-collusion invariant, and the only reason no danger multiplier is
+// needed: whatever the tier and whether or not the buyer signed, the target's
+// survival purse is strictly less than what the buyer parted with. Two players
+// who try to move money this way lose to !baltransfer, which is free.
+func TestMischiefPurseNeverExceedsOutlay(t *testing.T) {
+	for _, tier := range mischiefTiers {
+		purse := mischiefPurse(tier.Fee, tier.PayoutPct)
+		for _, paid := range []int{tier.Fee, mischiefSignedFee(tier.Fee)} {
+			if purse >= paid {
+				t.Errorf("%s: purse %d >= buyer outlay %d — collusion beats !baltransfer",
+					tier.Key, purse, paid)
+			}
+		}
+		if tier.PayoutPct > 0.75 {
+			t.Errorf("%s: payout %.2f exceeds the 75%% cap", tier.Key, tier.PayoutPct)
+		}
+	}
+}
+
+// The cap is enforced in code, not just in the table — an escalation (M2) raises
+// the payout basis, and nothing it can do may push the purse past 75%.
+func TestMischiefPurseHardCap(t *testing.T) {
+	if got := mischiefPurse(1000, 0.95); got != 750 {
+		t.Fatalf("mischiefPurse(1000, 0.95) = %d, want 750 (capped)", got)
+	}
+}
+
+func TestMischiefSignedFee(t *testing.T) {
+	// The tier table's signed prices, as priced in M0.
+	want := map[string]int{"grunt": 50, "mob": 125, "elite": 438, "boss": 1500}
+	for _, tier := range mischiefTiers {
+		if got := mischiefSignedFee(tier.Fee); got != want[tier.Key] {
+			t.Errorf("%s signed fee = %d, want %d", tier.Key, got, want[tier.Key])
+		}
+	}
+}
+
+// Exactly one of delivery and fizzle may claim a contract, however many ticks
+// race for it. Without this a restart mid-delivery could both maim the target
+// and refund the buyer.
+func TestMischiefClaimIsExactlyOnce(t *testing.T) {
+	newMischiefTestDB(t)
+	c := seedContract(t, "@buyer:x", "@target:x", "elite", false)
+
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("first claim should win")
+	}
+	if claimMischiefForDelivery(c.ID) {
+		t.Error("second claim won — a contract could be delivered twice")
+	}
+	if fizzleMischiefContract(c.ID) {
+		t.Error("fizzle won after the delivery claim — buyer would be refunded a hit that landed")
+	}
+
+	c2 := seedContract(t, "@buyer:x", "@other:x", "grunt", false)
+	if !fizzleMischiefContract(c2.ID) {
+		t.Fatal("first fizzle should win")
+	}
+	if claimMischiefForDelivery(c2.ID) {
+		t.Error("delivery claimed a fizzled contract — buyer would pay twice")
+	}
+}
+
+// Only a closed window is due, and a resolved contract never comes back.
+func TestMischiefDueWindow(t *testing.T) {
+	newMischiefTestDB(t)
+	now := time.Now().UTC()
+	c := seedContract(t, "@buyer:x", "@target:x", "mob", false)
+
+	if due := loadMischiefDue(now); len(due) != 0 {
+		t.Fatalf("contract is due before its window closed: %d", len(due))
+	}
+	due := loadMischiefDue(now.Add(mischiefWindow + time.Minute))
+	if len(due) != 1 || due[0].ID != c.ID {
+		t.Fatalf("want the contract due after its window; got %d", len(due))
+	}
+
+	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeSurvived)
+	if due := loadMischiefDue(now.Add(2 * mischiefWindow)); len(due) != 0 {
+		t.Error("a resolved contract came back around")
+	}
+}
+
+// One live contract per target: two monsters converging on the same person is a
+// mugging, not mischief.
+func TestMischiefOneLiveContractPerTarget(t *testing.T) {
+	newMischiefTestDB(t)
+	target := id.UserID("@target:x")
+	if liveMischiefForTarget(target) != nil {
+		t.Fatal("no contract seeded, but one is live")
+	}
+	c := seedContract(t, "@buyer:x", target, "grunt", false)
+	if live := liveMischiefForTarget(target); live == nil || live.ID != c.ID {
+		t.Fatal("open contract should be live")
+	}
+	// A claimed-but-unresolved contract still blocks — the monster is en route.
+	claimMischiefForDelivery(c.ID)
+	if liveMischiefForTarget(target) == nil {
+		t.Error("a delivering contract should still block a second one")
+	}
+	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeDowned)
+	if liveMischiefForTarget(target) != nil {
+		t.Error("a resolved contract still reads as live")
+	}
+}
+
+// The post-resolution breather. Also the regression guard for the modernc
+// datetime hazard: resolved_at round-trips through the driver's own encoding
+// (bound Go time in, time.Time out), so the row has to be a real one — a
+// hand-written stamp in some other format would compare lexicographically and
+// silently never expire.
+func TestMischiefTargetCooldown(t *testing.T) {
+	newMischiefTestDB(t)
+	target := id.UserID("@target:x")
+	now := time.Now().UTC()
+
+	if cooling, _ := mischiefTargetCoolingDown(target, now); cooling {
+		t.Fatal("a target with no history is cooling down")
+	}
+	c := seedContract(t, "@buyer:x", target, "grunt", false)
+	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeSurvived)
+
+	cooling, wait := mischiefTargetCoolingDown(target, now)
+	if !cooling {
+		t.Fatal("a just-resolved target should be cooling down")
+	}
+	// resolved_at is stamped a hair after `now`, so allow a second of slack.
+	if wait <= 0 || wait > mischiefTargetCooldown+time.Second {
+		t.Errorf("wait = %s, want within (0, %s]", wait, mischiefTargetCooldown)
+	}
+	if cooling, _ := mischiefTargetCoolingDown(target, now.Add(mischiefTargetCooldown+time.Minute)); cooling {
+		t.Error("still cooling down after the cooldown elapsed")
+	}
+}
+
+// Rate limits: contracts per buyer per day, and boss-tier per target per week.
+// Fizzled contracts count against the buyer — the limit is on how often you may
+// point a monster at someone, not on how often it connects.
+func TestMischiefRateLimits(t *testing.T) {
+	newMischiefTestDB(t)
+	buyer := id.UserID("@buyer:x")
+	now := time.Now().UTC()
+	dayAgo := now.Add(-24 * time.Hour)
+
+	if n := mischiefBuyerCountSince(buyer, dayAgo); n != 0 {
+		t.Fatalf("fresh buyer count = %d, want 0", n)
+	}
+	c1 := seedContract(t, buyer, "@a:x", "grunt", false)
+	seedContract(t, buyer, "@b:x", "mob", false)
+	fizzleMischiefContract(c1.ID)
+	if n := mischiefBuyerCountSince(buyer, dayAgo); n != mischiefBuyerDailyCap {
+		t.Errorf("buyer count = %d, want %d (a fizzle still counts)", n, mischiefBuyerDailyCap)
+	}
+
+	target := id.UserID("@whale:x")
+	weekAgo := now.Add(-mischiefBossPerTargetWindow)
+	if n := mischiefBossCountSince(target, weekAgo); n != 0 {
+		t.Fatalf("fresh boss count = %d, want 0", n)
+	}
+	elite := seedContract(t, "@other:x", target, "elite", false)
+	if n := mischiefBossCountSince(target, weekAgo); n != 0 {
+		t.Error("an elite contract counted against the boss-per-week limit")
+	}
+	// Resolve it first: only one contract may be live against a target at a time,
+	// and the database enforces that (idx_mischief_one_live_per_target).
+	resolveMischiefContract(elite.ID, mischiefStatusDelivered, mischiefOutcomeSurvived)
+	seedContract(t, "@other:x", target, "boss", false)
+	if n := mischiefBossCountSince(target, weekAgo); n != 1 {
+		t.Errorf("boss count = %d, want 1", n)
+	}
+}
+
+// The database, not a read-then-write check, is what stops two buyers racing a
+// monster at the same target. The placement path holds only the buyer's lock, so
+// without this index both inserts would land and the target would be hit twice.
+func TestMischiefSecondLiveContractIsRejected(t *testing.T) {
+	newMischiefTestDB(t)
+	target := id.UserID("@target:x")
+	seedContract(t, "@buyer1:x", target, "grunt", false)
+
+	second := &mischiefContract{
+		ID: uuid.NewString(), BuyerID: "@buyer2:x", TargetID: target,
+		Tier: "elite", Fee: 350, Paid: 350, Status: mischiefStatusOpen,
+		Source: "matrix", CreatedAt: time.Now().UTC(),
+		WindowEndsAt: time.Now().UTC().Add(mischiefWindow),
+	}
+	if err := insertMischiefContract(second); err == nil {
+		t.Fatal("a second live contract was accepted — the target can be hit twice at once")
+	}
+}
+
+// A delivery that dies mid-flight (restart, panic) must not strand the contract:
+// the row would block the target forever and the buyer's money would be gone.
+func TestMischiefStaleDeliverySweep(t *testing.T) {
+	newMischiefTestDB(t)
+	now := time.Now().UTC()
+	c := seedContract(t, "@buyer:x", "@target:x", "boss", false)
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("claim should win")
+	}
+
+	// Inside the grace period a slow delivery is left alone.
+	if stale := loadStaleMischiefDeliveries(now.Add(mischiefWindow)); len(stale) != 0 {
+		t.Errorf("a delivery still inside its grace window was called stranded: %d", len(stale))
+	}
+
+	stale := loadStaleMischiefDeliveries(now.Add(mischiefWindow + mischiefDeliveryGrace + time.Minute))
+	if len(stale) != 1 || stale[0].ID != c.ID {
+		t.Fatalf("stranded delivery not found: %d", len(stale))
+	}
+	if !abandonStaleMischief(c.ID) {
+		t.Fatal("abandon should win on a delivering row")
+	}
+	if abandonStaleMischief(c.ID) {
+		t.Error("abandon won twice — the buyer would be refunded twice")
+	}
+	// And the target is free again.
+	if liveMischiefForTarget("@target:x") != nil {
+		t.Error("a swept contract still blocks the target")
+	}
+}
+
+// The monster is priced against the TARGET's bracket, not the dungeon they are
+// standing in — that is what the M0 fee table measured.
+func TestMischiefBracketZones(t *testing.T) {
+	for _, tc := range []struct {
+		level int
+		tier  ZoneTier
+	}{{1, 1}, {3, 1}, {4, 2}, {7, 2}, {8, 3}, {12, 3}, {13, 4}, {17, 4}, {18, 5}, {20, 5}} {
+		zone := mischiefBracketZone(tc.level)
+		if zone.Tier != tc.tier {
+			t.Errorf("level %d draws from tier %d, want %d", tc.level, zone.Tier, tc.tier)
+		}
+	}
+}
+
+// The fight shapes the fee table was priced against. Changing any of these
+// invalidates the pricing, so they are pinned.
+func TestMischiefMonsterChains(t *testing.T) {
+	zone := mischiefBracketZone(10) // tier 3
+	rng := rand.New(rand.NewPCG(0x6d69, 1))
+
+	for _, tc := range []struct {
+		tier       string
+		wantLen    int
+		wantAmbush bool
+	}{
+		{"grunt", 1, false},
+		{"mob", 3, false},
+		{"elite", 1, true},
+		{"boss", 1, true},
+	} {
+		chain, ambush := mischiefMonsters(tc.tier, zone, rng)
+		if len(chain) != tc.wantLen {
+			t.Errorf("%s: chain of %d, want %d", tc.tier, len(chain), tc.wantLen)
+		}
+		if ambush != tc.wantAmbush {
+			t.Errorf("%s: ambush = %v, want %v", tc.tier, ambush, tc.wantAmbush)
+		}
+		for _, m := range chain {
+			if m.Name == "" {
+				t.Errorf("%s: chain holds an empty monster — the bestiary lookup missed", tc.tier)
+			}
+		}
+	}
+
+	// Boss tier sends the zone's actual boss; elite sends something flagged elite.
+	if chain, _ := mischiefMonsters("boss", zone, rng); chain[0].ID != zone.Boss.BestiaryID {
+		t.Errorf("boss tier sent %q, want the zone boss %q", chain[0].ID, zone.Boss.BestiaryID)
+	}
+	elite, _ := mischiefMonsters("elite", zone, rng)
+	found := false
+	for _, e := range zone.Enemies {
+		if e.BestiaryID == elite[0].ID && e.IsElite {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("elite tier sent %q, which isn't an elite in %s", elite[0].ID, zone.ID)
+	}
+}
+
+// ── End-to-end: the delivery path against a real character ───────────────────
+
+// seedMischiefTarget builds a real, playable adventurer on a live expedition —
+// the thing a contract actually lands on. Unit tests on the contract row prove
+// nothing about the fight; these drive runMischiefInterrupt and the close-outs.
+func seedMischiefTarget(t *testing.T, uid id.UserID, level, hp int) *Expedition {
+	t.Helper()
+	if err := createAdvCharacter(uid, "target"+uid.Localpart()); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: level,
+		STR: 18, DEX: 14, CON: 16, INT: 10, WIS: 10, CHA: 10,
+		HPMax: hp, HPCurrent: hp, ArmorClass: 18,
+	}); err != nil {
+		t.Fatalf("SaveDnDCharacter: %v", err)
+	}
+	run, err := startZoneRun(uid, ZoneGoblinWarrens, 1, nil)
+	if err != nil {
+		t.Fatalf("startZoneRun: %v", err)
+	}
+	if _, err := db.Get().Exec(`
+		INSERT INTO dnd_expedition (expedition_id, user_id, zone_id, run_id, status, start_date, coins_earned)
+		VALUES (?, ?, 'goblin_warrens', ?, 'active', ?, 500)`,
+		"exp-"+uid.Localpart(), string(uid), run.RunID, time.Now().UTC()); err != nil {
+		t.Fatalf("seed expedition: %v", err)
+	}
+	exp, err := getActiveExpedition(uid)
+	if err != nil || exp == nil {
+		t.Fatalf("getActiveExpedition: %v", err)
+	}
+	return exp
+}
+
+// A grunt against a healthy level-5 fighter: the fight actually runs, it costs
+// HP, and they live. This is the "mostly theatre" tier doing what it was priced
+// to do.
+func TestMischiefDelivery_GruntIsSurvivable(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{}
+	uid := id.UserID("@grunted:example.org")
+	exp := seedMischiefTarget(t, uid, 5, 60)
+
+	bracket := mischiefBracketZone(5)
+	chain, ambush := mischiefMonsters("grunt", bracket, rand.New(rand.NewPCG(1, 2)))
+
+	_, monster, survived := p.runMischiefInterrupt(uid, exp, bracket, chain, ambush)
+	if !survived {
+		t.Fatalf("a level-5 fighter at full HP died to a grunt (%s) — the tier is mispriced", monster)
+	}
+	hp, _ := dndHPSnapshot(uid)
+	if hp <= 0 {
+		t.Errorf("survivor is at %d HP", hp)
+	}
+}
+
+// The boss tier is the dangerous one, and the one where the no-perma-death rule
+// has to hold. A level-3 caster-grade sheet against a tier-1 boss goes down —
+// and must come back up at 1 HP with the expedition force-extracted, never dead.
+//
+// This is the property that separates mischief from paid murder: it is bought,
+// and it lands while the victim may well be asleep.
+func TestMischiefDelivery_DownedTargetIsMaimedNotKilled(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	uid := id.UserID("@doomed:example.org")
+	// 1 HP: whatever the dice do, this fight ends with them on the floor.
+	exp := seedMischiefTarget(t, uid, 3, 1)
+
+	c := seedContract(t, "@buyer:example.org", uid, "boss", false)
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("claim should win")
+	}
+	if err := p.deliverMischief(c, exp); err != nil {
+		t.Fatalf("deliverMischief: %v", err)
+	}
+
+	// Alive, floored, and carried home.
+	char, err := loadAdvCharacter(uid)
+	if err != nil || char == nil {
+		t.Fatal("target's character is gone")
+	}
+	if !char.Alive {
+		t.Fatal("a PURCHASED monster killed a player outright — mischief must maim, never murder")
+	}
+	if hp, _ := dndHPSnapshot(uid); hp != 1 {
+		t.Errorf("downed target is at %d HP, want the 1 HP floor", hp)
+	}
+	if e, _ := getActiveExpedition(uid); e != nil {
+		t.Error("the expedition survived a downing — it must be force-extracted")
+	}
+
+	// The buyer gets nothing back; the whole fee is a sink.
+	got, err := mischiefContractByID(c.ID)
+	if err != nil || got == nil {
+		t.Fatal("contract row vanished")
+	}
+	if got.Status != mischiefStatusDelivered || got.Outcome != mischiefOutcomeDowned {
+		t.Errorf("contract resolved as %s/%s, want delivered/downed", got.Status, got.Outcome)
+	}
+	if pot := communityPotBalance(); pot < c.Paid {
+		t.Errorf("community pot holds %d, want at least the %d fee — a landed hit refunds nobody", pot, c.Paid)
+	}
+	if bal := p.euro.GetBalance(c.BuyerID); bal > 0 {
+		t.Errorf("buyer was credited %.0f on a successful hit; glory only", bal)
+	}
+}
+
+// Survival pays the target out of the buyer's money, and never more than the
+// buyer spent. Driven through the real close-out, not the arithmetic helper.
+func TestMischiefDelivery_SurvivalPaysTheTarget(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	uid := id.UserID("@tough:example.org")
+	exp := seedMischiefTarget(t, uid, 12, 400) // comfortably survives a tier-1 grunt
+
+	c := seedContract(t, "@buyer:example.org", uid, "grunt", false)
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("claim should win")
+	}
+	before := p.euro.GetBalance(uid)
+	if err := p.deliverMischief(c, exp); err != nil {
+		t.Fatalf("deliverMischief: %v", err)
+	}
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.Outcome != mischiefOutcomeSurvived {
+		t.Fatalf("a level-12 fighter with 400 HP lost to a tier-1 grunt (outcome %s)", got.Outcome)
+	}
+	tier, _ := mischiefTierByKey("grunt")
+	purse := mischiefPurse(tier.Fee, tier.PayoutPct)
+	if gained := int(p.euro.GetBalance(uid) - before); gained != purse {
+		t.Errorf("survivor was paid %d, want the %d purse", gained, purse)
+	}
+	if purse >= c.Paid {
+		t.Errorf("purse %d >= outlay %d", purse, c.Paid)
+	}
+	// The remainder is a sink, not a rebate.
+	if pot := communityPotBalance(); pot != c.Paid-purse {
+		t.Errorf("pot holds %d, want the %d remainder", pot, c.Paid-purse)
+	}
+	// The expedition is untouched — they fought it off and walk on.
+	if e, _ := getActiveExpedition(uid); e == nil {
+		t.Error("surviving a contract ended the expedition")
+	}
+}
+
+// An expedition that ends before the window closes fizzles: the buyer is
+// refunded 90%, the town rakes the rest, and nobody is attacked.
+func TestMischiefDelivery_FizzlesWhenTargetWentHome(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	uid := id.UserID("@gone:example.org")
+	seedMischiefTarget(t, uid, 5, 60)
+
+	c := seedContract(t, "@buyer:example.org", uid, "elite", false)
+	// They extract before the monster arrives.
+	if _, _, err := forcedExtractExpedition("exp-"+uid.Localpart(), "went home"); err != nil {
+		t.Fatalf("forcedExtractExpedition: %v", err)
+	}
+
+	p.fireMischiefDeliveries(time.Now().UTC().Add(mischiefWindow + time.Minute))
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.Status != mischiefStatusFizzled {
+		t.Fatalf("contract status %s, want fizzled — the dungeon was empty", got.Status)
+	}
+	refund := int(float64(c.Paid) * mischiefFizzleRefund)
+	if bal := int(p.euro.GetBalance(c.BuyerID)); bal != refund {
+		t.Errorf("buyer refunded %d, want %d (90%%)", bal, refund)
+	}
+	if pot := communityPotBalance(); pot != c.Paid-refund {
+		t.Errorf("pot raked %d, want %d", pot, c.Paid-refund)
+	}
+	if hp, max := dndHPSnapshot(uid); hp != max {
+		t.Errorf("a fizzled contract still hurt the target (%d/%d HP)", hp, max)
+	}
+}
+
+// The limbo state. A leader can win a fight their friend went down in — and a
+// mischief delivery deliberately skips the close-outs that would normally mark a
+// 0-HP seat dead. So the seat must be floored on BOTH outcomes, or the member is
+// left alive at 0 HP: not dead enough for the hospital, too dead to act, and
+// read as broken by every gate that tests `HPCurrent <= 0`.
+func TestMischiefDelivery_SurvivalFloorsADroppedPartyMember(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	leader := id.UserID("@leader:example.org")
+	member := id.UserID("@member:example.org")
+
+	exp := seedMischiefTarget(t, leader, 12, 400) // wins comfortably
+	seatLeaderFixture(t, exp.ID)
+	if err := createAdvCharacter(member, "member"); err != nil {
+		t.Fatal(err)
+	}
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: member, Race: RaceHuman, Class: ClassFighter, Level: 3,
+		STR: 14, DEX: 12, CON: 12, INT: 10, WIS: 10, CHA: 10,
+		HPMax: 30, HPCurrent: 30, ArmorClass: 12,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := joinParty(exp.ID, member); err != nil {
+		t.Fatalf("joinParty: %v", err)
+	}
+	// Put the member on the floor the way the fight would.
+	if _, err := db.Get().Exec(
+		`UPDATE dnd_character SET hp_current = 0 WHERE user_id = ?`, string(member)); err != nil {
+		t.Fatal(err)
+	}
+
+	c := seedContract(t, "@buyer:example.org", leader, "grunt", false)
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("claim should win")
+	}
+	if err := p.deliverMischief(c, exp); err != nil {
+		t.Fatalf("deliverMischief: %v", err)
+	}
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.Outcome != mischiefOutcomeSurvived {
+		t.Fatalf("leader lost; this test needs a survival (outcome %s)", got.Outcome)
+	}
+	hp, _ := dndHPSnapshot(member)
+	if hp <= 0 {
+		t.Errorf("dropped party member left at %d HP on a survived contract — alive, but stuck at zero", hp)
+	}
+	if mc, _ := loadAdvCharacter(member); mc == nil || !mc.Alive {
+		t.Error("a bought monster killed a party member — mischief maims, it never murders")
+	}
+}

internal/plugin/adventure_npc_arcs_test.go

@@ -0,0 +1,91 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+)
+
+// D2 NPC arcs — pure-helper coverage. None of these touch combat, so the
+// characterization golden is unaffected; these just pin the arc thresholds,
+// gift tiers, and the keepsake shape.
+
+func TestMistyArcBeat_FiresOnlyAtThresholds(t *testing.T) {
+	want := map[int]bool{5: true, 15: true, 30: true}
+	for count := 0; count <= 40; count++ {
+		got := mistyArcBeat(count)
+		if want[count] {
+			if got == "" {
+				t.Errorf("encounter %d: expected an arc beat, got none", count)
+			}
+		} else if got != "" {
+			t.Errorf("encounter %d: expected no arc beat, got %q", count, got)
+		}
+	}
+}
+
+func TestMistyArcBeats_DoNotLeakBuffMechanics(t *testing.T) {
+	// The arena effects are a hidden discovery mechanic; arc copy must never
+	// tie a donation to a combat outcome.
+	banned := []string{"arena", "damage", "buff", "combat", "attack", "heal", "bonus"}
+	for count, beat := range mistyArcBeats {
+		lower := strings.ToLower(beat)
+		for _, b := range banned {
+			if strings.Contains(lower, b) {
+				t.Errorf("beat %d leaks mechanic word %q: %s", count, b, beat)
+			}
+		}
+	}
+}
+
+func TestRobbieGiftTier_MatchesArenaBands(t *testing.T) {
+	cases := []struct {
+		level int
+		tier  int
+	}{
+		{1, 1}, {3, 1}, {4, 2}, {7, 2}, {8, 3}, {12, 3},
+		{13, 4}, {17, 4}, {18, 5}, {20, 5},
+	}
+	for _, c := range cases {
+		if got := robbieGiftTier(c.level); got != c.tier {
+			t.Errorf("robbieGiftTier(%d) = %d, want %d", c.level, got, c.tier)
+		}
+	}
+}
+
+func TestRobbieGiftCadence(t *testing.T) {
+	// The gift lands on every 10th visit and no other.
+	for visit := 1; visit <= 35; visit++ {
+		gives := visit%robbieGiftEveryNVisits == 0
+		if gives != (visit == 10 || visit == 20 || visit == 30) {
+			t.Errorf("visit %d: unexpected gift cadence", visit)
+		}
+	}
+}
+
+func TestThomPetTreat_IsRobbieSafeKeepsake(t *testing.T) {
+	treat := thomPetTreatItem()
+	if treat.Name == "" {
+		t.Fatal("treat has no name")
+	}
+	// Robbie's sweep skips "card" items, so the keepsake survives him.
+	if treat.Type != "card" {
+		t.Errorf("treat type = %q, want card so Robbie's sweep skips it", treat.Type)
+	}
+	if treat.Value != 0 {
+		t.Errorf("treat value = %d, want 0 (inert keepsake)", treat.Value)
+	}
+	// Confirm the sweep filter actually excludes it.
+	if got := robbieQualifyingItems([]AdvItem{treat}, nil); len(got) != 0 {
+		t.Errorf("Robbie would take the treat: %+v", got)
+	}
+}
+
+func TestThomFinalLetterPet_SubstitutesPetName(t *testing.T) {
+	letter := strings.ReplaceAll(thomFinalLetterPet, "{pet}", "Biscuit")
+	if strings.Contains(letter, "{pet}") {
+		t.Error("unsubstituted {pet} placeholder remains")
+	}
+	if !strings.Contains(letter, "Biscuit") {
+		t.Error("pet name not substituted into the letter")
+	}
+}

internal/plugin/adventure_npcs.go

@@ -131,6 +131,15 @@ func (p *AdventurePlugin) npcFireEncounter(userID id.UserID, npc string) {
 		return
 	}
 
+	// Don't consume the encounter — or its one-shot arc beat — if the player is
+	// already mid-interaction (shop, treasure, another NPC). Bail before
+	// touching MistyEncounterCount so a contended slot defers the whole
+	// encounter to a later fire instead of durably advancing the counter past
+	// a 5/15/30 threshold and losing that beat forever.
+	if _, occupied := p.pending.Load(string(userID)); occupied {
+		return
+	}
+
 	now := time.Now().UTC()
 
 	var opening, prompt string
@@ -141,6 +150,12 @@ func (p *AdventurePlugin) npcFireEncounter(userID id.UserID, npc string) {
 		// Pool union: legacy mistyOpenings + D&D MistyGreeting flavor.
 		mistyPool := dndMistyGreetingPool()
 		opening = mistyPool[rand.IntN(len(mistyPool))]
+		// D2 arc: a deepening beat lands the one time the counter hits a
+		// threshold (5/15/30). MistyEncounterCount only ever increments by one
+		// above, so each beat is delivered exactly once.
+		if beat := mistyArcBeat(char.MistyEncounterCount); beat != "" {
+			opening = beat + "\n\n" + opening
+		}
 		prompt = fmt.Sprintf("👤 A woman approaches you.\n\n_%s_\n\n"+
 			"Reply `yes` to give €%d, or `no` to walk away.", opening, mistyCost)
 	case "arina":
@@ -159,11 +174,6 @@ func (p *AdventurePlugin) npcFireEncounter(userID id.UserID, npc string) {
 		slog.Error("player_meta: npc last_seen dual-write failed", "user", userID, "npc", npc, "err", err)
 	}
 
-	// Don't overwrite an existing pending interaction (shop, treasure, etc.)
-	if _, occupied := p.pending.Load(string(userID)); occupied {
-		return
-	}
-
 	// Set pending interaction — NPC encounters stay valid until end of UTC day
 	endOfDay := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC).Add(24 * time.Hour)
 	p.pending.Store(string(userID), &advPendingInteraction{

internal/plugin/adventure_omen.go

@@ -0,0 +1,101 @@
+package plugin
+
+import (
+	"time"
+)
+
+// N7/B3 — the Omen: one rotating world modifier per ISO week
+// (gogobee_engagement_plan.md §B3).
+//
+// The active omen is a pure function of the ISO (year, week): omenTable indexed
+// by (year*53 + week) % len, so it advances by exactly one entry each week and
+// needs no schema, no ticker state, and no persistence. Every seam reads
+// activeOmen() the same way isHolidayToday() is read, and a zero-valued effect
+// field means "this omen doesn't touch that seam."
+//
+// Launch-set rule (§B3): every omen is a buff-with-texture on a NON-combat
+// lever — harvest, supplies, expedition mood/threat, arena payout, ingredient
+// drops. Nothing touches SimulateCombat or the turn engine: the omen is keyed
+// on the real clock, so a combat-affecting omen would make the combat golden
+// and the balance corpus week-dependent. The plan's "elites +2 ATK" mutator is
+// deliberately omitted for exactly that reason.
+
+type omen struct {
+	Key     string // stable id (tests, logs)
+	Name    string // player-facing name, e.g. "Bountiful Harvest"
+	TwinBee string // first-person announce blurb (TwinBee voice)
+
+	// Effect fields — zero == no effect at that seam.
+	HarvestYieldBonus    int     // + units per harvest grant
+	SupplyFreebiePacks   int     // + complimentary standard packs at outfitting
+	StartMoodBonus       int     // + starting DM mood on a new expedition
+	ArenaPayoutMult      float64 // >1 scales arena net earnings
+	ConsumableChanceMult float64 // >1 scales the per-win ingredient drop chance
+	ThreatDriftReduce    int     // subtract from the daily threat *rise* (floored at hold-steady)
+}
+
+// simOmenDisabled neutralizes the weekly Omen for the balance sim, so a corpus
+// sweep's results never depend on which wall-clock week it was run in. Set true
+// by NewSimRunner (mirrors simAutoArmEnabled). Every seam reads activeOmen(),
+// which returns the no-effect omen while this is set.
+var simOmenDisabled bool
+
+// omenTable is the weekly rotation. Keep it a set of distinct non-combat levers;
+// order is the rotation order. Adding an entry reshuffles the schedule but never
+// breaks determinism (still a pure function of the week).
+var omenTable = []omen{
+	{
+		Key: "bountiful_harvest", Name: "Bountiful Harvest",
+		TwinBee:           "The land's feeling generous this week — every gather I make comes up with a little extra in hand.",
+		HarvestYieldBonus: 1,
+	},
+	{
+		Key: "quartermasters_blessing", Name: "Quartermaster's Blessing",
+		TwinBee:            "Somebody left the storerooms unlocked. Outfitting an expedition this week? There's a free pack in it, and I'm setting out in good spirits.",
+		SupplyFreebiePacks: 1,
+		StartMoodBonus:     5,
+	},
+	{
+		Key: "golden_purse", Name: "Golden Purse",
+		TwinBee:         "The arena crowd's flush this week — purses are paying out fat. Twenty percent over the odds, if you can win it.",
+		ArenaPayoutMult: 1.20,
+	},
+	{
+		Key: "overflowing_satchels", Name: "Overflowing Satchels",
+		TwinBee:              "Reagents are turning up everywhere I look — twice as often as usual. Good week to stock the crafting shelf.",
+		ConsumableChanceMult: 2.0,
+	},
+	{
+		Key: "still_waters", Name: "Still Waters",
+		TwinBee:           "It's quiet out there. Whatever's hunting us is slow to rouse this week — the daily dread holds steady instead of creeping up.",
+		ThreatDriftReduce: 1,
+	},
+}
+
+// omenForWeek returns the omen for an ISO (year, week). Pure and total.
+func omenForWeek(year, week int) omen {
+	idx := ((year*53)+week)%len(omenTable) + len(omenTable)
+	return omenTable[idx%len(omenTable)]
+}
+
+// activeOmen returns this week's omen (UTC ISO week), or a no-effect omen when
+// the balance sim has disabled it.
+func activeOmen() omen {
+	if simOmenDisabled {
+		return omen{Key: "none", Name: "None"}
+	}
+	// N7/E4 — a live season's themed omen overrides the weekly rotation. Kept
+	// behind the simOmenDisabled guard above so the balance sim never sees it.
+	if s, ok := activeSeason(); ok {
+		return s.Omen
+	}
+	y, w := time.Now().UTC().ISOWeek()
+	return omenForWeek(y, w)
+}
+
+// omenMorningLine is the compact one-liner surfaced in the morning DM (the §B3
+// announce seam). Empty is never returned — an omen is always active — but the
+// caller may still choose when to show it.
+func omenMorningLine(o omen) string {
+	return "🔮 **The Omen — " + o.Name + ".** _" + o.TwinBee + "_"
+}

internal/plugin/adventure_omen_test.go

@@ -0,0 +1,86 @@
+package plugin
+
+import "testing"
+
+// TestOmenForWeek_Deterministic — the same ISO week always yields the same omen.
+func TestOmenForWeek_Deterministic(t *testing.T) {
+	a := omenForWeek(2026, 28)
+	b := omenForWeek(2026, 28)
+	if a.Key != b.Key {
+		t.Fatalf("omenForWeek not deterministic: %q vs %q", a.Key, b.Key)
+	}
+}
+
+// TestOmenForWeek_AdvancesEachWeek — consecutive weeks step by exactly one table
+// entry, so the schedule rotates rather than sticking or skipping.
+func TestOmenForWeek_AdvancesEachWeek(t *testing.T) {
+	n := len(omenTable)
+	for w := 1; w <= n; w++ {
+		cur := omenForWeek(2026, w)
+		next := omenForWeek(2026, w+1)
+		wantNext := omenTable[((2026*53)+w+1)%n]
+		if next.Key != wantNext.Key {
+			t.Errorf("week %d→%d: got %q, want %q", w, w+1, next.Key, wantNext.Key)
+		}
+		if cur.Key == next.Key {
+			t.Errorf("week %d and %d produced the same omen %q (should advance)", w, w+1, cur.Key)
+		}
+	}
+}
+
+// TestOmenForWeek_TotalOverYearBoundary — never panics across week/year edges,
+// including ISO week 53.
+func TestOmenForWeek_TotalOverYearBoundary(t *testing.T) {
+	for y := 2020; y <= 2030; y++ {
+		for w := 1; w <= 53; w++ {
+			o := omenForWeek(y, w)
+			if o.Key == "" {
+				t.Fatalf("omenForWeek(%d,%d) returned zero omen", y, w)
+			}
+		}
+	}
+}
+
+// TestOmenTable_NonCombatOnly — every omen carries at least one effect and the
+// struct has no combat lever, so the launch set can never move the golden or the
+// balance corpus. §B3.
+func TestOmenTable_NonCombatOnly(t *testing.T) {
+	for _, o := range omenTable {
+		hasEffect := o.HarvestYieldBonus > 0 || o.SupplyFreebiePacks > 0 ||
+			o.StartMoodBonus > 0 || o.ArenaPayoutMult > 1.0 ||
+			o.ConsumableChanceMult > 1.0 || o.ThreatDriftReduce > 0
+		if !hasEffect {
+			t.Errorf("omen %q has no active effect", o.Key)
+		}
+		if o.Name == "" || o.TwinBee == "" {
+			t.Errorf("omen %q missing player-facing copy", o.Key)
+		}
+	}
+}
+
+// TestActiveOmen_SimDisabled — the balance sim neutralizes the omen so corpus
+// results are wall-clock-independent. §B3.
+func TestActiveOmen_SimDisabled(t *testing.T) {
+	defer func() { simOmenDisabled = false }()
+	simOmenDisabled = true
+	o := activeOmen()
+	if o.Key != "none" {
+		t.Errorf("sim-disabled omen = %q, want none", o.Key)
+	}
+	if o.HarvestYieldBonus != 0 || o.SupplyFreebiePacks != 0 || o.StartMoodBonus != 0 ||
+		o.ArenaPayoutMult != 0 || o.ConsumableChanceMult != 0 || o.ThreatDriftReduce != 0 {
+		t.Errorf("sim-disabled omen must have no effect, got %+v", o)
+	}
+}
+
+// TestOmenKeysUnique — no duplicate keys (a dup would make the rotation land on
+// the same omen two of every len(omenTable) weeks).
+func TestOmenKeysUnique(t *testing.T) {
+	seen := map[string]bool{}
+	for _, o := range omenTable {
+		if seen[o.Key] {
+			t.Errorf("duplicate omen key %q", o.Key)
+		}
+		seen[o.Key] = true
+	}
+}

internal/plugin/adventure_pet2_test.go

@@ -0,0 +1,180 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// TestDerivePlayerStats_OnePetIsByteIdentical pins that a single pet still
+// produces exactly the pre-two-pet mod values (the averaging code must reduce
+// to identity over one element, or the combat golden moves).
+func TestDerivePlayerStats_OnePetIsByteIdentical(t *testing.T) {
+	char := testChar(10)
+	char.PetType = "dog"
+	char.PetName = "Rex"
+	char.PetArrived = true
+	char.PetLevel = 6
+	char.PetArmorTier = 2
+
+	_, stats := DerivePlayerStats(char, testEquip(0), zeroBonuses(), 0, 0, false)
+
+	if stats.PetAttackProc != petAttackChance(6) {
+		t.Errorf("PetAttackProc = %v, want %v (identity over one pet)", stats.PetAttackProc, petAttackChance(6))
+	}
+	if stats.PetDeflectProc != petDeflectChance(6, 2) {
+		t.Errorf("PetDeflectProc = %v, want %v", stats.PetDeflectProc, petDeflectChance(6, 2))
+	}
+	if want := 0.01 + 6*0.005; stats.PetWhiffProc != want {
+		t.Errorf("PetWhiffProc = %v, want %v", stats.PetWhiffProc, want)
+	}
+	if stats.PetAttackDmg != 3+6 {
+		t.Errorf("PetAttackDmg = %d, want %d", stats.PetAttackDmg, 3+6)
+	}
+}
+
+// TestDerivePlayerStats_TwoEqualPetsMatchOne: two identical pets average to the
+// same procs as one — a pair is not a stat spike.
+func TestDerivePlayerStats_TwoEqualPetsMatchOne(t *testing.T) {
+	char := testChar(10)
+	char.PetType, char.PetName, char.PetArrived, char.PetLevel, char.PetArmorTier = "dog", "Rex", true, 8, 3
+	char.Pet2Type, char.Pet2Name, char.Pet2Arrived, char.Pet2Level, char.Pet2ArmorTier = "cat", "Luna", true, 8, 3
+
+	_, stats := DerivePlayerStats(char, testEquip(0), zeroBonuses(), 0, 0, false)
+
+	if stats.PetAttackProc != petAttackChance(8) {
+		t.Errorf("two L8 pets PetAttackProc = %v, want one-pet %v", stats.PetAttackProc, petAttackChance(8))
+	}
+	if stats.PetAttackDmg != 3+8 {
+		t.Errorf("two L8 pets PetAttackDmg = %d, want %d", stats.PetAttackDmg, 3+8)
+	}
+}
+
+// TestDerivePlayerStats_TwoUnequalPetsAverage: mixed levels average, never
+// exceeding the stronger pet's solo contribution.
+func TestDerivePlayerStats_TwoUnequalPetsAverage(t *testing.T) {
+	char := testChar(10)
+	char.PetType, char.PetArrived, char.PetLevel, char.PetArmorTier = "dog", true, 10, 0
+	char.Pet2Type, char.Pet2Arrived, char.Pet2Level, char.Pet2ArmorTier = "cat", true, 2, 0
+
+	_, stats := DerivePlayerStats(char, testEquip(0), zeroBonuses(), 0, 0, false)
+
+	wantAtk := (petAttackChance(10) + petAttackChance(2)) / 2
+	if stats.PetAttackProc != wantAtk {
+		t.Errorf("PetAttackProc = %v, want avg %v", stats.PetAttackProc, wantAtk)
+	}
+	// Averaged proc must sit strictly between the two pets' solo values.
+	if !(stats.PetAttackProc < petAttackChance(10) && stats.PetAttackProc > petAttackChance(2)) {
+		t.Errorf("averaged proc %v not between %v and %v", stats.PetAttackProc, petAttackChance(2), petAttackChance(10))
+	}
+	if want := 3 + (10+2+1)/2; stats.PetAttackDmg != want { // rounded avg level = 6
+		t.Errorf("PetAttackDmg = %d, want %d", stats.PetAttackDmg, want)
+	}
+}
+
+// TestDerivePlayerStats_Pet2OnlyStillContributes: if the first pet is chased
+// away but the second remains, combat still sees the second pet.
+func TestDerivePlayerStats_Pet2OnlyStillContributes(t *testing.T) {
+	char := testChar(10)
+	char.PetType, char.PetArrived, char.PetChasedAway, char.PetLevel = "dog", true, true, 5
+	char.Pet2Type, char.Pet2Arrived, char.Pet2Level = "cat", true, 4
+
+	_, stats := DerivePlayerStats(char, testEquip(0), zeroBonuses(), 0, 0, false)
+
+	if !char.HasPet() && stats.PetAttackProc != petAttackChance(4) {
+		t.Errorf("pet2-only PetAttackProc = %v, want %v", stats.PetAttackProc, petAttackChance(4))
+	}
+}
+
+// TestDerivePlayerStats_NoPetsZero: the golden's own case — no pets, no procs.
+func TestDerivePlayerStats_NoPetsZero(t *testing.T) {
+	_, stats := DerivePlayerStats(testChar(10), testEquip(0), zeroBonuses(), 0, 0, false)
+	if stats.PetAttackProc != 0 || stats.PetDeflectProc != 0 || stats.PetWhiffProc != 0 || stats.PetAttackDmg != 0 {
+		t.Errorf("petless character got pet mods: %+v", stats)
+	}
+}
+
+func TestPetShouldArrive2_Gating(t *testing.T) {
+	pet1 := PetState{Type: "dog", Arrived: true}
+	tier4 := HouseState{Tier: 4}
+	tier3 := HouseState{Tier: 3}
+
+	if petShouldArrive2(pet1, PetState{}, tier3) {
+		t.Error("second pet must not arrive below Tier 4")
+	}
+	if petShouldArrive2(PetState{}, PetState{}, tier4) {
+		t.Error("second pet needs an established first pet")
+	}
+	if petShouldArrive2(pet1, PetState{Arrived: true}, tier4) {
+		t.Error("already-arrived second pet must not re-roll")
+	}
+	if petShouldArrive2(pet1, PetState{ChasedAway: true}, tier4) {
+		t.Error("chased-away second pet does not re-arrive")
+	}
+}
+
+// TestPet2StoreRoundTrip exercises the pet2_* columns and the AdvChar mirror.
+func TestPet2StoreRoundTrip(t *testing.T) {
+	townTestDB(t)
+	user := id.UserID("@pet2:test.invalid")
+
+	char := &AdventureCharacter{UserID: user}
+	char.PetType, char.PetName, char.PetArrived, char.PetLevel = "dog", "Rex", true, 3
+	char.Pet2Type, char.Pet2Name, char.Pet2Arrived, char.Pet2Level, char.Pet2ArmorTier = "cat", "Luna", true, 5, 2
+	if err := saveAdvCharacter(char); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := loadAdvCharacter(user)
+	if err != nil || got == nil {
+		t.Fatalf("reload: %v", err)
+	}
+	if !got.HasPet2() || got.Pet2Name != "Luna" || got.Pet2Level != 5 || got.Pet2ArmorTier != 2 || got.Pet2Type != "cat" {
+		t.Fatalf("pet2 did not round-trip: %+v", got)
+	}
+	if !got.HasPet() || got.PetName != "Rex" {
+		t.Fatalf("pet1 clobbered by pet2 write: %+v", got)
+	}
+
+	// Direct slot loader agrees.
+	p2, _ := loadPet2State(user)
+	if p2.Name != "Luna" || p2.Level != 5 {
+		t.Fatalf("loadPet2State mismatch: %+v", p2)
+	}
+}
+
+// TestPetShowcase_IncludesBothSlots verifies the town showcase surfaces second
+// pets and hides a chased-away one.
+func TestPetShowcase_IncludesBothSlots(t *testing.T) {
+	townTestDB(t)
+
+	a := &AdventureCharacter{UserID: id.UserID("@a:test.invalid")}
+	a.PetType, a.PetName, a.PetArrived, a.PetLevel = "dog", "Rex", true, 4
+	a.Pet2Type, a.Pet2Name, a.Pet2Arrived, a.Pet2Level = "cat", "Luna", true, 9
+	if err := saveAdvCharacter(a); err != nil {
+		t.Fatal(err)
+	}
+	b := &AdventureCharacter{UserID: id.UserID("@b:test.invalid")}
+	b.Pet2Type, b.Pet2Name, b.Pet2Arrived, b.Pet2Level, b.Pet2ChasedAway = "dog", "Ghost", true, 7, true
+	if err := saveAdvCharacter(b); err != nil {
+		t.Fatal(err)
+	}
+
+	pets, err := loadPetShowcase(townListCap)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pets) != 2 {
+		t.Fatalf("want 2 active pets (Rex + Luna), got %d: %+v", len(pets), pets)
+	}
+	// Sorted by level desc → Luna (9) before Rex (4).
+	if !strings.Contains(pets[0].Name, "Luna") || !strings.Contains(pets[1].Name, "Rex") {
+		t.Fatalf("showcase not level-ordered across slots: %+v", pets)
+	}
+	for _, p := range pets {
+		if strings.Contains(p.Name, "Ghost") {
+			t.Errorf("chased-away second pet should be hidden: %+v", p)
+		}
+	}
+}

internal/plugin/adventure_pets.go

@@ -31,28 +31,37 @@ func petXPToNextLevel(level int) int {
 	}
 }
 
-// petGrantXP adds XP to the pet and handles level-ups. Returns true if leveled up.
+// petGrantXP adds a per-action XP grant to the pet and handles level-ups.
+// Returns true if leveled up. Shares the level-up loop with the babysit trickle
+// via advancePetLevelsFromXP.
 func petGrantXP(pet *PetState) bool {
-	if !pet.HasPet() || pet.Level >= 10 {
+	if !pet.HasPet() {
 		return false
 	}
+	return advancePetLevelsFromXP(&pet.XP, &pet.Level, &pet.Level10Date, int(petXPPerAction*100))
+}
 
-	pet.XP += int(petXPPerAction * 100) // store as centixp for precision
+// advancePetLevelsFromXP adds centi-XP to a pet and applies any level-ups, up
+// to the level-10 cap, stamping the level-10 date on first reaching it. Shared
+// by both pet slots (the babysit trickle). Returns true if the pet leveled.
+func advancePetLevelsFromXP(xp, level *int, level10Date *string, addCentiXP int) bool {
+	if *level >= 10 {
+		return false
+	}
+	*xp += addCentiXP
 	leveled := false
-	for pet.Level < 10 {
-		needed := petXPToNextLevel(pet.Level) * 100
-		if pet.XP < needed {
+	for *level < 10 {
+		needed := petXPToNextLevel(*level) * 100
+		if *xp < needed {
 			break
 		}
-		pet.XP -= needed
-		pet.Level++
+		*xp -= needed
+		*level++
 		leveled = true
 	}
-
-	if pet.Level >= 10 && pet.Level10Date == "" {
-		pet.Level10Date = time.Now().UTC().Format("2006-01-02")
+	if *level >= 10 && *level10Date == "" {
+		*level10Date = time.Now().UTC().Format("2006-01-02")
 	}
-
 	return leveled
 }
 
@@ -206,6 +215,23 @@ func petShouldArrive(pet PetState, house HouseState) bool {
 	return rand.Float64() < 0.30
 }
 
+// petShouldArrive2 gates the SECOND companion (N4/E1). It needs a Tier-4 Estate
+// and an established first pet — the second animal wanders in to join the first,
+// not an empty house. A chased-away second pet does not re-arrive (Misty's
+// reactivation is a pet-1 mechanic).
+func petShouldArrive2(pet1, pet2 PetState, house HouseState) bool {
+	if pet2.Arrived || pet2.ChasedAway {
+		return false
+	}
+	if house.Tier < 4 {
+		return false
+	}
+	if !pet1.HasPet() {
+		return false
+	}
+	return rand.Float64() < 0.30
+}
+
 // maybeRollPetArrivalOnEmerge rolls the pet-arrival check when a player
 // surfaces from an expedition (voluntary extract, abandon, or a survived
 // forced extraction) or revives after death. The arrival roll lives on the
@@ -221,32 +247,52 @@ func (p *AdventurePlugin) maybeRollPetArrivalOnEmerge(userID id.UserID) {
 	pet, _ := loadPetState(userID)
 	house, _ := loadHouseState(userID)
 	if petShouldArrive(pet, house) {
-		p.petArrivalDM(userID)
+		p.petArrivalDM(userID, 1)
+		return
+	}
+	// A Tier-4 Estate can draw a second companion once the first is settled.
+	pet2, _ := loadPet2State(userID)
+	if petShouldArrive2(pet, pet2, house) {
+		p.petArrivalDM(userID, 2)
 	}
 }
 
-// petArrivalDM sends the initial "there's an animal in your house" DM.
-func (p *AdventurePlugin) petArrivalDM(userID id.UserID) {
+// petArrivalDM sends the initial "there's an animal in your house" DM for the
+// given slot (1 or 2).
+func (p *AdventurePlugin) petArrivalDM(userID id.UserID, slot int) {
 	// Don't overwrite an existing pending interaction
 	if _, exists := p.pending.Load(string(userID)); exists {
 		return
 	}
 
-	text := "There's an animal in your house. It looks like a...\n\n" +
+	intro := "There's an animal in your house. It looks like a..."
+	if slot == 2 {
+		intro = "There's *another* animal in your house. Your first pet seems unbothered. It looks like a..."
+	}
+	text := intro + "\n\n" +
 		"🚪 Chase it away\n" +
 		"🍖 Feed it\n\n" +
 		"Reply with `chase` or `feed`."
 
 	p.pending.Store(string(userID), &advPendingInteraction{
 		Type:      "pet_arrival",
-		Data:      &advPendingPetArrival{},
+		Data:      &advPendingPetArrival{Slot: slot},
 		ExpiresAt: time.Now().Add(advDMResponseWindowLow),
 	})
 	_ = p.SendDM(userID, text)
 }
 
+// petSlotFromData reads a Slot off any pending-pet payload, defaulting to slot 1
+// for the zero value so older/first-pet interactions are unaffected.
+func petSlotFromData(slot int) int {
+	if slot == 2 {
+		return 2
+	}
+	return 1
+}
+
 // resolvePetArrival handles the chase/feed response.
-func (p *AdventurePlugin) resolvePetArrival(ctx MessageContext) error {
+func (p *AdventurePlugin) resolvePetArrival(ctx MessageContext, interaction *advPendingInteraction) error {
 	userMu := p.advUserLock(ctx.Sender)
 	userMu.Lock()
 	defer userMu.Unlock()
@@ -256,13 +302,18 @@ func (p *AdventurePlugin) resolvePetArrival(ctx MessageContext) error {
 		return p.SendDM(ctx.Sender, "Failed to load your character.")
 	}
 
+	slot := petSlotFromData(interaction.Data.(*advPendingPetArrival).Slot)
 	reply := strings.ToLower(strings.TrimSpace(ctx.Body))
 
 	if reply == "chase" || reply == "🚪" {
-		char.PetChasedAway = true
-		char.PetReactivated = false
+		if slot == 2 {
+			char.Pet2ChasedAway = true
+			char.Pet2Reactivated = false
+		} else {
+			char.PetChasedAway = true
+			char.PetReactivated = false
+		}
 		_ = saveAdvCharacter(char)
-		_ = upsertPlayerMetaPetState(char.UserID, petStateFromAdvChar(char))
 		return p.SendDM(ctx.Sender, "You chased it away. It disappeared around the corner and didn't come back.\n\nThe house is quiet again.")
 	}
 
@@ -276,7 +327,7 @@ func (p *AdventurePlugin) resolvePetArrival(ctx MessageContext) error {
 
 		p.pending.Store(string(ctx.Sender), &advPendingInteraction{
 			Type:      "pet_type",
-			Data:      &advPendingPetType{},
+			Data:      &advPendingPetType{Slot: slot},
 			ExpiresAt: time.Now().Add(advDMResponseWindowLow),
 		})
 		return p.SendDM(ctx.Sender, text)
@@ -285,18 +336,19 @@ func (p *AdventurePlugin) resolvePetArrival(ctx MessageContext) error {
 	// Invalid response — re-prompt
 	p.pending.Store(string(ctx.Sender), &advPendingInteraction{
 		Type:      "pet_arrival",
-		Data:      &advPendingPetArrival{},
+		Data:      &advPendingPetArrival{Slot: slot},
 		ExpiresAt: time.Now().Add(advDMResponseWindowLow),
 	})
 	return p.SendDM(ctx.Sender, "Reply with `chase` or `feed`.")
 }
 
 // resolvePetType handles dog/cat selection.
-func (p *AdventurePlugin) resolvePetType(ctx MessageContext) error {
+func (p *AdventurePlugin) resolvePetType(ctx MessageContext, interaction *advPendingInteraction) error {
 	userMu := p.advUserLock(ctx.Sender)
 	userMu.Lock()
 	defer userMu.Unlock()
 
+	slot := petSlotFromData(interaction.Data.(*advPendingPetType).Slot)
 	reply := strings.ToLower(strings.TrimSpace(ctx.Body))
 
 	petType := ""
@@ -309,7 +361,7 @@ func (p *AdventurePlugin) resolvePetType(ctx MessageContext) error {
 	if petType == "" {
 		p.pending.Store(string(ctx.Sender), &advPendingInteraction{
 			Type:      "pet_type",
-			Data:      &advPendingPetType{},
+			Data:      &advPendingPetType{Slot: slot},
 			ExpiresAt: time.Now().Add(advDMResponseWindowLow),
 		})
 		return p.SendDM(ctx.Sender, "Reply with `dog` or `cat`.")
@@ -317,7 +369,7 @@ func (p *AdventurePlugin) resolvePetType(ctx MessageContext) error {
 
 	p.pending.Store(string(ctx.Sender), &advPendingInteraction{
 		Type:      "pet_name",
-		Data:      &advPendingPetName{PetType: petType},
+		Data:      &advPendingPetName{PetType: petType, Slot: slot},
 		ExpiresAt: time.Now().Add(advDMResponseWindowLow),
 	})
 
@@ -355,24 +407,36 @@ func (p *AdventurePlugin) resolvePetName(ctx MessageContext, interaction *advPen
 		return p.SendDM(ctx.Sender, "Name can only contain letters, numbers, spaces, hyphens, and apostrophes. Try again.")
 	}
 
-	char.PetType = data.PetType
-	char.PetName = name
-	char.PetArrived = true
-	char.PetChasedAway = false
-	char.PetLevel = 1
-	char.PetXP = 0
+	if petSlotFromData(data.Slot) == 2 {
+		char.Pet2Type = data.PetType
+		char.Pet2Name = name
+		char.Pet2Arrived = true
+		char.Pet2ChasedAway = false
+		char.Pet2Level = 1
+		char.Pet2XP = 0
+	} else {
+		char.PetType = data.PetType
+		char.PetName = name
+		char.PetArrived = true
+		char.PetChasedAway = false
+		char.PetLevel = 1
+		char.PetXP = 0
+	}
 
 	if err := saveAdvCharacter(char); err != nil {
 		return p.SendDM(ctx.Sender, "Failed to save.")
 	}
-	_ = upsertPlayerMetaPetState(char.UserID, petStateFromAdvChar(char))
 
 	emoji := "🐶"
 	if data.PetType == "cat" {
 		emoji = "🐱"
 	}
-	return p.SendDM(ctx.Sender, fmt.Sprintf("%s **%s** has moved in.\n\nBreed: Massive %s.\nLevel: 1\n\n%s will join you in combat. %s will not explain their decisions.",
-		emoji, name, titleCase(data.PetType), name, name))
+	tail := fmt.Sprintf("%s will join you in combat. %s will not explain their decisions.", name, name)
+	if petSlotFromData(data.Slot) == 2 {
+		tail = fmt.Sprintf("%s fights alongside your first companion — the two share the spotlight, so together they're about as much help in a scrap as one seasoned pet. %s will not explain their decisions.", name, name)
+	}
+	return p.SendDM(ctx.Sender, fmt.Sprintf("%s **%s** has moved in.\n\nBreed: Massive %s.\nLevel: 1\n\n%s",
+		emoji, name, titleCase(data.PetType), tail))
 }
 
 // ── Morning Pet Events ─────────────────────────────────────────────────────

internal/plugin/adventure_render.go

@@ -312,6 +312,20 @@ func renderAdvMorningDM(userID id.UserID, equip map[EquipmentSlot]*AdvEquipment,
 		sb.WriteString(fmt.Sprintf("🎉 Happy %s! In recognition of %s, today's adventures come with TwinBee's blessing — new zone & expedition runs start at +5 mood, expedition outfitting includes a complimentary standard pack, and every harvest yields one extra unit.\n\n", holidayName, holidayName))
 	}
 
+	// N7/B3 the Omen — this week's world modifier, in TwinBee's voice. Rides the
+	// existing morning DM (no net-new scheduled message); persistent one-liner so
+	// a mid-week arrival still learns the active omen.
+	sb.WriteString(omenMorningLine(activeOmen()))
+	sb.WriteString("\n\n")
+
+	// N7/E4 — a live season adds a "what's live this week" banner under the Omen
+	// line (its themed omen already rode the line above). Same morning DM, no
+	// net-new scheduled message.
+	if s, ok := activeSeason(); ok {
+		sb.WriteString(seasonBannerLine(s))
+		sb.WriteString("\n\n")
+	}
+
 	// Pick a morning greeting
 	greeting, _ := advPickFlavor(MorningDM, userID, "morning_dm")
 	displayName, _ := loadDisplayName(userID)
@@ -974,6 +988,7 @@ type AdvLeaderboardEntry struct {
 	ForagingSkill int
 	FishingSkill  int
 	CurrentStreak int
+	Renown        int // N7/B2 — prestige level, cosmetic marker only
 }
 
 func renderAdvLeaderboard(chars []AdvLeaderboardEntry) string {
@@ -987,16 +1002,21 @@ func renderAdvLeaderboard(chars []AdvLeaderboardEntry) string {
 		Score  int
 		Levels string
 		Streak int
+		Renown int
 	}
 	var entries []entry
 	for _, c := range chars {
+		// Renown adds to the ranking score so a capped, prestigious player still
+		// climbs — it's the only progression they have left past L20.
 		score := (c.Level + c.MiningSkill + c.ForagingSkill + c.FishingSkill) * 10
+		score += c.Renown * 10
 		name, _ := loadDisplayName(c.UserID)
 		entries = append(entries, entry{
 			Name:   name,
 			Score:  score,
 			Levels: fmt.Sprintf("⚔️%d ⛏️%d 🌿%d 🎣%d", c.Level, c.MiningSkill, c.ForagingSkill, c.FishingSkill),
 			Streak: c.CurrentStreak,
+			Renown: c.Renown,
 		})
 	}
 
@@ -1028,7 +1048,11 @@ func renderAdvLeaderboard(chars []AdvLeaderboardEntry) string {
 		if e.Streak >= 7 {
 			streak = fmt.Sprintf(" 🔥%d", e.Streak)
 		}
-		sb.WriteString(fmt.Sprintf("%s **%s** — %s (score: %d%s)\n", prefix, e.Name, e.Levels, e.Score, streak))
+		renownBadge := ""
+		if m := renownMarker(e.Renown); m != "" {
+			renownBadge = " " + m
+		}
+		sb.WriteString(fmt.Sprintf("%s **%s**%s — %s (score: %d%s)\n", prefix, e.Name, renownBadge, e.Levels, e.Score, streak))
 	}
 
 	return sb.String()
@@ -1037,8 +1061,17 @@ func renderAdvLeaderboard(chars []AdvLeaderboardEntry) string {
 // ── Treasure Discard Prompt ──────────────────────────────────────────────────
 
 func renderAdvTreasureDiscardPrompt(newTreasure *AdvTreasureDef, existing []AdvTreasureDef) string {
-	if len(TreasureInventoryCap) == 0 {
-		return "You found a treasure but your inventory is full. Reply 1, 2, or 3 to discard, or `keep`."
+	// The flavor templates below are written for the base 3-slot set. With a
+	// T3 trophy room the set can hold 4, so fall back to a plain dynamic list
+	// whenever it isn't exactly 3 — every slot has to be visible to choose it.
+	if len(TreasureInventoryCap) == 0 || len(existing) != 3 {
+		var b strings.Builder
+		fmt.Fprintf(&b, "You found **%s** but your treasure slots are full. Discard one to make room:\n", newTreasure.Name)
+		for i, ex := range existing {
+			fmt.Fprintf(&b, "%d. %s — %s\n", i+1, ex.Name, ex.InventoryDesc)
+		}
+		fmt.Fprintf(&b, "\nReply with the number to discard, or `keep` to leave the new one behind.")
+		return b.String()
 	}
 
 	// Build substitution map with existing treasure info

internal/plugin/adventure_renown.go

@@ -0,0 +1,249 @@
+package plugin
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"maunium.net/go/mautrix/id"
+
+	"gogobee/internal/db"
+)
+
+// N7/B2 — Renown: prestige past the level cap (gogobee_engagement_plan.md §B2).
+//
+// A confirmed D&D character caps at L20 (dndMaxLevel). Before N7, grantDnDXP
+// silently dropped any XP earned past the cap. Renown reclaims that overflow as
+// a prestige track: every renownXPPerLevel of overflow is one Renown level.
+//
+// Storage is a single cumulative column, player_meta.renown_xp, written by an
+// atomic INSERT…ON CONFLICT … += (the journal_pages pattern) so there is no
+// read-modify-write race. renown_level is DERIVED (renownLevelFor) rather than
+// stored, so nothing can disagree with the XP total.
+//
+// The reward is deliberately prestige-only — a derived rank title, a cosmetic
+// marker on the sheet/leaderboard, and a small capped bundle of *activity*
+// bonuses (loot quality, XP, death avoidance). It NEVER grants combat stats:
+// the balance corpus (SimulateCombat / the golden) must stay valid, so renown
+// touches only the AdvBonusSummary activity levers and only at the activity
+// call sites, never loadCombatBonuses.
+
+// renownXPPerLevel is the overflow XP that buys one Renown level. Steep by
+// design (§B2): a capped L20 player earns ~750 XP per T5 dungeon win, so a
+// Renown level is dozens of endgame clears.
+const renownXPPerLevel = 25000
+
+// Renown perk ladder. One small step every renownPerkStepLevels Renown levels,
+// capped at renownPerkMaxSteps steps. At the cap the perks total +20% XP / +15%
+// loot, matching a streak-30 grant's economic half — §B2's ceiling in total
+// power.
+//
+// The perks are deliberately ONLY the two combat-neutral levers of the
+// AdvBonusSummary: combat_stats.go maps DeathModifier→Defense,
+// SuccessBonus→Attack and ExceptionalBonus→CritRate, so those *are* combat
+// stats and are off-limits (§B2: never combat-stat inflation, the balance
+// corpus must stay valid). LootQuality and XPMultiplier are read only by the
+// loot/XP economy, never by combat stat derivation — so renown can pay them out
+// even through loadCombatBonuses without moving the golden. That is why §B2's
+// suggested "−death penalty" perk is intentionally NOT granted: it would inflate
+// Defense.
+const (
+	renownPerkStepLevels = 3
+	renownPerkMaxSteps   = 10
+)
+
+// renownLevelFor derives the Renown level from cumulative overflow XP.
+func renownLevelFor(renownXP int) int {
+	if renownXP <= 0 {
+		return 0
+	}
+	return renownXP / renownXPPerLevel
+}
+
+// renownXPIntoLevel returns (progress, cost) toward the next Renown level, for
+// display. cost is always renownXPPerLevel.
+func renownXPIntoLevel(renownXP int) (int, int) {
+	if renownXP < 0 {
+		renownXP = 0
+	}
+	return renownXP % renownXPPerLevel, renownXPPerLevel
+}
+
+// renownRank is one rung of the derived title ladder: the first Renown level at
+// which the rank applies, and its name. A rank promotion (crossing into a new
+// rung) is what gets announced in the games room; plain level-ups only DM.
+type renownRank struct {
+	MinLevel int
+	Name     string
+}
+
+var renownRanks = []renownRank{
+	{1, "Renowned"},
+	{3, "Storied"},
+	{5, "Illustrious"},
+	{10, "Fabled"},
+	{15, "Mythic"},
+	{20, "Ascendant"},
+	{30, "Eternal"},
+}
+
+// renownRankFor returns the rank name for a Renown level, or "" below level 1.
+func renownRankFor(level int) string {
+	name := ""
+	for _, r := range renownRanks {
+		if level >= r.MinLevel {
+			name = r.Name
+		}
+	}
+	return name
+}
+
+// renownMarker is the cosmetic prestige badge shown next to a name on the sheet
+// and leaderboard. Empty below Renown 1.
+func renownMarker(level int) string {
+	if level < 1 {
+		return ""
+	}
+	return fmt.Sprintf("✦%d", level)
+}
+
+// applyRenownBonuses folds the capped renown perks into an AdvBonusSummary. It
+// touches ONLY LootQuality and XPMultiplier — the combat-neutral economy levers
+// — so it is safe to call anywhere the summary is built, including
+// loadCombatBonuses, without changing any combat stat (see the const block).
+func applyRenownBonuses(b *AdvBonusSummary, renownLevel int) {
+	if b == nil || renownLevel < renownPerkStepLevels {
+		return
+	}
+	steps := renownLevel / renownPerkStepLevels
+	if steps > renownPerkMaxSteps {
+		steps = renownPerkMaxSteps
+	}
+	b.XPMultiplier += float64(steps) * 2  // → +20% at the cap
+	b.LootQuality += float64(steps) * 1.5 // → +15% at the cap
+}
+
+// ── Persistence ──────────────────────────────────────────────────────────────
+
+// renownAccrueSQL is the atomic cumulative += on player_meta.renown_xp (the
+// journal_pages pattern), returning the post-update total. Shared by the
+// standalone and transactional accrual paths so the SQL lives in one place.
+const renownAccrueSQL = `INSERT INTO player_meta (user_id, renown_xp) VALUES (?, ?)
+	 ON CONFLICT(user_id) DO UPDATE SET renown_xp = renown_xp + excluded.renown_xp
+	 RETURNING renown_xp`
+
+// sqlQueryer is the subset of *sql.DB / *sql.Tx that accrueRenownXP needs, so
+// the accrual can run standalone or inside grantDnDXP's save transaction.
+type sqlQueryer interface {
+	QueryRow(query string, args ...any) *sql.Row
+}
+
+// accrueRenownXP adds delta (> 0) to renown_xp against any queryer and returns
+// the cumulative totals before and after. A single statement, safe against
+// concurrent grants — no lost update.
+func accrueRenownXP(q sqlQueryer, userID id.UserID, delta int) (before, after int, err error) {
+	if err = q.QueryRow(renownAccrueSQL, string(userID), delta).Scan(&after); err != nil {
+		return 0, 0, fmt.Errorf("accrue renown_xp: %w", err)
+	}
+	return after - delta, after, nil
+}
+
+// addRenownXP is the standalone accrual (its own DB write). delta <= 0 is a
+// no-op read. grantDnDXP uses the transactional saveDnDCharacterWithOverflow
+// instead, so this is the API for callers not already saving a character.
+func addRenownXP(userID id.UserID, delta int) (before, after int, err error) {
+	if delta <= 0 {
+		cur, e := loadRenownXP(userID)
+		return cur, cur, e
+	}
+	return accrueRenownXP(db.Get(), userID, delta)
+}
+
+// saveDnDCharacterWithOverflow persists the character and converts overflow XP
+// (> 0) to Renown in one transaction, so a crash can neither drop the overflow
+// nor double-credit it. Returns the cumulative renown totals before/after.
+func saveDnDCharacterWithOverflow(c *DnDCharacter, overflow int) (before, after int, err error) {
+	tx, err := db.Get().Begin()
+	if err != nil {
+		return 0, 0, err
+	}
+	defer tx.Rollback()
+	if err = saveDnDCharacterExec(tx, c); err != nil {
+		return 0, 0, err
+	}
+	if before, after, err = accrueRenownXP(tx, c.UserID, overflow); err != nil {
+		return 0, 0, err
+	}
+	if err = tx.Commit(); err != nil {
+		return 0, 0, err
+	}
+	return before, after, nil
+}
+
+// loadRenownXP reads the cumulative overflow XP. Absent row == 0.
+func loadRenownXP(userID id.UserID) (int, error) {
+	var xp int
+	err := db.Get().QueryRow(
+		`SELECT renown_xp FROM player_meta WHERE user_id = ?`,
+		string(userID),
+	).Scan(&xp)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, nil
+	}
+	return xp, err
+}
+
+// renownLevelForUser is the per-user Renown level, for callers (leaderboard)
+// that don't already hold the overlay. Errors resolve to 0.
+func renownLevelForUser(userID id.UserID) int {
+	xp, err := loadRenownXP(userID)
+	if err != nil {
+		return 0
+	}
+	return renownLevelFor(xp)
+}
+
+// ── Announce ─────────────────────────────────────────────────────────────────
+
+// announceRenown notifies the player of Renown level-ups (DM) and, when the
+// gain crossed into a new rank rung, the games room. Event-driven off a grant,
+// not a scheduled recap. from/to are Renown levels before/after the grant.
+func (p *AdventurePlugin) announceRenown(userID id.UserID, from, to int) {
+	if p == nil || to <= from {
+		return
+	}
+	gained := to - from
+	rank := renownRankFor(to)
+	if p.Client != nil {
+		msg := fmt.Sprintf("✦ **Renown %d** ✦\n\nYou've earned %s past the level cap — your legend grows.",
+			to, pluralLevels(gained))
+		if rank != "" {
+			msg += fmt.Sprintf("\nRank: **%s**.", rank)
+		}
+		if err := p.SendDM(userID, msg); err != nil {
+			slog.Error("renown: level-up DM failed", "user", userID, "err", err)
+		}
+	}
+	// Games-room shout only on a rank promotion, to keep the room quiet.
+	if renownRankFor(from) == rank {
+		return
+	}
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	name, _ := loadDisplayName(userID)
+	if name == "" {
+		name = string(userID)
+	}
+	p.SendMessage(id.RoomID(gr), fmt.Sprintf(
+		"✦ **%s** reached **Renown %d — %s.** A legend of the realm.", name, to, rank))
+}
+
+func pluralLevels(n int) string {
+	if n == 1 {
+		return "a Renown level"
+	}
+	return fmt.Sprintf("%d Renown levels", n)
+}

internal/plugin/adventure_renown_test.go

@@ -0,0 +1,238 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newRenownTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+func TestRenownLevelFor(t *testing.T) {
+	cases := []struct{ xp, want int }{
+		{0, 0},
+		{-100, 0},
+		{renownXPPerLevel - 1, 0},
+		{renownXPPerLevel, 1},
+		{renownXPPerLevel*3 + 12, 3},
+		{renownXPPerLevel * 30, 30},
+	}
+	for _, c := range cases {
+		if got := renownLevelFor(c.xp); got != c.want {
+			t.Errorf("renownLevelFor(%d) = %d, want %d", c.xp, got, c.want)
+		}
+	}
+}
+
+func TestRenownXPIntoLevel(t *testing.T) {
+	into, cost := renownXPIntoLevel(renownXPPerLevel + 500)
+	if cost != renownXPPerLevel {
+		t.Errorf("cost = %d, want %d", cost, renownXPPerLevel)
+	}
+	if into != 500 {
+		t.Errorf("into = %d, want 500", into)
+	}
+}
+
+func TestRenownRankLadderMonotonic(t *testing.T) {
+	// Rank thresholds must strictly increase so renownRankFor is well-defined.
+	for i := 1; i < len(renownRanks); i++ {
+		if renownRanks[i].MinLevel <= renownRanks[i-1].MinLevel {
+			t.Errorf("rank %d threshold %d not > %d", i, renownRanks[i].MinLevel, renownRanks[i-1].MinLevel)
+		}
+	}
+	if renownRankFor(0) != "" {
+		t.Errorf("rank at 0 should be empty")
+	}
+	if renownRankFor(1) != "Renowned" {
+		t.Errorf("rank at 1 = %q, want Renowned", renownRankFor(1))
+	}
+	if renownRankFor(4) != "Storied" {
+		t.Errorf("rank at 4 = %q, want Storied (threshold 3)", renownRankFor(4))
+	}
+	if renownRankFor(1000) != "Eternal" {
+		t.Errorf("top rank = %q, want Eternal", renownRankFor(1000))
+	}
+}
+
+func TestRenownMarker(t *testing.T) {
+	if renownMarker(0) != "" {
+		t.Errorf("marker at 0 should be empty")
+	}
+	if got := renownMarker(7); got != "✦7" {
+		t.Errorf("marker(7) = %q, want ✦7", got)
+	}
+}
+
+// TestApplyRenownBonuses_CombatNeutralAndCapped — renown grants only the two
+// combat-neutral economy levers (loot/XP), capped at +15%/+20%, and must never
+// touch a lever that combat_stats.go maps to a combat stat. §B2.
+func TestApplyRenownBonuses_CombatNeutralAndCapped(t *testing.T) {
+	// Below the first step: no effect.
+	b := &AdvBonusSummary{}
+	applyRenownBonuses(b, 2)
+	if b.XPMultiplier != 0 || b.LootQuality != 0 {
+		t.Errorf("renown < step should be inert, got %+v", b)
+	}
+
+	// One step at renown 3.
+	b = &AdvBonusSummary{}
+	applyRenownBonuses(b, 3)
+	if b.XPMultiplier != 2 || b.LootQuality != 1.5 {
+		t.Errorf("one step wrong: %+v", b)
+	}
+
+	// At renown 30 and beyond, capped at +20% XP / +15% loot.
+	for _, lvl := range []int{30, 45, 300} {
+		b = &AdvBonusSummary{}
+		applyRenownBonuses(b, lvl)
+		if b.XPMultiplier != 20 || b.LootQuality != 15 {
+			t.Errorf("renown %d not capped: %+v", lvl, b)
+		}
+	}
+
+	// Never combat-stat inflation: the levers combat_stats.go reads
+	// (DeathModifier→Defense, SuccessBonus→Attack, ExceptionalBonus→CritRate)
+	// and the skill/combat levers must all stay at zero at any renown level.
+	b = &AdvBonusSummary{}
+	applyRenownBonuses(b, 300)
+	if b.DeathModifier != 0 || b.SuccessBonus != 0 || b.ExceptionalBonus != 0 {
+		t.Errorf("renown leaked into a combat-stat lever: %+v", b)
+	}
+	if b.CombatBonus != 0 || b.MiningBonus != 0 || b.ForagingBonus != 0 || b.FishingBonus != 0 {
+		t.Errorf("renown leaked into combat/skill levers: %+v", b)
+	}
+}
+
+// TestAddRenownXP_Accumulates — cumulative += with correct before/after.
+func TestAddRenownXP_Accumulates(t *testing.T) {
+	newRenownTestDB(t)
+	uid := id.UserID("@renown_add:example")
+	if err := createAdvCharacter(uid, "Renowner"); err != nil {
+		t.Fatal(err)
+	}
+
+	before, after, err := addRenownXP(uid, 10000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if before != 0 || after != 10000 {
+		t.Errorf("first add: before=%d after=%d, want 0/10000", before, after)
+	}
+
+	before, after, err = addRenownXP(uid, 20000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if before != 10000 || after != 30000 {
+		t.Errorf("second add: before=%d after=%d, want 10000/30000", before, after)
+	}
+
+	got, err := loadRenownXP(uid)
+	if err != nil || got != 30000 {
+		t.Errorf("loadRenownXP = %d (err %v), want 30000", got, err)
+	}
+	if renownLevelForUser(uid) != 1 {
+		t.Errorf("renownLevelForUser = %d, want 1", renownLevelForUser(uid))
+	}
+}
+
+// TestRenownAtLeast — the B4 achievement gate reads the derived level correctly.
+func TestRenownAtLeast(t *testing.T) {
+	newRenownTestDB(t)
+	uid := id.UserID("@renown_ach:example")
+	if err := createAdvCharacter(uid, "Achiever"); err != nil {
+		t.Fatal(err)
+	}
+	d := db.Get()
+	if renownAtLeast(d, uid, 1) {
+		t.Errorf("no renown yet, should not meet level 1")
+	}
+	if _, _, err := addRenownXP(uid, renownXPPerLevel*5); err != nil {
+		t.Fatal(err)
+	}
+	if !renownAtLeast(d, uid, 5) {
+		t.Errorf("renown 5 should meet level 5")
+	}
+	if renownAtLeast(d, uid, 6) {
+		t.Errorf("renown 5 should not meet level 6")
+	}
+	// Absent player → false, not a crash.
+	if renownAtLeast(d, id.UserID("@nobody:nowhere.invalid"), 1) {
+		t.Errorf("absent player should not meet any renown level")
+	}
+}
+
+// TestRenownOverlay — applyPlayerMetaOverlay populates RenownXP and RenownLevel.
+func TestRenownOverlay(t *testing.T) {
+	newRenownTestDB(t)
+	uid := id.UserID("@renown_overlay:example")
+	if err := createAdvCharacter(uid, "Overlaid"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := addRenownXP(uid, renownXPPerLevel*5+7); err != nil {
+		t.Fatal(err)
+	}
+	c, err := loadAdvCharacter(uid)
+	if err != nil || c == nil {
+		t.Fatalf("load: %v", err)
+	}
+	if c.RenownXP != renownXPPerLevel*5+7 {
+		t.Errorf("overlay RenownXP = %d, want %d", c.RenownXP, renownXPPerLevel*5+7)
+	}
+	if c.RenownLevel() != 5 {
+		t.Errorf("RenownLevel() = %d, want 5", c.RenownLevel())
+	}
+}
+
+// TestGrantDnDXP_OverflowBecomesRenown — at the cap, grantDnDXP routes overflow
+// into renown_xp and zeroes dnd_xp (the pre-N7 cap invariant is preserved).
+func TestGrantDnDXP_OverflowBecomesRenown(t *testing.T) {
+	newRenownTestDB(t)
+	uid := id.UserID("@renown_grant:example")
+	if err := createAdvCharacter(uid, "Capped"); err != nil {
+		t.Fatal(err)
+	}
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: dndMaxLevel,
+		STR: 16, DEX: 13, CON: 14, INT: 8, WIS: 10, CHA: 12, ArmorClass: 16,
+	}
+	c.HPMax = 100
+	c.HPCurrent = 100
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+
+	p := &AdventurePlugin{}
+	events, err := p.grantDnDXP(uid, renownXPPerLevel+5000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(events) != 0 {
+		t.Errorf("got %d level-up events at cap, want 0", len(events))
+	}
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.Level != dndMaxLevel {
+		t.Errorf("level = %d, want %d", got.Level, dndMaxLevel)
+	}
+	if got.XP != 0 {
+		t.Errorf("dnd_xp = %d, want 0 (overflow moved to renown)", got.XP)
+	}
+	if xp, _ := loadRenownXP(uid); xp != renownXPPerLevel+5000 {
+		t.Errorf("renown_xp = %d, want %d", xp, renownXPPerLevel+5000)
+	}
+	if renownLevelForUser(uid) != 1 {
+		t.Errorf("renown level = %d, want 1", renownLevelForUser(uid))
+	}
+}

internal/plugin/adventure_robbie.go

@@ -164,21 +164,43 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 		gaveCard = true
 	}
 
-	// Update visit count
+	// Update visit count, and every 10th visit leave a small consumable
+	// "for the trouble" (D2 NPC arc).
+	var leftGift *AdvItem
 	char, err := loadAdvCharacter(userID)
 	if err == nil {
 		char.RobbieVisitCount++
+		if char.RobbieVisitCount%robbieGiftEveryNVisits == 0 {
+			// Use the canonical DnD level (like the arena's tier gate), not the
+			// frozen legacy CombatLevel — that snapshots at 1–3 once D&D setup
+			// completes, so reading it here would peg every gift at tier 1.
+			if gifts := consumableCache(robbieGiftTier(arenaDnDLevelOrZero(userID)), 1); len(gifts) > 0 {
+				if err := addAdvInventoryItem(userID, gifts[0]); err == nil {
+					leftGift = &gifts[0]
+				}
+			}
+		}
 		_ = saveAdvCharacter(char)
 		_ = upsertPlayerMetaNPCState(userID, npcStateFromAdvChar(char))
 	}
 
 	// Send DM
-	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard)
+	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard, leftGift)
 	if err := p.SendDM(userID, dm); err != nil {
 		slog.Error("adventure: robbie: failed to send DM", "user", userID, "err", err)
 	}
 
-	// Room announcement
+	// Room announcement — but not for a player who isn't there.
+	//
+	// A bored adventurer (gogobee_boredom_plan.md) auto-harvests ore and junk
+	// into inventory on every run, and Robbie takes all of it, every day. Left
+	// alone, each abandoned character would file a public bulletin every single
+	// day, indefinitely, about somebody who stopped playing weeks ago. He still
+	// visits and still pays — that income is what keeps the neglected adventurer
+	// walking — he just doesn't announce a house with nobody in it.
+	if playerIsIdle(userID, time.Now().UTC()) {
+		return
+	}
 	gr := gamesRoom()
 	if gr != "" {
 		announcement := renderRobbieRoomAnnouncement(displayName, len(takenItems), totalPayout, masterworkTaken, gaveCard)
@@ -191,10 +213,12 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 func robbieQualifyingItems(inv []AdvItem, equip map[EquipmentSlot]*AdvEquipment) []AdvItem {
 	var result []AdvItem
 	for _, item := range inv {
-		// Never touch Arena gear, cards, or consumables. Consumables are a
-		// player-curated stockpile (crafted or dropped); selling them is an
-		// explicit decision the player must make themselves.
-		if item.Type == "ArenaGear" || item.Type == "card" || item.Type == "consumable" {
+		// Never touch Arena gear, cards, consumables, or keys. Consumables are
+		// a player-curated stockpile (crafted or dropped); selling them is an
+		// explicit decision the player must make themselves. Keys are cross-zone
+		// unlock tokens (N5/D4) that must persist in inventory to open their
+		// vault later — sweeping one permanently breaks that unlock.
+		if item.Type == "ArenaGear" || item.Type == "card" || item.Type == "consumable" || item.Type == "key" {
 			continue
 		}
 
@@ -243,7 +267,27 @@ func robbiePlayerHasCard(userID id.UserID) bool {
 
 // ── DM Rendering ─────────────────────────────────────────────────────────────
 
-func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool) string {
+// robbieGiftEveryNVisits is how often Robbie leaves a consumable behind.
+const robbieGiftEveryNVisits = 10
+
+// robbieGiftTier maps a player's combat level to a consumable tier, matching
+// the arena tier bands (1–3 / 4–7 / 8–12 / 13–17 / 18+).
+func robbieGiftTier(level int) int {
+	switch {
+	case level >= 18:
+		return 5
+	case level >= 13:
+		return 4
+	case level >= 8:
+		return 3
+	case level >= 4:
+		return 2
+	default:
+		return 1
+	}
+}
+
+func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool, leftGift *AdvItem) string {
 	var sb strings.Builder
 
 	// Opening
@@ -290,6 +334,12 @@ func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gav
 	}
 	sb.WriteString("\n\n")
 
+	// Every-10th-visit consumable (D2).
+	if leftGift != nil {
+		sb.WriteString(fmt.Sprintf(robbieLeftConsumable, leftGift.Name))
+		sb.WriteString("\n\n")
+	}
+
 	// Closing
 	closing, _ := advPickFlavor(robbieClosings, userID, "robbie_closing")
 	sb.WriteString(closing)

internal/plugin/adventure_scheduler.go

@@ -163,6 +163,7 @@ func (p *AdventurePlugin) sendMorningDMs() {
 		treasures, _ := loadAdvTreasureBonuses(char.UserID)
 		buffs, _ := loadAdvActiveBuffs(char.UserID)
 		bonuses := computeAdvBonuses(treasures, buffs, char.CurrentStreak, false)
+		applyRenownBonuses(bonuses, char.RenownLevel()) // N7/B2 — activity path only, never combat
 		balance := p.euro.GetBalance(char.UserID)
 
 		holidayLabel := ""
@@ -404,8 +405,9 @@ func (p *AdventurePlugin) midnightReset() error {
 		return fmt.Errorf("load chars: %w", err)
 	}
 
-	today := time.Now().UTC().Format("2006-01-02")
-	yesterday := time.Now().UTC().Add(-24 * time.Hour).Format("2006-01-02")
+	now := time.Now().UTC()
+	today := now.Format("2006-01-02")
+	yesterday := now.Add(-24 * time.Hour).Format("2006-01-02")
 
 	// Unified activity oracle — same source the daily report uses. Unions
 	// adventure_activity_log + dnd_zone_run + dnd_expedition_log, so
@@ -420,6 +422,12 @@ func (p *AdventurePlugin) midnightReset() error {
 
 	dmsSent := 0
 	for _, char := range chars {
+		// Advance this player's Shadow (N6/D3) once for the day, before any
+		// streak/idle branching below — the rival runs whether or not the
+		// player did, which is the whole point of the race pressure. Own table,
+		// own idempotency guard; never touches char, never fails the reset.
+		p.advanceShadow(&char)
+
 		// Died inside the window — no shame, no streak change. Covers both
 		// currently-dead players and players revived at midnight (Alive
 		// already flipped to true by the reminder loop before this runs).
@@ -450,25 +458,32 @@ func (p *AdventurePlugin) midnightReset() error {
 			continue
 		}
 
-		// Activity happened on the player's behalf without an explicit tap —
-		// autopilot walked rooms, expedition log gained beats, a fight session
-		// is still locked open. Hold the streak: no bump, no shame, no decay.
-		// The player engaged earlier to kick this off; autopilot is a feature,
-		// not a way to game streaks, and absence of taps shouldn't strip
-		// progress they earned through real play.
-		if len(todayActs[char.UserID]) > 0 || len(yesterdayActs[char.UserID]) > 0 {
-			continue
-		}
-		// Safety net for live state the activity logs don't reflect yet
-		// (e.g. an active expedition that's been quiet today, or a combat
-		// session locked open across midnight without a log append).
-		if exp, err := getActiveExpedition(char.UserID); err != nil {
-			slog.Warn("adventure: failed to check active expedition for idle reaper", "user", char.UserID, "err", err)
-		} else if exp != nil {
-			continue
-		}
-		if hasActiveCombatSession(char.UserID) {
-			continue
+		// Every hold below rests on one premise: the player engaged earlier to
+		// kick this off, so the autopilot finishing the job shouldn't cost them
+		// their streak. A boredom expedition has no such origin — nobody kicked
+		// it off, and its player still hasn't come back. It earns them nothing
+		// and shields them from nothing (gogobee_boredom_plan.md §6).
+		if !isBoredomDriven(char.UserID, now) {
+			// Activity happened on the player's behalf without an explicit tap —
+			// autopilot walked rooms, expedition log gained beats, a fight session
+			// is still locked open. Hold the streak: no bump, no shame, no decay.
+			// The player engaged earlier to kick this off; autopilot is a feature,
+			// not a way to game streaks, and absence of taps shouldn't strip
+			// progress they earned through real play.
+			if len(todayActs[char.UserID]) > 0 || len(yesterdayActs[char.UserID]) > 0 {
+				continue
+			}
+			// Safety net for live state the activity logs don't reflect yet
+			// (e.g. an active expedition that's been quiet today, or a combat
+			// session locked open across midnight without a log append).
+			if exp, err := getActiveExpedition(char.UserID); err != nil {
+				slog.Warn("adventure: failed to check active expedition for idle reaper", "user", char.UserID, "err", err)
+			} else if exp != nil {
+				continue
+			}
+			if hasActiveCombatSession(char.UserID) {
+				continue
+			}
 		}
 
 		// Truly idle — shame DM + streak halve.

internal/plugin/adventure_season.go

@@ -0,0 +1,199 @@
+package plugin
+
+import (
+	"time"
+)
+
+// N7/E4 — Seasonal events (gogobee_engagement_plan.md §E4).
+//
+// A season is a 1-week skin anchored to a real holiday. Unlike isHolidayToday()
+// (a single UTC day, worth a double-action) and unlike the Omen (an ISO-week
+// rotation), a season spans a window around its anchor date and layers three
+// things on top of the world for that week:
+//
+//   1. A themed world modifier — a reskinned Omen that OVERRIDES the weekly
+//      rotation (see activeOmen). It reuses the omen effect fields, so the same
+//      non-combat rule holds: a season never touches SimulateCombat or the turn
+//      engine. That is enforced structurally — activeSeason() honours
+//      simOmenDisabled exactly as activeOmen() does, so the balance sim never
+//      sees a season through any path, and the season Omen only reaches the sim's
+//      omen seams behind activeOmen's own simOmenDisabled guard.
+//   2. A limited-time curio shelf at Luigi's — a curated selection of existing
+//      registry items (dailyCuriosStock). No new power enters the game; the shelf
+//      just changes which items rotate in for the week.
+//   3. A themed visitor on the road — a season-gated ambient event that leaves a
+//      small keepsake and a coin gift (expedition_ambient.go). No combat: the
+//      ambient seam has never opened a fight and this does not change that.
+//
+// A season is a pure function of the UTC date and the anchor calendar, so it
+// needs no schema, no ticker state, and no persistence — the same discipline as
+// the Omen and the holiday calendar.
+
+// seasonHalfWidth is the number of days on each side of the anchor date that the
+// season is live. 3 → a 7-day window (anchor ± 3).
+const seasonHalfWidth = 3
+
+// seasonVisitor is the themed ambient event a season adds to the road. It never
+// resolves combat — it leaves a sellable keepsake and a small coin gift.
+type seasonVisitor struct {
+	Weight        int      // relative weight in the ambient pick
+	FlavorPool    []string // scene narration lines for the visit
+	Keepsake      string   // sellable trophy left behind
+	KeepsakeValue int64    // coin baseline of the keepsake
+	Coins         int      // flat coin gift
+}
+
+// season is one holiday skin.
+type season struct {
+	Key      string                   // stable id (tests, logs)
+	Name     string                   // player-facing, e.g. "Hallowtide"
+	Emoji    string                   // banner emoji
+	Anchor   func(year int) time.Time // the anchor date for a given year (UTC)
+	Blurb    string                   // one-line "what's live this week" banner copy
+	Omen     omen                     // themed override omen (non-combat fields only)
+	CurioIDs []string                 // curated registry IDs for Luigi's shelf
+	Visitor  seasonVisitor            // the road visitor
+}
+
+// fixedAnchor builds an Anchor for a fixed month/day holiday.
+func fixedAnchor(month time.Month, day int) func(int) time.Time {
+	return func(year int) time.Time {
+		return time.Date(year, month, day, 0, 0, 0, 0, time.UTC)
+	}
+}
+
+// seasonTable is the set of anchor holidays that get a skin. Order is match
+// order; the windows are disjoint so it never matters, but keep them disjoint.
+var seasonTable = []season{
+	{
+		Key: "hallowtide", Name: "Hallowtide", Emoji: "🎃",
+		Anchor: fixedAnchor(time.October, 31),
+		Blurb:  "the veil's thin — spooky curios at Luigi's and things going bump on the road, all week",
+		Omen: omen{
+			Key: "hallowtide", Name: "Hallowtide",
+			TwinBee:              "The veil's gone thin for Hallowtide — reagents and oddments are spilling through from somewhere I'd rather not name. I'm grabbing them while they're here.",
+			ConsumableChanceMult: 2.0,
+		},
+		CurioIDs: []string{
+			"cloak_of_arachnida", "demon_armor", "goggles_of_night",
+			"slippers_of_spider_climbing", "staff_of_swarming_insects",
+			"sword_of_life_stealing", "dagger_of_venom", "cloak_of_the_bat",
+		},
+		Visitor: seasonVisitor{
+			Weight: 12,
+			FlavorPool: []string{
+				"A gourd-headed thing shuffles out of the dark, sets a little carved lantern on your bedroll, and shuffles right back into it.",
+				"Something small and many-legged skitters past, drops a trinket at your feet as if in tribute, and is gone before you can look twice.",
+				"A cold draft carries a whisper and a gift — a carved gourd, still faintly warm, left where you'll find it come morning.",
+			},
+			Keepsake: "Carved Gourd Lantern", KeepsakeValue: 60, Coins: 8,
+		},
+	},
+	{
+		Key: "midwinter", Name: "Midwinter Feast", Emoji: "❄️",
+		Anchor: fixedAnchor(time.December, 25),
+		Blurb:  "gifts by every door — a free pack for anyone heading out, warm curios at Luigi's, all week",
+		Omen: omen{
+			Key: "midwinter", Name: "Midwinter Feast",
+			TwinBee:            "It's Midwinter, and someone's been leaving gifts by the outfitter's door. There's a free pack in it for anyone heading out — and I set off in high spirits.",
+			SupplyFreebiePacks: 1,
+			StartMoodBonus:     5,
+		},
+		CurioIDs: []string{
+			"boots_of_the_winterlands", "frost_brand", "ring_of_warmth",
+			"staff_of_frost", "potion_of_healing", "staff_of_healing",
+		},
+		Visitor: seasonVisitor{
+			Weight: 12,
+			FlavorPool: []string{
+				"A bundled figure passes your camp without a word, leaves a frost-glass bauble hanging where the firelight catches it, and trudges on into the snow.",
+				"You wake to find your pack a little heavier — a wrapped bauble and a handful of coin, and a single set of bootprints leading away.",
+				"Bells, faint and far off. By the time they fade there's a bauble on your bedroll that wasn't there before.",
+			},
+			Keepsake: "Frost-Glass Bauble", KeepsakeValue: 60, Coins: 10,
+		},
+	},
+	{
+		Key: "sweethearts", Name: "Sweethearts' Revel", Emoji: "💗",
+		Anchor: fixedAnchor(time.February, 14),
+		Blurb:  "the arena crowd's throwing coin — fat purses, charming curios at Luigi's, all week",
+		Omen: omen{
+			Key: "sweethearts", Name: "Sweethearts' Revel",
+			TwinBee:         "The whole town's giddy for Sweethearts' week — the arena crowd's throwing coin like confetti. Win pretty and the purse pays twenty over the odds.",
+			ArenaPayoutMult: 1.20,
+		},
+		CurioIDs: []string{
+			"eyes_of_charming", "philter_of_love", "staff_of_charming",
+			"luck_blade", "stone_of_good_luck_luckstone", "pearl_of_power",
+			"glamoured_studded_leather",
+		},
+		Visitor: seasonVisitor{
+			Weight: 12,
+			FlavorPool: []string{
+				"A courier in festival colours finds you even out here, presses a ribbon-wrapped token into your hand with a wink, and hurries back the way they came.",
+				"A paper heart, pinned to a token and left on your pack — 'from an admirer,' it says, and nothing else.",
+				"Someone's left a ribbon-wrapped keepsake by the trail marker, addressed to no one and everyone. You pocket it.",
+			},
+			Keepsake: "Ribbon-Wrapped Token", KeepsakeValue: 55, Coins: 10,
+		},
+	},
+	{
+		Key: "first_bloom", Name: "First Bloom", Emoji: "🌷",
+		Anchor: func(year int) time.Time { return easterDate(year) },
+		Blurb:  "everything's growing eager — fuller harvests, green curios at Luigi's, all week",
+		Omen: omen{
+			Key: "first_bloom", Name: "First Bloom",
+			TwinBee:           "First Bloom's on us — everything's growing twice as eager and the woods feel calm with it. Every gather comes up fuller, and the dread's slow to rise.",
+			HarvestYieldBonus: 1,
+			ThreatDriftReduce: 1,
+		},
+		CurioIDs: []string{
+			"bag_of_beans", "potion_of_growth", "potion_of_animal_friendship",
+			"ring_of_animal_influence", "horn_of_valhalla", "sword_of_life_stealing",
+		},
+		Visitor: seasonVisitor{
+			Weight: 12,
+			FlavorPool: []string{
+				"A hare the size of a hound lopes up, regards you with unsettling calm, and leaves a pressed blossom on the ground before bounding off.",
+				"New vines have crept over your gear in the night — and tucked among them, a perfect pressed blossom and a little coin, as if the woods were paying rent.",
+				"The undergrowth parts on its own, sets a spring blossom at your feet, and closes again. You decide not to question it.",
+			},
+			Keepsake: "Pressed Spring Blossom", KeepsakeValue: 50, Coins: 8,
+		},
+	},
+}
+
+// activeSeason returns the season whose window contains today (UTC), or false.
+// Honours simOmenDisabled so the balance sim never observes a season through any
+// path — the same neutralisation activeOmen applies to the weekly rotation.
+func activeSeason() (season, bool) {
+	if simOmenDisabled {
+		return season{}, false
+	}
+	now := time.Now().UTC()
+	today := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
+	return seasonForDate(today)
+}
+
+// seasonForDate is the pure core of activeSeason, split out for tests. The
+// anchor is checked against the target year and its neighbours so a window that
+// straddles a year boundary still resolves.
+func seasonForDate(today time.Time) (season, bool) {
+	for _, s := range seasonTable {
+		for _, yr := range []int{today.Year() - 1, today.Year(), today.Year() + 1} {
+			a := s.Anchor(yr)
+			lo := a.AddDate(0, 0, -seasonHalfWidth)
+			hi := a.AddDate(0, 0, seasonHalfWidth)
+			if !today.Before(lo) && !today.After(hi) {
+				return s, true
+			}
+		}
+	}
+	return season{}, false
+}
+
+// seasonBannerLine is the "what's live this week" one-liner surfaced under the
+// Omen line in the morning DM. Empty when no season is active.
+func seasonBannerLine(s season) string {
+	return s.Emoji + " **" + s.Name + "** is here — " + s.Blurb + "."
+}

internal/plugin/adventure_season_test.go

@@ -0,0 +1,120 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+)
+
+func date(y int, m time.Month, d int) time.Time {
+	return time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+}
+
+// TestSeasonForDate_ActiveOnAnchor — every season resolves on its own anchor day
+// and both window edges (±seasonHalfWidth), and is dark one day past each edge.
+func TestSeasonForDate_ActiveOnAnchor(t *testing.T) {
+	for _, s := range seasonTable {
+		a := s.Anchor(2026)
+		for _, off := range []int{-seasonHalfWidth, 0, seasonHalfWidth} {
+			got, ok := seasonForDate(a.AddDate(0, 0, off))
+			if !ok || got.Key != s.Key {
+				t.Errorf("%s: day offset %d → (%v, %q), want (true, %q)",
+					s.Key, off, ok, got.Key, s.Key)
+			}
+		}
+		for _, off := range []int{-seasonHalfWidth - 1, seasonHalfWidth + 1} {
+			if got, ok := seasonForDate(a.AddDate(0, 0, off)); ok {
+				t.Errorf("%s: day offset %d should be dark, got %q", s.Key, off, got.Key)
+			}
+		}
+	}
+}
+
+// TestSeasonForDate_WindowsDisjoint — no calendar day resolves to two seasons, so
+// the first-match order in seasonForDate never hides overlapping content.
+func TestSeasonForDate_WindowsDisjoint(t *testing.T) {
+	for y := 2024; y <= 2030; y++ {
+		day := date(y, time.January, 1)
+		end := date(y+1, time.January, 1)
+		for day.Before(end) {
+			matches := 0
+			for _, s := range seasonTable {
+				for _, yr := range []int{day.Year() - 1, day.Year(), day.Year() + 1} {
+					a := s.Anchor(yr)
+					if !day.Before(a.AddDate(0, 0, -seasonHalfWidth)) &&
+						!day.After(a.AddDate(0, 0, seasonHalfWidth)) {
+						matches++
+						break
+					}
+				}
+			}
+			if matches > 1 {
+				t.Fatalf("%s resolves to %d seasons (windows must be disjoint)",
+					day.Format("2006-01-02"), matches)
+			}
+			day = day.AddDate(0, 0, 1)
+		}
+	}
+}
+
+// TestSeasonTable_CuratedItemsExist — every curated curio ID is a real registry
+// item, so a season's shelf never lists a phantom the buyer can't purchase. Guards
+// against typos and registry edits (mirrors TestTemperMaterialsAreObtainable).
+func TestSeasonTable_CuratedItemsExist(t *testing.T) {
+	for _, s := range seasonTable {
+		if len(s.CurioIDs) == 0 {
+			t.Errorf("%s has no curated curios", s.Key)
+		}
+		for _, id := range s.CurioIDs {
+			if _, ok := magicItemRegistry[id]; !ok {
+				t.Errorf("%s curio %q is not in magicItemRegistry", s.Key, id)
+			}
+		}
+	}
+}
+
+// TestSeasonTable_OmenIsNonCombat — a season's themed omen carries an effect and
+// only touches the non-combat omen levers, so overriding the weekly rotation with
+// it can never move the combat golden or the balance corpus. §E4/§B3.
+func TestSeasonTable_OmenIsNonCombat(t *testing.T) {
+	for _, s := range seasonTable {
+		o := s.Omen
+		hasEffect := o.HarvestYieldBonus > 0 || o.SupplyFreebiePacks > 0 ||
+			o.StartMoodBonus > 0 || o.ArenaPayoutMult > 1.0 ||
+			o.ConsumableChanceMult > 1.0 || o.ThreatDriftReduce > 0
+		if !hasEffect {
+			t.Errorf("%s omen has no active effect", s.Key)
+		}
+		if o.Name == "" || o.TwinBee == "" {
+			t.Errorf("%s omen missing player-facing copy", s.Key)
+		}
+	}
+}
+
+// TestSeasonTable_VisitorRewardComplete — every season's road visitor has flavor,
+// a named keepsake, and a positive keepsake value, so applyAmbientEffect always
+// has a real reward to grant.
+func TestSeasonTable_VisitorRewardComplete(t *testing.T) {
+	for _, s := range seasonTable {
+		v := s.Visitor
+		if len(v.FlavorPool) == 0 {
+			t.Errorf("%s visitor has no flavor", s.Key)
+		}
+		if v.Keepsake == "" || v.KeepsakeValue <= 0 {
+			t.Errorf("%s visitor keepsake incomplete: %q value %d", s.Key, v.Keepsake, v.KeepsakeValue)
+		}
+		if v.Weight <= 0 {
+			t.Errorf("%s visitor has non-positive weight %d", s.Key, v.Weight)
+		}
+	}
+}
+
+// TestActiveSeason_NeutralizedInSim — the balance sim must never observe a season
+// through any path; activeSeason honours simOmenDisabled exactly as activeOmen does.
+func TestActiveSeason_NeutralizedInSim(t *testing.T) {
+	prev := simOmenDisabled
+	simOmenDisabled = true
+	defer func() { simOmenDisabled = prev }()
+	if s, ok := activeSeason(); ok {
+		t.Fatalf("activeSeason returned %q while simOmenDisabled", s.Key)
+	}
+}

internal/plugin/adventure_secret_room_test.go

@@ -0,0 +1,216 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// registeredSecretNodes collects every NodeKindSecret node across all
+// registered zone graphs, keyed by node ID.
+func registeredSecretNodes(t *testing.T) map[string]ZoneNode {
+	t.Helper()
+	out := map[string]ZoneNode{}
+	for _, z := range allZones() {
+		g, ok := loadZoneGraph(z.ID)
+		if !ok {
+			continue
+		}
+		for id, n := range g.Nodes {
+			if n.Kind == NodeKindSecret {
+				out[id] = n
+			}
+		}
+	}
+	return out
+}
+
+// TestSecretRoomDiscovery_EverySecretHasBespokeFlavor guards that no secret
+// node ships on the generic fallback — every one gets an authored line. Catches
+// a future secret room added without a discovery entry.
+func TestSecretRoomDiscovery_EverySecretHasBespokeFlavor(t *testing.T) {
+	for id, n := range registeredSecretNodes(t) {
+		if _, ok := secretRoomDiscovery[id]; !ok {
+			t.Errorf("secret node %q (%q) has no bespoke discovery line", id, n.Label)
+		}
+		if line := secretRoomDiscoveryLine(n); strings.TrimSpace(line) == "" {
+			t.Errorf("secret node %q produced an empty discovery line", id)
+		}
+	}
+}
+
+func TestSecretRoomDiscoveryLine_FallsBackOnUnknownNode(t *testing.T) {
+	n := ZoneNode{NodeID: "made_up.node", Kind: NodeKindSecret, Label: "Nowhere Nook"}
+	line := secretRoomDiscoveryLine(n)
+	if !strings.Contains(line, "Nowhere Nook") {
+		t.Errorf("fallback should name the node label, got: %s", line)
+	}
+}
+
+// TestSecretRoomKeys_UnlockRealDestinationEdges is the cross-zone-key
+// consistency check: every key's item Name must match a LockKey edge's key_id
+// (lower-cased) in its destination zone, and every source must be a real secret
+// room. A typo between the granted item name and the authored key_id would
+// silently make a vault permanently unreachable; this catches it.
+func TestSecretRoomKeys_UnlockRealDestinationEdges(t *testing.T) {
+	secrets := registeredSecretNodes(t)
+	for srcNode, key := range secretRoomKeys {
+		if _, ok := secrets[srcNode]; !ok {
+			t.Errorf("key source %q is not a registered secret room", srcNode)
+		}
+		g, ok := loadZoneGraph(key.unlocksIn)
+		if !ok {
+			t.Errorf("%s: destination zone %q has no graph", srcNode, key.unlocksIn)
+			continue
+		}
+		wantKeyID := strings.ToLower(key.item.Name)
+		found := false
+		for _, outs := range g.Edges {
+			for _, e := range outs {
+				if e.Lock == LockKey && strings.ToLower(lockDataString(e.LockData, "key_id")) == wantKeyID {
+					found = true
+				}
+			}
+		}
+		if !found {
+			t.Errorf("key %q (from %s) has no LockKey edge with key_id=%q in zone %q — vault unreachable",
+				key.item.Name, srcNode, wantKeyID, key.unlocksIn)
+		}
+	}
+}
+
+// TestCrossZoneKey_UnlocksWithItemNotWithout exercises the runtime lock
+// evaluation end-to-end on a real authored edge.
+func TestCrossZoneKey_UnlocksWithItemNotWithout(t *testing.T) {
+	g, ok := loadZoneGraph(ZoneManorBlackspire)
+	if !ok {
+		t.Fatal("manor graph missing")
+	}
+	var keyEdge ZoneEdge
+	for _, e := range g.outgoingEdges("manor_blackspire.upper_hall") {
+		if e.Lock == LockKey {
+			keyEdge = e
+		}
+	}
+	if keyEdge.To == "" {
+		t.Fatal("no LockKey edge off manor upper_hall")
+	}
+
+	base := edgeUnlockCtx{RunID: "r", FromNode: "manor_blackspire.upper_hall"}
+	if ok, _ := evaluateEdgeLock(keyEdge, base); ok {
+		t.Error("edge should be locked without the key in inventory")
+	}
+
+	withKey := base
+	withKey.InventoryNames = map[string]bool{"sunken sigil": true}
+	if ok, reason := evaluateEdgeLock(keyEdge, withKey); !ok {
+		t.Errorf("edge should unlock with the sigil in inventory, got locked: %s", reason)
+	}
+}
+
+// TestGrantSecretRoomKey_GrantsOnceIdempotent verifies a key-bearing secret
+// hands its key over exactly once.
+func TestGrantSecretRoomKey_GrantsOnceIdempotent(t *testing.T) {
+	townTestDB(t)
+	p := &AdventurePlugin{}
+	u := id.UserID("@keyholder:test.invalid")
+
+	node := ZoneNode{NodeID: "sunken_temple.coral_reliquary", Kind: NodeKindSecret}
+	line := p.grantSecretRoomKey(u, node)
+	if !strings.Contains(line, "Sunken Sigil") {
+		t.Fatalf("first grant should name the key, got: %q", line)
+	}
+
+	items, err := loadAdvInventory(u)
+	if err != nil {
+		t.Fatalf("load inventory: %v", err)
+	}
+	sigils := 0
+	for _, it := range items {
+		if strings.EqualFold(it.Name, "Sunken Sigil") {
+			sigils++
+		}
+	}
+	if sigils != 1 {
+		t.Fatalf("want exactly 1 Sunken Sigil, got %d", sigils)
+	}
+
+	// Second find on a later run must not stack a duplicate.
+	if again := p.grantSecretRoomKey(u, node); again != "" {
+		t.Errorf("re-finding the room should not re-grant the key, got: %q", again)
+	}
+	items, _ = loadAdvInventory(u)
+	sigils = 0
+	for _, it := range items {
+		if strings.EqualFold(it.Name, "Sunken Sigil") {
+			sigils++
+		}
+	}
+	if sigils != 1 {
+		t.Fatalf("still want exactly 1 Sunken Sigil after re-find, got %d", sigils)
+	}
+}
+
+// TestGrantSecretRoomKey_NoKeyForPlainSecret confirms a secret room that carries
+// no cross-zone key stays silent.
+func TestGrantSecretRoomKey_NoKeyForPlainSecret(t *testing.T) {
+	townTestDB(t)
+	p := &AdventurePlugin{}
+	u := id.UserID("@plain:test.invalid")
+	node := ZoneNode{NodeID: "forest_shadows.sapling_shrine", Kind: NodeKindSecret}
+	if line := p.grantSecretRoomKey(u, node); line != "" {
+		t.Errorf("plain secret should grant no key, got: %q", line)
+	}
+}
+
+// TestResolveSecretRoom_GrantsPageCacheAndKey checks the full treasure-cache
+// payout: a journal page, the consumable cache, and (for a key-bearing secret)
+// the cross-zone key — with no combat touching HP.
+func TestResolveSecretRoom_GrantsPageCacheAndKey(t *testing.T) {
+	townTestDB(t)
+	p := &AdventurePlugin{}
+	u := id.UserID("@secret:test.invalid")
+
+	zone, ok := getZone(ZoneSunkenTemple)
+	if !ok {
+		t.Fatal("sunken temple zone missing")
+	}
+	node := ZoneNode{
+		NodeID: "sunken_temple.coral_reliquary", Kind: NodeKindSecret,
+		Label:   "Coral Reliquary",
+		Content: ZoneNodeContent{LootBias: 1.8},
+	}
+	run := &DungeonRun{UserID: string(u), ZoneID: ZoneSunkenTemple, CurrentNode: node.NodeID}
+
+	out := p.resolveSecretRoom(u, run, zone, node)
+	if !strings.Contains(out, "Coral Reliquary") {
+		t.Errorf("outcome should carry the discovery line:\n%s", out)
+	}
+
+	// A journal page was granted (fresh player, nothing found yet).
+	if mask, err := loadJournalPages(u); err != nil || journalPageCount(mask) != 1 {
+		t.Fatalf("want exactly 1 journal page granted, got count=%d err=%v", journalPageCount(mask), err)
+	}
+
+	// The guaranteed cache + the cross-zone key are in inventory.
+	items, err := loadAdvInventory(u)
+	if err != nil {
+		t.Fatalf("load inventory: %v", err)
+	}
+	var caches, keys int
+	for _, it := range items {
+		switch {
+		case it.Type == "key":
+			keys++
+		case it.Type == "consumable":
+			caches++
+		}
+	}
+	if caches != secretRoomCacheCount {
+		t.Errorf("want %d cache consumables, got %d", secretRoomCacheCount, caches)
+	}
+	if keys != 1 {
+		t.Errorf("want the Sunken Sigil key granted, got %d keys", keys)
+	}
+}

internal/plugin/adventure_shadow.go

@@ -0,0 +1,432 @@
+package plugin
+
+import (
+	"database/sql"
+	"fmt"
+	"hash/fnv"
+	"log/slog"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The Shadow (N6/D3) — a per-player simulated rival adventurer. It "runs" the
+// same zone progression the player does, advanced once per UTC day by the
+// midnight ticker at ~1.3x the player's own long-run clear pace, so it stays
+// just ahead: a rival you can always see and always nearly catch.
+//
+// It is pure theatre. There is no Shadow combat, no punishment, no state the
+// player can lose. The only mechanics are race pressure (a morning-briefing
+// line telling you where it is relative to you) and two payoffs at each zone
+// clear: beat the Shadow to a zone and TwinBee crows a little bonus XP; let the
+// Shadow clear it first and it leaves a journal page waiting in the boss room
+// (the D1 campaign tie-in). All Shadow narration TwinBee speaks is first-person,
+// he/him, implicit-subject — the campaign voice rules (feedback_twinbee_voice,
+// feedback_twinbee_is_male). The Shadow itself is referred to as "the Shadow"
+// (or by its name); "he" in TwinBee's lines is TwinBee, never a third-person
+// "TwinBee".
+
+const (
+	// shadowPaceMultiplier keeps the Shadow just ahead: it clears at ~1.3x the
+	// player's own long-run pace.
+	shadowPaceMultiplier = 1.3
+	// shadowMinDailyStep is the floor on a day's advance, so a brand-new or idle
+	// player still watches the rival creep forward rather than sit frozen.
+	shadowMinDailyStep = 0.2
+	// shadowMaxDailyStep caps a day's advance at just under one zone, so even a
+	// prolific player never sees the Shadow clear two zones overnight.
+	shadowMaxDailyStep = 1.0
+	// shadowMaxLead caps how far ahead the Shadow may run — it is a race, not a
+	// runaway. It will never sit more than ~2.5 zones past the player's own count.
+	shadowMaxLead = 2.5
+	// shadowCrowXPPerTier scales the "you beat me here" bonus by zone tier, so a
+	// T5 crow is worth more than a T1 one. Small on purpose (lift, not a spike).
+	shadowCrowXPPerTier = 12
+)
+
+// shadowState mirrors the adventure_shadow row.
+type shadowState struct {
+	UserID       id.UserID
+	Name         string
+	Progress     float64
+	ZonesCleared int
+	PendingMask  int64
+	CrowedMask   int64
+	DayCounter   int
+	LastAdvanced string
+}
+
+// The Shadow walks zoneOrder — the design-doc order the zone registry is built
+// in — start to finish, tier 1 → 5. Bit i of a Shadow's masks is zoneOrder[i].
+
+// shadowZoneIndex returns the progression index of a zone, or -1 if it is not
+// on the path (the arena, an unknown id).
+func shadowZoneIndex(z ZoneID) int {
+	for i, id := range zoneOrder {
+		if id == z {
+			return i
+		}
+	}
+	return -1
+}
+
+func shadowSetBit(mask int64, idx int) int64 {
+	if idx < 0 || idx > 62 {
+		return mask
+	}
+	return mask | (int64(1) << idx)
+}
+
+func shadowClearBit(mask int64, idx int) int64 {
+	if idx < 0 || idx > 62 {
+		return mask
+	}
+	return mask &^ (int64(1) << idx)
+}
+
+func shadowBitSet(mask int64, idx int) bool {
+	if idx < 0 || idx > 62 {
+		return false
+	}
+	return mask&(int64(1)<<idx) != 0
+}
+
+// loadShadow reads a player's Shadow, or (nil, nil) if it hasn't been born yet.
+func loadShadow(userID id.UserID) (*shadowState, error) {
+	s := &shadowState{UserID: userID}
+	err := db.Get().QueryRow(
+		`SELECT name, progress, zones_cleared, pending_mask, crowed_mask, day_counter, last_advanced
+		   FROM adventure_shadow WHERE user_id = ?`,
+		string(userID),
+	).Scan(&s.Name, &s.Progress, &s.ZonesCleared, &s.PendingMask, &s.CrowedMask, &s.DayCounter, &s.LastAdvanced)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+// upsertShadow persists the whole Shadow row. The ticker is the only writer, so
+// a plain last-write-wins upsert is safe — there is no concurrent mutator to
+// race (unlike the player_meta columns a character save also touches).
+func upsertShadow(s *shadowState) error {
+	_, err := db.Get().Exec(
+		`INSERT INTO adventure_shadow
+		   (user_id, name, progress, zones_cleared, pending_mask, crowed_mask, day_counter, last_advanced)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(user_id) DO UPDATE SET
+		   name = excluded.name,
+		   progress = excluded.progress,
+		   zones_cleared = excluded.zones_cleared,
+		   pending_mask = excluded.pending_mask,
+		   crowed_mask = excluded.crowed_mask,
+		   day_counter = excluded.day_counter,
+		   last_advanced = excluded.last_advanced`,
+		string(s.UserID), s.Name, s.Progress, s.ZonesCleared, s.PendingMask,
+		s.CrowedMask, s.DayCounter, s.LastAdvanced,
+	)
+	return err
+}
+
+// shadowNames is the pool the rival's proper name is drawn from — cold,
+// half-familiar names for a thing that shadows you. Picked deterministically
+// from the player's own name so a given player always faces the same Shadow.
+var shadowNames = []string{
+	"Vael", "Corriss", "Mordane", "Ashen", "Locke", "Grimma", "Sable",
+	"Thane", "Wren", "Vesper", "Cael", "Orrin", "Dain", "Wraithe",
+	"Nyx", "Solenne",
+}
+
+// shadowNameFor seeds the Shadow's name from the player's display name so it is
+// stable per player and "seeded from the player's" (D3 spec). Falls back to the
+// user id when the display name is empty.
+func shadowNameFor(displayName string, userID id.UserID) string {
+	seed := strings.ToLower(strings.TrimSpace(displayName))
+	if seed == "" {
+		seed = string(userID)
+	}
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(seed))
+	return shadowNames[int(h.Sum32())%len(shadowNames)]
+}
+
+// newShadow mints a fresh Shadow at the start line.
+func newShadow(userID id.UserID, displayName string) *shadowState {
+	return &shadowState{
+		UserID: userID,
+		Name:   shadowNameFor(displayName, userID),
+	}
+}
+
+// advanceShadow moves a player's Shadow forward one UTC day. Idempotent per day
+// via last_advanced, so the once-a-day midnight guard plus this makes a double
+// tick a no-op. Mints the Shadow on first call. Errors are logged and swallowed
+// — a stalled Shadow is cosmetic, and must never break the midnight reset loop.
+func (p *AdventurePlugin) advanceShadow(char *AdventureCharacter) {
+	today := time.Now().UTC().Format("2006-01-02")
+	s, err := loadShadow(char.UserID)
+	if err != nil {
+		slog.Warn("shadow: load", "user", char.UserID, "err", err)
+		return
+	}
+	if s == nil {
+		s = newShadow(char.UserID, char.DisplayName)
+	}
+	if s.LastAdvanced == today {
+		return // already advanced this UTC day
+	}
+
+	cleared := clearedZoneIDs(db.Get(), char.UserID)
+	playerCount := len(cleared)
+
+	// The player's long-run pace, in zones per day, drives the Shadow's speed.
+	// Floor it so a new/idle player still gets a creeping rival; the 1.3x keeps
+	// the Shadow just ahead; cap the daily step so it never leaps two zones.
+	step := (float64(playerCount) / float64(shadowPlayerAgeDays(char))) * shadowPaceMultiplier
+	if step < shadowMinDailyStep {
+		step = shadowMinDailyStep
+	}
+	if step > shadowMaxDailyStep {
+		step = shadowMaxDailyStep
+	}
+
+	newProg := s.Progress + step
+	// Keep it a race: never more than shadowMaxLead zones past the player's count.
+	if leadCap := float64(playerCount) + shadowMaxLead; newProg > leadCap {
+		newProg = leadCap
+	}
+	if maxProg := float64(len(zoneOrder)); newProg > maxProg {
+		newProg = maxProg
+	}
+	if newProg < s.Progress {
+		newProg = s.Progress // never regress (a lead cap that dropped below current)
+	}
+
+	// Any progression zone the Shadow newly finishes, and the player hasn't,
+	// leaves a page waiting. Compare per-zone (not by count): the Shadow walks
+	// in order while the player may clear out of order, so "did the Shadow clear
+	// zone i first" is a per-zone question.
+	newCleared := int(newProg)
+	if newCleared > len(zoneOrder) {
+		newCleared = len(zoneOrder)
+	}
+	for idx := s.ZonesCleared; idx < newCleared; idx++ {
+		if !cleared[zoneOrder[idx]] {
+			s.PendingMask = shadowSetBit(s.PendingMask, idx)
+		}
+	}
+
+	s.Progress = newProg
+	s.ZonesCleared = newCleared
+	s.DayCounter++
+	s.LastAdvanced = today
+	if err := upsertShadow(s); err != nil {
+		slog.Warn("shadow: advance upsert", "user", char.UserID, "err", err)
+	}
+}
+
+// shadowPlayerAgeDays estimates how many days the player has been adventuring,
+// clamped to at least 1 so a same-day character never divides by zero. Used as
+// the denominator of the player's pace.
+func shadowPlayerAgeDays(char *AdventureCharacter) float64 {
+	if char.CreatedAt.IsZero() {
+		return 1
+	}
+	days := time.Since(char.CreatedAt).Hours() / 24
+	if days < 1 {
+		return 1
+	}
+	return days
+}
+
+// shadowOnPlayerZoneClear is the payoff, fired when the player clears a zone's
+// boss. Three outcomes: the Shadow left a page here (pending bit) → grant the
+// page and clear the bit; the player beat the Shadow to this zone → a crow plus
+// a little bonus XP; or the Shadow already passed through with nothing owed →
+// nothing. Returns the narration line to append to the clear message ("" for
+// the silent case, or when the Shadow hasn't been born yet).
+func (p *AdventurePlugin) shadowOnPlayerZoneClear(userID id.UserID, zoneID ZoneID) string {
+	s, err := loadShadow(userID)
+	if err != nil || s == nil {
+		return ""
+	}
+	idx := shadowZoneIndex(zoneID)
+	if idx < 0 {
+		return ""
+	}
+
+	if shadowBitSet(s.PendingMask, idx) {
+		// The Shadow got here first and left a page. Grant it BEFORE retiring the
+		// debt: grantJournalPage returns "" both when the campaign is already
+		// complete and on a transient DB error, so clear the pending bit only once
+		// the page has actually landed (or the ledger is genuinely full). A
+		// transient failure then leaves the bit set and the next clear retries,
+		// rather than swallowing a page the player earned.
+		pageLine := p.grantJournalPage(userID, nil)
+		mask, _ := loadJournalPages(userID)
+		if pageLine == "" && !journalComplete(mask) {
+			slog.Warn("shadow: waiting page grant failed; leaving debt for retry",
+				"user", userID, "zone", zoneID)
+			return ""
+		}
+		s.PendingMask = shadowClearBit(s.PendingMask, idx)
+		if err := upsertShadow(s); err != nil {
+			// The page is already granted; a failed bit-clear can at worst re-grant
+			// a different unfound page on a later re-clear, which is benign (pages
+			// are collectible and the campaign self-limits). Better than losing it.
+			slog.Warn("shadow: clear pending bit", "user", userID, "zone", zoneID, "err", err)
+		}
+		if pageLine == "" {
+			// Ledger already complete — nothing to leave, but the Shadow was first.
+			return shadowBeatYouHereLine(s)
+		}
+		return shadowLeftPageLine(s) + "\n" + pageLine
+	}
+
+	// No page owed. If the Shadow hasn't reached this zone yet, the player beat
+	// it here — crow and hand over a small bonus, but only once per zone: the
+	// crowed bit makes re-running a not-yet-reached zone unable to farm the XP.
+	if int(s.Progress) <= idx && !shadowBitSet(s.CrowedMask, idx) {
+		xp := shadowCrowXP(zoneID)
+		if _, err := p.grantDnDXP(userID, xp); err != nil {
+			// Don't promise XP we didn't grant, and don't burn the crow — leave the
+			// bit unset so the next clear can crow for real.
+			slog.Warn("shadow: crow xp", "user", userID, "err", err)
+			return ""
+		}
+		s.CrowedMask = shadowSetBit(s.CrowedMask, idx)
+		if err := upsertShadow(s); err != nil {
+			slog.Warn("shadow: set crowed bit", "user", userID, "zone", zoneID, "err", err)
+		}
+		return shadowCrowLine(s, xp)
+	}
+	return ""
+}
+
+// shadowCrowXP is the bonus for beating the Shadow to a zone, scaled by tier.
+func shadowCrowXP(zoneID ZoneID) int {
+	tier := 1
+	if z, ok := getZone(zoneID); ok {
+		tier = int(z.Tier)
+	}
+	if tier < 1 {
+		tier = 1
+	}
+	return tier * shadowCrowXPPerTier
+}
+
+// shadowBriefingLine is the morning-briefing race-pressure beat: where the
+// Shadow stands relative to the player. Deterministic by day so a re-rendered
+// briefing reads the same, and silent until the Shadow has been born and has
+// something to say. TwinBee's voice.
+func (p *AdventurePlugin) shadowBriefingLine(e *Expedition) string {
+	userID := id.UserID(e.UserID)
+	s, err := loadShadow(userID)
+	if err != nil || s == nil {
+		return ""
+	}
+	playerCount := len(clearedZoneIDs(db.Get(), userID))
+	lead := s.ZonesCleared - playerCount
+	return shadowRacePressureLine(s, e.CurrentDay, lead)
+}
+
+// ── Flavour ────────────────────────────────────────────────────────────────
+//
+// TwinBee's voice: first-person, implicit subject, he/him, one line. "The
+// Shadow"/"{name}" is the rival; "I"/"we" is TwinBee and the player. Never the
+// third-person "TwinBee" (guarded by test, same as the journal reactions).
+
+// shadowAheadLines — TwinBee, the Shadow is ahead of us. Race pressure.
+var shadowAheadLines = []string{
+	"Passed the Shadow's camp at dawn — cold ashes, a day old. %s is ahead of us again.",
+	"Found %s's mark cut into a doorframe up ahead. Still warm. We're not gaining.",
+	"%s came through here already. I can smell the pitch of a torch not long snuffed.",
+	"The Shadow's been and gone. %s leaves the doors open behind, like he wants us to know.",
+}
+
+// shadowBehindLines — TwinBee, we're ahead of the Shadow. Earned swagger.
+var shadowBehindLines = []string{
+	"No sign of %s ahead — I think we're out in front for once. Let's keep it that way.",
+	"We've outpaced the Shadow. %s is somewhere behind us, eating our dust. Good.",
+	"Quiet up ahead. %s hasn't reached this deep yet. First ones through.",
+}
+
+// shadowNeckLines — TwinBee, we're level with the Shadow. Tension.
+var shadowNeckLines = []string{
+	"%s is right on our heels — or we're on his. Hard to say who's chasing who now.",
+	"Neck and neck with the Shadow. I keep catching %s at the edge of the torchlight.",
+	"%s is close. Same rooms, hours apart. Whoever clears the next zone first wins the day.",
+}
+
+// shadowRacePressureLine picks a race-pressure line by the day and the Shadow's
+// lead, deterministically. lead > 0: Shadow ahead; lead < 0: player ahead; 0:
+// level.
+func shadowRacePressureLine(s *shadowState, day, lead int) string {
+	var pool []string
+	switch {
+	case lead > 0:
+		pool = shadowAheadLines
+	case lead < 0:
+		pool = shadowBehindLines
+	default:
+		pool = shadowNeckLines
+	}
+	if len(pool) == 0 {
+		return ""
+	}
+	idx := (day + s.DayCounter) % len(pool)
+	if idx < 0 {
+		idx = -idx
+	}
+	return "👤 " + fmt.Sprintf(pool[idx], s.Name)
+}
+
+// shadowLeftPageLine prefaces the waiting journal page: the Shadow cleared this
+// zone first and left a page behind for us. TwinBee's voice.
+func shadowLeftPageLine(s *shadowState) string {
+	return fmt.Sprintf("👤 %s beat us to this one — but left a torn page pinned in the boss's lair, like a note for whoever came next.", s.Name)
+}
+
+// shadowBeatYouHereLine is the page-less acknowledgement (campaign already
+// complete): the Shadow was first, but there's nothing left to find.
+func shadowBeatYouHereLine(s *shadowState) string {
+	return fmt.Sprintf("👤 %s was here before us. Boot-prints in the dust, and nothing left to take. We know how this ends now anyway.", s.Name)
+}
+
+// shadowCrowLine is TwinBee crowing that we beat the Shadow to a zone, with the
+// bonus XP.
+func shadowCrowLine(s *shadowState, xp int) string {
+	return fmt.Sprintf("👤 First ones through — %s is still somewhere behind us. I'd crow if it wouldn't give us away. (**+%d XP**, for beating the Shadow here.)", s.Name, xp)
+}
+
+// handleShadowCmd renders the player's standing against the Shadow. A quiet
+// status view — the feature lives mostly in the briefing and at zone clears.
+func (p *AdventurePlugin) handleShadowCmd(ctx MessageContext) error {
+	s, err := loadShadow(ctx.Sender)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't read the trail just now. Try again in a moment.")
+	}
+	if s == nil {
+		return p.SendDM(ctx.Sender, "👤 No one's shadowing you yet. Clear a zone or two and someone will take an interest.")
+	}
+	playerCount := len(clearedZoneIDs(db.Get(), ctx.Sender))
+	total := len(zoneOrder)
+	var b strings.Builder
+	b.WriteString(fmt.Sprintf("👤 **The Shadow — %s**\n\n", s.Name))
+	b.WriteString(fmt.Sprintf("🏴 **%s's trail:** %d / %d zones cleared\n", s.Name, s.ZonesCleared, total))
+	b.WriteString(fmt.Sprintf("🚩 **Your trail:** %d / %d zones cleared\n", playerCount, total))
+	switch lead := s.ZonesCleared - playerCount; {
+	case lead > 0:
+		b.WriteString(fmt.Sprintf("\n_%s is **%d** ahead. Pages wait where he cleared first — take them back by clearing those zones yourself._", s.Name, lead))
+	case lead < 0:
+		b.WriteString(fmt.Sprintf("\n_You're **%d** ahead. Keep it that way._", -lead))
+	default:
+		b.WriteString("\n_Dead level. The next zone decides who's chasing whom._")
+	}
+	return p.SendDM(ctx.Sender, b.String())
+}

internal/plugin/adventure_shadow_test.go

@@ -0,0 +1,360 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newShadowTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+// freshChar builds a same-day character so shadowPlayerAgeDays reads 1 day.
+func freshChar(user id.UserID) *AdventureCharacter {
+	return &AdventureCharacter{
+		UserID:      user,
+		DisplayName: "Tester",
+		CreatedAt:   time.Now().UTC(),
+	}
+}
+
+func TestShadowName_DeterministicAndInPool(t *testing.T) {
+	user := id.UserID("@name:test.invalid")
+	first := shadowNameFor("Aria", user)
+	if again := shadowNameFor("Aria", user); again != first {
+		t.Errorf("name not deterministic: %q vs %q", first, again)
+	}
+	inPool := false
+	for _, n := range shadowNames {
+		if n == first {
+			inPool = true
+			break
+		}
+	}
+	if !inPool {
+		t.Errorf("generated name %q not in shadowNames pool", first)
+	}
+	// Empty display name falls back to the user id and still yields a pool name.
+	if got := shadowNameFor("", user); got == "" {
+		t.Error("empty display name produced an empty shadow name")
+	}
+}
+
+// TestShadowFlavor_NoThirdPersonTwinBee: every Shadow line TwinBee speaks obeys
+// the campaign voice rule — he never refers to himself in the third person
+// (feedback_twinbee_voice). Same guard the journal reactions carry.
+func TestShadowFlavor_NoThirdPersonTwinBee(t *testing.T) {
+	pools := [][]string{shadowAheadLines, shadowBehindLines, shadowNeckLines}
+	for _, pool := range pools {
+		for _, line := range pool {
+			if strings.Contains(line, "TwinBee") {
+				t.Errorf("third-person TwinBee in Shadow pool line: %q", line)
+			}
+			if !strings.Contains(line, "%s") {
+				t.Errorf("race-pressure line missing the name slot: %q", line)
+			}
+		}
+	}
+	s := &shadowState{Name: "Vael"}
+	rendered := []string{
+		shadowLeftPageLine(s),
+		shadowBeatYouHereLine(s),
+		shadowCrowLine(s, 24),
+		shadowRacePressureLine(s, 3, 1),
+		shadowRacePressureLine(s, 3, -1),
+		shadowRacePressureLine(s, 3, 0),
+	}
+	for _, r := range rendered {
+		if strings.Contains(r, "TwinBee") {
+			t.Errorf("third-person TwinBee in rendered Shadow line: %q", r)
+		}
+		if !strings.Contains(r, "Vael") {
+			t.Errorf("rendered line dropped the Shadow's name: %q", r)
+		}
+	}
+}
+
+func TestShadowRacePressure_Deterministic(t *testing.T) {
+	s := &shadowState{Name: "Vael", DayCounter: 2}
+	first := shadowRacePressureLine(s, 4, 1)
+	if again := shadowRacePressureLine(s, 4, 1); again != first {
+		t.Errorf("race pressure not deterministic: %q vs %q", first, again)
+	}
+	// Direction picks a different pool: ahead vs behind must differ in wording.
+	ahead := shadowRacePressureLine(s, 4, 2)
+	behind := shadowRacePressureLine(s, 4, -2)
+	if ahead == behind {
+		t.Errorf("ahead and behind produced the same line: %q", ahead)
+	}
+}
+
+func TestShadowAdvance_CreepsAndIsIdempotent(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@creep:test.invalid")
+	char := freshChar(user)
+
+	p.advanceShadow(char)
+	s, err := loadShadow(user)
+	if err != nil || s == nil {
+		t.Fatalf("shadow not born: %v", err)
+	}
+	if s.Progress <= 0 {
+		t.Errorf("a born shadow should have crept forward, got progress %v", s.Progress)
+	}
+	if s.Name == "" {
+		t.Error("born shadow has no name")
+	}
+	firstProg := s.Progress
+
+	// Second advance the same UTC day is a no-op.
+	p.advanceShadow(char)
+	s2, _ := loadShadow(user)
+	if s2.Progress != firstProg {
+		t.Errorf("same-day re-advance moved the shadow: %v -> %v", firstProg, s2.Progress)
+	}
+
+	// Roll the clock back a day and it advances again.
+	s2.LastAdvanced = time.Now().UTC().Add(-24 * time.Hour).Format("2006-01-02")
+	if err := upsertShadow(s2); err != nil {
+		t.Fatal(err)
+	}
+	p.advanceShadow(char)
+	s3, _ := loadShadow(user)
+	if s3.Progress <= firstProg {
+		t.Errorf("a new day should have advanced the shadow: %v -> %v", firstProg, s3.Progress)
+	}
+}
+
+func TestShadowAdvance_PendingBitForUnclearedZone(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@pending:test.invalid")
+	char := freshChar(user)
+
+	// Seed the shadow one step short of clearing zone 0, dated yesterday so the
+	// next advance runs. The player has cleared nothing.
+	yesterday := time.Now().UTC().Add(-24 * time.Hour).Format("2006-01-02")
+	seed := newShadow(user, char.DisplayName)
+	seed.Progress = 0.95
+	seed.LastAdvanced = yesterday
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	p.advanceShadow(char)
+	s, _ := loadShadow(user)
+	if s.ZonesCleared < 1 {
+		t.Fatalf("shadow should have cleared zone 0, zones_cleared=%d prog=%v", s.ZonesCleared, s.Progress)
+	}
+	if !shadowBitSet(s.PendingMask, 0) {
+		t.Errorf("shadow cleared zone 0 before the player but left no pending page (mask=%b)", s.PendingMask)
+	}
+}
+
+func TestShadowAdvance_NoPendingWhenPlayerClearedFirst(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@nopending:test.invalid")
+	char := freshChar(user)
+
+	// Player already cleared zone 0.
+	insertClearedExpedition(t, user, zoneOrder[0], ExpeditionStatusComplete, 1, "{}")
+
+	yesterday := time.Now().UTC().Add(-24 * time.Hour).Format("2006-01-02")
+	seed := newShadow(user, char.DisplayName)
+	seed.Progress = 0.95
+	seed.LastAdvanced = yesterday
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	p.advanceShadow(char)
+	s, _ := loadShadow(user)
+	if s.ZonesCleared < 1 {
+		t.Fatalf("shadow should have cleared zone 0, zones_cleared=%d", s.ZonesCleared)
+	}
+	if shadowBitSet(s.PendingMask, 0) {
+		t.Errorf("player cleared zone 0 first — no page should wait (mask=%b)", s.PendingMask)
+	}
+}
+
+func TestShadowAdvance_LeadCapKeepsItARace(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@leadcap:test.invalid")
+	char := freshChar(user) // player has cleared nothing → count 0
+
+	yesterday := time.Now().UTC().Add(-24 * time.Hour).Format("2006-01-02")
+	seed := newShadow(user, char.DisplayName)
+	seed.Progress = shadowMaxLead // already at the cap for a 0-clear player
+	seed.ZonesCleared = 2
+	seed.LastAdvanced = yesterday
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	p.advanceShadow(char)
+	s, _ := loadShadow(user)
+	if s.Progress > shadowMaxLead+0.0001 {
+		t.Errorf("shadow ran past the lead cap: progress %v > %v", s.Progress, shadowMaxLead)
+	}
+}
+
+func TestShadowZoneClear_PendingGrantsWaitingPage(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@page:test.invalid")
+
+	idx := 2
+	seed := newShadow(user, "Tester")
+	seed.Progress = 5
+	seed.ZonesCleared = 5
+	seed.PendingMask = shadowSetBit(0, idx)
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	line := p.shadowOnPlayerZoneClear(user, zoneOrder[idx])
+	if strings.TrimSpace(line) == "" {
+		t.Fatal("a waiting page should have produced a clear-message line")
+	}
+	if !strings.Contains(line, "page") {
+		t.Errorf("expected a journal-page grant in the line, got: %q", line)
+	}
+	// Bit cleared so a re-clear can't re-award.
+	s, _ := loadShadow(user)
+	if shadowBitSet(s.PendingMask, idx) {
+		t.Error("pending bit not cleared after the page was granted")
+	}
+	// The page actually landed.
+	if mask, _ := loadJournalPages(user); journalPageCount(mask) != 1 {
+		t.Errorf("expected exactly one journal page granted, got %d", journalPageCount(mask))
+	}
+
+	// A second clear of the same zone grants nothing more.
+	again := p.shadowOnPlayerZoneClear(user, zoneOrder[idx])
+	if again != "" {
+		t.Errorf("re-clearing a paid-out zone should be silent, got: %q", again)
+	}
+	if mask, _ := loadJournalPages(user); journalPageCount(mask) != 1 {
+		t.Errorf("re-clear granted a second page (count %d)", journalPageCount(mask))
+	}
+}
+
+func TestShadowZoneClear_PlayerFirstCrows(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@crow:test.invalid")
+
+	idx := 3
+	seed := newShadow(user, "Tester")
+	seed.Progress = 0 // shadow hasn't reached this zone
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	line := p.shadowOnPlayerZoneClear(user, zoneOrder[idx])
+	if !strings.Contains(line, "XP") {
+		t.Errorf("beating the shadow should crow a bonus, got: %q", line)
+	}
+	// No page granted on a crow.
+	if mask, _ := loadJournalPages(user); journalPageCount(mask) != 0 {
+		t.Errorf("a crow should not grant a page (count %d)", journalPageCount(mask))
+	}
+	// The crowed bit is set so a re-run of the same not-yet-reached zone can't
+	// farm the XP again — second clear is silent.
+	if s, _ := loadShadow(user); !shadowBitSet(s.CrowedMask, idx) {
+		t.Error("crowed bit not set after the first crow")
+	}
+	if again := p.shadowOnPlayerZoneClear(user, zoneOrder[idx]); again != "" {
+		t.Errorf("re-clearing an already-crowed zone should be silent, got: %q", again)
+	}
+}
+
+func TestShadowZoneClear_ShadowPassedNoDebt(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@passed:test.invalid")
+
+	idx := 1
+	seed := newShadow(user, "Tester")
+	seed.Progress = 5 // well past this zone
+	seed.ZonesCleared = 5
+	seed.PendingMask = 0 // nothing owed here
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+
+	if line := p.shadowOnPlayerZoneClear(user, zoneOrder[idx]); line != "" {
+		t.Errorf("a zone the shadow passed with nothing owed should be silent, got: %q", line)
+	}
+}
+
+func TestShadowZoneClear_SilentBeforeBirth(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@unborn:test.invalid")
+	if line := p.shadowOnPlayerZoneClear(user, zoneOrder[0]); line != "" {
+		t.Errorf("no shadow yet should be silent, got: %q", line)
+	}
+}
+
+func TestShadowBriefingLine_SilentUntilBorn(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	user := id.UserID("@brief:test.invalid")
+	e := &Expedition{UserID: string(user), ZoneID: zoneOrder[0], CurrentDay: 2}
+
+	if line := p.shadowBriefingLine(e); line != "" {
+		t.Errorf("no shadow should mean no briefing line, got: %q", line)
+	}
+
+	seed := newShadow(user, "Tester")
+	seed.ZonesCleared = 2
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+	if line := p.shadowBriefingLine(e); strings.TrimSpace(line) == "" {
+		t.Error("a born shadow should produce a briefing line")
+	}
+}
+
+func TestHandleShadowCmd_DMsStatus(t *testing.T) {
+	newShadowTestDB(t)
+	p := &AdventurePlugin{}
+	sink := installSink(p)
+	user := id.UserID("@cmd:test.invalid")
+
+	// Before birth: a gentle "no one's shadowing you yet".
+	if err := p.handleShadowCmd(MessageContext{Sender: user}); err != nil {
+		t.Fatal(err)
+	}
+	if dms := sink.dmsTo(user); len(dms) != 1 || !strings.Contains(dms[0], "shadowing you yet") {
+		t.Errorf("expected an unborn-shadow DM, got: %v", sink.dmsTo(user))
+	}
+
+	seed := newShadow(user, "Tester")
+	seed.ZonesCleared = 4
+	if err := upsertShadow(seed); err != nil {
+		t.Fatal(err)
+	}
+	if err := p.handleShadowCmd(MessageContext{Sender: user}); err != nil {
+		t.Fatal(err)
+	}
+	dms := sink.dmsTo(user)
+	if len(dms) != 2 || !strings.Contains(dms[1], seed.Name) {
+		t.Errorf("expected a status DM naming the shadow, got: %v", dms)
+	}
+}

internal/plugin/adventure_shop.go

@@ -1146,13 +1146,38 @@ func dailyCuriosStock() []MagicItem {
 	rng := rand.New(rand.NewPCG(seed, seed^0x9e3779b97f4a7c15))
 	rng.Shuffle(len(ids), func(i, j int) { ids[i], ids[j] = ids[j], ids[i] })
 
-	n := curiosStockSize
-	if n > len(ids) {
-		n = len(ids)
+	target := curiosStockSize
+	if target > len(ids) {
+		target = len(ids)
 	}
-	stock := make([]MagicItem, 0, n)
-	for _, id := range ids[:n] {
+	stock := make([]MagicItem, 0, target)
+	seen := make(map[string]bool)
+
+	// N7/E4 — a live season features its curated items at the front of the shelf,
+	// displacing the day's rotation. They are existing registry items, so no
+	// net-new power enters the economy for the week; only which items rotate in.
+	if s, ok := activeSeason(); ok {
+		for _, id := range s.CurioIDs {
+			if mi, ok := magicItemRegistry[id]; ok && !seen[id] {
+				stock = append(stock, mi)
+				seen[id] = true
+			}
+		}
+		if len(stock) > target {
+			target = len(stock)
+		}
+	}
+
+	// Fill the remaining slots from the day's deterministic rotation.
+	for _, id := range ids {
+		if len(stock) >= target {
+			break
+		}
+		if seen[id] {
+			continue
+		}
 		stock = append(stock, magicItemRegistry[id])
+		seen[id] = true
 	}
 	// Stable display order: rarity ascending, then name.
 	sort.Slice(stock, func(i, j int) bool {
@@ -1167,7 +1192,11 @@ func dailyCuriosStock() []MagicItem {
 
 func (p *AdventurePlugin) luigiCuriosView(userID id.UserID, balance float64) string {
 	var sb strings.Builder
-	sb.WriteString("🔮 **Curios** — fresh stock daily at dawn\n")
+	if s, ok := activeSeason(); ok {
+		sb.WriteString(fmt.Sprintf("%s **Curios** — %s stock, this week only\n", s.Emoji, s.Name))
+	} else {
+		sb.WriteString("🔮 **Curios** — fresh stock daily at dawn\n")
+	}
 	sb.WriteString(fmt.Sprintf("💰 Balance: €%.0f\n\n", balance))
 
 	factor := p.shopSessionPriceFactor(userID)

internal/plugin/adventure_temper.go

@@ -140,8 +140,12 @@ func findTemperMaterial(items []AdvItem) (AdvItem, bool) {
 	return AdvItem{}, false
 }
 
-// parseTemperIndex reads a leading 1-indexed number and bounds-checks it.
-func parseTemperIndex(reply string, n int) (int, bool) {
+// parseMenuIndex reads a leading 1-indexed number off a menu reply and returns
+// the bounds-checked 0-indexed position. The single parser behind every "reply
+// with a number from the list" prompt — temper, magic-item equip, masterwork
+// equip. Leading whitespace and any trailing text after the digits are ignored;
+// a reply with no leading digit, or one outside [1, n], returns ok=false.
+func parseMenuIndex(reply string, n int) (int, bool) {
 	idx, parsed := 0, false
 	for _, c := range strings.TrimSpace(reply) {
 		if c < '0' || c > '9' {
@@ -214,7 +218,7 @@ func (p *AdventurePlugin) resolveTemperPick(ctx MessageContext, interaction *adv
 	if strings.EqualFold(reply, "cancel") {
 		return p.SendDM(ctx.Sender, "_The forge keeps burning._ Come back when you've decided.")
 	}
-	idx, ok := parseTemperIndex(reply, len(data.Targets))
+	idx, ok := parseMenuIndex(reply, len(data.Targets))
 	if !ok {
 		p.pending.Store(string(ctx.Sender), interaction)
 		return p.SendDM(ctx.Sender, "Reply with a number from the list, or \"cancel\".")

internal/plugin/adventure_temper_test.go

@@ -346,9 +346,9 @@ func TestParseTemperIndex(t *testing.T) {
 		{"cancel", 3, 0, false},
 	}
 	for _, tc := range tests {
-		got, ok := parseTemperIndex(tc.in, tc.n)
+		got, ok := parseMenuIndex(tc.in, tc.n)
 		if ok != tc.wantOK || (ok && got != tc.want) {
-			t.Errorf("parseTemperIndex(%q, %d) = (%d, %v), want (%d, %v)",
+			t.Errorf("parseMenuIndex(%q, %d) = (%d, %v), want (%d, %v)",
 				tc.in, tc.n, got, ok, tc.want, tc.wantOK)
 		}
 	}

internal/plugin/adventure_town.go

@@ -0,0 +1,487 @@
+package plugin
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+)
+
+// E3 — Surfacing the buried social data. Three read-only registries that
+// render data the game already stores: !town (civic pride + housing + pets),
+// !graveyard (recent deaths), and !rivals board (room-wide duel standings).
+//
+// Leak-check (gogobee_engagement_plan.md §E3): the civic-pride board ranks
+// tax_ledger.total_paid, which is dominated by gambling/shop/arena rake and
+// carries ZERO Misty/Arina donation signal — those debits never touch
+// tax_ledger (adventure_npcs.go routes them through euro.Debit with their own
+// reason strings, counters live in player_meta.misty_*/arina_* columns). So no
+// board here can let a player correlate donations with the hidden NPC buffs.
+
+const (
+	// townCivicBoardLimit caps the civic-pride board.
+	townCivicBoardLimit = 10
+	// townListCap caps the housing/pet showcase lists.
+	townListCap = 15
+	// graveyardLimit caps the graveyard.
+	graveyardLimit = 12
+	// rivalsBoardLimit caps the room-wide rivalry standings.
+	rivalsBoardLimit = 10
+)
+
+// ── Civic pride ──────────────────────────────────────────────────────────────
+
+type civicEntry struct {
+	Name      string
+	TotalPaid int64
+}
+
+// loadCivicPrideBoard returns the top contributors to the community pot by
+// lifetime tax paid. Safe to rank — see the leak-check note above.
+func loadCivicPrideBoard(limit int) ([]civicEntry, error) {
+	rows, err := db.Get().Query(
+		`SELECT COALESCE(NULLIF(c.display_name, ''), t.user_id), t.total_paid
+		   FROM tax_ledger t
+		   LEFT JOIN player_meta c ON c.user_id = t.user_id
+		  WHERE t.total_paid > 0
+		  ORDER BY t.total_paid DESC
+		  LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []civicEntry
+	for rows.Next() {
+		var e civicEntry
+		if err := rows.Scan(&e.Name, &e.TotalPaid); err != nil {
+			return nil, err
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// ── Housing street ───────────────────────────────────────────────────────────
+
+type housingEntry struct {
+	Name string
+	Tier int
+}
+
+// loadHousingStreet returns everyone who owns a house, best homes first.
+func loadHousingStreet(limit int) ([]housingEntry, error) {
+	rows, err := db.Get().Query(
+		`SELECT COALESCE(NULLIF(display_name, ''), user_id), house_tier
+		   FROM player_meta
+		  WHERE house_tier > 0
+		  ORDER BY house_tier DESC, display_name
+		  LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []housingEntry
+	for rows.Next() {
+		var e housingEntry
+		if err := rows.Scan(&e.Name, &e.Tier); err != nil {
+			return nil, err
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// ── Pet showcase ─────────────────────────────────────────────────────────────
+
+type petShowcaseEntry struct {
+	Name      string
+	Type      string
+	Level     int
+	ArmorName string
+}
+
+// loadPetShowcase returns every active pet — both slots — across all players,
+// highest level first. The arrived/chased flags live in the *_flags_json
+// columns, so they're decoded in Go rather than in SQL.
+func loadPetShowcase(limit int) ([]petShowcaseEntry, error) {
+	rows, err := db.Get().Query(
+		`SELECT COALESCE(NULLIF(display_name, ''), user_id),
+		        pet_name, pet_type, pet_level, pet_armor_tier, pet_flags_json,
+		        pet2_name, pet2_type, pet2_level, pet2_armor_tier, pet2_flags_json
+		   FROM player_meta
+		  WHERE pet_type != '' OR pet2_type != ''`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []petShowcaseEntry
+	for rows.Next() {
+		var (
+			owner                         string
+			petName, petType, flagsRaw    string
+			level, armorTier              int
+			pet2Name, pet2Type, flags2Raw string
+			pet2Level, pet2Armor          int
+		)
+		if err := rows.Scan(&owner, &petName, &petType, &level, &armorTier, &flagsRaw,
+			&pet2Name, &pet2Type, &pet2Level, &pet2Armor, &flags2Raw); err != nil {
+			return nil, err
+		}
+		if e, ok := showcaseEntryFor(owner, petName, petType, level, armorTier, flagsRaw); ok {
+			out = append(out, e)
+		}
+		if e, ok := showcaseEntryFor(owner, pet2Name, pet2Type, pet2Level, pet2Armor, flags2Raw); ok {
+			out = append(out, e)
+		}
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	sort.SliceStable(out, func(i, j int) bool {
+		if out[i].Level != out[j].Level {
+			return out[i].Level > out[j].Level
+		}
+		return out[i].Name < out[j].Name
+	})
+	if len(out) > limit {
+		out = out[:limit]
+	}
+	return out, nil
+}
+
+// showcaseEntryFor builds a showcase entry for one pet slot, returning ok=false
+// if the slot is empty or its pet was chased away.
+func showcaseEntryFor(owner, petName, petType string, level, armorTier int, flagsRaw string) (petShowcaseEntry, bool) {
+	if petType == "" {
+		return petShowcaseEntry{}, false
+	}
+	var flags petFlagsJSON
+	if flagsRaw != "" {
+		_ = json.Unmarshal([]byte(flagsRaw), &flags)
+	}
+	if !flags.Arrived || flags.ChasedAway {
+		return petShowcaseEntry{}, false
+	}
+	return petShowcaseEntry{
+		Name:      firstNonEmpty(petName, "an unnamed companion") + " (" + owner + ")",
+		Type:      petType,
+		Level:     level,
+		ArmorName: petArmorName(petType, armorTier),
+	}, true
+}
+
+// petArmorName maps a pet's armor tier to its barding name, or "" for none.
+func petArmorName(petType string, tier int) string {
+	if tier <= 0 {
+		return ""
+	}
+	for _, a := range petArmorDefs(petType) {
+		if a.Tier == tier {
+			return a.Name
+		}
+	}
+	return ""
+}
+
+// ── Graveyard ────────────────────────────────────────────────────────────────
+
+type graveEntry struct {
+	Name          string
+	Source        string // "adventure" | "arena" | ""
+	Location      string
+	LastDeathDate string // "2006-01-02"
+	StillDown     bool   // alive == 0 (inside the 6h respawn window)
+}
+
+// loadGraveyard returns the most recent deaths across all players. Deaths are
+// day-granularity (last_death_date), so ordering falls back to dead_until for
+// the still-in-the-ground; a revived player keeps their last_death_date but
+// clears dead_until.
+func loadGraveyard(limit int) ([]graveEntry, error) {
+	rows, err := db.Get().Query(
+		`SELECT COALESCE(NULLIF(display_name, ''), user_id),
+		        alive, death_source, death_location, last_death_date, dead_until
+		   FROM player_meta
+		  WHERE last_death_date != ''
+		  ORDER BY last_death_date DESC, dead_until DESC
+		  LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []graveEntry
+	for rows.Next() {
+		var (
+			e         graveEntry
+			aliveInt  int
+			deadUntil sql.NullTime
+		)
+		if err := rows.Scan(&e.Name, &aliveInt, &e.Source, &e.Location, &e.LastDeathDate, &deadUntil); err != nil {
+			return nil, err
+		}
+		e.StillDown = aliveInt == 0
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// ── Rivals board ─────────────────────────────────────────────────────────────
+
+type rivalBoardEntry struct {
+	Name       string
+	Wins       int
+	Losses     int
+	LastDuelAt *time.Time
+}
+
+// loadRivalsBoard aggregates adventure_rival_records into room-wide standings.
+// The table is a directed per-pair ledger written from both duellists' sides,
+// so summing a user_id's rows gives that player's total record.
+func loadRivalsBoard(limit int) ([]rivalBoardEntry, error) {
+	rows, err := db.Get().Query(
+		`SELECT COALESCE(NULLIF(c.display_name, ''), r.user_id),
+		        SUM(r.wins), SUM(r.losses), MAX(r.last_duel_at)
+		   FROM adventure_rival_records r
+		   LEFT JOIN player_meta c ON c.user_id = r.user_id
+		  GROUP BY r.user_id
+		  ORDER BY SUM(r.wins) DESC, SUM(r.losses) ASC
+		  LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []rivalBoardEntry
+	for rows.Next() {
+		var (
+			e        rivalBoardEntry
+			lastDuel sql.NullString
+		)
+		if err := rows.Scan(&e.Name, &e.Wins, &e.Losses, &lastDuel); err != nil {
+			return nil, err
+		}
+		// MAX() over a DATETIME column loses SQLite's type affinity and comes
+		// back as text, so parse it by hand rather than scanning a NullTime.
+		if lastDuel.Valid {
+			if t, ok := parseSQLiteTime(lastDuel.String); ok {
+				e.LastDuelAt = &t
+			}
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// ── Rendering (client-free, unit-testable) ───────────────────────────────────
+
+func renderTownRegistry(civic []civicEntry, houses []housingEntry, pets []petShowcaseEntry) string {
+	var sb strings.Builder
+	sb.WriteString("🏛️ **The Town Registry**\n\n")
+
+	sb.WriteString("**Civic Pride** — the guild's most generous coffers-fillers\n")
+	if len(civic) == 0 {
+		sb.WriteString("  _The collection plate is empty. Tragic._\n")
+	} else {
+		for i, e := range civic {
+			sb.WriteString(fmt.Sprintf("  %2d. %-18s %s\n", i+1, truncName(e.Name, 18), fmtEuro(e.TotalPaid)))
+		}
+	}
+	sb.WriteString("\n")
+
+	sb.WriteString("**Housing Street** — who's put down roots\n")
+	if len(houses) == 0 {
+		sb.WriteString("  _Not a single deed on file. A town of drifters._\n")
+	} else {
+		for _, e := range houses {
+			tierName := "a house"
+			if def := houseTierByTier(e.Tier); def != nil {
+				tierName = def.Name
+			}
+			sb.WriteString(fmt.Sprintf("  %-18s  %s\n", truncName(e.Name, 18), tierName))
+		}
+	}
+	sb.WriteString("\n")
+
+	sb.WriteString("**Pet Showcase** — the good companions\n")
+	if len(pets) == 0 {
+		sb.WriteString("  _No pets in town. Somebody adopt something._\n")
+	} else {
+		for _, e := range pets {
+			line := fmt.Sprintf("  %-30s  L%d %s", truncName(e.Name, 30), e.Level, e.Type)
+			if e.ArmorName != "" {
+				line += " · " + e.ArmorName
+			}
+			sb.WriteString(line + "\n")
+		}
+	}
+
+	return strings.TrimRight(sb.String(), "\n")
+}
+
+func renderGraveyard(deaths []graveEntry, now time.Time) string {
+	var sb strings.Builder
+	sb.WriteString("⚰️ **St. Guildmore's Memorial Garden**\n")
+	sb.WriteString("_The groundskeeper tips his hat. \"They gave their all. Well — they gave enough.\"_\n\n")
+
+	if len(deaths) == 0 {
+		sb.WriteString("_Nobody's died lately. The garden's quiet. Enjoy it while it lasts._")
+		return sb.String()
+	}
+
+	for _, e := range deaths {
+		place := e.Location
+		if place == "" {
+			place = "parts unknown"
+		}
+		verb := "fell"
+		if e.Source == "arena" {
+			verb = "fell in the arena"
+		}
+		when := humanizeDeathDate(e.LastDeathDate, now)
+		line := fmt.Sprintf("  ⚰️ **%s** — %s at %s (%s)", truncName(e.Name, 24), verb, place, when)
+		if e.StillDown {
+			line += " · _still resting_"
+		} else {
+			line += " · _back on their feet_"
+		}
+		sb.WriteString(line + "\n")
+	}
+
+	return strings.TrimRight(sb.String(), "\n")
+}
+
+func renderRivalsBoard(board []rivalBoardEntry, now time.Time) string {
+	var sb strings.Builder
+	sb.WriteString("⚔️ **Rivalry Standings** — duels across the guild\n\n")
+
+	if len(board) == 0 {
+		sb.WriteString("_No duels on record. A suspiciously peaceful town._")
+		return sb.String()
+	}
+
+	for i, e := range board {
+		last := "—"
+		if e.LastDuelAt != nil {
+			last = humanizeDaysAgo(*e.LastDuelAt, now)
+		}
+		sb.WriteString(fmt.Sprintf("  %2d. %-18s %dW - %dL   last duel: %s\n",
+			i+1, truncName(e.Name, 18), e.Wins, e.Losses, last))
+	}
+
+	return strings.TrimRight(sb.String(), "\n")
+}
+
+// ── Small render helpers ─────────────────────────────────────────────────────
+
+func truncName(s string, max int) string {
+	r := []rune(s)
+	if len(r) <= max {
+		return s
+	}
+	if max <= 1 {
+		return string(r[:max])
+	}
+	return string(r[:max-1]) + "…"
+}
+
+func firstNonEmpty(s, fallback string) string {
+	if strings.TrimSpace(s) == "" {
+		return fallback
+	}
+	return s
+}
+
+// parseSQLiteTime parses a SQLite CURRENT_TIMESTAMP string ("2006-01-02
+// 15:04:05", UTC), tolerating an RFC3339 variant. Aggregates like MAX() strip
+// the column's type affinity so the driver hands back text.
+func parseSQLiteTime(s string) (time.Time, bool) {
+	for _, layout := range []string{"2006-01-02 15:04:05", time.RFC3339} {
+		if t, err := time.Parse(layout, s); err == nil {
+			return t.UTC(), true
+		}
+	}
+	return time.Time{}, false
+}
+
+// humanizeDaysAgo renders a duel/event time as "today" / "1 day ago" / "N days
+// ago", matching the inline style in handleRivalsCmd.
+func humanizeDaysAgo(t, now time.Time) string {
+	days := int(now.Sub(t).Hours() / 24)
+	switch {
+	case days <= 0:
+		return "today"
+	case days == 1:
+		return "1 day ago"
+	default:
+		return fmt.Sprintf("%d days ago", days)
+	}
+}
+
+// humanizeDeathDate renders a "2006-01-02" death date relative to now. Falls
+// back to the raw string if it doesn't parse.
+func humanizeDeathDate(dateStr string, now time.Time) string {
+	t, err := time.Parse("2006-01-02", dateStr)
+	if err != nil {
+		if dateStr == "" {
+			return "some time ago"
+		}
+		return dateStr
+	}
+	days := int(now.UTC().Truncate(24*time.Hour).Sub(t).Hours() / 24)
+	switch {
+	case days <= 0:
+		return "today"
+	case days == 1:
+		return "yesterday"
+	default:
+		return fmt.Sprintf("%d days ago", days)
+	}
+}
+
+// ── Handlers ─────────────────────────────────────────────────────────────────
+
+func (p *AdventurePlugin) handleTownCmd(ctx MessageContext) error {
+	civic, err := loadCivicPrideBoard(townCivicBoardLimit)
+	if err != nil {
+		return err
+	}
+	houses, err := loadHousingStreet(townListCap)
+	if err != nil {
+		return err
+	}
+	pets, err := loadPetShowcase(townListCap)
+	if err != nil {
+		return err
+	}
+	return p.SendReply(ctx.RoomID, ctx.EventID, renderTownRegistry(civic, houses, pets))
+}
+
+func (p *AdventurePlugin) handleGraveyardCmd(ctx MessageContext) error {
+	deaths, err := loadGraveyard(graveyardLimit)
+	if err != nil {
+		return err
+	}
+	return p.SendReply(ctx.RoomID, ctx.EventID, renderGraveyard(deaths, time.Now().UTC()))
+}
+
+// handleRivalsTopCmd routes the top-level !rivals command: "!rivals board" is
+// the room-wide standings; anything else defers to the per-user record view.
+func (p *AdventurePlugin) handleRivalsTopCmd(ctx MessageContext, args string) error {
+	if strings.EqualFold(strings.TrimSpace(args), "board") {
+		board, err := loadRivalsBoard(rivalsBoardLimit)
+		if err != nil {
+			return err
+		}
+		return p.SendReply(ctx.RoomID, ctx.EventID, renderRivalsBoard(board, time.Now().UTC()))
+	}
+	return p.handleRivalsCmd(ctx)
+}

internal/plugin/adventure_town_test.go

@@ -0,0 +1,234 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func townTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+// TestTownLoaders_ExerciseRealSchema seeds each source table and runs every
+// loader against a real DB, catching column typos / GROUP BY errors that the
+// pure render tests can't.
+func TestTownLoaders_ExerciseRealSchema(t *testing.T) {
+	townTestDB(t)
+
+	alice := id.UserID("@alice:test.invalid")
+	bob := id.UserID("@bob:test.invalid")
+
+	if err := upsertPlayerMetaDisplayName(alice, "Alice"); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertPlayerMetaDisplayName(bob, "Bob"); err != nil {
+		t.Fatal(err)
+	}
+
+	// Civic pride.
+	trackTaxPaid(alice, 5000)
+	trackTaxPaid(bob, 100)
+	civic, err := loadCivicPrideBoard(townCivicBoardLimit)
+	if err != nil {
+		t.Fatalf("loadCivicPrideBoard: %v", err)
+	}
+	if len(civic) != 2 || civic[0].Name != "Alice" || civic[0].TotalPaid != 5000 {
+		t.Fatalf("civic board wrong: %+v", civic)
+	}
+
+	// Housing street.
+	if err := upsertPlayerMetaHouseState(alice, HouseState{Tier: 4}); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertPlayerMetaHouseState(bob, HouseState{Tier: 1}); err != nil {
+		t.Fatal(err)
+	}
+	houses, err := loadHousingStreet(townListCap)
+	if err != nil {
+		t.Fatalf("loadHousingStreet: %v", err)
+	}
+	if len(houses) != 2 || houses[0].Tier != 4 {
+		t.Fatalf("housing street wrong: %+v", houses)
+	}
+
+	// Pet showcase — only arrived, non-chased pets appear.
+	if err := upsertPlayerMetaPetState(alice, PetState{Type: "dog", Name: "Rex", Level: 5, ArmorTier: 2, Arrived: true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertPlayerMetaPetState(bob, PetState{Type: "cat", Name: "Ghost", Level: 3, Arrived: true, ChasedAway: true}); err != nil {
+		t.Fatal(err)
+	}
+	pets, err := loadPetShowcase(townListCap)
+	if err != nil {
+		t.Fatalf("loadPetShowcase: %v", err)
+	}
+	if len(pets) != 1 || !strings.Contains(pets[0].Name, "Rex") || pets[0].ArmorName != "Chain Dog Barding" {
+		t.Fatalf("pet showcase wrong (chased-away pet should be hidden): %+v", pets)
+	}
+
+	// Graveyard.
+	deadUntil := time.Now().Add(6 * time.Hour).UTC()
+	if err := upsertPlayerMetaDeathState(alice, DeathState{
+		Alive: false, DeadUntil: &deadUntil, LastDeathDate: "2026-07-10",
+		DeathSource: "arena", DeathLocation: "the Colosseum",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	graves, err := loadGraveyard(graveyardLimit)
+	if err != nil {
+		t.Fatalf("loadGraveyard: %v", err)
+	}
+	if len(graves) != 1 || graves[0].Name != "Alice" || !graves[0].StillDown || graves[0].Source != "arena" {
+		t.Fatalf("graveyard wrong: %+v", graves)
+	}
+
+	// Rivals board — directed pair ledger summed per user.
+	upsertRivalRecord(alice, bob, true)
+	upsertRivalRecord(alice, bob, true)
+	upsertRivalRecord(bob, alice, false)
+	board, err := loadRivalsBoard(rivalsBoardLimit)
+	if err != nil {
+		t.Fatalf("loadRivalsBoard: %v", err)
+	}
+	if len(board) != 2 || board[0].Name != "Alice" || board[0].Wins != 2 {
+		t.Fatalf("rivals board wrong: %+v", board)
+	}
+}
+
+func TestRenderTownRegistry_AllThreeBoards(t *testing.T) {
+	civic := []civicEntry{{Name: "Alice", TotalPaid: 1234567}, {Name: "Bob", TotalPaid: 500}}
+	houses := []housingEntry{{Name: "Alice", Tier: 4}, {Name: "Bob", Tier: 1}}
+	pets := []petShowcaseEntry{{Name: "Rex (Alice)", Type: "dog", Level: 7, ArmorName: "Plate Dog Barding"}}
+
+	out := renderTownRegistry(civic, houses, pets)
+
+	for _, want := range []string{
+		"Civic Pride", "€1,234,567", "Alice",
+		"Housing Street", "Established", "Base House",
+		"Pet Showcase", "Rex (Alice)", "L7 dog", "Plate Dog Barding",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("town registry missing %q\n---\n%s", want, out)
+		}
+	}
+}
+
+func TestRenderTownRegistry_EmptyBoardsDontPanic(t *testing.T) {
+	out := renderTownRegistry(nil, nil, nil)
+	for _, want := range []string{"Civic Pride", "Housing Street", "Pet Showcase"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("empty registry missing header %q", want)
+		}
+	}
+}
+
+func TestPetArmorName(t *testing.T) {
+	if got := petArmorName("dog", 0); got != "" {
+		t.Errorf("tier 0 should be no armor, got %q", got)
+	}
+	if got := petArmorName("dog", 3); got != "Plate Dog Barding" {
+		t.Errorf("dog tier 3 = %q, want Plate Dog Barding", got)
+	}
+	if got := petArmorName("cat", 5); got != "Dragonscale Cat Armor" {
+		t.Errorf("cat tier 5 = %q, want Dragonscale Cat Armor", got)
+	}
+	if got := petArmorName("dog", 99); got != "" {
+		t.Errorf("out-of-range tier should be empty, got %q", got)
+	}
+}
+
+func TestRenderGraveyard_StillDownVsRecovered(t *testing.T) {
+	now := time.Date(2026, 7, 10, 12, 0, 0, 0, time.UTC)
+	deaths := []graveEntry{
+		{Name: "Alice", Source: "arena", Location: "the Colosseum", LastDeathDate: "2026-07-10", StillDown: true},
+		{Name: "Bob", Source: "adventure", Location: "", LastDeathDate: "2026-07-08", StillDown: false},
+	}
+	out := renderGraveyard(deaths, now)
+
+	if !strings.Contains(out, "fell in the arena") {
+		t.Errorf("arena death should read distinctly\n%s", out)
+	}
+	if !strings.Contains(out, "parts unknown") {
+		t.Errorf("blank location should fall back\n%s", out)
+	}
+	if !strings.Contains(out, "still resting") {
+		t.Errorf("Alice is still down\n%s", out)
+	}
+	if !strings.Contains(out, "back on their feet") {
+		t.Errorf("Bob has recovered\n%s", out)
+	}
+	if !strings.Contains(out, "today") || !strings.Contains(out, "2 days ago") {
+		t.Errorf("relative dates missing\n%s", out)
+	}
+}
+
+func TestRenderGraveyard_Empty(t *testing.T) {
+	out := renderGraveyard(nil, time.Now())
+	if !strings.Contains(out, "garden's quiet") {
+		t.Errorf("empty graveyard should be flavored\n%s", out)
+	}
+}
+
+func TestRenderRivalsBoard_OrdersAndFormats(t *testing.T) {
+	now := time.Date(2026, 7, 10, 12, 0, 0, 0, time.UTC)
+	yesterday := now.Add(-24 * time.Hour)
+	board := []rivalBoardEntry{
+		{Name: "Alice", Wins: 9, Losses: 2, LastDuelAt: &yesterday},
+		{Name: "Bob", Wins: 3, Losses: 5, LastDuelAt: nil},
+	}
+	out := renderRivalsBoard(board, now)
+
+	if !strings.Contains(out, "9W - 2L") {
+		t.Errorf("Alice's record missing\n%s", out)
+	}
+	if !strings.Contains(out, "1 day ago") {
+		t.Errorf("relative last-duel missing\n%s", out)
+	}
+	if !strings.Contains(out, "last duel: —") {
+		t.Errorf("Bob has no recorded duel time\n%s", out)
+	}
+	// Alice ranks above Bob.
+	if strings.Index(out, "Alice") > strings.Index(out, "Bob") {
+		t.Errorf("board should be ordered by wins\n%s", out)
+	}
+}
+
+func TestHumanizeDeathDate(t *testing.T) {
+	now := time.Date(2026, 7, 10, 6, 0, 0, 0, time.UTC)
+	cases := map[string]string{
+		"2026-07-10": "today",
+		"2026-07-09": "yesterday",
+		"2026-07-05": "5 days ago",
+		"":           "some time ago",
+		"garbage":    "garbage",
+	}
+	for in, want := range cases {
+		if got := humanizeDeathDate(in, now); got != want {
+			t.Errorf("humanizeDeathDate(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestTruncName(t *testing.T) {
+	if got := truncName("short", 18); got != "short" {
+		t.Errorf("short name unchanged, got %q", got)
+	}
+	long := truncName("this-is-a-very-long-display-name", 10)
+	if len([]rune(long)) != 10 {
+		t.Errorf("truncated to %d runes, want 10: %q", len([]rune(long)), long)
+	}
+	if !strings.HasSuffix(long, "…") {
+		t.Errorf("truncated name should end with ellipsis: %q", long)
+	}
+}

internal/plugin/adventure_treasure.go

@@ -50,6 +50,26 @@ var advTreasureDropRates = map[int]float64{
 
 const advMaxTreasures = 3
 
+// houseTierTrophyRoom is the T3 "Comfortable" house that unlocks the trophy
+// room — a fourth treasure slot.
+const houseTierTrophyRoom = 3
+
+// maxTreasuresForTier returns how many treasures a player may hold. The base
+// cap is 3; a T3+ house adds the trophy-room slot for a 4th.
+//
+// The extra slot is a housing perk, but HouseTier is only ever written upward
+// (purchase paths; there is no foreclosure/downgrade that writes it back down),
+// so a player can only ever hold a 4th treasure while tier>=3. There is
+// therefore no reachable state where a held treasure must be revoked at
+// bonus-computation time, and the cap is enforced only at the save gate.
+func maxTreasuresForTier(houseTier int) int {
+	n := advMaxTreasures
+	if houseTier >= houseTierTrophyRoom {
+		n++
+	}
+	return n
+}
+
 // ── Treasure Definitions ─────────────────────────────────────────────────────
 
 var advAllTreasures = map[int][]AdvTreasureDef{

internal/plugin/adventure_treasure_test.go

@@ -79,3 +79,13 @@ func TestAdvLocForZone(t *testing.T) {
 		t.Errorf("name = %q, want the zone's display name", loc.Name)
 	}
 }
+
+// TestMaxTreasuresForTier pins the T3 "trophy room" 4th slot: the base cap is
+// 3, and only a tier-3+ home lifts it to 4.
+func TestMaxTreasuresForTier(t *testing.T) {
+	for tier, want := range map[int]int{0: 3, 1: 3, 2: 3, 3: 4, 4: 4} {
+		if got := maxTreasuresForTier(tier); got != want {
+			t.Errorf("maxTreasuresForTier(%d) = %d, want %d", tier, got, want)
+		}
+	}
+}

internal/plugin/adventure_twinbee.go

@@ -40,7 +40,7 @@ func twinBeeMaxTier() int {
 		if !c.Alive {
 			continue
 		}
-		combined := dndLevelForUser(c.UserID) + c.MiningSkill + c.ForagingSkill + c.FishingSkill
+		combined := combinedAdvLevel(&c)
 		if combined > bestLevel {
 			bestLevel = combined
 		}
@@ -283,7 +283,7 @@ func (p *AdventurePlugin) distributeTwinBeeRewards(result *TwinBeeResult) TwinBe
 		weight := 4 // minimum (level 1 in all 4 skills)
 		for _, c := range chars {
 			if c.UserID == uid {
-				weight = dndLevelForUser(c.UserID) + c.MiningSkill + c.ForagingSkill + c.FishingSkill
+				weight = combinedAdvLevel(&c)
 				if weight < 4 {
 					weight = 4
 				}

internal/plugin/adventure_vault.go

@@ -0,0 +1,133 @@
+package plugin
+
+import (
+	"fmt"
+	"strings"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// N4/E1 — the Tier-4 "Established" home unlocks a vault: a fixed pool of slots
+// that shelters items from `!sell all`, crafting, and combat consumption. It is
+// pure storage — a vaulted item drops out of every play surface (loadAdvInventory
+// filters it) until it is taken back — and the plumbing E2 gifting builds on.
+const (
+	vaultCapacity     = 10 // slots an Established home provides
+	vaultMinHouseTier = 4  // Tier 4 "Established" gates the vault
+)
+
+// vaultUnlocked reports whether the character's house tier grants a vault, and a
+// player-facing refusal line when it does not.
+func vaultUnlocked(char *AdventureCharacter) (bool, string) {
+	if char.HouseTier >= vaultMinHouseTier {
+		return true, ""
+	}
+	return false, "🔒 A vault comes with an **Established** home (Tier 4). Upgrade your house at `!thom` to unlock " +
+		fmt.Sprintf("%d slots of protected storage — vaulted items are safe from `!sell all` and never spent in combat.", vaultCapacity)
+}
+
+// handleVaultCmd routes `!adventure vault [store|take] <item>`. The reply-building
+// core is client-free (renderVault / vaultStoreItem / vaultTakeItem) so it is
+// unit-testable without a Matrix stub; the handler only loads the character and
+// sends the result.
+func (p *AdventurePlugin) handleVaultCmd(ctx MessageContext, args string) error {
+	char, _, err := p.ensureCharacter(ctx.Sender)
+	if err != nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Failed to load your character. Try `!adventure` to create one first.")
+	}
+	if !char.Alive {
+		return p.SendDM(ctx.Sender, "You're dead. The vault stays locked.")
+	}
+	if ok, refusal := vaultUnlocked(char); !ok {
+		return p.SendDM(ctx.Sender, refusal)
+	}
+
+	lower := strings.ToLower(strings.TrimSpace(args))
+	var reply string
+	switch {
+	case lower == "" || lower == "list":
+		reply = renderVault(ctx.Sender)
+	case strings.HasPrefix(lower, "store "):
+		// Serialize a player's own store/take so two near-simultaneous stores
+		// can't both pass the capacity check and overfill the vault.
+		userMu := p.advUserLock(ctx.Sender)
+		userMu.Lock()
+		reply = vaultStoreItem(ctx.Sender, strings.TrimSpace(args[len("store "):]))
+		userMu.Unlock()
+	case strings.HasPrefix(lower, "take "):
+		userMu := p.advUserLock(ctx.Sender)
+		userMu.Lock()
+		reply = vaultTakeItem(ctx.Sender, strings.TrimSpace(args[len("take "):]))
+		userMu.Unlock()
+	default:
+		reply = "Usage: `!adventure vault` to view · `!adventure vault store <item>` · `!adventure vault take <item>`."
+	}
+	return p.SendDM(ctx.Sender, reply)
+}
+
+// renderVault shows what is stowed and how many slots remain.
+func renderVault(userID id.UserID) string {
+	items, err := loadAdvVault(userID)
+	if err != nil {
+		return "The vault door won't budge. Try again in a moment."
+	}
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("🏛️ **Your Vault** — %d / %d slots\n\n", len(items), vaultCapacity))
+	if len(items) == 0 {
+		sb.WriteString("Empty. `!adventure vault store <item>` to shelter something from sale or use.")
+		return sb.String()
+	}
+	for _, it := range items {
+		name := it.Name
+		if it.Temper > 0 {
+			name = fmt.Sprintf("%s +%d", name, it.Temper)
+		}
+		sb.WriteString(fmt.Sprintf("• %s — €%d\n", name, it.Value))
+	}
+	sb.WriteString("\n`!adventure vault take <item>` to bring one back into play.")
+	return sb.String()
+}
+
+// vaultStoreItem moves one matching inventory item into the vault. Guards the
+// capacity and reports the fresh slot count so the player never has to re-list.
+func vaultStoreItem(userID id.UserID, query string) string {
+	if query == "" {
+		return "Store what? `!adventure vault store <item>`."
+	}
+	if advVaultCount(userID) >= vaultCapacity {
+		return fmt.Sprintf("The vault is full (%d / %d). Take something out first with `!adventure vault take <item>`.", vaultCapacity, vaultCapacity)
+	}
+	items, err := loadAdvInventory(userID)
+	if err != nil {
+		return "Couldn't reach your inventory. Try again in a moment."
+	}
+	match := findInventoryMatch(items, query)
+	if match == nil {
+		return fmt.Sprintf("No inventory item matches %q. Check `!adventure inventory`.", query)
+	}
+	moved, err := setItemVaulted(userID, match.ID, true)
+	if err != nil || !moved {
+		return "Couldn't stow that item. Try again in a moment."
+	}
+	return fmt.Sprintf("🏛️ Stowed **%s** in the vault. %d / %d slots used.", match.Name, advVaultCount(userID), vaultCapacity)
+}
+
+// vaultTakeItem returns one matching vaulted item to the active inventory.
+func vaultTakeItem(userID id.UserID, query string) string {
+	if query == "" {
+		return "Take what? `!adventure vault take <item>`."
+	}
+	items, err := loadAdvVault(userID)
+	if err != nil {
+		return "The vault door won't budge. Try again in a moment."
+	}
+	match := findInventoryMatch(items, query)
+	if match == nil {
+		return fmt.Sprintf("Nothing in the vault matches %q. Check `!adventure vault`.", query)
+	}
+	moved, err := setItemVaulted(userID, match.ID, false)
+	if err != nil || !moved {
+		return "Couldn't retrieve that item. Try again in a moment."
+	}
+	return fmt.Sprintf("Took **%s** out of the vault and back into your pack. %d / %d slots used.", match.Name, advVaultCount(userID), vaultCapacity)
+}

internal/plugin/adventure_vault_test.go

@@ -0,0 +1,138 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func vaultTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+func seedVaultItem(t *testing.T, user id.UserID, name string, value int64) {
+	t.Helper()
+	if err := addAdvInventoryItem(user, AdvItem{Name: name, Type: "treasure", Tier: 3, Value: value}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestVaultStoreTakeRoundTrip: an item vaulted leaves the active inventory and
+// joins the vault; taken back, it reverses exactly.
+func TestVaultStoreTakeRoundTrip(t *testing.T) {
+	vaultTestDB(t)
+	user := id.UserID("@vault:test.invalid")
+	seedVaultItem(t, user, "Jeweled Crown", 5000)
+
+	if got := vaultStoreItem(user, "crown"); !strings.Contains(got, "Stowed") {
+		t.Fatalf("store reply = %q, want a stow confirmation", got)
+	}
+
+	inv, _ := loadAdvInventory(user)
+	if len(inv) != 0 {
+		t.Fatalf("active inventory = %d items, want 0 (item is vaulted)", len(inv))
+	}
+	vault, _ := loadAdvVault(user)
+	if len(vault) != 1 || vault[0].Name != "Jeweled Crown" {
+		t.Fatalf("vault = %+v, want the crown", vault)
+	}
+
+	if got := vaultTakeItem(user, "crown"); !strings.Contains(got, "back into your pack") {
+		t.Fatalf("take reply = %q, want a retrieval confirmation", got)
+	}
+	inv, _ = loadAdvInventory(user)
+	if len(inv) != 1 {
+		t.Fatalf("active inventory = %d items, want 1 after take", len(inv))
+	}
+	if n := advVaultCount(user); n != 0 {
+		t.Fatalf("vault count = %d, want 0", n)
+	}
+}
+
+// TestVaultCapacity: the 10th item stores, the 11th is refused, and the refusal
+// leaves the item in the active inventory.
+func TestVaultCapacity(t *testing.T) {
+	vaultTestDB(t)
+	user := id.UserID("@vaultcap:test.invalid")
+	for i := 0; i < vaultCapacity; i++ {
+		seedVaultItem(t, user, "Gem", 100)
+		if got := vaultStoreItem(user, "Gem"); !strings.Contains(got, "Stowed") {
+			t.Fatalf("store %d reply = %q, want success", i, got)
+		}
+	}
+	if n := advVaultCount(user); n != vaultCapacity {
+		t.Fatalf("vault count = %d, want %d", n, vaultCapacity)
+	}
+
+	seedVaultItem(t, user, "Overflow Gem", 100)
+	got := vaultStoreItem(user, "Overflow Gem")
+	if !strings.Contains(got, "full") {
+		t.Fatalf("11th store reply = %q, want a full-vault refusal", got)
+	}
+	// The refused item is still in play.
+	inv, _ := loadAdvInventory(user)
+	if len(inv) != 1 || inv[0].Name != "Overflow Gem" {
+		t.Fatalf("active inventory = %+v, want the overflow gem left in play", inv)
+	}
+}
+
+// TestVaultShieldsFromSellAll: `!sell all` liquidates loadAdvInventory, which a
+// vaulted item is no longer part of — the whole point of the vault.
+func TestVaultShieldsFromSellAll(t *testing.T) {
+	vaultTestDB(t)
+	user := id.UserID("@vaultsell:test.invalid")
+	seedVaultItem(t, user, "Heirloom", 9000)
+	seedVaultItem(t, user, "Junk", 5)
+
+	if got := vaultStoreItem(user, "Heirloom"); !strings.Contains(got, "Stowed") {
+		t.Fatalf("store reply = %q", got)
+	}
+	// What sell-all would consume:
+	sellable, _ := loadAdvInventory(user)
+	if len(sellable) != 1 || sellable[0].Name != "Junk" {
+		t.Fatalf("sellable inventory = %+v, want only Junk (heirloom sheltered)", sellable)
+	}
+}
+
+// TestVaultGate: below Tier 4 the vault is locked; at Tier 4 it opens.
+func TestVaultGate(t *testing.T) {
+	locked := &AdventureCharacter{HouseTier: 3}
+	if ok, msg := vaultUnlocked(locked); ok || msg == "" {
+		t.Fatalf("tier 3: ok=%v msg=%q, want locked with a refusal", ok, msg)
+	}
+	open := &AdventureCharacter{HouseTier: 4}
+	if ok, msg := vaultUnlocked(open); !ok || msg != "" {
+		t.Fatalf("tier 4: ok=%v msg=%q, want unlocked", ok, msg)
+	}
+}
+
+// TestSetItemVaultedIsOwnerScoped: another user's id cannot be flipped.
+func TestSetItemVaultedIsOwnerScoped(t *testing.T) {
+	vaultTestDB(t)
+	owner := id.UserID("@owner:test.invalid")
+	intruder := id.UserID("@intruder:test.invalid")
+	seedVaultItem(t, owner, "Relic", 1000)
+	items, _ := loadAdvInventory(owner)
+	if len(items) != 1 {
+		t.Fatalf("setup: owner inventory = %d, want 1", len(items))
+	}
+	moved, err := setItemVaulted(intruder, items[0].ID, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if moved {
+		t.Fatalf("intruder moved the owner's item; want no-op")
+	}
+	if advVaultCount(owner) != 0 {
+		t.Fatalf("owner's item was vaulted by an intruder")
+	}
+}

internal/plugin/adventure_well_rested.go

@@ -0,0 +1,110 @@
+package plugin
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Well-rested — a long rest taken at a home of tier 2+ grants a temporary buff
+// that lasts until the next long rest. Renting a room at Thom Krooke's inn does
+// not: the perk exists to give owning (and upgrading) a house a payoff the inn
+// can't match, and it turns the dead T3/T4 prestige tiers into something worth
+// buying.
+//
+// Two halves, both scaling with house tier (2 < 3 < 4):
+//   - wellRestedTempHP: a temporary hit-point cushion, layered above MaxHP for
+//     the day's fights via applyDnDHPScaling; and
+//   - wellRestedSlotBonus: bonus spell slots folded into the caster's pool at
+//     their highest available slot level.
+//
+// The tuning below is deliberately generous toward casters, who trail on
+// spell-pool richness — the bonus slots are the substantive reward and the
+// temp HP is a lighter feel-good cushion. All values are tunable.
+//
+// Nothing here is a secret discovery mechanic (cf. Misty/Arina), so the rest
+// message surfaces exactly what was granted.
+
+// homeRestTempHPPct maps house tier → temp-HP fraction of MaxHP.
+func homeRestTempHPPct(houseTier int) float64 {
+	switch {
+	case houseTier >= 4:
+		return 0.16
+	case houseTier >= 3:
+		return 0.12
+	case houseTier >= 2:
+		return 0.08
+	default:
+		return 0
+	}
+}
+
+// homeRestBonusSlots maps house tier → number of bonus spell slots.
+func homeRestBonusSlots(houseTier int) int {
+	switch {
+	case houseTier >= 4:
+		return 3
+	case houseTier >= 3:
+		return 2
+	case houseTier >= 2:
+		return 1
+	default:
+		return 0
+	}
+}
+
+// wellRestedTempHP returns the temporary HP granted by a home long rest at the
+// given house tier. Tier 1 and the inn grant none. Always at least 1 when the
+// tier qualifies, so a low-HP character still sees the buff.
+func wellRestedTempHP(hpMax, houseTier int) int {
+	pct := homeRestTempHPPct(houseTier)
+	if pct <= 0 {
+		return 0
+	}
+	hp := int(float64(hpMax) * pct)
+	if hp < 1 {
+		hp = 1
+	}
+	return hp
+}
+
+// wellRestedSlotBonus returns the temporary bonus spell slots granted by a home
+// long rest, placed entirely at the caster's highest available slot level (the
+// most valuable, and one a caster is guaranteed to have). Tier 1, the inn, and
+// non-casters (empty pool) grant none.
+func wellRestedSlotBonus(houseTier int, pool map[int]int) map[int]int {
+	n := homeRestBonusSlots(houseTier)
+	if n == 0 || len(pool) == 0 {
+		return nil
+	}
+	highest := 0
+	for lvl := range pool {
+		if lvl > highest {
+			highest = lvl
+		}
+	}
+	if highest == 0 {
+		return nil
+	}
+	return map[int]int{highest: n}
+}
+
+// wellRestedSummary renders the player-facing description of a granted buff,
+// e.g. "+18 temp HP, +2 level-5 spell slots". Returns "" when nothing was
+// granted (tier 1, the inn, or a non-caster with no temp HP).
+func wellRestedSummary(tempHP int, slotBonus map[int]int) string {
+	var bits []string
+	if tempHP > 0 {
+		bits = append(bits, fmt.Sprintf("+%d temp HP", tempHP))
+	}
+	for lvl, n := range slotBonus {
+		if n <= 0 {
+			continue
+		}
+		plural := ""
+		if n != 1 {
+			plural = "s"
+		}
+		bits = append(bits, fmt.Sprintf("+%d level-%d spell slot%s", n, lvl, plural))
+	}
+	return strings.Join(bits, ", ")
+}

internal/plugin/adventure_well_rested_test.go

@@ -0,0 +1,192 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func TestWellRestedTempHP_ByTier(t *testing.T) {
+	cases := []struct {
+		tier, hpMax, want int
+	}{
+		{0, 100, 0},  // no house
+		{1, 100, 0},  // tier-1 shack: nothing
+		{2, 100, 8},  // 8%
+		{3, 100, 12}, // 12%
+		{4, 100, 16}, // 16%
+		{2, 3, 1},    // rounds to <1 → floored to 1
+	}
+	for _, c := range cases {
+		if got := wellRestedTempHP(c.hpMax, c.tier); got != c.want {
+			t.Errorf("wellRestedTempHP(hpMax=%d, tier=%d) = %d, want %d", c.hpMax, c.tier, got, c.want)
+		}
+	}
+}
+
+func TestWellRestedSlotBonus_PlacesAtHighestLevel(t *testing.T) {
+	pool := map[int]int{1: 4, 2: 3, 3: 2} // highest available = 3
+
+	if got := wellRestedSlotBonus(1, pool); got != nil {
+		t.Errorf("tier 1 → %v, want nil", got)
+	}
+	if got := wellRestedSlotBonus(0, pool); got != nil {
+		t.Errorf("tier 0 → %v, want nil", got)
+	}
+	if got := wellRestedSlotBonus(3, nil); got != nil {
+		t.Errorf("non-caster (nil pool) → %v, want nil", got)
+	}
+
+	for tier, wantN := range map[int]int{2: 1, 3: 2, 4: 3} {
+		got := wellRestedSlotBonus(tier, pool)
+		if len(got) != 1 || got[3] != wantN {
+			t.Errorf("tier %d → %v, want {3: %d}", tier, got, wantN)
+		}
+	}
+}
+
+func TestApplyDnDHPScaling_TempHPCushion(t *testing.T) {
+	// Golden-safety: TempHP==0 must leave a full-HP character untouched
+	// (StartHP stays 0 = "enter at MaxHP", MaxHP unchanged).
+	stats := CombatStats{MaxHP: 100, HPBonus: 10}
+	full := &DnDCharacter{HPMax: 100, HPCurrent: 100, TempHP: 0}
+	applyDnDHPScaling(&stats, full)
+	if stats.MaxHP != 100 || stats.StartHP != 0 {
+		t.Fatalf("TempHP=0 full HP: MaxHP=%d StartHP=%d, want 100/0", stats.MaxHP, stats.StartHP)
+	}
+
+	// Full HP + cushion: MaxHP grows by TempHP, StartHP stays the sentinel so
+	// combat enters at the bumped max (full + cushion).
+	stats = CombatStats{MaxHP: 100, HPBonus: 10}
+	rested := &DnDCharacter{HPMax: 100, HPCurrent: 100, TempHP: 15}
+	applyDnDHPScaling(&stats, rested)
+	if stats.MaxHP != 115 || stats.StartHP != 0 {
+		t.Fatalf("full HP + cushion: MaxHP=%d StartHP=%d, want 115/0", stats.MaxHP, stats.StartHP)
+	}
+
+	// Wounded + cushion: entry HP is current + gear bonus + cushion, MaxHP grows.
+	stats = CombatStats{MaxHP: 100, HPBonus: 10}
+	wounded := &DnDCharacter{HPMax: 100, HPCurrent: 40, TempHP: 15}
+	applyDnDHPScaling(&stats, wounded)
+	if stats.MaxHP != 115 || stats.StartHP != 65 { // 40 + 10 + 15
+		t.Fatalf("wounded + cushion: MaxHP=%d StartHP=%d, want 115/65", stats.MaxHP, stats.StartHP)
+	}
+}
+
+func TestApplyLongRestSpellSlots_GrantAndExpiry(t *testing.T) {
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatalf("db.Init: %v", err)
+	}
+	t.Cleanup(db.Close)
+
+	uid := id.UserID("@rested_caster:example")
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassCleric, Level: 5,
+		STR: 10, DEX: 12, CON: 14, INT: 10, WIS: 16, CHA: 10,
+	}
+	c.HPMax = computeMaxHP(c.Class, abilityModifier(c.CON), c.Level)
+	c.HPCurrent = c.HPMax
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatalf("SaveDnDCharacter: %v", err)
+	}
+	if err := setSpellSlotsForCharacter(c); err != nil {
+		t.Fatalf("setSpellSlotsForCharacter: %v", err)
+	}
+
+	base, _ := getSpellSlots(uid)
+	if len(base) == 0 {
+		t.Fatal("cleric L5 should have a base slot pool")
+	}
+	highest := 0
+	for lvl := range base {
+		if lvl > highest {
+			highest = lvl
+		}
+	}
+
+	// Home rest at tier 4 → +3 at highest level, used reset to 0.
+	bonus, err := applyLongRestSpellSlots(c, 4)
+	if err != nil {
+		t.Fatalf("applyLongRestSpellSlots(tier4): %v", err)
+	}
+	if bonus[highest] != 3 {
+		t.Fatalf("tier-4 bonus = %v, want {%d: 3}", bonus, highest)
+	}
+	after, _ := getSpellSlots(uid)
+	if after[highest][0] != base[highest][0]+3 {
+		t.Errorf("highest total = %d, want base+3 = %d", after[highest][0], base[highest][0]+3)
+	}
+	for lvl, pair := range after {
+		if pair[1] != 0 {
+			t.Errorf("slot L%d used = %d after rest, want 0", lvl, pair[1])
+		}
+	}
+
+	// Next rest at the inn (tier 0) → bonus expires, totals back to base.
+	if _, err := applyLongRestSpellSlots(c, 0); err != nil {
+		t.Fatalf("applyLongRestSpellSlots(tier0): %v", err)
+	}
+	reset, _ := getSpellSlots(uid)
+	for lvl, pair := range reset {
+		if pair[0] != base[lvl][0] {
+			t.Errorf("L%d total = %d after expiry, want base %d", lvl, pair[0], base[lvl][0])
+		}
+	}
+
+	// Tier-1 house grants nothing.
+	if bonus, _ := applyLongRestSpellSlots(c, 1); bonus != nil {
+		t.Errorf("tier-1 bonus = %v, want nil", bonus)
+	}
+}
+
+func TestApplyLongRestSpellSlots_NonCaster(t *testing.T) {
+	if err := db.Init(t.TempDir()); err != nil {
+		t.Fatalf("db.Init: %v", err)
+	}
+	t.Cleanup(db.Close)
+
+	uid := id.UserID("@rested_fighter:example")
+	c := &DnDCharacter{UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: 5, CON: 14}
+	c.HPMax = computeMaxHP(c.Class, abilityModifier(c.CON), c.Level)
+	c.HPCurrent = c.HPMax
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatalf("SaveDnDCharacter: %v", err)
+	}
+
+	bonus, err := applyLongRestSpellSlots(c, 4)
+	if err != nil {
+		t.Fatalf("applyLongRestSpellSlots: %v", err)
+	}
+	if bonus != nil {
+		t.Errorf("non-caster bonus = %v, want nil", bonus)
+	}
+	if slots, _ := getSpellSlots(uid); len(slots) != 0 {
+		t.Errorf("non-caster has %d slot rows, want 0", len(slots))
+	}
+}
+
+// TestHomeWorkshop pins the T3 workshop craft bonus and its effect on the
+// success-rate cap.
+func TestHomeWorkshop(t *testing.T) {
+	for tier, want := range map[int]float64{0: 0, 1: 0, 2: 0, 3: 0.05, 4: 0.05} {
+		if got := homeWorkshopCraftBonus(tier); got != want {
+			t.Errorf("homeWorkshopCraftBonus(%d) = %.2f, want %.2f", tier, got, want)
+		}
+	}
+	// No workshop: base cap holds at 0.95 for a maxed forager.
+	if got := craftingSuccessRate(100, 1, 0); got != 0.95 {
+		t.Errorf("maxed forager, no workshop = %.3f, want 0.95", got)
+	}
+	// Workshop lifts the cap to 0.98.
+	if got := craftingSuccessRate(100, 1, 0.05); got != 0.98 {
+		t.Errorf("maxed forager, workshop = %.3f, want 0.98", got)
+	}
+	// Mid-level forager gets the flat +5% added below the cap.
+	base := craftingSuccessRate(15, 10, 0)
+	withShop := craftingSuccessRate(15, 10, 0.05)
+	if diff := withShop - base; diff < 0.049 || diff > 0.051 {
+		t.Errorf("workshop delta = %.3f, want ~0.05", diff)
+	}
+}

internal/plugin/adventure_worldboss.go

@@ -0,0 +1,785 @@
+package plugin
+
+import (
+	"database/sql"
+	"fmt"
+	"hash/fnv"
+	"log/slog"
+	"sort"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// World boss (N6/C3) — the monthly communal "Siege". A named boss camps outside
+// town for a fixed window with a single shared HP pool. Every player gets one
+// bout per day against it (an arena-style fight through runZoneCombat); the
+// damage they deal is subtracted from the shared pool whether the individual
+// bout is won or lost. The pool falling to zero defeats the boss; the window
+// lapsing with the pool still up means the boss survives and loots the town.
+//
+// Economy (decisions locked 2026-07-10): a defeat pays every contributor from a
+// freshly minted bounty scaled by fights fought (not damage — accessibility),
+// plus a consumable cache and one low-rate treasure roll each; a survival debits
+// the community pot as a tribute (a sink the economy wants). The bout itself
+// costs real HP the way the arena does — no restore — but never permadeaths.
+//
+// The event lives in its own tables (world_boss / world_boss_contrib), outside
+// the saveAdvCharacter fan-out, so a character save can never clobber the shared
+// pool — the same structural isolation adventure_shadow earns.
+
+const (
+	// worldBossWindow is how long the boss camps outside town once it spawns.
+	worldBossWindow = 72 * time.Hour
+	// worldBossPresenceDays is the any-chat presence lookback used to size the
+	// boss to the community that will actually fight it
+	// (feedback_presence_is_any_chat).
+	worldBossPresenceDays = 14
+	// worldBossMinTier floors the boss tier — the Siege is always a serious
+	// fight, never a T1/T2 pushover, even for a low-level town.
+	worldBossMinTier = 3
+	// worldBossBoutsPerPlayer sizes the shared pool: expected full-damage bouts
+	// to fell the boss ≈ activePlayers × this. Higher = a longer siege that needs
+	// more of the town to turn up. Tunable; watch prod turnout.
+	worldBossBoutsPerPlayer = 2.0
+	// worldBossMinBouts / worldBossMaxBouts clamp the pool so a near-empty town
+	// still gets a beatable boss and a huge town doesn't get an unkillable one.
+	worldBossMinBouts = 4
+	worldBossMaxBouts = 60
+	// worldBossDefeatBaseEuro is the minted bounty a single fight earns a
+	// contributor on a defeat; total payout = base × fights fought.
+	worldBossDefeatBaseEuro = 1500
+	// worldBossTributePct is the fraction of the community pot the boss loots on
+	// a survival — a visible pot sink.
+	worldBossTributePct = 0.20
+	// worldBossTreasureWeight is the (low) weight of the single treasure roll each
+	// contributor gets on a defeat.
+	worldBossTreasureWeight = advTreasureWeightElite
+	// worldBossCacheSize is how many tier consumables each contributor is handed
+	// on a defeat.
+	worldBossCacheSize = 2
+)
+
+// worldBossState mirrors an active world_boss row.
+type worldBossState struct {
+	ID        int64
+	Name      string
+	Tier      int
+	HPMax     int
+	HPCurrent int
+	Status    string // active | defeated | survived
+	StartsAt  time.Time
+	EndsAt    time.Time
+}
+
+// worldBossContrib mirrors a world_boss_contrib row — one player's tally against
+// one boss.
+type worldBossContrib struct {
+	BossID        int64
+	UserID        id.UserID
+	Fights        int
+	Damage        int
+	LastFightDate string
+}
+
+// worldBossNames is the pool a Siege boss is named from — big, ancient,
+// town-threatening things. Picked deterministically per event so a given month's
+// boss reads the same to everyone.
+var worldBossNames = []string{
+	"Gorloth the Sunderer", "The Ashen Wyrm", "Kravok, Maw of the Deep",
+	"Nyxaris the Devouring", "The Iron Colossus", "Ssath'ra, Coil of Ruin",
+	"Ymirok the Frostbound", "The Hollow Leviathan", "Dravmaug, Ender of Walls",
+	"The Bone Cathedral", "Vornath the Insatiable", "The Screaming Tide",
+}
+
+// worldBossNameFor picks a stable boss name from an event key (the spawn month),
+// so the same Siege always reads by the same name.
+func worldBossNameFor(eventKey string) string {
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(eventKey))
+	return worldBossNames[int(h.Sum32())%len(worldBossNames)]
+}
+
+// ── Persistence ──────────────────────────────────────────────────────────────
+
+func scanWorldBoss(row interface{ Scan(...any) error }) (*worldBossState, error) {
+	b := &worldBossState{}
+	err := row.Scan(&b.ID, &b.Name, &b.Tier, &b.HPMax, &b.HPCurrent, &b.Status, &b.StartsAt, &b.EndsAt)
+	if err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+// loadActiveWorldBoss returns the live Siege, or (nil, nil) if none is camped.
+func loadActiveWorldBoss() (*worldBossState, error) {
+	b, err := scanWorldBoss(db.Get().QueryRow(
+		`SELECT id, name, tier, hp_max, hp_current, status, starts_at, ends_at
+		   FROM world_boss WHERE status = 'active' ORDER BY id DESC LIMIT 1`))
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+// loadWorldBoss reads one boss by id (history included). (nil, nil) if absent.
+func loadWorldBoss(bossID int64) (*worldBossState, error) {
+	b, err := scanWorldBoss(db.Get().QueryRow(
+		`SELECT id, name, tier, hp_max, hp_current, status, starts_at, ends_at
+		   FROM world_boss WHERE id = ?`, bossID))
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+// insertWorldBoss writes a fresh active boss and returns its id.
+func insertWorldBoss(name string, tier, hpMax int, startsAt, endsAt time.Time) (int64, error) {
+	res, err := db.Get().Exec(
+		`INSERT INTO world_boss (name, tier, hp_max, hp_current, status, starts_at, ends_at)
+		 VALUES (?, ?, ?, ?, 'active', ?, ?)`,
+		name, tier, hpMax, hpMax, startsAt, endsAt)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+// applyWorldBossDamage subtracts damage from the shared pool atomically, clamped
+// at zero, only while the boss is still active. Returns the pool's new value and
+// whether the pool is now down (killed). The UPDATE and the re-read are separate
+// statements, so two concurrent killers can BOTH observe killed=true — that is
+// fine: resolveWorldBossDefeated dedupes on the status='active' guard in
+// setWorldBossStatus, so only one payout ever fires. killed is just "should the
+// caller attempt resolution".
+func applyWorldBossDamage(bossID int64, dmg int) (remaining int, killed bool, err error) {
+	if dmg < 0 {
+		dmg = 0
+	}
+	_, err = db.Get().Exec(
+		`UPDATE world_boss SET hp_current = MAX(0, hp_current - ?)
+		   WHERE id = ? AND status = 'active'`, dmg, bossID)
+	if err != nil {
+		return 0, false, err
+	}
+	b, err := loadWorldBoss(bossID)
+	if err != nil || b == nil {
+		return 0, false, err
+	}
+	return b.HPCurrent, b.HPCurrent <= 0 && b.Status == "active", nil
+}
+
+// setWorldBossStatus closes out a boss (defeated | survived) and stamps
+// resolved_at. Guarded on status='active' so a double resolution is a no-op.
+func setWorldBossStatus(bossID int64, status string) (bool, error) {
+	res, err := db.Get().Exec(
+		`UPDATE world_boss SET status = ?, resolved_at = CURRENT_TIMESTAMP
+		   WHERE id = ? AND status = 'active'`, status, bossID)
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n == 1, nil
+}
+
+// upsertWorldBossContrib bumps a player's tally against a boss.
+func upsertWorldBossContrib(bossID int64, userID id.UserID, dmg int, dateKey string) error {
+	_, err := db.Get().Exec(
+		`INSERT INTO world_boss_contrib (boss_id, user_id, fights, damage, last_fight_date)
+		 VALUES (?, ?, 1, ?, ?)
+		 ON CONFLICT(boss_id, user_id) DO UPDATE SET
+		   fights = fights + 1,
+		   damage = damage + excluded.damage,
+		   last_fight_date = excluded.last_fight_date`,
+		bossID, string(userID), dmg, dateKey)
+	return err
+}
+
+// loadWorldBossContrib reads one player's tally, or (nil, nil) if they haven't
+// fought this boss.
+func loadWorldBossContrib(bossID int64, userID id.UserID) (*worldBossContrib, error) {
+	c := &worldBossContrib{BossID: bossID, UserID: userID}
+	err := db.Get().QueryRow(
+		`SELECT fights, damage, last_fight_date FROM world_boss_contrib
+		   WHERE boss_id = ? AND user_id = ?`, bossID, string(userID)).
+		Scan(&c.Fights, &c.Damage, &c.LastFightDate)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// loadWorldBossContribs reads every contributor to a boss, ordered by fights
+// desc then damage desc (the board order).
+func loadWorldBossContribs(bossID int64) ([]worldBossContrib, error) {
+	rows, err := db.Get().Query(
+		`SELECT user_id, fights, damage, last_fight_date FROM world_boss_contrib
+		   WHERE boss_id = ? ORDER BY fights DESC, damage DESC`, bossID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []worldBossContrib
+	for rows.Next() {
+		c := worldBossContrib{BossID: bossID}
+		var uid string
+		if err := rows.Scan(&uid, &c.Fights, &c.Damage, &c.LastFightDate); err != nil {
+			return nil, err
+		}
+		c.UserID = id.UserID(uid)
+		out = append(out, c)
+	}
+	return out, rows.Err()
+}
+
+// ── Scaling ──────────────────────────────────────────────────────────────────
+
+// activePlayerIDs returns the user ids that have chatted (any message, not just
+// commands) in the last `days` days — the any-chat presence signal
+// (feedback_presence_is_any_chat), read off the streaks plugin's daily_activity
+// table.
+func activePlayerIDs(days int) ([]id.UserID, error) {
+	cutoff := time.Now().UTC().AddDate(0, 0, -days).Format("2006-01-02")
+	rows, err := db.Get().Query(
+		`SELECT DISTINCT user_id FROM daily_activity WHERE date >= ?`, cutoff)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []id.UserID
+	for rows.Next() {
+		var uid string
+		if err := rows.Scan(&uid); err != nil {
+			return nil, err
+		}
+		out = append(out, id.UserID(uid))
+	}
+	return out, rows.Err()
+}
+
+// combinedAdvLevel is the same "how strong is this adventurer" reducer TwinBee
+// uses — combat level plus the three gathering skills.
+func combinedAdvLevel(c *AdventureCharacter) int {
+	return dndLevelForUser(c.UserID) + c.MiningSkill + c.ForagingSkill + c.FishingSkill
+}
+
+// medianInt returns the median of a sorted-or-not int slice (0 for empty).
+func medianInt(xs []int) int {
+	if len(xs) == 0 {
+		return 0
+	}
+	s := append([]int(nil), xs...)
+	sort.Ints(s)
+	mid := len(s) / 2
+	if len(s)%2 == 1 {
+		return s[mid]
+	}
+	return (s[mid-1] + s[mid]) / 2
+}
+
+// tierForCombinedLevel buckets a combined adventure level to a zone tier, floored
+// at worldBossMinTier. Same thresholds as twinBeeMaxTier (combined 12 → T4,
+// 21 → T5), applied here to the median rather than the max.
+func tierForCombinedLevel(level int) int {
+	switch {
+	case level >= 21:
+		return 5
+	case level >= 12:
+		return 4
+	default:
+		return worldBossMinTier
+	}
+}
+
+// groupInt renders an int with thousands separators (no currency symbol),
+// reusing fmtEuro's grouping.
+func groupInt(n int) string {
+	return strings.TrimPrefix(fmtEuro(n), "€")
+}
+
+// worldBossSpawnPlan computes the boss's tier and pool HP from the players active
+// in the presence window. Returns the tier, HP, and the active-player count that
+// drove the sizing (0 players ⇒ a floor boss so a manual spawn still works).
+func worldBossSpawnPlan() (tier, hpMax, activeN int) {
+	ids, err := activePlayerIDs(worldBossPresenceDays)
+	if err != nil {
+		slog.Warn("worldboss: active player lookup failed", "err", err)
+	}
+	active := make(map[id.UserID]bool, len(ids))
+	for _, uid := range ids {
+		active[uid] = true
+	}
+	chars, err := loadAllAdvCharacters()
+	if err != nil {
+		slog.Warn("worldboss: char load failed", "err", err)
+	}
+	var levels []int
+	for i := range chars {
+		c := &chars[i]
+		if !active[c.UserID] || !c.Alive {
+			continue
+		}
+		levels = append(levels, combinedAdvLevel(c))
+	}
+	activeN = len(levels)
+	tier = tierForCombinedLevel(medianInt(levels))
+
+	bouts := int(float64(max(activeN, 1)) * worldBossBoutsPerPlayer)
+	if bouts < worldBossMinBouts {
+		bouts = worldBossMinBouts
+	}
+	if bouts > worldBossMaxBouts {
+		bouts = worldBossMaxBouts
+	}
+	perBout, _, _, _, _ := arenaTierBaseStats(tier)
+	hpMax = perBout * bouts
+	return tier, hpMax, activeN
+}
+
+// worldBossTemplate builds the disposable per-bout enemy stat block. The shared
+// pool lives in world_boss.hp_current; this template is just the thing a single
+// player swings at, so its own HP is the arena tier's boss HP — beatable in a
+// bout, which lets a strong player land a full boss's worth of damage on the
+// pool.
+func worldBossTemplate(name string, tier int) DnDMonsterTemplate {
+	hp, ac, atk, ab, cr := arenaTierBaseStats(tier)
+	return DnDMonsterTemplate{
+		ID:          fmt.Sprintf("worldboss_t%d", tier),
+		Name:        name,
+		CR:          cr,
+		HP:          hp,
+		AC:          ac,
+		Attack:      atk,
+		AttackBonus: ab,
+		Speed:       12,
+		BlockRate:   0.05,
+		XPValue:     arenaTiers[tier-1].BattleXP * 5,
+		Notes:       "the Siege",
+	}
+}
+
+// ── Lifecycle ────────────────────────────────────────────────────────────────
+
+// spawnWorldBoss mints a fresh Siege and announces it. It refuses if one is
+// already camped (only one at a time). eventKey names the boss deterministically
+// (the spawn month for the auto path, a stamp for a manual one).
+func (p *AdventurePlugin) spawnWorldBoss(eventKey string) (*worldBossState, error) {
+	if existing, err := loadActiveWorldBoss(); err != nil {
+		return nil, err
+	} else if existing != nil {
+		return existing, fmt.Errorf("a world boss is already active")
+	}
+	tier, hpMax, activeN := worldBossSpawnPlan()
+	name := worldBossNameFor(eventKey)
+	now := time.Now().UTC()
+	ends := now.Add(worldBossWindow)
+	bossID, err := insertWorldBoss(name, tier, hpMax, now, ends)
+	if err != nil {
+		return nil, err
+	}
+	boss, err := loadWorldBoss(bossID)
+	if err != nil {
+		return nil, err
+	}
+	p.announceWorldBossSpawn(boss, activeN)
+	slog.Info("worldboss: spawned", "id", bossID, "name", name, "tier", tier, "hp", hpMax, "activeN", activeN)
+	return boss, nil
+}
+
+// worldBossTick rides the 1-minute event ticker. It auto-spawns a boss on the
+// first of each UTC month and resolves a live boss whose window has lapsed. The
+// defeat path is not here — a bout crossing the pool to zero resolves inline
+// (W2), because the ticker never sees the pool between two 60s reads.
+func (p *AdventurePlugin) worldBossTick() {
+	boss, err := loadActiveWorldBoss()
+	if err != nil {
+		slog.Warn("worldboss: tick load failed", "err", err)
+		return
+	}
+	now := time.Now().UTC()
+	if boss != nil {
+		// Safety net: a killing blow commits the pool to 0 inline, but if the
+		// process died (or was redeployed) before the bout resolved the status,
+		// the boss is left active/0-HP. Resolve it as the defeat it was — never
+		// let the survive branch below debit the pot for a boss the town killed.
+		if boss.HPCurrent <= 0 {
+			p.resolveWorldBossDefeated(boss)
+			return
+		}
+		if now.After(boss.EndsAt) {
+			p.resolveWorldBossSurvived(boss)
+		}
+		return
+	}
+	// No boss camped — auto-spawn on the 1st of the month, once.
+	if now.Day() != 1 {
+		return
+	}
+	monthKey := now.Format("2006-01")
+	if db.JobCompleted("worldboss_spawn", monthKey) {
+		return
+	}
+	if _, err := p.spawnWorldBoss(monthKey); err != nil {
+		slog.Warn("worldboss: auto-spawn failed", "err", err)
+		return
+	}
+	db.MarkJobCompleted("worldboss_spawn", monthKey)
+}
+
+// ── Resolution ───────────────────────────────────────────────────────────────
+
+// worldBossPayout is one contributor's minted defeat reward.
+type worldBossPayout struct {
+	UserID id.UserID
+	Fights int
+	Euro   int
+}
+
+// computeWorldBossPayouts scales the minted bounty by fights fought (not damage —
+// accessibility). Pure so the split is testable without a euro/Matrix stub.
+func computeWorldBossPayouts(contribs []worldBossContrib, baseEuro int) []worldBossPayout {
+	out := make([]worldBossPayout, 0, len(contribs))
+	for _, c := range contribs {
+		if c.Fights <= 0 {
+			continue
+		}
+		out = append(out, worldBossPayout{UserID: c.UserID, Fights: c.Fights, Euro: baseEuro * c.Fights})
+	}
+	return out
+}
+
+// resolveWorldBossDefeated pays every contributor a minted bounty scaled by
+// fights, plus a consumable cache and one low-rate treasure roll each, then
+// announces the kill. Guarded so it fires once.
+func (p *AdventurePlugin) resolveWorldBossDefeated(boss *worldBossState) {
+	won, err := setWorldBossStatus(boss.ID, "defeated")
+	if err != nil {
+		slog.Warn("worldboss: defeat close-out failed", "err", err)
+		return
+	}
+	if !won {
+		return // someone else already resolved it
+	}
+	contribs, err := loadWorldBossContribs(boss.ID)
+	if err != nil {
+		slog.Warn("worldboss: contrib load failed", "err", err)
+	}
+	payouts := computeWorldBossPayouts(contribs, worldBossDefeatBaseEuro)
+	treasureZone := worldBossTreasureZone(boss.Tier)
+	for _, pay := range payouts {
+		p.euro.Credit(pay.UserID, float64(pay.Euro), "worldboss_bounty")
+		for _, item := range consumableCache(boss.Tier, worldBossCacheSize) {
+			it := item
+			p.grantZoneItem(pay.UserID, &it, "🧪")
+		}
+		if treasureZone != "" {
+			p.rollZoneTreasure(pay.UserID, treasureZone, worldBossTreasureWeight)
+		}
+	}
+	p.announceWorldBossDefeated(boss, payouts)
+	slog.Info("worldboss: defeated", "id", boss.ID, "contributors", len(payouts))
+}
+
+// resolveWorldBossSurvived debits the community pot as a tribute (a sink) and
+// announces the town's loss. Guarded so it fires once.
+func (p *AdventurePlugin) resolveWorldBossSurvived(boss *worldBossState) {
+	won, err := setWorldBossStatus(boss.ID, "survived")
+	if err != nil {
+		slog.Warn("worldboss: survive close-out failed", "err", err)
+		return
+	}
+	if !won {
+		return
+	}
+	tribute := int(float64(communityPotBalance()) * worldBossTributePct)
+	paid := 0
+	if tribute > 0 && communityPotDebit(tribute) {
+		paid = tribute
+	}
+	p.announceWorldBossSurvived(boss, paid)
+	slog.Info("worldboss: survived", "id", boss.ID, "tribute", paid)
+}
+
+// worldBossTreasureZone maps the boss tier to a representative zone whose treasure
+// table the defeat roll draws from. "" if no zone of that tier exists.
+func worldBossTreasureZone(tier int) ZoneID {
+	zs := zonesByTier(ZoneTier(tier))
+	if len(zs) == 0 {
+		return ""
+	}
+	return zs[0].ID
+}
+
+// ── Announcements (games room) ───────────────────────────────────────────────
+
+// announceWorldBoss posts to the shared games room. No-op if GAMES_ROOM is unset.
+func (p *AdventurePlugin) announceWorldBoss(text string) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	if err := p.SendMessage(gr, text); err != nil {
+		slog.Warn("worldboss: games-room announce failed", "err", err)
+	}
+}
+
+func (p *AdventurePlugin) announceWorldBossSpawn(boss *worldBossState, activeN int) {
+	p.announceWorldBoss(fmt.Sprintf(
+		"⚔️ **The Siege has begun!** **%s** (Tier %d) camps outside town with **%s HP**.\n"+
+			"Everyone gets **one bout per day** for the next 72 hours — `!adventure worldboss fight`. "+
+			"Every hit chips the shared pool. Fell it together for a bounty; let it stand and it loots the town.",
+		boss.Name, boss.Tier, groupInt(boss.HPMax)))
+}
+
+func (p *AdventurePlugin) announceWorldBossDefeated(boss *worldBossState, payouts []worldBossPayout) {
+	var top string
+	if len(payouts) > 0 {
+		top = fmt.Sprintf(" Top of the muster: %s (%d fights).",
+			p.DisplayName(payouts[0].UserID), payouts[0].Fights)
+	}
+	p.announceWorldBoss(fmt.Sprintf(
+		"🏆 **%s has fallen!** %d adventurer(s) brought it down.%s\n"+
+			"Bounties, supply caches, and salvage have been paid out to everyone who fought.",
+		boss.Name, len(payouts), top))
+}
+
+func (p *AdventurePlugin) announceWorldBossSurvived(boss *worldBossState, tribute int) {
+	msg := fmt.Sprintf("💀 **%s still stands.** The Siege is over — the town could not bring it down.", boss.Name)
+	if tribute > 0 {
+		msg += fmt.Sprintf(" It loots **€%s** from the community pot on its way out.", groupInt(tribute))
+	}
+	p.announceWorldBoss(msg)
+}
+
+// ── Player command (W2) ──────────────────────────────────────────────────────
+
+// handleWorldBossCmd routes `!adventure worldboss [status|fight|spawn]` (alias
+// `!adventure siege …`). Bare / "status" shows the board; "fight" takes today's
+// bout; "spawn" is an operator override.
+func (p *AdventurePlugin) handleWorldBossCmd(ctx MessageContext, args string) error {
+	switch strings.ToLower(strings.TrimSpace(args)) {
+	case "", "status":
+		return p.worldBossStatusDM(ctx)
+	case "fight":
+		return p.fightWorldBoss(ctx)
+	case "spawn":
+		return p.worldBossOperatorSpawn(ctx)
+	}
+	return p.SendDM(ctx.Sender, "Usage: `!adventure worldboss [status|fight]`")
+}
+
+// worldBossOperatorSpawn lets an admin start a Siege on demand (the override half
+// of the "both" spawn decision). Silent to non-admins, like the other admin
+// commands.
+func (p *AdventurePlugin) worldBossOperatorSpawn(ctx MessageContext) error {
+	if !p.IsAdmin(ctx.Sender) {
+		return nil
+	}
+	key := "manual-" + time.Now().UTC().Format("2006-01-02T15:04")
+	boss, err := p.spawnWorldBoss(key)
+	if err != nil {
+		return p.SendDM(ctx.Sender, fmt.Sprintf("Could not spawn the Siege: %v", err))
+	}
+	return p.SendDM(ctx.Sender, fmt.Sprintf(
+		"Spawned **%s** (Tier %d, %s HP). It camps for 72 hours.",
+		boss.Name, boss.Tier, groupInt(boss.HPMax)))
+}
+
+// fightWorldBoss runs one player's daily bout against the Siege: an arena-style
+// solo fight whose damage is subtracted from the shared pool win or lose. Real
+// HP cost, no death — a loss leaves the fighter battered (floored at 1 HP) but
+// standing. The per-user lock serialises a player's own repeat submits, so the
+// once-per-day gate can't be raced by a double-tap.
+func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
+	userMu := p.advUserLock(ctx.Sender)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	boss, err := loadActiveWorldBoss()
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+	}
+	if boss == nil {
+		return p.SendDM(ctx.Sender, "No Siege is camped outside town right now.")
+	}
+
+	char, err := loadAdvCharacter(ctx.Sender)
+	if err != nil || char == nil {
+		return p.SendDM(ctx.Sender, "You need an adventurer first — type `!adventure` to begin.")
+	}
+	if !char.Alive {
+		return p.SendDM(ctx.Sender, "You're dead. The Siege will have to wait until you're back on your feet.")
+	}
+
+	today := time.Now().UTC().Format("2006-01-02")
+	if worldBossBoutUsedToday(boss.ID, ctx.Sender, today) {
+		return p.SendDM(ctx.Sender, fmt.Sprintf(
+			"You've already taken your bout against **%s** today. Come back tomorrow — one fight per day.", boss.Name))
+	}
+
+	bout, err := p.resolveWorldBossBout(ctx.Sender, boss, today)
+	if err != nil {
+		slog.Error("worldboss: bout failed", "user", ctx.Sender, "err", err)
+		return p.SendDM(ctx.Sender, "The Siege combat hit an error. Try again in a moment.")
+	}
+
+	// Resolve a defeat BEFORE streaming the (multi-second) narration. The pool is
+	// already committed to 0; flipping the status now closes the window where a
+	// crash or the ticker's survive path could resolve a killed boss as a
+	// survival and debit the pot instead of paying bounties.
+	if bout.Killed {
+		p.resolveWorldBossDefeated(boss)
+	}
+
+	playerName, _ := loadDisplayName(ctx.Sender)
+	if playerName == "" {
+		playerName = "You"
+	}
+	phaseMessages := append([]string{
+		fmt.Sprintf("⚔️ **The Siege — %s** (Tier %d)", boss.Name, boss.Tier),
+	}, RenderCombatLog(bout.Combat, playerName, boss.Name)...)
+
+	var footer string
+	if bout.Killed {
+		footer = fmt.Sprintf("💥 You deal **%d** damage — the killing blow! **%s** falls!", bout.Damage, boss.Name)
+	} else {
+		footer = fmt.Sprintf("💥 You deal **%d** damage. **%s** has **%s / %s HP** left.",
+			bout.Damage, boss.Name, groupInt(bout.Remaining), groupInt(boss.HPMax))
+	}
+	if bout.Battered {
+		footer += "\nYou stagger out of the fight at 1 HP — rest up before your next outing."
+	}
+
+	<-p.sendZoneCombatMessages(ctx.Sender, phaseMessages, footer)
+	return nil
+}
+
+// worldBossBoutUsedToday reports whether a player has already spent their daily
+// bout against this boss.
+func worldBossBoutUsedToday(bossID int64, userID id.UserID, dateKey string) bool {
+	c, err := loadWorldBossContrib(bossID, userID)
+	return err == nil && c != nil && c.LastFightDate == dateKey
+}
+
+// worldBossBoutResult is the outcome of one resolved bout, before narration.
+type worldBossBoutResult struct {
+	Damage    int
+	Remaining int
+	Killed    bool
+	Battered  bool
+	Combat    CombatResult
+}
+
+// resolveWorldBossBout runs the arena-style fight, applies the real HP cost with
+// the no-death floor, subtracts the damage dealt from the shared pool, and
+// records the contribution. It performs no DM or games-room I/O, so it is the
+// testable core of fightWorldBoss.
+func (p *AdventurePlugin) resolveWorldBossBout(userID id.UserID, boss *worldBossState, dateKey string) (worldBossBoutResult, error) {
+	monster := worldBossTemplate(boss.Name, boss.Tier)
+	result, err := p.runZoneCombat(userID, monster, boss.Tier, bossCombatPhases, 50)
+	if err != nil {
+		return worldBossBoutResult{}, err
+	}
+
+	// No death / no hospital: floor the fighter at 1 HP so a loss never reads as
+	// a corpse. runZoneCombat already persisted the real HP cost.
+	battered := floorHPAtOne(userID)
+
+	dmg := result.EnemyEntryHP - result.EnemyEndHP
+	if dmg < 0 {
+		dmg = 0
+	}
+	// Record the contribution (which also sets the once-per-day gate) BEFORE
+	// draining the shared pool. If this write fails we must not have already
+	// drained the pool — otherwise the player could refight a pool they emptied
+	// and lose the credit for it. A hard error here aborts the bout; the HP cost
+	// was already paid, but the pool is untouched and the player can retry.
+	if err := upsertWorldBossContrib(boss.ID, userID, dmg, dateKey); err != nil {
+		return worldBossBoutResult{}, err
+	}
+	remaining, killed, err := applyWorldBossDamage(boss.ID, dmg)
+	if err != nil {
+		return worldBossBoutResult{}, err
+	}
+	return worldBossBoutResult{
+		Damage: dmg, Remaining: remaining, Killed: killed, Battered: battered, Combat: result,
+	}, nil
+}
+
+// floorHPAtOne raises a player to 1 HP if the fight left them at zero, and
+// reports whether it had to. Keeps "no death" honest without undoing the real
+// HP cost of a bout the player mostly survived. Shared by the two no-death
+// fights: the world-boss bout and a Mischief Makers delivery.
+func floorHPAtOne(userID id.UserID) bool {
+	cur, _ := dndHPSnapshot(userID)
+	if cur > 0 {
+		return false
+	}
+	if _, err := db.Get().Exec(
+		`UPDATE dnd_character SET hp_current = 1, updated_at = CURRENT_TIMESTAMP WHERE user_id = ?`,
+		string(userID)); err != nil {
+		slog.Warn("worldboss: hp floor failed", "user", userID, "err", err)
+	}
+	return true
+}
+
+// worldBossStatusDM renders the current Siege board to the caller.
+func (p *AdventurePlugin) worldBossStatusDM(ctx MessageContext) error {
+	boss, err := loadActiveWorldBoss()
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+	}
+	if boss == nil {
+		return p.SendDM(ctx.Sender,
+			"No Siege is camped outside town right now. The next one arrives at the start of the month.")
+	}
+
+	var sb strings.Builder
+	pct := 0
+	if boss.HPMax > 0 {
+		pct = boss.HPCurrent * 100 / boss.HPMax
+	}
+	fmt.Fprintf(&sb, "⚔️ **The Siege — %s** (Tier %d)\n", boss.Name, boss.Tier)
+	fmt.Fprintf(&sb, "Pool: **%s / %s HP** (%d%%)\n", groupInt(boss.HPCurrent), groupInt(boss.HPMax), pct)
+	if left := time.Until(boss.EndsAt); left > 0 {
+		h := int(left.Hours())
+		m := int(left.Minutes()) % 60
+		fmt.Fprintf(&sb, "Time left: **%dh %dm**\n", h, m)
+	}
+
+	today := time.Now().UTC().Format("2006-01-02")
+	if c, _ := loadWorldBossContrib(boss.ID, ctx.Sender); c != nil {
+		line := fmt.Sprintf("\nYou: %d fight(s), %s damage dealt.", c.Fights, groupInt(c.Damage))
+		if c.LastFightDate == today {
+			line += " Your bout is spent for today."
+		} else {
+			line += " Your bout is ready — `!adventure worldboss fight`."
+		}
+		sb.WriteString(line + "\n")
+	} else {
+		sb.WriteString("\nYou haven't fought yet — `!adventure worldboss fight`.\n")
+	}
+
+	if contribs, _ := loadWorldBossContribs(boss.ID); len(contribs) > 0 {
+		sb.WriteString("\n**Top of the muster:**\n")
+		for i, c := range contribs {
+			if i >= 5 {
+				break
+			}
+			fmt.Fprintf(&sb, "%d. %s — %d fight(s)\n", i+1, p.DisplayName(c.UserID), c.Fights)
+		}
+	}
+	return p.SendDM(ctx.Sender, sb.String())
+}

internal/plugin/adventure_worldboss_test.go

@@ -0,0 +1,417 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newWorldBossTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+func TestWorldBossName_DeterministicAndInPool(t *testing.T) {
+	first := worldBossNameFor("2026-07")
+	if again := worldBossNameFor("2026-07"); again != first {
+		t.Errorf("name not deterministic: %q vs %q", first, again)
+	}
+	inPool := false
+	for _, n := range worldBossNames {
+		if n == first {
+			inPool = true
+			break
+		}
+	}
+	if !inPool {
+		t.Errorf("generated name %q not in worldBossNames pool", first)
+	}
+}
+
+func TestMedianInt(t *testing.T) {
+	cases := []struct {
+		in   []int
+		want int
+	}{
+		{nil, 0},
+		{[]int{5}, 5},
+		{[]int{3, 1, 2}, 2},         // odd, unsorted
+		{[]int{4, 2, 8, 6}, 5},      // even → mean of the two middles (4,6)
+		{[]int{10, 10, 10, 10}, 10}, // even, all equal
+	}
+	for _, c := range cases {
+		if got := medianInt(c.in); got != c.want {
+			t.Errorf("medianInt(%v) = %d, want %d", c.in, got, c.want)
+		}
+	}
+}
+
+func TestTierForCombinedLevel(t *testing.T) {
+	cases := []struct{ level, want int }{
+		{0, worldBossMinTier},
+		{11, worldBossMinTier},
+		{12, 4},
+		{20, 4},
+		{21, 5},
+		{99, 5},
+	}
+	for _, c := range cases {
+		if got := tierForCombinedLevel(c.level); got != c.want {
+			t.Errorf("tierForCombinedLevel(%d) = %d, want %d", c.level, got, c.want)
+		}
+	}
+}
+
+func TestWorldBoss_InsertLoadRoundTrip(t *testing.T) {
+	newWorldBossTestDB(t)
+	now := time.Now().UTC().Truncate(time.Second)
+	id0, err := insertWorldBoss("Gorloth", 5, 2400, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+	active, err := loadActiveWorldBoss()
+	if err != nil || active == nil {
+		t.Fatalf("loadActiveWorldBoss: %v (nil=%v)", err, active == nil)
+	}
+	if active.ID != id0 || active.Name != "Gorloth" || active.Tier != 5 ||
+		active.HPMax != 2400 || active.HPCurrent != 2400 || active.Status != "active" {
+		t.Errorf("round-trip mismatch: %+v", active)
+	}
+}
+
+func TestApplyWorldBossDamage_ClampsAndFells(t *testing.T) {
+	newWorldBossTestDB(t)
+	now := time.Now().UTC()
+	bossID, err := insertWorldBoss("Kravok", 3, 100, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rem, killed, err := applyWorldBossDamage(bossID, 40)
+	if err != nil || rem != 60 || killed {
+		t.Fatalf("first hit: rem=%d killed=%v err=%v (want 60,false)", rem, killed, err)
+	}
+
+	// Overkill clamps at 0 and reports the fell.
+	rem, killed, err = applyWorldBossDamage(bossID, 999)
+	if err != nil || rem != 0 || !killed {
+		t.Fatalf("overkill: rem=%d killed=%v err=%v (want 0,true)", rem, killed, err)
+	}
+
+	// Negative damage is treated as zero.
+	if rem, _, err := applyWorldBossDamage(bossID, -5); err != nil || rem != 0 {
+		t.Fatalf("negative: rem=%d err=%v", rem, err)
+	}
+}
+
+func TestSetWorldBossStatus_ResolvesOnce(t *testing.T) {
+	newWorldBossTestDB(t)
+	now := time.Now().UTC()
+	bossID, err := insertWorldBoss("Ymirok", 4, 500, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok, err := setWorldBossStatus(bossID, "defeated"); err != nil || !ok {
+		t.Fatalf("first close-out: ok=%v err=%v (want true)", ok, err)
+	}
+	// A second close-out is a no-op — the boss is no longer active.
+	if ok, err := setWorldBossStatus(bossID, "survived"); err != nil || ok {
+		t.Fatalf("double close-out: ok=%v err=%v (want false)", ok, err)
+	}
+	// And damage no longer lands on a resolved boss.
+	if rem, killed, _ := applyWorldBossDamage(bossID, 500); rem != 500 || killed {
+		t.Errorf("damage on resolved boss changed pool: rem=%d killed=%v", rem, killed)
+	}
+}
+
+func TestWorldBossContrib_UpsertAccumulates(t *testing.T) {
+	newWorldBossTestDB(t)
+	user := id.UserID("@a:test.invalid")
+	if err := upsertWorldBossContrib(1, user, 30, "2026-07-01"); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertWorldBossContrib(1, user, 45, "2026-07-02"); err != nil {
+		t.Fatal(err)
+	}
+	c, err := loadWorldBossContrib(1, user)
+	if err != nil || c == nil {
+		t.Fatalf("load: %v (nil=%v)", err, c == nil)
+	}
+	if c.Fights != 2 || c.Damage != 75 || c.LastFightDate != "2026-07-02" {
+		t.Errorf("accumulate mismatch: %+v", c)
+	}
+}
+
+func TestLoadWorldBossContribs_OrderedByFights(t *testing.T) {
+	newWorldBossTestDB(t)
+	a := id.UserID("@a:test.invalid")
+	b := id.UserID("@b:test.invalid")
+	// a: 1 fight; b: 2 fights → b sorts first.
+	upsertWorldBossContrib(7, a, 100, "2026-07-01")
+	upsertWorldBossContrib(7, b, 10, "2026-07-01")
+	upsertWorldBossContrib(7, b, 10, "2026-07-02")
+	got, err := loadWorldBossContribs(7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || got[0].UserID != b || got[1].UserID != a {
+		t.Errorf("order = %+v, want b then a", got)
+	}
+}
+
+func TestComputeWorldBossPayouts_ScalesByFights(t *testing.T) {
+	contribs := []worldBossContrib{
+		{UserID: "@a:t", Fights: 3, Damage: 999},
+		{UserID: "@b:t", Fights: 1, Damage: 10},
+		{UserID: "@c:t", Fights: 0, Damage: 0}, // no fights → no payout
+	}
+	pays := computeWorldBossPayouts(contribs, 1000)
+	if len(pays) != 2 {
+		t.Fatalf("got %d payouts, want 2 (zero-fight excluded)", len(pays))
+	}
+	if pays[0].Euro != 3000 || pays[1].Euro != 1000 {
+		t.Errorf("payouts = %d,%d want 3000,1000", pays[0].Euro, pays[1].Euro)
+	}
+}
+
+// TestWorldBossSpawnPlan_SizesToActiveTown seeds three active max-level players
+// and checks the boss is T5 with a pool scaled to the turnout.
+func TestWorldBossSpawnPlan_SizesToActiveTown(t *testing.T) {
+	newWorldBossTestDB(t)
+	today := time.Now().UTC().Format("2006-01-02")
+	for _, u := range []string{"@a:test.invalid", "@b:test.invalid", "@c:test.invalid"} {
+		c := &AdventureCharacter{UserID: id.UserID(u), DisplayName: "P", Alive: true,
+			ForagingSkill: 30, CreatedAt: time.Now().UTC()}
+		if err := saveAdvCharacter(c); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := db.Get().Exec(
+			`INSERT INTO daily_activity (user_id, date, message_count) VALUES (?, ?, 1)`,
+			u, today); err != nil {
+			t.Fatal(err)
+		}
+	}
+	tier, hpMax, activeN := worldBossSpawnPlan()
+	if activeN != 3 {
+		t.Errorf("activeN = %d, want 3", activeN)
+	}
+	if tier != 5 {
+		t.Errorf("tier = %d, want 5 (combined >= 21)", tier)
+	}
+	// bouts = 3 × 2.0 = 6; perBout at T5 = 400 → pool 2400.
+	perBout, _, _, _, _ := arenaTierBaseStats(5)
+	if want := perBout * 6; hpMax != want {
+		t.Errorf("hpMax = %d, want %d", hpMax, want)
+	}
+}
+
+// TestWorldBossSpawnPlan_EmptyTownGetsFloorBoss: no active players still yields a
+// beatable floor boss so a manual spawn works.
+func TestWorldBossSpawnPlan_EmptyTownGetsFloorBoss(t *testing.T) {
+	newWorldBossTestDB(t)
+	tier, hpMax, activeN := worldBossSpawnPlan()
+	if activeN != 0 {
+		t.Errorf("activeN = %d, want 0", activeN)
+	}
+	if tier != worldBossMinTier {
+		t.Errorf("tier = %d, want floor %d", tier, worldBossMinTier)
+	}
+	perBout, _, _, _, _ := arenaTierBaseStats(worldBossMinTier)
+	if want := perBout * worldBossMinBouts; hpMax != want {
+		t.Errorf("hpMax = %d, want %d (min bouts floor)", hpMax, want)
+	}
+}
+
+func TestSpawnWorldBoss_RefusesWhenOneIsActive(t *testing.T) {
+	newWorldBossTestDB(t)
+	p := &AdventurePlugin{}
+	first, err := p.spawnWorldBoss("2026-07")
+	if err != nil || first == nil {
+		t.Fatalf("first spawn: %v (nil=%v)", err, first == nil)
+	}
+	second, err := p.spawnWorldBoss("2026-07")
+	if err == nil {
+		t.Error("second spawn should refuse while one is active")
+	}
+	if second == nil || second.ID != first.ID {
+		t.Error("refusal should return the existing active boss")
+	}
+}
+
+// TestResolveWorldBossSurvived_DebitsPot exercises the survive path end to end:
+// the boss closes out and the pot loses its tribute.
+func TestResolveWorldBossSurvived_DebitsPot(t *testing.T) {
+	newWorldBossTestDB(t)
+	communityPotAdd(1000)
+	now := time.Now().UTC()
+	bossID, err := insertWorldBoss("Vornath", 5, 2400, now.Add(-worldBossWindow), now.Add(-time.Hour))
+	if err != nil {
+		t.Fatal(err)
+	}
+	boss, _ := loadWorldBoss(bossID)
+	p := &AdventurePlugin{}
+	p.resolveWorldBossSurvived(boss)
+
+	after, _ := loadWorldBoss(bossID)
+	if after.Status != "survived" {
+		t.Errorf("status = %q, want survived", after.Status)
+	}
+	// tribute = 20% of 1000 = 200 → pot left with 800.
+	if bal := communityPotBalance(); bal != 800 {
+		t.Errorf("pot = %d, want 800 after 20%% tribute", bal)
+	}
+}
+
+// ── W2: the bout ─────────────────────────────────────────────────────────────
+
+func fightableChar(t *testing.T, uid id.UserID) {
+	t.Helper()
+	if err := createAdvCharacter(uid, "boxer"); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: 12,
+		STR: 18, DEX: 14, CON: 16, INT: 10, WIS: 10, CHA: 10,
+		HPMax: 120, HPCurrent: 120, ArmorClass: 18,
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatalf("SaveDnDCharacter: %v", err)
+	}
+}
+
+func TestWorldBossFloorHP(t *testing.T) {
+	newWorldBossTestDB(t)
+	uid := id.UserID("@floor:test.invalid")
+	fightableChar(t, uid)
+	if floorHPAtOne(uid) {
+		t.Error("floor should be a no-op above 0 HP")
+	}
+	if _, err := db.Get().Exec(`UPDATE dnd_character SET hp_current = 0 WHERE user_id = ?`, string(uid)); err != nil {
+		t.Fatal(err)
+	}
+	if !floorHPAtOne(uid) {
+		t.Error("floor should raise a 0-HP fighter")
+	}
+	if cur, _ := dndHPSnapshot(uid); cur != 1 {
+		t.Errorf("hp after floor = %d, want 1", cur)
+	}
+}
+
+func TestResolveWorldBossBout_SubtractsAndRecords(t *testing.T) {
+	newWorldBossTestDB(t)
+	uid := id.UserID("@bout:test.invalid")
+	fightableChar(t, uid)
+	now := time.Now().UTC()
+	// Big pool so one bout can only chip it — assert the partial subtract + contrib.
+	bossID, err := insertWorldBoss("Kravok", 3, 100000, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+	boss, _ := loadWorldBoss(bossID)
+	p := &AdventurePlugin{}
+	bout, err := p.resolveWorldBossBout(uid, boss, "2026-07-05")
+	if err != nil {
+		t.Fatalf("bout: %v", err)
+	}
+	if bout.Damage < 0 {
+		t.Errorf("damage negative: %d", bout.Damage)
+	}
+	if bout.Killed {
+		t.Error("a 100k pool should survive one bout")
+	}
+	if bout.Remaining != 100000-bout.Damage {
+		t.Errorf("remaining %d != max-dmg %d", bout.Remaining, 100000-bout.Damage)
+	}
+	c, _ := loadWorldBossContrib(bossID, uid)
+	if c == nil || c.Fights != 1 || c.Damage != bout.Damage || c.LastFightDate != "2026-07-05" {
+		t.Errorf("contrib mismatch: %+v (bout dmg %d)", c, bout.Damage)
+	}
+	if !worldBossBoutUsedToday(bossID, uid, "2026-07-05") {
+		t.Error("bout should read as used for that day")
+	}
+	if worldBossBoutUsedToday(bossID, uid, "2026-07-06") {
+		t.Error("a different day should still be available")
+	}
+}
+
+func TestResolveWorldBossBout_FellsTinyPool(t *testing.T) {
+	newWorldBossTestDB(t)
+	uid := id.UserID("@kill:test.invalid")
+	fightableChar(t, uid)
+	now := time.Now().UTC()
+	bossID, err := insertWorldBoss("Wisp", 3, 1, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+	boss, _ := loadWorldBoss(bossID)
+	p := &AdventurePlugin{}
+	bout, err := p.resolveWorldBossBout(uid, boss, "2026-07-05")
+	if err != nil {
+		t.Fatalf("bout: %v", err)
+	}
+	// A L12 fighter lands at least one blow on a T3 dummy over a full boss fight,
+	// felling a 1-HP pool.
+	if !bout.Killed || bout.Remaining != 0 {
+		t.Errorf("tiny pool not felled: killed=%v remaining=%d dmg=%d", bout.Killed, bout.Remaining, bout.Damage)
+	}
+	// Resolution is the caller's job — the bout leaves the boss active.
+	after, _ := loadWorldBoss(bossID)
+	if after.Status != "active" {
+		t.Errorf("bout should not self-resolve; status=%q", after.Status)
+	}
+}
+
+// TestWorldBossTick_ResolvesZeroHPBossAsDefeated: a killing blow that committed
+// the pool to 0 but (crash/redeploy) never resolved the status must be resolved
+// as DEFEATED by the ticker net — never fall through to the survive/pot-debit
+// path. No contributors here, so resolution never touches euro.
+func TestWorldBossTick_ResolvesZeroHPBossAsDefeated(t *testing.T) {
+	newWorldBossTestDB(t)
+	now := time.Now().UTC()
+	communityPotAdd(1000)
+	bossID, err := insertWorldBoss("Ghost", 3, 100, now, now.Add(worldBossWindow))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Get().Exec(`UPDATE world_boss SET hp_current = 0 WHERE id = ?`, bossID); err != nil {
+		t.Fatal(err)
+	}
+	p := &AdventurePlugin{}
+	p.worldBossTick()
+	after, _ := loadWorldBoss(bossID)
+	if after.Status != "defeated" {
+		t.Errorf("status = %q, want defeated (ticker safety net)", after.Status)
+	}
+	if bal := communityPotBalance(); bal != 1000 {
+		t.Errorf("pot = %d, want 1000 — a defeat mints, it must not debit the pot", bal)
+	}
+}
+
+// TestWorldBossTick_ResolvesLapsedBossAsSurvived: a boss whose window lapsed with
+// the pool still up survives and loots the pot.
+func TestWorldBossTick_ResolvesLapsedBossAsSurvived(t *testing.T) {
+	newWorldBossTestDB(t)
+	now := time.Now().UTC()
+	communityPotAdd(1000)
+	bossID, err := insertWorldBoss("Titan", 4, 500, now.Add(-worldBossWindow), now.Add(-time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p := &AdventurePlugin{}
+	p.worldBossTick()
+	after, _ := loadWorldBoss(bossID)
+	if after.Status != "survived" {
+		t.Errorf("status = %q, want survived", after.Status)
+	}
+	if bal := communityPotBalance(); bal != 800 {
+		t.Errorf("pot = %d, want 800 after 20%% tribute", bal)
+	}
+}

internal/plugin/bootstrap_boredom_clock.go

@@ -0,0 +1,47 @@
+package plugin
+
+import (
+	"log/slog"
+
+	"gogobee/internal/db"
+)
+
+// bootstrapBoredomClock seeds player_meta.last_player_action_at for rows that
+// predate the column (gogobee_boredom_plan.md §1).
+//
+// Without this, the column is NULL for every existing player on the deploy that
+// adds it, and loadBoredomCandidates falls back to created_at — which is when
+// the character was *made*, not when it was last played. Every alive character
+// on the server is therefore months past the idle threshold on the first tick
+// after the deploy, and the whole player base gets marched into a dungeon at
+// once, coins debited, thirty minutes after restart. A player who typed a
+// command a minute before the deploy is no exception: the clock has never heard
+// of them.
+//
+// last_active_at is the best proxy we have for "the character did something
+// recently" and is exactly right at deploy time: recent for anyone still
+// playing, stale for anyone who isn't. It is unusable as the clock itself (the
+// autopilot bumps it through saveAdvCharacter, so a bored character would keep
+// refreshing its own idle clock — see markPlayerAction), which is why this is a
+// one-time seed and not a fallback in the query.
+//
+// Re-running on every boot is safe and intentionally a no-op:
+//   - a row seeded here, or stamped by a real action, is no longer NULL;
+//   - a character the boredom ticker has already sent out (last_boredom_at set)
+//     is skipped, so a restart mid-boredom can't hand it a fresh idle clock off
+//     the autopilot's own writes.
+func bootstrapBoredomClock() {
+	res, err := db.Get().Exec(`
+		UPDATE player_meta
+		   SET last_player_action_at = COALESCE(last_active_at, created_at)
+		 WHERE last_player_action_at IS NULL
+		   AND last_boredom_at IS NULL
+		   AND COALESCE(last_active_at, created_at) IS NOT NULL`)
+	if err != nil {
+		slog.Error("bootstrap: boredom clock seed failed", "err", err)
+		return
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		slog.Warn("bootstrap: seeded boredom idle clock from last_active_at", "rows", n)
+	}
+}

internal/plugin/bootstrap_pete_news.go

@@ -0,0 +1,227 @@
+package plugin
+
+import (
+	"fmt"
+	"log/slog"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// bootstrapPeteNewsBackfill replays the back-catalogue through the news emit
+// path the first time the seam comes up enabled, so a launch doesn't open onto
+// an empty section. It covers the three tractable, high-signal sources:
+//
+//  1. Realm-first zone clears — the earliest boss-defeated run of each zone. This
+//     also SEEDS news_realm_firsts, so a later live clear of an already-cleared
+//     zone tiers as a BULLETIN repeat, not a mis-announced "first ever".
+//  2. Deaths — every player_meta row that carries a death (graveyard content).
+//  3. Single-holder achievements — rarity-gated to one holder, matching the live
+//     milestone rule so routine unlocks don't flood the backlog.
+//
+// Backfilled facts are backdated to when they happened and marked NoPush (no
+// web-push spam on launch). GUIDs are deterministic (keyed on the historical
+// timestamp), so a re-run — or a later live emit of the same event — dedups on
+// Pete's side. Guarded one-shot; kept (never deleted at close-out) so a fresh
+// deploy doesn't ghost-town again. See pete_adventure_news_plan.md gap #7.
+func (p *AdventurePlugin) bootstrapPeteNewsBackfill() {
+	const jobName = "pete_news_backfill_v1"
+	if db.JobCompleted(jobName, "once") {
+		return
+	}
+	// The backfill IS the launch content, so it should fire the first boot the
+	// seam is actually live — not get silently consumed on a boot where emission
+	// is off. Leave the job unmarked until both switches are on.
+	if !peteclient.Enabled() || !newsEmissionOn() {
+		return
+	}
+
+	firsts := p.backfillZoneFirsts()
+	deaths := backfillDeaths()
+	achv := p.backfillSoloAchievements()
+
+	db.MarkJobCompleted(jobName, "once")
+	slog.Warn("bootstrap: pete news backfill complete",
+		"zone_firsts", firsts, "deaths", deaths, "achievements", achv)
+}
+
+// backfillZoneFirsts seeds news_realm_firsts from history and emits one PRIORITY
+// realm-first dispatch per zone, attributed to its earliest boss-defeating
+// clearer. SQLite returns the user_id from the same row as MIN(completed_at)
+// (bare-column min/max rule), so the (zone, first clearer, time) triple is
+// consistent. Returns the count emitted.
+func (p *AdventurePlugin) backfillZoneFirsts() int {
+	rows, err := db.Get().Query(
+		`SELECT zone_id, user_id, MIN(completed_at)
+		   FROM dnd_zone_run
+		  WHERE boss_defeated = 1 AND completed_at IS NOT NULL AND abandoned = 0
+		  GROUP BY zone_id`)
+	if err != nil {
+		slog.Error("backfill: zone-firsts query", "err", err)
+		return 0
+	}
+	type first struct {
+		zoneID, userID, completedAt string
+	}
+	var firsts []first
+	for rows.Next() {
+		var f first
+		if err := rows.Scan(&f.zoneID, &f.userID, &f.completedAt); err != nil {
+			slog.Error("backfill: zone-firsts scan", "err", err)
+			continue
+		}
+		firsts = append(firsts, f)
+	}
+	rows.Close()
+
+	n := 0
+	for _, f := range firsts {
+		uid := id.UserID(f.userID)
+		// Seed the ledger regardless of whether we can render a dispatch, so the
+		// realm-first tiering is correct even for an unnamed straggler.
+		claimRealmFirst("zone", f.zoneID)
+
+		name := charName(uid)
+		if name == "" {
+			continue
+		}
+		ts, ok := parseSQLiteTime(f.completedAt)
+		if !ok {
+			continue
+		}
+		zone := zoneOrFallback(ZoneID(f.zoneID))
+		lvl := charLevel(uid)
+		emitFact(peteclient.Fact{
+			GUID:       fmt.Sprintf("zone_first:%s:%s:%d", eventToken(uid, fmt.Sprintf("%s:%d", f.zoneID, ts.Unix())), f.zoneID, ts.Unix()),
+			EventType:  "zone_first",
+			Tier:       "priority",
+			Subject:    name,
+			Zone:       zone.Display,
+			Boss:       zone.Boss.Name,
+			Level:      lvl,
+			Outcome:    "cleared",
+			OccurredAt: ts.Unix(),
+			NoPush:     true,
+		}, uid, "")
+		n++
+	}
+	return n
+}
+
+// backfillDeaths emits one death dispatch per player_meta death record. Deaths
+// are day-granular (last_death_date), so the dispatch is backdated to that day.
+func backfillDeaths() int {
+	rows, err := db.Get().Query(
+		`SELECT user_id, last_death_date, death_location
+		   FROM player_meta
+		  WHERE last_death_date != ''`)
+	if err != nil {
+		slog.Error("backfill: deaths query", "err", err)
+		return 0
+	}
+	type death struct {
+		userID, date, location string
+	}
+	var deaths []death
+	for rows.Next() {
+		var d death
+		if err := rows.Scan(&d.userID, &d.date, &d.location); err != nil {
+			slog.Error("backfill: deaths scan", "err", err)
+			continue
+		}
+		deaths = append(deaths, d)
+	}
+	rows.Close()
+
+	n := 0
+	for _, d := range deaths {
+		uid := id.UserID(d.userID)
+		name := charName(uid)
+		if name == "" {
+			continue
+		}
+		day, err := time.Parse("2006-01-02", d.date)
+		if err != nil {
+			continue
+		}
+		lvl := charLevel(uid)
+		emitFact(peteclient.Fact{
+			GUID:       fmt.Sprintf("death:%s:%s", eventToken(uid, d.date), d.date),
+			EventType:  "death",
+			Tier:       "priority",
+			Subject:    name,
+			Zone:       d.location,
+			Level:      lvl,
+			Outcome:    "lost",
+			OccurredAt: day.UTC().Unix(),
+			NoPush:     true,
+		}, uid, "")
+		n++
+	}
+	return n
+}
+
+// backfillSoloAchievements emits a milestone dispatch for every achievement held
+// by exactly one player — the same rarity gate the live path uses — so the
+// backlog carries the genuinely distinctive unlocks, not routine ones.
+func (p *AdventurePlugin) backfillSoloAchievements() int {
+	rows, err := db.Get().Query(
+		`SELECT achievement_id, user_id, unlocked_at
+		   FROM achievements
+		  GROUP BY achievement_id
+		 HAVING COUNT(*) = 1`)
+	if err != nil {
+		slog.Error("backfill: achievements query", "err", err)
+		return 0
+	}
+	type solo struct {
+		achID, userID string
+		unlockedAt    int64
+	}
+	var solos []solo
+	for rows.Next() {
+		var s solo
+		if err := rows.Scan(&s.achID, &s.userID, &s.unlockedAt); err != nil {
+			slog.Error("backfill: achievements scan", "err", err)
+			continue
+		}
+		solos = append(solos, s)
+	}
+	rows.Close()
+
+	n := 0
+	for _, s := range solos {
+		uid := id.UserID(s.userID)
+		name := charName(uid)
+		if name == "" {
+			continue
+		}
+		label := s.achID
+		if p.achievements != nil {
+			for _, a := range p.achievements.achievements {
+				if a.ID == s.achID {
+					label = a.Name
+					break
+				}
+			}
+		}
+		ts := s.unlockedAt
+		if ts == 0 {
+			ts = nowUnix()
+		}
+		emitFact(peteclient.Fact{
+			GUID:       fmt.Sprintf("milestone:%s:%s", eventToken(uid, s.achID), s.achID),
+			EventType:  "milestone",
+			Tier:       "bulletin",
+			Subject:    name,
+			Milestone:  label,
+			OccurredAt: ts,
+			NoPush:     true,
+		}, uid, "")
+		n++
+	}
+	return n
+}

internal/plugin/combat_ally_heal_test.go

@@ -0,0 +1,174 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// §1 — the cleric fix.
+//
+// Until this landed, EVERY heal in the combat engine was self-scoped:
+// MistyHealProc healed the actor, HealItem fired the actor's own trigger, and
+// turnActionEffect.PlayerHeal wrote to the acting seat. There was no action of any
+// kind that could touch another seat's HP. A party cleric — the class whose entire
+// identity is keeping other people upright — could not put one hit point on a
+// friend, and N3 shipped that way without a single test going red, because party
+// combat had no golden.
+//
+// These tests exist so that can never be true again.
+
+// startAllyHealFight seats a healer at 0 and a hurt friend at 1.
+func startAllyHealFight(t *testing.T, p *AdventurePlugin, hurtHP int) *CombatSession {
+	t.Helper()
+	healer := basePlayer()
+	friend := basePlayer()
+	enemy := Combatant{Name: "dummy", Stats: CombatStats{MaxHP: 800, AC: 10, Attack: 1, AttackBonus: 1}}
+
+	// Distinct ids per fight: one active session per player is enforced, so two
+	// fights sharing a healer would collide.
+	tag := strings.ReplaceAll(t.Name(), "/", "_")
+	sess, err := p.startPartyCombatSession("run-"+tag, "enc", "goblin", &enemy, []CombatSeatSetup{
+		{UserID: healerID(tag), HP: 100, HPMax: 100, Mods: healer.Mods, C: &healer},
+		{UserID: friendID(tag), HP: hurtHP, HPMax: 100, Mods: friend.Mods, C: &friend},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return sess
+}
+
+func healerID(tag string) id.UserID { return id.UserID("@healer-" + tag + ":example.org") }
+func friendID(tag string) id.UserID { return id.UserID("@friend-" + tag + ":example.org") }
+
+func TestAllyHeal_LandsOnTheFriendNotTheCaster(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	sess := startAllyHealFight(t, p, 20)
+
+	healer, friend := basePlayer(), basePlayer()
+	players := []*Combatant{&healer, &friend}
+	enemy := Combatant{Name: "dummy", Stats: CombatStats{MaxHP: 800, AC: 10, Attack: 1, AttackBonus: 1}}
+	ct := &combatTurn{sess: sess, players: players, enemy: &enemy, seat: 0, uid: healerID(strings.ReplaceAll(t.Name(), "/", "_"))}
+
+	casterBefore, friendBefore := sess.seatHP(0), sess.seatHP(1)
+
+	_, err := p.driveCombatRound(ct, PlayerAction{
+		Kind: ActionCast,
+		Effect: &turnActionEffect{
+			Label: "Cure Wounds", Action: "spell_cast",
+			AllyHeal: 30, AllySeat: 1,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got := sess.seatHP(1); got != friendBefore+30 {
+		t.Errorf("friend HP = %d, want %d — the heal did not reach them. "+
+			"This is the bug: a cleric who cannot heal anyone but themselves.",
+			got, friendBefore+30)
+	}
+	if got := sess.seatHP(0); got > casterBefore {
+		t.Errorf("caster HP = %d (was %d) — the heal landed on the caster instead of the target",
+			got, casterBefore)
+	}
+}
+
+// A heal cannot exceed the target's ceiling, and cannot raise the dead. Death is
+// terminal for the fight — the close-out marks them, the hospital takes them — and
+// a heal that resurrected a corpse would quietly rewrite the loss rules every
+// close-out path depends on.
+func TestAllyHeal_CapsAtMaxAndWillNotRaiseTheDead(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+
+	t.Run("caps at max", func(t *testing.T) {
+		sess := startAllyHealFight(t, p, 90)
+		healer, friend := basePlayer(), basePlayer()
+		ct := &combatTurn{sess: sess, players: []*Combatant{&healer, &friend},
+			enemy: &Combatant{Name: "d", Stats: CombatStats{MaxHP: 800, AC: 10, Attack: 1, AttackBonus: 1}},
+			seat:  0, uid: healerID(strings.ReplaceAll(t.Name(), "/", "_"))}
+
+		if _, err := p.driveCombatRound(ct, PlayerAction{Kind: ActionCast,
+			Effect: &turnActionEffect{Label: "Cure", Action: "spell_cast", AllyHeal: 500, AllySeat: 1},
+		}); err != nil {
+			t.Fatal(err)
+		}
+		if got, want := sess.seatHP(1), sess.seatHPMax(1); got > want {
+			t.Errorf("friend healed to %d over a max of %d", got, want)
+		}
+	})
+
+	t.Run("will not raise the dead", func(t *testing.T) {
+		sess := startAllyHealFight(t, p, 0) // seat 1 is already down
+		healer, friend := basePlayer(), basePlayer()
+		ct := &combatTurn{sess: sess, players: []*Combatant{&healer, &friend},
+			enemy: &Combatant{Name: "d", Stats: CombatStats{MaxHP: 800, AC: 10, Attack: 1, AttackBonus: 1}},
+			seat:  0, uid: healerID(strings.ReplaceAll(t.Name(), "/", "_"))}
+
+		if _, err := p.driveCombatRound(ct, PlayerAction{Kind: ActionCast,
+			Effect: &turnActionEffect{Label: "Cure", Action: "spell_cast", AllyHeal: 50, AllySeat: 1},
+		}); err != nil {
+			t.Fatal(err)
+		}
+		if got := sess.seatHP(1); got > 0 {
+			t.Errorf("a downed seat was healed to %d — healing keeps people up, it does not bring them back", got)
+		}
+	})
+}
+
+// The target parser resolves against the people in the fight, and leaves anything
+// it does not recognise on the string for the spell parser — so every existing
+// `!cast` form still means what it always meant.
+func TestSplitCastTarget(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	sess := startAllyHealFight(t, p, 50)
+	healer, friend := basePlayer(), basePlayer()
+	healer.Name, friend.Name = "Ayla", "Bram"
+	ct := &combatTurn{sess: sess, players: []*Combatant{&healer, &friend},
+		enemy: &Combatant{Name: "d"}, seat: 0, uid: healerID(strings.ReplaceAll(t.Name(), "/", "_"))}
+
+	tName := t.Name()
+	tests := []struct {
+		name      string
+		in        string
+		wantArgs  string
+		wantSeat  int
+		wantError bool
+	}{
+		{"no target", "cure wounds", "cure wounds", -1, false},
+		{"slot level is not a target", "fireball 3", "fireball 3", -1, false},
+		{"@mention by display name", "cure wounds @Bram", "cure wounds", 1, false},
+		// The flag !help has advertised all along, and that parseCombatCast used to
+		// accept and silently throw away ("reserved for SP3").
+		{"--target flag", "cure wounds --target @Bram", "cure wounds", 1, false},
+		{"--target mid-string", "cure wounds --target Bram", "cure wounds", 1, false},
+		{"--target with no name", "cure wounds --target", "", -1, true},
+		{"bare display name", "cure wounds Bram", "cure wounds", 1, false},
+		{"by localpart", "cure wounds @" + friendID(strings.ReplaceAll(tName, "/", "_")).Localpart(), "cure wounds", 1, false},
+		{"targeting yourself is just casting it", "cure wounds @Ayla", "cure wounds", -1, false},
+		{"@mention of a stranger is an error", "cure wounds @nobody", "", -1, true},
+		{"an unknown bare word is left for the spell parser", "mass cure wounds", "mass cure wounds", -1, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			args, seat, errMsg := splitCastTarget(ct, 0, tc.in)
+			if tc.wantError {
+				if errMsg == "" {
+					t.Fatalf("splitCastTarget(%q) gave no error; a mistyped @mention would silently waste the slot", tc.in)
+				}
+				return
+			}
+			if errMsg != "" {
+				t.Fatalf("splitCastTarget(%q) errored: %s", tc.in, errMsg)
+			}
+			if args != tc.wantArgs || seat != tc.wantSeat {
+				t.Errorf("splitCastTarget(%q) = (%q, %d), want (%q, %d)",
+					tc.in, args, seat, tc.wantArgs, tc.wantSeat)
+			}
+		})
+	}
+}

internal/plugin/combat_armed_ability_test.go

@@ -0,0 +1,294 @@
+package plugin
+
+import (
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// An armed ability is consumed once, at fight start, and its id is parked on the
+// seat. Everything here defends that split.
+//
+// Before it existed, buildZoneCombatants consumed the ability itself — and the
+// turn-based engine calls that builder again on every !attack. So a Berserker
+// raged on round 1, the builder cleared their armed flag and saved, and round 2
+// rebuilt them with no rage at all. They paid stamina for one round of a buff
+// that is supposed to span the fight, and the close-out could not see the rage
+// it was supposed to charge exhaustion for.
+
+// ragingBerserker is a Fighter who has already `!arm`ed rage.
+func ragingBerserker(t *testing.T, uid id.UserID) *DnDCharacter {
+	t.Helper()
+	if err := createAdvCharacter(uid, string(uid)); err != nil {
+		t.Fatal(err)
+	}
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Subclass: SubclassBerserker, Level: 5,
+		STR: 16, DEX: 12, CON: 14, INT: 10, WIS: 10, CHA: 10,
+		HPMax: 40, HPCurrent: 40, ArmorClass: 15,
+		ArmedAbility: "rage",
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+// ── the split ────────────────────────────────────────────────────────────────
+
+// consumeArmedAbility disarms and reports; applyAbilityByID applies and does not
+// disarm. Calling the second one twice must be indistinguishable from once.
+func TestApplyAbilityByID_IsPureAndRepeatable(t *testing.T) {
+	setupEmptyTestDB(t)
+	c := ragingBerserker(t, "@pure:example.org")
+
+	armed := consumeArmedAbility(c)
+	if armed != "rage" {
+		t.Fatalf("consumeArmedAbility = %q, want rage", armed)
+	}
+	if c.ArmedAbility != "" {
+		t.Errorf("character still armed after consume: %q", c.ArmedAbility)
+	}
+	if again := consumeArmedAbility(c); again != "" {
+		t.Errorf("second consume returned %q, want \"\" — the ability is spent", again)
+	}
+
+	// Same id, applied to two independent mod sets, yields the same rage.
+	for i, want := range []bool{true, true} {
+		var mods CombatModifiers
+		name, fired := applyAbilityByID(c, armed, &mods)
+		if !fired || name != "Rage" {
+			t.Fatalf("apply #%d: fired=%v name=%q", i+1, fired, name)
+		}
+		if mods.BerserkerRage != want {
+			t.Errorf("apply #%d: BerserkerRage = %v, want %v", i+1, mods.BerserkerRage, want)
+		}
+		if mods.RageMeleeDmg != 2 || !mods.PhysicalResistRage {
+			t.Errorf("apply #%d: rage did not carry its full mod set: %+v", i+1, mods)
+		}
+	}
+
+	// And it never writes back to the sheet.
+	got, _ := LoadDnDCharacter(c.UserID)
+	if got.ArmedAbility != "" {
+		t.Errorf("applyAbilityByID re-armed the sheet: %q", got.ArmedAbility)
+	}
+}
+
+func TestApplyAbilityByID_UnknownAndEmptyAreNoOps(t *testing.T) {
+	c := &DnDCharacter{Class: ClassFighter}
+	for _, id := range []string{"", "no_such_ability"} {
+		var mods CombatModifiers
+		if _, fired := applyAbilityByID(c, id, &mods); fired {
+			t.Errorf("applyAbilityByID(%q) fired", id)
+		}
+		if mods.BerserkerRage {
+			t.Errorf("applyAbilityByID(%q) set rage", id)
+		}
+	}
+}
+
+// ── the fight-start seat ─────────────────────────────────────────────────────
+
+// The seat carries the id forward, and the sheet is disarmed exactly once.
+func TestBuildFightSeats_ConsumesTheAbilityOnceAndCarriesItOnTheSeat(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@berserk:example.org")
+	ragingBerserker(t, uid)
+
+	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
+		uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+	if refusal != "" {
+		t.Fatalf("fight refused: %s", refusal)
+	}
+	if len(seats) != 1 {
+		t.Fatalf("seats = %d, want 1", len(seats))
+	}
+	if seats[0].ArmedAbility != "rage" {
+		t.Errorf("seat.ArmedAbility = %q, want rage", seats[0].ArmedAbility)
+	}
+	if !seats[0].Mods.BerserkerRage {
+		t.Error("seat built without rage in its mods")
+	}
+	got, _ := LoadDnDCharacter(uid)
+	if got.ArmedAbility != "" {
+		t.Errorf("sheet still armed after fight start: %q", got.ArmedAbility)
+	}
+}
+
+// The regression itself: rebuilding the combatant — what every !attack does —
+// must reproduce the rage from the persisted id, not from the (now cleared)
+// sheet. Two rebuilds in a row, both raging.
+func TestBuildZoneCombatants_RebuildKeepsTheRageForTheWholeFight(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@rebuild:example.org")
+	ragingBerserker(t, uid)
+	p := &AdventurePlugin{}
+
+	seats, _, _, refusal := p.buildFightSeats(uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+	if refusal != "" {
+		t.Fatalf("fight refused: %s", refusal)
+	}
+	armed := seats[0].ArmedAbility
+
+	for round := 2; round <= 3; round++ {
+		player, _, _, err := p.buildZoneCombatants(uid, dndBestiary["goblin"], 1, 0, armed)
+		if err != nil {
+			t.Fatalf("round %d rebuild: %v", round, err)
+		}
+		if !player.Mods.BerserkerRage {
+			t.Errorf("round %d: rage evaporated on rebuild", round)
+		}
+		if player.Mods.RageMeleeDmg != 2 {
+			t.Errorf("round %d: RageMeleeDmg = %d, want 2", round, player.Mods.RageMeleeDmg)
+		}
+	}
+
+	// A seat that armed nothing rebuilds without rage — the id is the only source.
+	player, _, _, err := p.buildZoneCombatants(uid, dndBestiary["goblin"], 1, 0, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if player.Mods.BerserkerRage {
+		t.Error("unarmed rebuild raged anyway")
+	}
+}
+
+// A member who is down sits the fight out. They must not be charged the ability
+// they had readied for it — the refusal is checked before the arm.
+func TestBuildFightSeats_SatOutMemberKeepsTheirArmedAbility(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader := id.UserID("@lead:example.org")
+	downed := id.UserID("@downed:example.org")
+	fightTestChar(t, leader, 30)
+	ragingBerserker(t, downed)
+
+	// Drop the member to 0 HP with rage still armed.
+	c, _ := LoadDnDCharacter(downed)
+	c.HPCurrent = 0
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+
+	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
+		leader, []id.UserID{leader, downed}, dndBestiary["goblin"], 1, 0)
+	if refusal != "" {
+		t.Fatalf("fight refused: %s", refusal)
+	}
+	if len(seats) != 1 || seats[0].UserID != leader {
+		t.Fatalf("seats = %+v, want the leader alone", seats)
+	}
+	got, _ := LoadDnDCharacter(downed)
+	if got.ArmedAbility != "rage" {
+		t.Errorf("downed member was disarmed for a fight they never joined: %q", got.ArmedAbility)
+	}
+}
+
+// ── the close-out ────────────────────────────────────────────────────────────
+
+func TestSeatFightStartMods_ReadsTheRageOffTheSeatsStatuses(t *testing.T) {
+	c := &DnDCharacter{Class: ClassFighter, Subclass: SubclassBerserker, Level: 5}
+
+	raging := &CombatSession{}
+	raging.Statuses.ArmedAbility = "rage"
+	if !seatFightStartMods(raging, 0, c).BerserkerRage {
+		t.Error("seat 0 armed rage, mods say otherwise")
+	}
+
+	// Seat 1 reads its own statuses, not the leader's.
+	party := &CombatSession{Participants: []CombatParticipant{{Seat: 1}}}
+	party.Statuses.ArmedAbility = "rage"
+	if seatFightStartMods(party, 1, c).BerserkerRage {
+		t.Error("a member inherited the leader's rage")
+	}
+}
+
+func TestSeatCombatResult_ReadsWinAndNearDeathOffTheSession(t *testing.T) {
+	sess := &CombatSession{
+		Status: CombatStatusWon, Round: 4, PlayerHP: 5, PlayerHPMax: 40, EnemyHP: 0,
+		TurnLog: []CombatEvent{
+			{Action: "attack", Seat: 0},
+			{Action: "use_consumable", Seat: 1},
+		},
+	}
+	got := seatCombatResult(sess, 0)
+	if !got.PlayerWon {
+		t.Error("PlayerWon = false on a won session")
+	}
+	if !got.NearDeath {
+		t.Error("5/40 HP is under the 15% near-death line")
+	}
+	if len(got.Events) != 1 || got.Events[0].Action != "attack" {
+		t.Errorf("seat 0 got seat 1's events: %+v", got.Events)
+	}
+
+	sess.PlayerHP = 30
+	if seatCombatResult(sess, 0).NearDeath {
+		t.Error("30/40 HP is not near death")
+	}
+	sess.Status = CombatStatusLost
+	sess.PlayerHP = 0
+	if seatCombatResult(sess, 0).PlayerWon {
+		t.Error("PlayerWon = true on a lost session")
+	}
+}
+
+// Item A: the manual kill now costs the Berserker their exhaustion, exactly as
+// the auto-resolved one always has.
+func TestPostCombatBookkeepingForSeat_RageCostsExhaustionOnTheTurnBasedPath(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@exhausted:example.org")
+	ragingBerserker(t, uid)
+
+	sess := &CombatSession{
+		UserID: string(uid), Status: CombatStatusWon, Round: 3,
+		PlayerHP: 12, PlayerHPMax: 40,
+	}
+	sess.Statuses.ArmedAbility = "rage"
+
+	(&AdventurePlugin{}).postCombatBookkeepingForSeat(sess, 0)
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.Exhaustion != 1 {
+		t.Errorf("Exhaustion = %d after a raging win, want 1", got.Exhaustion)
+	}
+}
+
+// A fight nobody raged in leaves the sheet alone.
+func TestPostCombatBookkeepingForSeat_NoRageNoExhaustion(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@calm:example.org")
+	fightTestChar(t, uid, 30)
+
+	sess := &CombatSession{
+		UserID: string(uid), Status: CombatStatusWon, Round: 2,
+		PlayerHP: 20, PlayerHPMax: 30,
+	}
+	(&AdventurePlugin{}).postCombatBookkeepingForSeat(sess, 0)
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.Exhaustion != 0 {
+		t.Errorf("Exhaustion = %d with no rage, want 0", got.Exhaustion)
+	}
+}
+
+// Losing while raging still exhausts you — the close-out runs on every terminal
+// status, not just the win. This is the half the turn-based path used to skip.
+func TestPostCombatBookkeepingForSeat_RageCostsExhaustionOnALoss(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@dead:example.org")
+	ragingBerserker(t, uid)
+
+	sess := &CombatSession{
+		UserID: string(uid), Status: CombatStatusLost, Round: 6,
+		PlayerHP: 0, PlayerHPMax: 40,
+	}
+	sess.Statuses.ArmedAbility = "rage"
+
+	(&AdventurePlugin{}).postCombatBookkeepingForSeat(sess, 0)
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.Exhaustion != 1 {
+		t.Errorf("Exhaustion = %d after a raging loss, want 1", got.Exhaustion)
+	}
+}

internal/plugin/combat_bridge.go

@@ -10,6 +10,30 @@ import (
 	"maunium.net/go/mautrix/id"
 )
 
+// postCombatBookkeeping is the close-out every fight owes its character,
+// whatever surface it was fought on: achievements, and the subclass state that
+// outlives the fight (Berserker exhaustion, Grim Harvest's kill-heal).
+//
+// It exists because there are four close-outs — two auto-resolve
+// (runDungeonCombat, runZoneCombatRoster) and two turn-based
+// (finishCombatSession, finishPartyCombatSession) — and for a long time only
+// the auto-resolve pair ran any of this. The same Elite kill therefore paid out
+// differently depending on whether the player let it auto-resolve or fought it
+// a round at a time. Route all four through here and the divergence cannot
+// silently reopen.
+//
+// raged is whether the character's Berserker rage was active for this fight;
+// mods carries the fight-start modifiers Grim Harvest reads. HP persistence is
+// NOT done here — the turn-based paths already own their own HP writes.
+func (p *AdventurePlugin) postCombatBookkeeping(
+	userID id.UserID, dndChar *DnDCharacter, raged bool, result CombatResult, mods CombatModifiers,
+) {
+	p.grantCombatAchievements(userID, result)
+	if err := persistDnDPostCombatSubclass(dndChar, raged, result, mods); err != nil {
+		slog.Error("dnd: post-combat subclass persist", "user", userID, "err", err)
+	}
+}
+
 // grantCombatAchievements checks combat results for achievement-worthy moments.
 func (p *AdventurePlugin) grantCombatAchievements(userID id.UserID, result CombatResult) {
 	if p.achievements == nil {
@@ -87,7 +111,7 @@ func (p *AdventurePlugin) runDungeonCombat(
 	applySubclassPassives(&playerStats, &playerMods, dndChar)
 	applyMagicItemEffects(&playerStats, &playerMods, userID)
 	trySimAutoArm(dndChar)
-	if firedName, fired := applyArmedAbility(dndChar, &playerMods); fired {
+	if firedName, fired := armAbilityForFight(dndChar, &playerMods); fired {
 		slog.Info("dnd: armed ability fired", "user", userID, "ability", firedName)
 	}
 	applyDnDDungeonMonsterLayer(&enemyStats, loc.Tier)
@@ -129,12 +153,8 @@ func (p *AdventurePlugin) runDungeonCombat(
 	// until a player-driven use command lands.
 	consumeFiredHealingItems(userID, countHealEventsFired(result))
 
-	p.grantCombatAchievements(userID, result)
-
 	persistDnDHPAfterCombat(userID, result.PlayerEndHP)
-	if err := persistDnDPostCombatSubclass(dndChar, playerMods.BerserkerRage, result, playerMods); err != nil {
-		slog.Error("dnd: post-combat subclass persist (dungeon)", "user", userID, "err", err)
-	}
+	p.postCombatBookkeeping(userID, dndChar, playerMods.BerserkerRage, result, playerMods)
 
 	if xp := dungeonCombatXP(result, loc.Tier); xp > 0 {
 		if _, err := p.grantDnDXP(userID, xp); err != nil {
@@ -151,7 +171,12 @@ func (p *AdventurePlugin) loadCombatBonuses(userID id.UserID, char *AdventureCha
 	treasures, _ := loadAdvTreasureBonuses(userID)
 	buffs, _ := loadAdvActiveBuffs(userID)
 	hasGrudge := char.GrudgeLocation != ""
-	return computeAdvBonuses(treasures, buffs, char.CurrentStreak, hasGrudge)
+	b := computeAdvBonuses(treasures, buffs, char.CurrentStreak, hasGrudge)
+	// N7/B2 — renown pays out on loot/XP here too. Safe despite this feeding
+	// combat_stats: applyRenownBonuses touches only LootQuality/XPMultiplier,
+	// which combat stat derivation never reads (see adventure_renown.go).
+	applyRenownBonuses(b, char.RenownLevel())
+	return b
 }
 
 // loadConsumableInventory scans inventory for items matching consumable definitions.
@@ -165,7 +190,7 @@ func (p *AdventurePlugin) loadConsumableInventory(userID id.UserID) []Consumable
 	// Auto-craft if player has foraging level 10+
 	char, err := loadAdvCharacter(userID)
 	if err == nil && char.ForagingSkill >= 10 {
-		craftResults, updatedItems := autoCraftConsumables(userID, items, char.ForagingSkill)
+		craftResults, updatedItems := autoCraftConsumables(userID, items, char.ForagingSkill, homeWorkshopCraftBonus(char.HouseTier))
 		if len(craftResults) > 0 {
 			items = updatedItems
 			for _, cr := range craftResults {

internal/plugin/combat_cmd.go

@@ -101,7 +101,11 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {
 	if refusal != "" {
 		return p.replyDM(ctx, refusal)
 	}
-	enemyHP := enemy.Stats.MaxHP
+	// The persisted session scales enemy HP for a party (solo scales by 1.0, so
+	// this is a no-op there); mirror it here so the entry banner and the opening
+	// round resolve against the same ceiling startPartyCombatSession persisted and
+	// the rebuilt rounds use.
+	enemyHP := scaledEnemyMaxHP(enemy.Stats.MaxHP, seatSetupWeight(seats))
 
 	// Fight-start one-shot resources (Abjuration Arcane Ward, etc.) are seeded
 	// per seat onto the session and its participant rows, so they survive the
@@ -130,6 +134,11 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {
 
 	if sess.IsParty() {
 		players := seatCombatants(seats)
+		// Align the in-memory template with the scaled HP persisted above, so the
+		// opening-round settle resolves the enemy against the same MaxHP the
+		// rebuilt rounds do (regen clamp, bloodied-ability threshold). The persist
+		// already happened off the unscaled value, so this does not double-scale.
+		enemy.Stats.MaxHP = enemyHP
 		// The enemy may have won initiative. Resolve everything the round owes
 		// before anyone is asked to act, so the opening block narrates the hit
 		// rather than showing its damage with no explanation.
@@ -332,6 +341,10 @@ func continueHint(userID id.UserID) string {
 // the room's manual combat is done, and a fresh !zone advance clears the room.
 func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSession, enemy Combatant) string {
 	persistDnDHPAfterCombat(userID, sess.PlayerHP)
+	// Achievements and post-combat subclass state are owed on every terminal
+	// status, not just a win — a Berserker who rages and loses still comes out
+	// of it exhausted. The auto-resolve close-outs have always done this.
+	p.postCombatBookkeepingForSeat(sess, 0)
 
 	run, _ := getZoneRun(sess.RunID)
 	var zone ZoneDefinition
@@ -350,28 +363,12 @@ func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSess
 	var b strings.Builder
 	switch sess.Status {
 	case CombatStatusWon:
-		recordZoneKillForUser(userID, sess.EnemyID)
-		applyRoomCombatThreatForUser(userID, elite)
-		// zoneCombatXP only reads PlayerWon + NearDeath off the result.
-		nearDeath := sess.PlayerHPMax > 0 && sess.PlayerHP*5 < sess.PlayerHPMax
 		tier := 1
 		if run != nil {
 			tier = int(zone.Tier)
 		}
-		if xp := zoneCombatXP(CombatResult{PlayerWon: true, NearDeath: nearDeath}, monster.CR, tier); xp > 0 {
-			if _, err := p.grantDnDXP(userID, xp); err != nil {
-				slog.Error("combat: grantDnDXP turn-based", "user", userID, "err", err)
-			}
-		}
-		bossOnExpedition := false
-		if !elite {
-			// §8.1 — zone boss defeat drops expedition threat. Silent no-op
-			// for standalone zone runs (no active expedition).
-			if exp, eerr := getActiveExpedition(userID); eerr == nil && exp != nil {
-				_ = applyBossDefeatThreat(exp.ID)
-				bossOnExpedition = true
-			}
-		}
+		bossOnExpedition := p.applyOwnerWinEffects(userID, sess.EnemyID, elite)
+		p.grantSeatWinXP(userID, sess.PlayerHP, sess.PlayerHPMax, monster, tier)
 		if line := twinBeeLine(zone.ID, DMCombatEnd, sess.RunID, cadence); line != "" {
 			b.WriteString(line + "\n")
 		}
@@ -384,6 +381,9 @@ func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSess
 		if drop := p.dropZoneLoot(userID, zone.ID, monster, !elite, elite); drop != "" {
 			b.WriteString(drop + "\n")
 		}
+		if !elite {
+			writeBossEpilogue(&b, zone.ID)
+		}
 		if bossOnExpedition {
 			// The boss is the expedition's climax. Frame the close-out as
 			// the win rather than a "keep walking" nudge. One more
@@ -395,11 +395,7 @@ func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSess
 		}
 
 	case CombatStatusLost:
-		if run != nil {
-			_, _ = applyMoodEvent(sess.RunID, MoodEventPlayerDeath)
-		}
-		_ = abandonZoneRun(userID)
-		forceExtractExpeditionForRunLoss(userID, "combat death")
+		endRunOnLoss(userID, sess.RunID, true)
 		markAdventureDead(userID, "zone", zone.Display)
 		if line := twinBeeLine(zone.ID, DMPlayerDeath, sess.RunID, cadence); line != "" {
 			b.WriteString(line + "\n")
@@ -410,8 +406,7 @@ func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSess
 		// Flee = run ends, light penalty: wounds persist (HP already saved),
 		// but no death timer. Chosen candidate from the migration plan's
 		// open question on flee outcome.
-		_ = abandonZoneRun(userID)
-		forceExtractExpeditionForRunLoss(userID, "combat flee")
+		endRunOnLoss(userID, sess.RunID, false)
 		b.WriteString(fmt.Sprintf("🏃 You broke off from **%s** and slipped away. Run ended — you keep your wounds, but you live.", enemy.Name))
 
 	default:
@@ -430,7 +425,11 @@ func (p *AdventurePlugin) finishCombatSession(userID id.UserID, sess *CombatSess
 // returns the spell plus the resolved slot level. errMsg is non-empty and
 // player-facing on any validation failure. It performs NO resource spend —
 // the caller debits the slot only once the round is about to resolve.
-func parseCombatCast(userID id.UserID, c *DnDCharacter, args string) (SpellDefinition, int, string) {
+//
+// It takes the seat, not just the user, because "do you know this spell" is a
+// question about a combatant and only *usually* a question about a database row:
+// the hired companion has no rows and answers it from his synthetic sheet.
+func parseCombatCast(sess *CombatSession, seat int, userID id.UserID, c *DnDCharacter, args string) (SpellDefinition, int, string) {
 	tokens := strings.Fields(args)
 	upcast := 0
 	var spellTokens []string
@@ -478,7 +477,7 @@ func parseCombatCast(userID id.UserID, c *DnDCharacter, args string) (SpellDefin
 			return SpellDefinition{}, 0, fmt.Sprintf("At level %d, your Arcane Trickster magic only reaches level-%d spells.", c.Level, mx)
 		}
 	}
-	known, prepared, err := playerKnowsSpell(userID, spell.ID)
+	known, prepared, err := seatKnowsSpell(sess, seat, userID, spell.ID)
 	if err != nil {
 		return SpellDefinition{}, 0, "Couldn't check your spell list."
 	}
@@ -531,12 +530,92 @@ func (p *AdventurePlugin) handleCombatCastCmd(ctx MessageContext, args string) e
 // the roster so the buff is live for the round's enemy turn. Before P5 that
 // delta went to the session's embedded copy — seat 0 — so a party member
 // buffing themselves would have buffed the leader.
+// splitCastTarget peels an optional ally target off the end of a `!cast` argument
+// — `cure wounds @alex`, or just `cure wounds alex` — and resolves it to a seat.
+//
+// It resolves against the people *in this fight* rather than the room, which is
+// both cheaper (no ResolveUser round-trip, no RoomID to thread down here) and
+// more correct: the only legal target of a combat heal is somebody sitting in the
+// combat. Anything it does not recognise is left on the string for the spell
+// parser, so `!cast cure wounds` and `!cast fireball 3` behave exactly as before.
+//
+// Both spellings work: the `--target @alex` flag that `!help` has advertised all
+// along (and that parseCombatCast has been silently swallowing since SP2 —
+// "reserved for SP3, accept and ignore"), and a plain trailing `@alex`.
+//
+// Returns (remainingArgs, seat, errMsg). seat is -1 when no target was named.
+func splitCastTarget(ct *combatTurn, caster int, args string) (string, int, string) {
+	args = strings.TrimSpace(args)
+	if args == "" || !ct.isParty() {
+		return args, -1, ""
+	}
+	fields := strings.Fields(args)
+
+	// `--target <who>` anywhere in the string.
+	explicit, name := false, ""
+	for i := 0; i < len(fields); i++ {
+		if !strings.EqualFold(fields[i], "--target") {
+			continue
+		}
+		if i+1 >= len(fields) {
+			return args, -1, "`--target` needs a name: `!cast cure wounds --target @alex`."
+		}
+		explicit, name = true, strings.TrimPrefix(fields[i+1], "@")
+		fields = append(fields[:i], fields[i+2:]...)
+		break
+	}
+
+	if name == "" {
+		last := fields[len(fields)-1]
+		// A bare number is a slot level (`!cast fireball 3`), never a target.
+		if _, err := strconv.Atoi(last); err == nil {
+			return args, -1, ""
+		}
+		explicit = strings.HasPrefix(last, "@")
+		name = strings.TrimPrefix(last, "@")
+		if name == "" {
+			return args, -1, ""
+		}
+		fields = fields[:len(fields)-1]
+	}
+	// From here `fields` is the spell tokens with the target removed.
+	rest := strings.Join(fields, " ")
+
+	for i, c := range ct.players {
+		uid := ct.sess.seatUserID(i)
+		if !strings.EqualFold(c.Name, name) &&
+			!strings.EqualFold(uid, name) &&
+			!strings.EqualFold(id.UserID(uid).Localpart(), name) {
+			continue
+		}
+		if i == caster {
+			// Targeting yourself is just casting it on yourself, which is what the
+			// engine does by default. Drop the target and carry on.
+			return rest, -1, ""
+		}
+		return rest, i, ""
+	}
+	// An explicit @mention that matches nobody in the fight is a mistake worth
+	// naming — silently casting it on yourself would waste the slot.
+	if explicit {
+		return args, -1, fmt.Sprintf("**%s** isn't in this fight. Cast it on someone who is.", name)
+	}
+	return args, -1, ""
+}
+
 func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args string) (PlayerAction, func(bool), string) {
 	noop := func(bool) {}
 	uid := id.UserID(ct.sess.seatUserID(seat))
 
-	advChar, _ := loadAdvCharacter(uid)
-	c, err := p.ensureCharForDnDCmd(uid, advChar)
+	// §1 — a heal may name somebody else in the fight: `!cast cure wounds @alex`.
+	// Split the target off before the spell is parsed, so the spell parser sees
+	// the same string it always has.
+	args, targetSeat, targetErr := splitCastTarget(ct, seat, args)
+	if targetErr != "" {
+		return PlayerAction{}, noop, targetErr
+	}
+
+	c, err := p.seatCastSheet(ct.sess, uid)
 	if err != nil || c == nil {
 		return PlayerAction{}, noop, "Couldn't load your Adv 2.0 sheet."
 	}
@@ -545,7 +624,7 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			"%s isn't a caster class. `!attack` or `!consume <item>` instead.", titleClass(c.Class))
 	}
 
-	spell, slotLevel, errMsg := parseCombatCast(uid, c, strings.TrimSpace(args))
+	spell, slotLevel, errMsg := parseCombatCast(ct.sess, seat, uid, c, strings.TrimSpace(args))
 	if errMsg != "" {
 		return PlayerAction{}, noop, errMsg
 	}
@@ -556,7 +635,7 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 
 	refund := func(ok bool) {
 		if !ok && spell.Level > 0 {
-			_ = refundSpellSlot(uid, slotLevel)
+			_ = refundSeatSlot(ct.sess, seat, uid, slotLevel)
 		}
 	}
 
@@ -573,7 +652,7 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			return PlayerAction{}, noop, fmt.Sprintf(
 				"%s has no effect the turn-based engine can apply yet.", spell.Name)
 		}
-		if msg := p.chargeSpellCost(uid, spell, slotLevel); msg != "" {
+		if msg := p.chargeSpellCost(ct.sess, seat, uid, spell, slotLevel); msg != "" {
 			return PlayerAction{}, noop, msg
 		}
 		ct.sess.actorStatusesPtr(seat).applyBuffDelta(d)
@@ -595,9 +674,21 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			return PlayerAction{}, noop, fmt.Sprintf(
 				"%s is a utility spell — those aren't usable in turn-based fights yet. Try a damage, healing, control, or buff spell.", spell.Name)
 		}
-		if msg := p.chargeSpellCost(uid, spell, slotLevel); msg != "" {
+		if msg := p.chargeSpellCost(ct.sess, seat, uid, spell, slotLevel); msg != "" {
 			return PlayerAction{}, noop, msg
 		}
+		// Park the Necromancy kill-heal stash on the casting seat. The
+		// auto-resolve path keeps it on the fight-start CombatModifiers, which
+		// a turn-based fight has nowhere to hold — it rebuilds its combatants
+		// every round. Only a damaging cast stashes (a miss leaves the slot at
+		// 0), and each one overwrites the last, so the stash always describes
+		// the seat's most recent landed spell — which is the only one that can
+		// have been lethal by the time the close-out reads it.
+		if out.GrimHarvestSlot > 0 {
+			as := ct.sess.actorStatusesPtr(seat)
+			as.GrimHarvestSlot = out.GrimHarvestSlot
+			as.GrimHarvestNecrotic = out.GrimHarvestNecrotic
+		}
 		eff = &turnActionEffect{
 			Label:       out.Desc,
 			Action:      "spell_cast",
@@ -605,6 +696,20 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			PlayerHeal:  out.PlayerHeal,
 			EnemySkip:   out.EnemySkip,
 		}
+		// §1 — redirect the heal onto the named ally. The roll is the same; only
+		// the body it lands on changes. This is the line that makes a cleric a
+		// cleric: until it existed, every heal in the engine was a self-heal, and
+		// the class whose whole job is keeping other people upright could not put
+		// a single hit point on a friend.
+		if targetSeat >= 0 && targetSeat != seat {
+			if out.PlayerHeal <= 0 {
+				return PlayerAction{}, refund, fmt.Sprintf(
+					"%s isn't something you can cast on someone else. Drop the target to cast it yourself.", spell.Name)
+			}
+			eff.AllyHeal, eff.AllySeat = out.PlayerHeal, targetSeat
+			eff.PlayerHeal = 0
+			eff.Label = fmt.Sprintf("%s → %s (+%d HP)", spell.Name, ct.players[targetSeat].Name, out.PlayerHeal)
+		}
 		// Concentration AOE damage spells linger: the burst lands this round
 		// (EnemyDamage) and the same value re-ticks every round_end after, via
 		// the engine's concentration aura. spiritual_weapon already covers the
@@ -633,18 +738,30 @@ func (p *AdventurePlugin) rebuildRoster(ct *combatTurn) error {
 // success the caller owns the slot and must refundSpellSlot if the round itself
 // errors. Material components (rare in a fight) are not refunded if the slot
 // debit then fails — matching the auto-resolve cast path.
-func (p *AdventurePlugin) chargeSpellCost(userID id.UserID, spell SpellDefinition, slotLevel int) string {
+func (p *AdventurePlugin) chargeSpellCost(sess *CombatSession, seat int, userID id.UserID, spell SpellDefinition, slotLevel int) string {
+	_, _, companion := seatCompanionLoadout(sess, userID)
+
+	// The companion carries no purse — he has no wallet to debit and no inventory
+	// to stock one from, so a component cost is not a price he can pay but a spell
+	// he cannot cast. Refusing here (rather than letting the debit fail on an empty
+	// account) keeps that an explicit rule instead of an accident of his balance.
 	if spell.MaterialCost > 0 {
+		if companion {
+			return fmt.Sprintf("%s needs a component %s doesn't carry.", spell.Name, companionDisplayName)
+		}
 		if p.euro == nil || !p.euro.Debit(userID, float64(spell.MaterialCost), "dnd_spell_component") {
 			return fmt.Sprintf("%s needs a %d-coin diamond component you can't afford.", spell.Name, spell.MaterialCost)
 		}
 	}
 	if spell.Level > 0 {
-		ok, serr := consumeSpellSlot(userID, slotLevel)
+		ok, serr := consumeSeatSlot(sess, seat, userID, slotLevel)
 		if serr != nil {
 			return "Couldn't consume slot: " + serr.Error()
 		}
 		if !ok {
+			if companion {
+				return fmt.Sprintf("%s is out of level-%d energy.", companionDisplayName, slotLevel)
+			}
 			return fmt.Sprintf("You're out of level-%d energy. %s", slotLevel, renderSlotsBrief(userID))
 		}
 	}

internal/plugin/combat_engine.go

@@ -162,9 +162,11 @@ type CombatModifiers struct {
 	// ArcaneWardHP: flat HP buffer absorbed before player HP. Refilled at the
 	// start of each combat by Abjuration L5+ (2× Mage level, +prof at L7).
 	// Persists across rounds within a single combat; not refunded between fights.
-	// GrimHarvestSlot/Necrotic: snapshot of the queued spell stashed by
-	// applyPendingCast for the post-combat Grim Harvest hook (Necromancy L5+).
-	// Heal fires only if the spell event is what dropped the enemy to 0.
+	// GrimHarvestSlot/Necrotic: snapshot of the damaging spell stashed for the
+	// post-combat Grim Harvest hook (Necromancy L5+) — by applyPendingCast on
+	// the auto-resolve path, and by seatFightStartMods reading the seat's
+	// statuses on the turn-based one. Heal fires only if that spell's event is
+	// what dropped the enemy to 0.
 	ArcaneWardHP        int
 	GrimHarvestSlot     int
 	GrimHarvestNecrotic bool
@@ -187,6 +189,22 @@ type Combatant struct {
 	Mods     CombatModifiers
 	IsPlayer bool
 	Ability  *MonsterAbility // non-nil for monsters with a special ability
+
+	// SeatWeight is what this seat costs the enemy: 1.0 is a full peer of the
+	// leader, and less than that is a seat that brings less to the fight. Zero
+	// means "unset" and reads as 1.0, so every existing call site — and every solo
+	// fight — is unchanged.
+	//
+	// The enemy's HP bump and its action economy scale on the SUM of these rather
+	// than on a seat count. A seat count charges the boss the same for an
+	// under-levelled friend, a hired NPC, and a peer, which is why hiring a
+	// below-median body was measurably worse than going alone: he cost a full
+	// seat's worth of boss and did not give a full seat's worth back.
+	//
+	// It is derived from the seat's identity (level, and whether it is a hireling),
+	// NOT from fight state — so every per-round rebuild recomputes the same number
+	// and there is nothing to persist. See seatWeight.
+	SeatWeight float64
 }
 
 type CombatPhase struct {
@@ -218,7 +236,14 @@ type CombatEvent struct {
 	//
 	// It exists so a party's play-by-play can name the right person. Solo events
 	// are all seat 0, and the omitempty tag keeps the field out of every solo
-	// turn_log_json — rows written before N3/P5 decode unchanged.
+	// turn_log_json — rows written before N3/P5 decode unchanged, and a fight in
+	// flight across a deploy resumes byte-identically (TestP5Fields_StayOffSoloRows).
+	//
+	// The omitempty makes seat 0 and "no seat" identical on the wire, which is
+	// fine for persistence and actively misleading in a diagnostic trace — it hid
+	// a companion who never swung, making the fight look like it had one seat.
+	// Do NOT fix that here; the wire format is load-bearing. The sim's trace
+	// serializes through simTraceEvent, which always emits the seat.
 	Seat int `json:"Seat,omitempty"`
 }
 

internal/plugin/combat_engine_party.go

@@ -64,6 +64,12 @@ func simulateParty(players []Combatant, enemy Combatant, phases []CombatPhase) P
 }
 
 func simulatePartyWithRNG(players []Combatant, enemy Combatant, phases []CombatPhase, rng *rand.Rand) PartyCombatResult {
+	// Party-only: bump the enemy's max HP so the fight lasts long enough for the
+	// scaled action economy to actually threaten each member. Solo is unchanged
+	// (scale 1.0), so SimulateCombat and the golden do not move.
+	if len(players) > 1 {
+		enemy.Stats.MaxHP = scaledEnemyMaxHP(enemy.Stats.MaxHP, partyWeightOf(players))
+	}
 	enemyStart := enemy.Stats.MaxHP
 	if enemy.Stats.StartHP > 0 && enemy.Stats.StartHP < enemy.Stats.MaxHP {
 		enemyStart = enemy.Stats.StartHP
@@ -289,6 +295,279 @@ func roundInitiative(st *combatState, enemy *Combatant, phase *CombatPhase) []in
 	return order
 }
 
+// enemyActionsThisRound is how many attack-actions the enemy takes this round
+// against the seated roster. Solo returns 1 without drawing from the RNG, so both
+// combat engines collapse to their pre-party behaviour and the characterization
+// golden and d8prereq corpus do not move.
+//
+// A party's action budget is a *fractional expectation* (partyActionExpectation),
+// realised as floor(exp) actions plus one more with probability frac(exp). The
+// fraction matters because the action lever is coarse: against a party of two, an
+// integer 2 actions is a 100% faceroll and 3 is brutal (~45%), with nothing
+// between — a per-round coin-flip for the extra action is the only way to land
+// the band in the gap. The single draw is taken only for a party, so the solo RNG
+// stream is untouched.
+// §2(b): the budget counts the seats still STANDING, re-derived every round —
+// not the seats that walked in.
+//
+// It used to read len(st.actors), which includes the dead. So a party that lost a
+// member kept paying for them: the survivor faced a boss still swinging at
+// two-player cadence, alone. That is a death spiral with the arrow pointing the
+// wrong way — the moment a party is losing, the engine hits it harder — and it is
+// the single nastiest thing the companion sweep turned up, because it is not a
+// companion bug at all. It has been live for every human party since N3.
+//
+// A corpse does not threaten anybody, and the enemy has no reason to keep spending
+// actions on one.
+func enemyActionsThisRound(st *combatState) int {
+	if livingActors(st) < 2 {
+		return 1
+	}
+	// The summed weight of the seats still standing — not a head count of them.
+	// A seat that brings half a peer buys the boss half a peer's worth of extra
+	// swings, and a seat that is down buys none at all.
+	n := livingWeight(st)
+	exp := partyActionExpectation(n)
+	base := int(exp)
+	if frac := exp - float64(base); frac > 0 && st.randFloat() < frac {
+		base++
+	}
+	return base
+}
+
+// livingActors counts the seats still standing.
+func livingActors(st *combatState) int {
+	n := 0
+	for _, a := range st.actors {
+		if a.playerHP > 0 {
+			n++
+		}
+	}
+	return n
+}
+
+// livingWeight is livingActors in the currency the enemy actually charges in: the
+// summed SeatWeight of the seats still standing.
+func livingWeight(st *combatState) float64 {
+	total := 0.0
+	for _, a := range st.actors {
+		if a.playerHP > 0 {
+			total += combatantWeight(a.c)
+		}
+	}
+	return total
+}
+
+// partyActionExpectation is the expected number of enemy attack-actions per round
+// against a party of n. A single enemy swing (the pre-P8 behaviour) let each
+// member absorb ~1/N² of the solo incoming and cleared 100% of T5; the sim band
+// landed the martial-leader target only near ~2N actions, and HP alone can't touch
+// a martial (fighter stays at 100% even at enemy HP ×1.6). So the enemy's action
+// economy is the load-bearing lever, and it is fractional so a two-person party
+// lands between soloing and a trio instead of snapping to one of two integers
+// (against a duo, an integer 2 actions is a ~91% faceroll and 3 is a ~45% meat
+// grinder — 2.4 sits fighter+cleric at ~75%, between solo 70% and trio 90%).
+//
+// N≥3 follows 2N−1, the point that gave fighter ~90% / cleric-led ~72% at
+// HP ×1.15. The whole curve is monotonic by party size and never drops a
+// composition below its solo clear rate — bringing a friend is never a penalty.
+// It takes a fractional party size — the summed SeatWeight of the living seats,
+// not a head count — and interpolates linearly between the integer knots the P8
+// sweep actually tuned: (1, 1.0), (2, 2.4), and 2n−1 from 3 up. Every integer
+// input therefore returns exactly what it always returned, so a solo fight and a
+// party of peers are byte-identical and the balance corpus is untouched. Only a
+// roster of *unequal* seats lands between the knots, which is the entire point:
+// a half-strength body should buy the boss half a body's worth of extra swings.
+func partyActionExpectation(n float64) float64 {
+	switch {
+	case n <= 1:
+		return 1
+	case n <= 2:
+		// (1, 1.0) → (2, 2.4)
+		return 1 + 1.4*(n-1)
+	case n <= 3:
+		// (2, 2.4) → (3, 5.0); the original curve stepped here, so the segment is
+		// steeper than the 2n−1 line it joins.
+		return 2.4 + 2.6*(n-2)
+	default:
+		return 2*n - 1
+	}
+}
+
+// seatWeight is what one seat costs the enemy, relative to the leader.
+//
+// **Level, not stats.** A power score built from HP × damage would rank a cleric
+// below a fighter and quietly make every mixed *human* party easier — the support
+// classes would stop paying their way. Level is the class-neutral measure of what
+// a body is worth, and it is exactly the axis on which the two seats that violated
+// the peer assumption differ: an under-levelled friend, and a hireling who arrives
+// a level down by design.
+//
+// A peer of the leader weighs 1.0, so a party of equals is unchanged. Nobody weighs
+// more than a peer: out-levelling the leader does not make the boss harder for
+// everyone else.
+func seatWeight(seatLevel, leaderLevel int, companion bool) float64 {
+	if leaderLevel <= 0 || seatLevel <= 0 {
+		return 1
+	}
+	w := float64(seatLevel) / float64(leaderLevel)
+	if w > 1 {
+		w = 1
+	}
+	if companion {
+		// The layers a player accumulates and a hireling never will: no subclass, no
+		// magic items, no armed ability, and gear that is never Masterwork. Levels
+		// cannot see any of that, so it is priced here.
+		w *= companionSeatWeight
+	}
+	if w < seatWeightFloor {
+		w = seatWeightFloor
+	}
+	return w
+}
+
+const (
+	// companionSeatWeight is the hireling discount — the one tunable in this model.
+	companionSeatWeight = 0.65
+	// seatWeightFloor stops a badly under-levelled seat from becoming free. A body
+	// in the fight is always worth something to the enemy: it is one more thing that
+	// has to be killed.
+	seatWeightFloor = 0.35
+)
+
+// partyWeight sums the seats' weights. An unset weight (0) reads as a full peer,
+// which is what every combatant built before this existed is.
+func partyWeight(players []*Combatant) float64 {
+	total := 0.0
+	for _, c := range players {
+		total += combatantWeight(c)
+	}
+	return total
+}
+
+func combatantWeight(c *Combatant) float64 {
+	if c == nil {
+		return 0
+	}
+	if c.SeatWeight <= 0 {
+		return 1
+	}
+	return c.SeatWeight
+}
+
+// partyWeightOf is partyWeight for a value slice.
+func partyWeightOf(players []Combatant) float64 {
+	total := 0.0
+	for i := range players {
+		total += combatantWeight(&players[i])
+	}
+	return total
+}
+
+// seatSetupWeight is partyWeight for a roster that is still being seated.
+func seatSetupWeight(seats []CombatSeatSetup) float64 {
+	total := 0.0
+	for _, s := range seats {
+		total += combatantWeight(s.C)
+	}
+	return total
+}
+
+// partyEnemyHPScale is the party-only multiplier on the enemy's max HP. Solo
+// (roster < 2) returns 1.0, so the solo path — and the characterization golden
+// and the d8prereq corpus — is byte-for-byte untouched. With the action economy
+// fixed, each member now takes ~1 swing a round, so a longer fight is more
+// cumulative exposure per member: HP became a live difficulty lever exactly the
+// way P6e predicted it would once the enemy stopped swinging only once.
+//
+// 1.15 is where the P8 sim sweep landed the band: with 2N−1 actions, a party of
+// three clears the T5 martial-leader band at ~89% (fighter) / ~67% (cleric-led),
+// clearly safer than soloing (70% / 27%) but with real TPKs and member deaths —
+// not the 100% faceroll a single enemy swing produced.
+// Like partyActionExpectation it takes the summed SeatWeight rather than a head
+// count, and ramps between the same knots: weight 1 (solo) pays nothing, weight 2
+// (a peer at the leader's side) pays the full 1.15 the P8 sweep tuned. Integer
+// inputs are byte-exact, so solo and a party of peers are unchanged; a roster
+// carrying a below-median body pays proportionally less, because it brought
+// proportionally less.
+func partyEnemyHPScale(weight float64) float64 {
+	if weight <= 1 {
+		return 1.0
+	}
+	if weight >= 2 {
+		return 1.15
+	}
+	return 1.0 + 0.15*(weight-1)
+}
+
+// scaledEnemyMaxHP applies the party HP scalar to a base max-HP with one rounding
+// rule, so every call site (the auto-resolve engine, the party session's initial
+// persist, and the per-turn rebuild) agrees on the same number.
+func scaledEnemyMaxHP(baseMaxHP int, weight float64) int {
+	return int(float64(baseMaxHP) * partyEnemyHPScale(weight))
+}
+
+// enemyActionPlan is the shared action budget both combat engines resolve an
+// enemy turn against: how many attack-actions the enemy takes, and whether the
+// first one reuses the round's already-picked target (and its already-rolled
+// procs). A cleave/lifesteal ability already spent the first action, so one fewer
+// follows and none of them reuse the initial target. Both engines call this so
+// the load-bearing count stays in lockstep even though their per-action bodies
+// differ.
+func enemyActionPlan(st *combatState, abilityDealtDamage bool) (count int, reuseFirst bool) {
+	count = enemyActionsThisRound(st)
+	reuseFirst = !abilityDealtDamage
+	if abilityDealtDamage {
+		count--
+	}
+	return count, reuseFirst
+}
+
+// enemyRoundSwings resolves the enemy's attacks for one round of the auto-resolve
+// engine. A solo roster takes exactly one swing at its single seat, reusing the
+// round's already-rolled target and pet procs, so its RNG stream and event log are
+// byte-for-byte the pre-P8 engine's. A party faces enemyActionsThisRound() swings,
+// each re-targeted at a random standing seat with that seat's own pet procs, so the
+// damage is spread across the roster instead of pinning the round's first target.
+//
+// abilityDealtDamage means a cleave/lifesteal already spent the enemy's first
+// action this round, so one fewer swing follows — for solo that collapses to the
+// old "the ability stands in for the attack" skip. Returns true if the fight is
+// decided.
+func enemyRoundSwings(st *combatState, enemy *Combatant, phase *CombatPhase, seats []CombatResult,
+	target int, abilityDealtDamage, petWhiff, petDeflect, sporeMiss bool) bool {
+
+	swings, reuseFirst := enemyActionPlan(st, abilityDealtDamage)
+	for k := 0; k < swings; k++ {
+		tgt := target
+		sw, sd, sp := petWhiff, petDeflect, sporeMiss
+		if !(reuseFirst && k == 0) {
+			// A fresh target for every swing past the first: re-pick among the
+			// standing seats and roll that seat's own pet procs. This branch never
+			// runs for a solo roster, so it adds no draws to the solo stream.
+			var alive bool
+			if tgt, alive = enemyTargetSeat(st); !alive {
+				return combatOver(st)
+			}
+			st.seat(tgt)
+			sw = st.c.Mods.PetWhiffProc > 0 && st.randFloat() < st.c.Mods.PetWhiffProc
+			sd = st.c.Mods.PetDeflectProc > 0 && st.randFloat() < st.c.Mods.PetDeflectProc
+			if sd {
+				seats[tgt].PetDeflected = true
+			}
+			sp = st.sporeRounds > 0 && st.randFloat() < 0.15
+		}
+		st.seat(tgt)
+		mark := len(st.events)
+		over := resolveEnemyAttack(st, st.c, enemy, phase, &seats[tgt], sw, sd, sp)
+		stampEventSeats(st, mark, tgt)
+		if over && combatOver(st) {
+			return true
+		}
+	}
+	return false
+}
+
 // simulatePartyRound runs one round for the whole roster. Returns true if the
 // fight is over.
 func simulatePartyRound(st *combatState, enemy *Combatant, phase *CombatPhase, seats []CombatResult) bool {
@@ -383,14 +662,7 @@ func simulatePartyRound(st *combatState, enemy *Combatant, phase *CombatPhase, s
 	// via Mods.InitiativeBias — +X means they go first more often.
 	for _, s := range roundInitiative(st, enemy, phase) {
 		if s == enemySeat {
-			if abilityDealtDamage {
-				continue
-			}
-			st.seat(target)
-			mark := len(st.events)
-			over := resolveEnemyAttack(st, st.c, enemy, phase, &seats[target], petWhiff, petDeflect, sporeMiss)
-			stampEventSeats(st, mark, target)
-			if over && combatOver(st) {
+			if enemyRoundSwings(st, enemy, phase, seats, target, abilityDealtDamage, petWhiff, petDeflect, sporeMiss) {
 				return true
 			}
 			continue
@@ -448,6 +720,78 @@ func simulatePartyRound(st *combatState, enemy *Combatant, phase *CombatPhase, s
 	return false
 }
 
+// ── Misty's pair, shared by both engines ─────────────────────────────────────
+//
+// These two are the only round-end effects the turn engine did not have its own
+// copy of. Everything else in endOfRoundForSeat either exists there already (the
+// pet, the spiritual weapon — fired after a player action rather than at round
+// end), is deliberately absent (the environmental hazard: turnCombatPhase is a
+// single flat "Duel" phase with EnvironmentProc at 0), or is replaced by an
+// explicit player command (the consumable auto-heal, which is `!consume`).
+//
+// So they are hoisted rather than re-implemented. A parallel sibling is what let
+// the two win close-outs drift apart (deferred item D); this pair is now one
+// list of effects with two callers, and cannot.
+//
+// Neither draws from the RNG unless its proc is armed, so a character with no
+// Misty history rolls exactly the dice it rolled before — the sim corpus and
+// combat_characterization.golden do not move.
+
+// mistyCrowdRevenge is the debuff for declining Misty: her crowd takes a swing
+// at the end of the round. Returns true when it decided the fight — that is,
+// when it dropped this character, the death save failed, and nobody else is
+// standing. A downed character in a still-live party returns false.
+func mistyCrowdRevenge(st *combatState, player *Combatant, phaseName string) bool {
+	if player.Mods.CrowdRevengeProc <= 0 || st.randFloat() >= player.Mods.CrowdRevengeProc {
+		return false
+	}
+	dmg := player.Mods.CrowdRevengeDmg
+	st.playerHP = max(0, st.playerHP-dmg)
+	st.events = append(st.events, CombatEvent{
+		Round: st.round, Phase: phaseName, Actor: "environment", Action: "crowd_revenge",
+		Damage: dmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+		Desc: "Misty's crowd",
+	})
+	return st.playerHP <= 0 && !trySave(st, player, phaseName) && !st.anyAlive()
+}
+
+// mistyHeal is the buff's payout. It cannot decide the fight, so it returns
+// nothing. result may be a scratch value the caller discards (the turn engine's
+// is) — the durable record is the misty_heal event on the log, which is what
+// seatCombatResult reads to award combat_misty_clutch.
+func mistyHeal(st *combatState, player *Combatant, phaseName string, result *CombatResult) {
+	if player.Mods.MistyHealProc <= 0 || st.randFloat() >= player.Mods.MistyHealProc {
+		return
+	}
+	healAmt := player.Mods.MistyHealAmt
+	st.playerHP = min(effPlayerMaxHP(player, st), st.playerHP+healAmt)
+	result.MistyHealed = true
+	st.events = append(st.events, CombatEvent{
+		Round: st.round, Phase: phaseName, Actor: "npc", Action: "misty_heal",
+		Damage: healAmt, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+		Desc: "Misty",
+	})
+}
+
+// seatEndOfRound runs the round-end effects the turn engine owes one seat, in
+// the order endOfRoundForSeat runs them: the crowd's swing, then — if the seat
+// survived it — Misty's heal. Returns true when the fight is over.
+//
+// It exists because the turn engine's stepRoundEnd never ran either one. A
+// player carrying Misty's buff lost it by fighting manually; worse, a player
+// carrying her debuff *escaped* it by doing the same, which needed no discovery
+// to exploit — just press !attack.
+func seatEndOfRound(st *combatState, player *Combatant, phaseName string, result *CombatResult) bool {
+	if over := mistyCrowdRevenge(st, player, phaseName); over {
+		return true
+	}
+	if st.playerHP <= 0 {
+		return false
+	}
+	mistyHeal(st, player, phaseName, result)
+	return false
+}
+
 // endOfRoundForSeat runs the per-character close of a round against the seat the
 // cursor already points at: environment, Misty's crowd, the pet, the spiritual
 // weapon, Misty's heal, and the consumable auto-heal — in that order, which is
@@ -470,17 +814,8 @@ func endOfRoundForSeat(st *combatState, phase *CombatPhase, result *CombatResult
 	}
 
 	// Misty crowd revenge (debuff for declining Misty)
-	if player.Mods.CrowdRevengeProc > 0 && st.randFloat() < player.Mods.CrowdRevengeProc {
-		dmg := player.Mods.CrowdRevengeDmg
-		st.playerHP = max(0, st.playerHP-dmg)
-		st.events = append(st.events, CombatEvent{
-			Round: st.round, Phase: phaseName, Actor: "environment", Action: "crowd_revenge",
-			Damage: dmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
-			Desc: "Misty's crowd",
-		})
-		if st.playerHP <= 0 && !trySave(st, player, phaseName) && !st.anyAlive() {
-			return true
-		}
+	if over := mistyCrowdRevenge(st, player, phaseName); over {
+		return true
 	}
 
 	// A character the round just killed stops acting, but the fight goes on if
@@ -517,16 +852,7 @@ func endOfRoundForSeat(st *combatState, phase *CombatPhase, result *CombatResult
 	}
 
 	// Misty heal
-	if player.Mods.MistyHealProc > 0 && st.randFloat() < player.Mods.MistyHealProc {
-		healAmt := player.Mods.MistyHealAmt
-		st.playerHP = min(effPlayerMaxHP(player, st), st.playerHP+healAmt)
-		result.MistyHealed = true
-		st.events = append(st.events, CombatEvent{
-			Round: st.round, Phase: phaseName, Actor: "npc", Action: "misty_heal",
-			Damage: healAmt, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
-			Desc: "Misty",
-		})
-	}
+	mistyHeal(st, player, phaseName, result)
 
 	// Consumable heal: triggers when the character drops below 60% HP. Fires up
 	// to HealItemCharges times per fight (1 = legacy one-shot; bosses can

internal/plugin/combat_engine_party_test.go

@@ -124,31 +124,100 @@ func TestSimulateParty_DownedMemberDoesNotEndTheFight(t *testing.T) {
 	}
 }
 
-// The enemy swings at one seat per round, not at everyone.
-func TestSimulateParty_EnemyStrikesOneSeatPerRound(t *testing.T) {
+// P8 scaling constants: solo is exempt on both levers (1 action, ×1.0 HP) so the
+// characterization golden and the d8prereq corpus are untouched. A party's action
+// budget is a fractional expectation — 2.4 for a duo (so it lands between soloing
+// and a trio, where an integer 2 vs 3 has no room), 2N−1 for N≥3 — plus ×1.15
+// enemy HP.
+func TestP8PartyScaling_SoloExemptPartyScaled(t *testing.T) {
+	if got := partyActionExpectation(1); got != 1 {
+		t.Fatalf("solo action expectation = %v, want 1", got)
+	}
+	if got := partyEnemyHPScale(1); got != 1.0 {
+		t.Fatalf("solo HP scale = %v, want 1.0", got)
+	}
+	if got := scaledEnemyMaxHP(200, 1); got != 200 {
+		t.Fatalf("solo enemy HP = %d, want 200 (unscaled)", got)
+	}
+	if got := partyActionExpectation(2); got != 2.4 {
+		t.Fatalf("duo action expectation = %v, want 2.4", got)
+	}
+	// The curve now takes a fractional weight rather than a head count, so that a
+	// below-median seat costs the enemy less than a peer does. Every INTEGER input
+	// must still return exactly what it always returned — that is what keeps solo
+	// and a party of peers byte-identical, and the balance corpus with them.
+	for n := 3; n <= 5; n++ {
+		if got, want := partyActionExpectation(float64(n)), float64(2*n-1); got != want {
+			t.Fatalf("party of %d: action expectation = %v, want %v", n, got, want)
+		}
+	}
+	// A duo carrying a half-strength body sits between soloing and a true duo.
+	if got := partyActionExpectation(1.5); got <= 1 || got >= 2.4 {
+		t.Fatalf("weight 1.5 action expectation = %v, want strictly between 1 and 2.4", got)
+	}
+	if got := partyEnemyHPScale(1.5); got <= 1.0 || got >= 1.15 {
+		t.Fatalf("weight 1.5 HP scale = %v, want strictly between 1.0 and 1.15", got)
+	}
+	if got := partyEnemyHPScale(3); got != 1.15 {
+		t.Fatalf("party HP scale = %v, want 1.15", got)
+	}
+	// int(200*1.15) truncates 229.99… to 229; the 1-HP floor is immaterial.
+	if got := scaledEnemyMaxHP(200, 3); got != 229 {
+		t.Fatalf("party enemy HP = %d, want 229 (trunc 200*1.15)", got)
+	}
+}
+
+// P8: the enemy's action economy scales with the roster. A party of N faces up to
+// N attack-actions a round, each re-targeted, so the enemy's damage spreads across
+// the roster instead of pinning one seat — the 1/N² exposure that made P6e's party
+// a 100%-clear faceroll. Solo stays at exactly one swing a round, the pre-party
+// behaviour the characterization golden pins.
+func TestSimulateParty_EnemyActionEconomyScalesWithRoster(t *testing.T) {
+	enemyRollsPerRound := func(res PartyCombatResult) map[int]int {
+		perRound := map[int]int{}
+		for _, e := range res.Events {
+			if e.Actor == "enemy" && e.Roll > 0 {
+				perRound[e.Round]++
+			}
+		}
+		return perRound
+	}
+
+	// Solo: never more than one enemy swing in a round.
+	soloTank := baseEnemy()
+	soloTank.Stats.MaxHP = 5000
+	solo := simulatePartyWithRNG(
+		[]Combatant{basePlayer()}, soloTank, dungeonCombatPhases, seededRNG(23))
+	if len(enemyRollsPerRound(solo)) == 0 {
+		t.Fatal("solo: the enemy never attacked")
+	}
+	for round, n := range enemyRollsPerRound(solo) {
+		if n > 1 {
+			t.Fatalf("solo round %d: enemy swung %d times, want at most 1", round, n)
+		}
+	}
+
+	// Party of 3: no round exceeds the roster's action budget, and at least one
+	// round sees more than one swing — the enemy is really taking extra actions.
 	tank := baseEnemy()
 	tank.Stats.MaxHP = 5000
-
-	res := simulatePartyWithRNG(
+	party := simulatePartyWithRNG(
 		[]Combatant{basePlayer(), basePlayer(), basePlayer()}, tank, dungeonCombatPhases, seededRNG(23))
-
-	perRound := map[int]map[int]bool{}
-	for _, e := range res.Events {
-		if e.Actor != "enemy" || e.Roll == 0 {
-			continue
-		}
-		if perRound[e.Round] == nil {
-			perRound[e.Round] = map[int]bool{}
-		}
-		perRound[e.Round][e.Seat] = true
+	budget := int(partyActionExpectation(3))
+	if partyActionExpectation(3) > float64(budget) {
+		budget++ // ceil: the coin-flip round can add one action
 	}
-	if len(perRound) == 0 {
-		t.Fatal("the enemy never attacked")
-	}
-	for round, seats := range perRound {
-		if len(seats) != 1 {
-			t.Fatalf("round %d: enemy attack rolls landed on %d seats, want 1", round, len(seats))
+	sawMulti := false
+	for round, n := range enemyRollsPerRound(party) {
+		if n > budget {
+			t.Fatalf("party round %d: enemy swung %d times, over the %d-action budget", round, n, budget)
 		}
+		if n > 1 {
+			sawMulti = true
+		}
+	}
+	if !sawMulti {
+		t.Fatal("a party of 3 never faced more than one enemy swing in a round — action economy did not scale")
 	}
 }
 

internal/plugin/combat_grim_harvest_turn_test.go

@@ -0,0 +1,232 @@
+package plugin
+
+import (
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Grim Harvest on the turn-based surface.
+//
+// The auto-resolve path stashes the killing spell's slot level on the
+// fight-start CombatModifiers, where the close-out reads it. A turn-based fight
+// has nowhere to keep that: it rebuilds its combatants from the session row on
+// every !attack / !cast. resolveTurnSpell computed the stash into a local mod
+// set and dropped it on the floor, so a Necromancy Mage who killed with a spell
+// never healed — on a class that already trails.
+//
+// The stash now rides on the casting seat's ActorStatuses, and the close-out
+// asks whether the *last* spell_cast is the one that dropped the enemy to 0.
+//
+// (Empowered Evocation and Overchannel were never broken here: they only move
+// mods.SpellPreDamage, which resolveTurnSpell already returns as EnemyDamage.)
+
+// necromancer is a Mage who has reached L5 Grim Harvest.
+func necromancer(t *testing.T, uid id.UserID, level int) *DnDCharacter {
+	t.Helper()
+	if err := createAdvCharacter(uid, string(uid)); err != nil {
+		t.Fatal(err)
+	}
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassMage, Subclass: SubclassNecromancy, Level: level,
+		STR: 8, DEX: 12, CON: 12, INT: 16, WIS: 10, CHA: 10,
+		HPMax: 30, HPCurrent: 10, ArmorClass: 12,
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+// tough is a stat block a spell can be cast at without any of it mattering.
+func tough() CombatStats { return CombatStats{MaxHP: 40, AC: 10} }
+
+// ── the leak itself ──────────────────────────────────────────────────────────
+
+// resolveTurnSpell must hand the stash back to its caller. Before this, the
+// slot level lived and died inside the function.
+func TestResolveTurnSpell_CarriesTheGrimHarvestStashOut(t *testing.T) {
+	c := &DnDCharacter{Class: ClassMage, Subclass: SubclassNecromancy, Level: 5, INT: 16}
+
+	// magic_missile: auto-hit, force damage, upcast to a 3rd-level slot.
+	spell, _ := lookupSpell("magic_missile")
+	enemy := tough()
+	out, ok := resolveTurnSpell(c, spell, 3, &enemy)
+	if !ok {
+		t.Fatal("magic_missile should be a supported turn spell")
+	}
+	if out.GrimHarvestSlot != 3 {
+		t.Errorf("GrimHarvestSlot = %d, want 3 (the slot it was cast at)", out.GrimHarvestSlot)
+	}
+	if out.GrimHarvestNecrotic {
+		t.Error("magic_missile deals force damage — Necrotic should be false")
+	}
+
+	// blight: auto-hit, necrotic — the flag that triples the heal.
+	spell, _ = lookupSpell("blight")
+	enemy = tough()
+	out, _ = resolveTurnSpell(c, spell, 4, &enemy)
+	if out.GrimHarvestSlot != 4 || !out.GrimHarvestNecrotic {
+		t.Errorf("blight L4: slot=%d necrotic=%v, want 4/true", out.GrimHarvestSlot, out.GrimHarvestNecrotic)
+	}
+}
+
+// Nobody else stashes. A Mage below L5 has not learned the harvest, and an
+// Evocation Mage never will.
+func TestResolveTurnSpell_NoStashForAnyoneElse(t *testing.T) {
+	spell, _ := lookupSpell("magic_missile")
+	for _, c := range []*DnDCharacter{
+		{Class: ClassMage, Subclass: SubclassNecromancy, Level: 4, INT: 16},
+		{Class: ClassMage, Subclass: SubclassEvocation, Level: 12, INT: 16},
+		{Class: ClassSorcerer, Level: 12, CHA: 16},
+	} {
+		enemy := tough()
+		out, _ := resolveTurnSpell(c, spell, 3, &enemy)
+		if out.GrimHarvestSlot != 0 {
+			t.Errorf("%s/%s L%d stashed slot %d, want 0",
+				c.Class, c.Subclass, c.Level, out.GrimHarvestSlot)
+		}
+	}
+}
+
+// ── which cast counts ────────────────────────────────────────────────────────
+
+// The killing-blow check used to break on the first spell_cast it saw. In a
+// turn-based fight the mage casts every round, so the first one is an opening
+// cantrip that left the enemy standing — and it vetoed the heal the killing
+// spell had earned. It is the last cast that has to be lethal.
+func TestGrimHarvestHeal_ReadsTheLastCastNotTheFirst(t *testing.T) {
+	c := &DnDCharacter{Class: ClassMage, Subclass: SubclassNecromancy, Level: 5, INT: 16}
+	mods := CombatModifiers{GrimHarvestSlot: 2, GrimHarvestNecrotic: true}
+
+	result := CombatResult{PlayerWon: true, Events: []CombatEvent{
+		{Round: 1, Action: "spell_cast", EnemyHP: 22}, // opening cantrip, enemy stands
+		{Round: 2, Action: "enemy_attack", EnemyHP: 22},
+		{Round: 2, Action: "spell_cast", EnemyHP: 0}, // this one killed it
+	}}
+	if got := grimHarvestHeal(c, result, mods); got != 6 {
+		t.Errorf("heal = %d, want 6 (3× a 2nd-level necrotic slot)", got)
+	}
+}
+
+// The mirror: the mage softened it up with a spell, then finished it with a
+// weapon. No spell landed the blow, so no harvest.
+func TestGrimHarvestHeal_WeaponKillAfterASpellDoesNotHarvest(t *testing.T) {
+	c := &DnDCharacter{Class: ClassMage, Subclass: SubclassNecromancy, Level: 5, INT: 16}
+	mods := CombatModifiers{GrimHarvestSlot: 2, GrimHarvestNecrotic: true}
+
+	result := CombatResult{PlayerWon: true, Events: []CombatEvent{
+		{Round: 1, Action: "spell_cast", EnemyHP: 9},
+		{Round: 2, Action: "player_attack", EnemyHP: 0},
+	}}
+	if got := grimHarvestHeal(c, result, mods); got != 0 {
+		t.Errorf("heal = %d, want 0 — the sword landed the blow, not the spell", got)
+	}
+}
+
+// ── the seam through the session ─────────────────────────────────────────────
+
+// The stash has to survive the round-trip the fight puts it through: parked on
+// the seat by the cast, carried across commit()'s snapshot, read back by the
+// close-out.
+func TestSeatFightStartMods_ReadsTheStashOffTheSeat(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@seatstash:example.org")
+	c := necromancer(t, uid, 5)
+
+	sess := &CombatSession{UserID: string(uid), Status: CombatStatusWon}
+	sess.Statuses.GrimHarvestSlot = 3
+	sess.Statuses.GrimHarvestNecrotic = true
+
+	mods := seatFightStartMods(sess, 0, c)
+	if mods.GrimHarvestSlot != 3 || !mods.GrimHarvestNecrotic {
+		t.Fatalf("seatFightStartMods lost the stash: %+v", mods)
+	}
+
+	// snapshotActor rebuilds ActorStatuses from combatState each commit; fields
+	// with no combatState counterpart must be carried over from the prior
+	// snapshot, the way ArmedAbility is.
+	kept := snapshotActor(&actor{}, sess.Statuses.ActorStatuses)
+	if kept.GrimHarvestSlot != 3 || !kept.GrimHarvestNecrotic {
+		t.Errorf("commit() dropped the stash: %+v", kept)
+	}
+}
+
+// End to end at the close-out: a necromancer who ended the fight at 10/30 HP
+// with a lethal 2nd-level necrotic spell walks away with 6 HP back.
+func TestPostCombatBookkeepingForSeat_GrimHarvestHealsOnASpellKill(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@harvest:example.org")
+	necromancer(t, uid, 5)
+
+	sess := &CombatSession{
+		UserID: string(uid), Status: CombatStatusWon, Round: 3,
+		PlayerHP: 10, PlayerHPMax: 30, EnemyHP: 0,
+		TurnLog: []CombatEvent{
+			{Round: 1, Action: "spell_cast", EnemyHP: 14},
+			{Round: 3, Action: "spell_cast", EnemyHP: 0},
+		},
+	}
+	sess.Statuses.GrimHarvestSlot = 2
+	sess.Statuses.GrimHarvestNecrotic = true
+
+	(&AdventurePlugin{}).postCombatBookkeepingForSeat(sess, 0)
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.HPCurrent != 16 {
+		t.Errorf("HPCurrent = %d after a turn-based spell kill, want 16 (10 + 3×2)", got.HPCurrent)
+	}
+}
+
+// A seat with no stash — the mage never cast, or missed every time — is left
+// exactly as the fight left them.
+func TestPostCombatBookkeepingForSeat_NoStashNoHeal(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@nostash:example.org")
+	necromancer(t, uid, 5)
+
+	sess := &CombatSession{
+		UserID: string(uid), Status: CombatStatusWon, Round: 2,
+		PlayerHP: 10, PlayerHPMax: 30, EnemyHP: 0,
+		TurnLog: []CombatEvent{{Round: 2, Action: "player_attack", EnemyHP: 0}},
+	}
+	(&AdventurePlugin{}).postCombatBookkeepingForSeat(sess, 0)
+
+	got, _ := LoadDnDCharacter(uid)
+	if got.HPCurrent != 10 {
+		t.Errorf("HPCurrent = %d, want 10 — nothing was stashed", got.HPCurrent)
+	}
+}
+
+// Party fights: the stash is per-seat, so seat 1's harvest cannot heal seat 0.
+// This is the same class of bug P5 fixed for mid-fight buffs.
+func TestGrimHarvestStash_IsPerSeat(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, member := id.UserID("@leader:example.org"), id.UserID("@member:example.org")
+	fightTestChar(t, leader, 30)
+	necromancer(t, member, 5)
+
+	sess := &CombatSession{
+		UserID: string(leader), Status: CombatStatusWon, Round: 2,
+		PlayerHP: 20, PlayerHPMax: 30, EnemyHP: 0,
+		Participants: []CombatParticipant{{Seat: 1, UserID: string(member), HP: 10, HPMax: 30}},
+		TurnLog: []CombatEvent{
+			{Round: 2, Seat: 1, Action: "spell_cast", EnemyHP: 0},
+		},
+	}
+	sess.Participants[0].Statuses.GrimHarvestSlot = 2
+	sess.Participants[0].Statuses.GrimHarvestNecrotic = true
+
+	p := &AdventurePlugin{}
+	p.postCombatBookkeepingForSeat(sess, 0)
+	p.postCombatBookkeepingForSeat(sess, 1)
+
+	gotLeader, _ := LoadDnDCharacter(leader)
+	if gotLeader.HPCurrent != 30 {
+		t.Errorf("leader HPCurrent = %d, want 30 — the member's harvest is not theirs", gotLeader.HPCurrent)
+	}
+	gotMember, _ := LoadDnDCharacter(member)
+	if gotMember.HPCurrent != 16 {
+		t.Errorf("member HPCurrent = %d, want 16 (10 + 3×2)", gotMember.HPCurrent)
+	}
+}

internal/plugin/combat_misty_turn_test.go

@@ -0,0 +1,169 @@
+package plugin
+
+import (
+	"math/rand/v2"
+	"testing"
+)
+
+// Misty's two round-end procs on the turn-based surface.
+//
+// Both were built onto every turn-based combatant by DerivePlayerStats and then
+// never read: stepRoundEnd had no counterpart to endOfRoundForSeat. The buff was
+// simply lost. The debuff was an exploit — a player who declined Misty escaped
+// her crowd entirely by fighting with !attack instead of letting the room
+// auto-resolve, which needed no discovery at all.
+//
+// seatEndOfRound is the shared hook. These pin that it fires, that it cannot be
+// dodged, and that a character with no Misty history is not touched at all —
+// the property that keeps the sim corpus and the golden file still.
+
+// mistyState seats one combatant at hp, cursor armed, with a seeded RNG.
+func mistyState(t *testing.T, player *Combatant, hp int) *combatState {
+	t.Helper()
+	st := testCombatState(hp, 100, 1, rand.New(rand.NewPCG(7, 7)))
+	st.actor.c = player
+	st.actor.hpMax = player.Stats.MaxHP
+	return st
+}
+
+// The two procs at certainty, so no test depends on a roll.
+func mistyCursed(maxHP, dmg int) *Combatant {
+	return &Combatant{
+		Name:  "Cursed",
+		Stats: CombatStats{MaxHP: maxHP, AC: 10},
+		Mods:  CombatModifiers{CrowdRevengeProc: 1.0, CrowdRevengeDmg: dmg},
+	}
+}
+
+func mistyBuffed(maxHP, heal int) *Combatant {
+	return &Combatant{
+		Name:  "Buffed",
+		Stats: CombatStats{MaxHP: maxHP, AC: 10},
+		Mods:  CombatModifiers{MistyHealProc: 1.0, MistyHealAmt: heal},
+	}
+}
+
+// ── the exploit ──────────────────────────────────────────────────────────────
+
+// The debuff must land at round end in a manual fight, exactly as it does when
+// the room auto-resolves. Before seatEndOfRound, !attack was a clean escape.
+func TestSeatEndOfRound_CrowdRevengeCannotBeDodgedByFightingManually(t *testing.T) {
+	st := mistyState(t, mistyCursed(40, 6), 40)
+	over := seatEndOfRound(st, st.c, CombatPhaseRoundEnd, &CombatResult{})
+
+	if over {
+		t.Fatal("a 6-damage swing against 40 HP should not end the fight")
+	}
+	if st.playerHP != 34 {
+		t.Errorf("playerHP = %d, want 34 — Misty's crowd took its swing", st.playerHP)
+	}
+	if !hasAction(st.events, "crowd_revenge") {
+		t.Error("no crowd_revenge event on the log")
+	}
+}
+
+// The debuff can be lethal, and a lethal one with nobody else standing ends the
+// fight rather than leaving a corpse to take the next round's turn.
+func TestSeatEndOfRound_CrowdRevengeCanEndASoloFight(t *testing.T) {
+	st := mistyState(t, mistyCursed(40, 30), 3)
+	over := seatEndOfRound(st, st.c, CombatPhaseRoundEnd, &CombatResult{})
+
+	if st.playerHP != 0 {
+		t.Fatalf("playerHP = %d, want 0", st.playerHP)
+	}
+	if !over {
+		t.Error("a solo character dropped by the crowd should end the fight")
+	}
+}
+
+// ── the buff ─────────────────────────────────────────────────────────────────
+
+// The heal fires, caps at max HP, and marks the result so the achievement can
+// be granted.
+func TestSeatEndOfRound_MistyHealFiresAndCaps(t *testing.T) {
+	st := mistyState(t, mistyBuffed(40, 12), 34)
+	var res CombatResult
+	seatEndOfRound(st, st.c, CombatPhaseRoundEnd, &res)
+
+	if st.playerHP != 40 {
+		t.Errorf("playerHP = %d, want 40 — the heal caps at max HP", st.playerHP)
+	}
+	if !res.MistyHealed {
+		t.Error("MistyHealed flag not set")
+	}
+	if !hasAction(st.events, "misty_heal") {
+		t.Error("no misty_heal event on the log")
+	}
+}
+
+// A character the crowd just dropped is not then healed back up by the same
+// hook. The heal is for the living.
+func TestSeatEndOfRound_NoHealForACharacterTheCrowdJustDropped(t *testing.T) {
+	c := mistyCursed(40, 40)
+	c.Mods.MistyHealProc = 1.0
+	c.Mods.MistyHealAmt = 20
+
+	st := mistyState(t, c, 10)
+	st.actors = append(st.actors, &actor{playerHP: 5}) // an ally keeps the fight alive
+	over := seatEndOfRound(st, st.c, CombatPhaseRoundEnd, &CombatResult{})
+
+	if over {
+		t.Fatal("an ally is still standing — the fight is not over")
+	}
+	if st.playerHP != 0 {
+		t.Errorf("playerHP = %d, want 0 — the heal must not resurrect them", st.playerHP)
+	}
+	if hasAction(st.events, "misty_heal") {
+		t.Error("misty_heal fired on a downed character")
+	}
+}
+
+// ── the property that protects the corpus ────────────────────────────────────
+
+// A character with no Misty history is untouched: no HP change, no events, and
+// — because both procs short-circuit before st.randFloat() — no dice drawn. If
+// the hook drew even one float, every simulated fight would diverge and
+// combat_characterization.golden would move.
+func TestSeatEndOfRound_UnbuffedCharacterIsUntouchedAndDrawsNoDice(t *testing.T) {
+	plain := &Combatant{Name: "Plain", Stats: CombatStats{MaxHP: 40, AC: 10}}
+
+	st := mistyState(t, plain, 40)
+	control := mistyState(t, plain, 40) // same seed, never passed to the hook
+
+	if over := seatEndOfRound(st, st.c, CombatPhaseRoundEnd, &CombatResult{}); over {
+		t.Fatal("an unbuffed character cannot be dropped by a hook that does nothing")
+	}
+	if st.playerHP != 40 || len(st.events) != 0 {
+		t.Errorf("unbuffed character was touched: hp=%d events=%d", st.playerHP, len(st.events))
+	}
+	// The RNG streams must still be in lockstep: the hook consumed nothing.
+	if got, want := st.randFloat(), control.randFloat(); got != want {
+		t.Errorf("seatEndOfRound consumed RNG: next float %v, want %v", got, want)
+	}
+}
+
+// ── the wiring ───────────────────────────────────────────────────────────────
+
+// The unit tests above call seatEndOfRound directly, which proves the hook is
+// correct but not that stepRoundEnd calls it. This drives the real session API
+// through a round_end step. Comment the call out of stepRoundEnd and this test
+// reports PlayerHP=40 — the exploit, exactly as it shipped.
+func TestStepRoundEnd_WiresSeatEndOfRound(t *testing.T) {
+	setupEmptyTestDB(t)
+	player := mistyCursed(40, 6)
+	enemy := &Combatant{Name: "Target", Stats: CombatStats{MaxHP: 100, AC: 10}}
+	sess := &CombatSession{
+		SessionID: "wiring", UserID: "@u:example.org", Status: CombatStatusActive,
+		PlayerHP: 40, PlayerHPMax: 40, EnemyHP: 100,
+		Phase: CombatPhaseRoundEnd, Round: 1,
+	}
+	if _, err := advanceCombatSession(sess, player, enemy, PlayerAction{}); err != nil {
+		t.Fatal(err)
+	}
+	if sess.PlayerHP != 34 {
+		t.Errorf("PlayerHP = %d, want 34 — stepRoundEnd never ran the hook", sess.PlayerHP)
+	}
+	if !hasAction(sess.TurnLog, "crowd_revenge") {
+		t.Error("no crowd_revenge event persisted to the session log")
+	}
+}

internal/plugin/combat_narrative.go

@@ -979,6 +979,12 @@ func renderAllySeatEvent(e CombatEvent, name, enemyName string) string {
 		return down(fmt.Sprintf("☠️ %s takes %d from poison.", who, e.Damage))
 	case "environmental":
 		return down(fmt.Sprintf("%s takes %d from the room.", who, e.Damage))
+	case "crowd_revenge":
+		// Deliberately unattributed. An ally sees the damage land — silence
+		// would read as HP vanishing — but Misty's grudge is the owner's own
+		// discovery, and naming her here would spoil it for the whole party.
+		// Same reason misty_heal below reads as a plain recovery.
+		return down(fmt.Sprintf("%s takes %d.", who, e.Damage))
 	case "flat_damage":
 		return fmt.Sprintf("%s deals %d.", who, e.Damage)
 	case "heal_item", "misty_heal":

internal/plugin/combat_party_characterization_test.go

@@ -0,0 +1,159 @@
+package plugin
+
+import (
+	"flag"
+	"fmt"
+	"math/rand/v2"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Party characterization — the net that did not exist.
+//
+// TestCombatCharacterization pins SOLO combat exhaustively, and it has been the
+// tripwire for every balance change since. Party combat had nothing. The whole
+// N-body layer — initiative order, per-seat resolution, enemy targeting, the P8
+// action-economy and HP scaling, downed-seat handling — shipped unpinned.
+//
+// What that cost: N3 shipped a Cleric class that cannot heal a single ally (no
+// action in the engine can target another seat) and not one test went red. The
+// hired companion then stood in fights doing nothing, and the unit tests stayed
+// green through that too. It took a 1500-run expedition sweep to see either.
+//
+// So: pin it. Any change to the party engine now has to state, in the diff, what
+// it moved. Regenerate ONLY on purpose:
+//
+//	go test ./internal/plugin -run TestPartyCharacterization -update
+//
+// This golden covers simulateParty — the auto-resolve engine, which decides most
+// expedition rooms and which the balance harness is built on. The turn engine's
+// party half (manual play + boss fights) needs DB fixtures and is pinned by
+// combat_turn_party_test.go; widening THAT into a golden is the follow-up.
+
+var updatePartyGolden = flag.Bool("update-party", false, "rewrite the party characterization golden")
+
+// partyScenario is one pinned N-body fight.
+type partyScenario struct {
+	name   string
+	seats  []Combatant
+	enemy  Combatant
+	phases []CombatPhase
+}
+
+// seatOfClass shapes a seat that stands in for a class archetype. These are
+// deliberately engine-level (stat blocks, not sheets): the golden pins what the
+// ENGINE does with a roster, not what the character layer feeds it.
+func seatOfClass(name string, hp, atk, def, speed int) Combatant {
+	c := basePlayer()
+	c.Name = name
+	c.Stats.MaxHP = hp
+	c.Stats.Attack = atk
+	c.Stats.Defense = def
+	c.Stats.Speed = speed
+	return c
+}
+
+func partyCharacterizationScenarios() []partyScenario {
+	tank := seatOfClass("Tank", 160, 14, 12, 8)
+	striker := seatOfClass("Striker", 90, 22, 6, 14)
+	support := seatOfClass("Support", 110, 11, 9, 10)
+	// The seat this whole plan is about: a body that is real but below median.
+	// If scaling ever stops overcharging for it, THIS line is what moves.
+	weak := seatOfClass("Weak", 70, 8, 5, 9)
+	// A seat that will fall early. Its corpse must not keep buffing the enemy —
+	// when §2 lands, this scenario is the one that proves it.
+	glass := seatOfClass("Glass", 12, 18, 0, 16)
+
+	return []partyScenario{
+		{"duo/even", []Combatant{tank, striker}, tankyEnemy(), dungeonCombatPhases},
+		{"duo/tank+support", []Combatant{tank, support}, tankyEnemy(), dungeonCombatPhases},
+		{"duo/median+weak", []Combatant{tank, weak}, tankyEnemy(), dungeonCombatPhases},
+		{"duo/glass falls early", []Combatant{tank, glass}, hardHitEnemy(), dungeonCombatPhases},
+		{"trio/even", []Combatant{tank, striker, support}, tankyEnemy(), dungeonCombatPhases},
+		{"trio/one weak seat", []Combatant{tank, striker, weak}, tankyEnemy(), dungeonCombatPhases},
+		{"trio/two glass seats", []Combatant{tank, glass, glass}, hardHitEnemy(), dungeonCombatPhases},
+		{"duo/vs ability enemy", []Combatant{tank, striker},
+			abilityEnemy("Wither", "poison", "Duel"), dungeonCombatPhases},
+		// The degenerate case. A one-seat roster MUST stay bit-identical to solo —
+		// it is the invariant the entire balance corpus rests on, and the reason
+		// the solo golden is allowed to stay untouched while this file grows.
+		{"solo/one-seat roster", []Combatant{basePlayer()}, baseEnemy(), dungeonCombatPhases},
+	}
+}
+
+// formatPartyResult prints the seat on EVERY line. The solo formatter does not
+// (it cannot; there is only one seat), and CombatEvent.Seat is `omitempty`, so a
+// JSON trace renders seat 0 and "no seat" identically — which sent me chasing a
+// phantom "the companion never swings" bug for an hour. A party golden that
+// could not tell you WHO acted would be worth very little.
+func formatPartyResult(r PartyCombatResult) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "result: won=%v timedOut=%v rounds=%d survivors=%v\n",
+		r.PlayerWon, r.TimedOut, r.TotalRounds, r.AnySurvivor())
+	fmt.Fprintf(&b, "  enemy: start=%d entry=%d end=%d\n", r.EnemyStartHP, r.EnemyEntryHP, r.EnemyEndHP)
+	for i, s := range r.Seats {
+		fmt.Fprintf(&b, "  seat[%d]: start=%d entry=%d end=%d\n",
+			i, s.PlayerStartHP, s.PlayerEntryHP, s.PlayerEndHP)
+	}
+	for i, e := range r.Events {
+		fmt.Fprintf(&b, "  [%02d] r%d seat=%d %-12s %-8s %-16s dmg=%-5d php=%-4d ehp=%-4d roll=%d/%d desc=%q\n",
+			i, e.Round, e.Seat, e.Phase, e.Actor, e.Action, e.Damage, e.PlayerHP, e.EnemyHP,
+			e.Roll, e.RollAgainst, e.Desc)
+	}
+	return b.String()
+}
+
+func TestPartyCharacterization(t *testing.T) {
+	var b strings.Builder
+	for _, sc := range partyCharacterizationScenarios() {
+		for _, seed := range charSeeds {
+			rng := rand.New(rand.NewPCG(seed, 0xC0FFEE))
+			res := simulatePartyWithRNG(sc.seats, sc.enemy, sc.phases, rng)
+			fmt.Fprintf(&b, "=== %s seed=%d ===\n", sc.name, seed)
+			b.WriteString(formatPartyResult(res))
+			b.WriteString("\n")
+		}
+	}
+	got := b.String()
+
+	path := filepath.Join("testdata", "party_characterization.golden")
+	if *updatePartyGolden {
+		if err := os.WriteFile(path, []byte(got), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		t.Log("party golden rewritten:", path)
+		return
+	}
+	want, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read party golden (run with -update-party to create it): %v", err)
+	}
+	if string(want) != got {
+		t.Fatalf("PARTY ENGINE BEHAVIOUR MOVED.\n\n%s\n\n"+
+			"If this was deliberate, say so in the commit and regenerate:\n"+
+			"  go test ./internal/plugin -run TestPartyCharacterization -update-party",
+			firstDiff(string(want), got))
+	}
+}
+
+// The one-seat roster is the solo engine. If this ever fails, the N-body path has
+// stopped being a superset of the path the entire balance corpus was measured on,
+// and every baseline in the repo is suspect.
+func TestPartyCharacterization_OneSeatIsStillSolo(t *testing.T) {
+	for _, seed := range charSeeds {
+		solo := simulateCombatWithRNG(basePlayer(), baseEnemy(), dungeonCombatPhases,
+			rand.New(rand.NewPCG(seed, 0xC0FFEE)))
+		party := simulatePartyWithRNG([]Combatant{basePlayer()}, baseEnemy(), dungeonCombatPhases,
+			rand.New(rand.NewPCG(seed, 0xC0FFEE)))
+
+		if solo.PlayerWon != party.PlayerWon || solo.TotalRounds != party.TotalRounds ||
+			solo.EnemyEndHP != party.EnemyEndHP || solo.PlayerEndHP != party.Seats[0].PlayerEndHP {
+			t.Fatalf("seed %d: a one-seat roster diverged from solo\n solo:  won=%v rounds=%d ehp=%d php=%d\n party: won=%v rounds=%d ehp=%d php=%d",
+				seed,
+				solo.PlayerWon, solo.TotalRounds, solo.EnemyEndHP, solo.PlayerEndHP,
+				party.PlayerWon, party.TotalRounds, party.EnemyEndHP, party.Seats[0].PlayerEndHP)
+		}
+	}
+}

internal/plugin/combat_party_finish.go

@@ -51,9 +51,24 @@ func (p *AdventurePlugin) finishPartyCombatSession(ct *combatTurn) []string {
 	// nat20/nat1 mood deltas from the whole fight's event log — the run's, so once.
 	scanMoodEventsFromEvents(sess.RunID, sess.TurnLog)
 
-	// Every seat's HP lands on their sheet regardless of how the fight ended.
+	// Every seat's HP lands on their sheet regardless of how the fight ended, and
+	// so does the bookkeeping that outlives the fight — a Berserker who raged and
+	// lost is still exhausted. Both fan out; neither is the owner's alone.
 	for seat := range sess.RosterSize() {
+		// The companion has no sheet, so none of the sheet-keyed bookkeeping below
+		// applies to him — and postCombatBookkeepingForSeat logs at ERROR for a
+		// seat with no sheet, which would file one for every party fight he is ever
+		// hired for. But his HP is not bookkeeping: it is the fight's result. It
+		// lands on his roster row, because that is the only row he has.
+		//
+		// He used to be skipped outright, and "he arrives fresh next time" was the
+		// stated intent. It is a free lunch — see companionSeatHP.
+		if isCompanionUser(sess.seatUserID(seat)) {
+			_ = setCompanionHPForRun(sess.RunID, sess.seatHP(seat))
+			continue
+		}
 		persistDnDHPAfterCombat(id.UserID(sess.seatUserID(seat)), sess.seatHP(seat))
+		p.postCombatBookkeepingForSeat(sess, seat)
 	}
 
 	switch sess.Status {
@@ -62,8 +77,7 @@ func (p *AdventurePlugin) finishPartyCombatSession(ct *combatTurn) []string {
 	case CombatStatusLost:
 		return p.finishPartyLoss(ct, zone, cadence)
 	case CombatStatusFled:
-		_ = abandonZoneRun(owner)
-		forceExtractExpeditionForRunLoss(owner, "combat flee")
+		endRunOnLoss(owner, sess.RunID, false)
 		return p.eachSeat(ct, fmt.Sprintf(
 			"🏃 The party broke off from **%s** and slipped away. Run ended — you keep your wounds, but you live.", enemy.Name))
 	default:
@@ -81,16 +95,7 @@ func (p *AdventurePlugin) finishPartyWin(
 	sess := ct.sess
 	owner := id.UserID(sess.UserID)
 
-	recordZoneKillForUser(owner, sess.EnemyID)
-	applyRoomCombatThreatForUser(owner, elite)
-
-	bossOnExpedition := false
-	if !elite {
-		if exp, eerr := getActiveExpedition(owner); eerr == nil && exp != nil {
-			_ = applyBossDefeatThreat(exp.ID)
-			bossOnExpedition = true
-		}
-	}
+	bossOnExpedition := p.applyOwnerWinEffects(owner, sess.EnemyID, elite)
 
 	tier := 1
 	if run != nil {
@@ -107,15 +112,19 @@ func (p *AdventurePlugin) finishPartyWin(
 		uid := id.UserID(sess.seatUserID(seat))
 		hp, hpMax := sess.seatHP(seat), sess.seatHPMax(seat)
 
-		// A member who went down before the killing blow still earns the kill —
-		// but at a fifth of their pool or less, the XP path calls it near-death.
-		nearDeath := hpMax > 0 && hp*5 < hpMax
-		if xp := zoneCombatXP(CombatResult{PlayerWon: true, NearDeath: nearDeath}, monster.CR, tier); xp > 0 {
-			if _, err := p.grantDnDXP(uid, xp); err != nil {
-				slog.Error("combat: party grantDnDXP", "user", uid, "err", err)
-			}
+		// The hired companion takes no cut. He earns no XP (there is no sheet to
+		// put it on), rolls no loot (dropZoneLoot writes real inventory rows for
+		// whatever id it is handed, and a bot with a magic sword is nobody's
+		// intent), and takes no death row. His seat renders nothing: he is not
+		// reading this. He was paid up front.
+		if isCompanionSeat(uid) {
+			out[seat] = ""
+			continue
 		}
 
+		// A member who went down before the killing blow still earns the kill.
+		p.grantSeatWinXP(uid, hp, hpMax, monster, tier)
+
 		var b strings.Builder
 		if shared != "" && seat == 0 {
 			b.WriteString(shared + "\n")
@@ -131,6 +140,9 @@ func (p *AdventurePlugin) finishPartyWin(
 				b.WriteString(drop + "\n")
 			}
 		}
+		if !elite {
+			writeBossEpilogue(&b, zone.ID)
+		}
 		switch {
 		case bossOnExpedition && seat == 0:
 			b.WriteString("🎉 **Zone cleared — the expedition is won.** `!expedition run` to march out and claim your spoils.")
@@ -153,16 +165,22 @@ func (p *AdventurePlugin) finishPartyLoss(ct *combatTurn, zone ZoneDefinition, c
 	sess := ct.sess
 	owner := id.UserID(sess.UserID)
 
-	if run, _ := getZoneRun(sess.RunID); run != nil {
-		_, _ = applyMoodEvent(sess.RunID, MoodEventPlayerDeath)
-	}
-	_ = abandonZoneRun(owner)
-	forceExtractExpeditionForRunLoss(owner, "combat death")
+	endRunOnLoss(owner, sess.RunID, true)
 
 	line := twinBeeLine(zone.ID, DMPlayerDeath, sess.RunID, cadence)
 	out := make([]string, sess.RosterSize())
 	for seat := range sess.RosterSize() {
-		markAdventureDead(id.UserID(sess.seatUserID(seat)), "zone", zone.Display)
+		uid := id.UserID(sess.seatUserID(seat))
+		// The companion does not die. markAdventureDead is a silent no-op for him
+		// today (no player_meta row to mark), but relying on that accident is how
+		// he ends up in the graveyard the first time someone gives him a row —
+		// and emitDeathNews would have the news bot file a death notice about
+		// itself. Say it out loud instead.
+		if isCompanionSeat(uid) {
+			out[seat] = ""
+			continue
+		}
+		markAdventureDead(uid, "zone", zone.Display)
 		var b strings.Builder
 		if line != "" && seat == 0 {
 			b.WriteString(line + "\n")
@@ -181,3 +199,62 @@ func (p *AdventurePlugin) eachSeat(ct *combatTurn, block string) []string {
 	}
 	return out
 }
+
+// ── Shared terminal effects (item D) ─────────────────────────────────────────
+//
+// finishCombatSession (solo, combat_cmd.go) and finishPartyWin/finishPartyLoss
+// (party, above) still write their own player-facing text — the solo line says
+// "You finished", the party line says "The party stands", and the death-on-win
+// rule is deliberately roster-size-dependent (see item E). But the *effects*
+// they fire were hand-copied lists, and item A drifted exactly there. These
+// helpers are the single copy of each effect; both close-outs route through
+// them so the effect lists cannot diverge again.
+
+// applyOwnerWinEffects fires the terminal effects a win owes the run and
+// expedition — the zone-kill record, room threat, and the boss-defeat threat
+// drop — once, through the row's owner (a party member owns neither row).
+// Returns whether the kill was a zone boss on an active expedition; both
+// close-outs use it to reframe the final line as the expedition's climax.
+func (p *AdventurePlugin) applyOwnerWinEffects(owner id.UserID, enemyID string, elite bool) (bossOnExpedition bool) {
+	recordZoneKillForUser(owner, enemyID)
+	applyRoomCombatThreatForUser(owner, elite)
+	if !elite {
+		// §8.1 — a zone boss defeat drops expedition threat. Silent no-op for a
+		// standalone zone run with no active expedition.
+		if exp, eerr := getActiveExpedition(owner); eerr == nil && exp != nil {
+			_ = applyBossDefeatThreat(exp.ID)
+			bossOnExpedition = true
+		}
+	}
+	return bossOnExpedition
+}
+
+// grantSeatWinXP pays one combatant their kill XP. A seat that finished at a
+// fifth of its pool or less takes the near-death path. Full XP per person,
+// solo or party, per the accessibility-over-crunch stance.
+func (p *AdventurePlugin) grantSeatWinXP(uid id.UserID, hp, hpMax int, monster DnDMonsterTemplate, tier int) {
+	nearDeath := hpMax > 0 && hp*5 < hpMax
+	if xp := zoneCombatXP(CombatResult{PlayerWon: true, NearDeath: nearDeath}, monster.CR, tier); xp > 0 {
+		if _, err := p.grantDnDXP(uid, xp); err != nil {
+			slog.Error("combat: grantDnDXP", "user", uid, "err", err)
+		}
+	}
+}
+
+// endRunOnLoss tears down the owner's run and wrapping expedition when a fight
+// ends in death or flight. On a death (not a flee) it also stamps the run's
+// mood event. Owner-scoped, fires once; the per-seat death mark stays with the
+// caller, since it is decided per HP and gated on roster size.
+func endRunOnLoss(owner id.UserID, runID string, death bool) {
+	if death {
+		if run, _ := getZoneRun(runID); run != nil {
+			_, _ = applyMoodEvent(runID, MoodEventPlayerDeath)
+		}
+	}
+	_ = abandonZoneRun(owner)
+	reason := lossCombatFlee
+	if death {
+		reason = lossCombatDeath
+	}
+	forceExtractExpeditionForRunLoss(owner, reason)
+}

internal/plugin/combat_party_start.go

@@ -33,7 +33,9 @@ func fightRoster(sender id.UserID) []id.UserID {
 	if err != nil || e == nil {
 		return []id.UserID{sender}
 	}
-	return expeditionAudience(e)
+	// Seats, not audience: the hired companion fights even though he never
+	// receives a DM about it.
+	return expeditionSeats(e)
 }
 
 // buildFightSeats turns a roster into the seats that will actually sit down, and
@@ -56,21 +58,43 @@ func (p *AdventurePlugin) buildFightSeats(
 			senderSkip = why
 		}
 	}
+	// Parallel to `seats`, so a skipped member leaves no gap: what a seat costs the
+	// enemy is priced from these once the roster is final.
+	var levels []int
+	var companions []bool
 	for i, uid := range roster {
 		leader := i == 0
-		player, e, _, err := p.buildZoneCombatants(uid, monster, tier, dmMood)
-		if err != nil {
-			if leader {
-				return nil, nil, "", "Couldn't set up the fight: " + err.Error()
-			}
-			slog.Warn("combat: party member left out of fight", "user", uid, "err", err)
-			skip(uid, "Couldn't bring you into the fight: "+err.Error())
+
+		// The hired companion. He must be handled before everything below:
+		// dndHPSnapshot returns (0,0) for a user with no sheet, so the very next
+		// check would quietly sit him out of every fight he was paid for, and
+		// buildZoneCombatants would then fail on him anyway.
+		//
+		// He is latched onto autopilot at seat time rather than after the away-player
+		// deadline — nobody is going to type for him, and waiting three minutes to
+		// discover that would stall the fight and then announce him to the party as
+		// an absent player.
+		if isCompanionSeat(uid) {
+			expID := companionExpeditionFor(roster[0])
+			class, level := companionLoadout(expID)
+			player, _, _ := p.companionCombatant(class, level, monster, tier, dmMood)
+			// He carries his wounds between fights, like everyone else. Seating him at
+			// full max HP — which is what this did — hands the party an infinite body:
+			// he soaks a share of every fight's incoming and then resets, while the
+			// humans beside him bleed all the way to camp.
+			seats = append(seats, CombatSeatSetup{
+				UserID: uid,
+				HP:     companionSeatHP(expID, player.Stats.MaxHP),
+				HPMax:  player.Stats.MaxHP,
+				Mods:   player.Mods, C: &player, EngineDriven: true,
+			})
+			levels, companions = append(levels, level), append(companions, true)
 			continue
 		}
-		if leader {
-			enemy = &e
-		}
 
+		// Both refusals below are cheap and neither needs the build, so they run
+		// before it: consuming a seat's armed ability and *then* sitting them out
+		// would spend their rage on a fight they never joined.
 		hp, hpMax := dndHPSnapshot(uid)
 		if hp <= 0 {
 			if leader {
@@ -96,8 +120,43 @@ func (p *AdventurePlugin) buildFightSeats(
 			continue
 		}
 
-		seats = append(seats, CombatSeatSetup{UserID: uid, HP: hp, HPMax: hpMax, Mods: player.Mods, C: &player})
+		// Consumed exactly once for the fight, here. Every later rebuild
+		// re-applies this id off the seat's statuses rather than re-arming.
+		armed := ""
+		if c, cerr := LoadDnDCharacter(uid); cerr == nil && c != nil {
+			trySimAutoArm(c)
+			armed = consumeArmedAbility(c)
+		}
+		player, e, dc, err := p.buildZoneCombatants(uid, monster, tier, dmMood, armed)
+		if err != nil {
+			if leader {
+				return nil, nil, "", "Couldn't set up the fight: " + err.Error()
+			}
+			slog.Warn("combat: party member left out of fight", "user", uid, "err", err)
+			skip(uid, "Couldn't bring you into the fight: "+err.Error())
+			continue
+		}
+		if leader {
+			enemy = &e
+		}
+		if armed != "" {
+			slog.Info("combat: armed ability fired (turn-based start)", "user", uid, "ability", armed)
+		}
+
+		seats = append(seats, CombatSeatSetup{
+			UserID: uid, HP: hp, HPMax: hpMax, Mods: player.Mods, C: &player, ArmedAbility: armed,
+		})
+		lvl := 0
+		if dc != nil {
+			lvl = dc.Level
+		}
+		levels, companions = append(levels, lvl), append(companions, false)
 	}
+
+	// Price each seat against the leader. It runs here, over the seats that were
+	// actually seated — a member who was skipped (downed, busy elsewhere) never
+	// joined the fight and must not be charged to the enemy.
+	applySeatWeights(seatCombatants(seats), levels, companions)
 	return seats, enemy, senderSkip, ""
 }
 
@@ -143,6 +202,12 @@ func (p *AdventurePlugin) announcePartyFightStart(
 		names[i] = c.Name
 	}
 	for seat, uid := range sess.SeatUserIDs() {
+		// Seat-keyed fan-out, so it bypasses expeditionAudience's filter — the
+		// companion sits down but is never written to. (He also has no magic items
+		// to line up, and activeMagicItemsLine would go looking for them.)
+		if isCompanionUser(uid) {
+			continue
+		}
 		var b strings.Builder
 		b.WriteString(header)
 		b.WriteString(fmt.Sprintf("You: **%d/%d HP**.\n", sess.seatHP(seat), sess.seatHPMax(seat)))

internal/plugin/combat_party_turn.go

@@ -166,6 +166,15 @@ func (p *AdventurePlugin) beginCombatTurn(sender id.UserID, noFightMsg string) (
 		return fail(notYourTurnMsg(players, acting, waiting))
 	}
 
+	// An engine-driven seat has nobody to hand the wheel back to. A command
+	// arriving from one is not a player returning to the keyboard — it is a driver
+	// impersonating a seat, which is precisely the confusion that used to strand
+	// the companion: his own auto-played turn came back through here looking like
+	// a keystroke and cleared the latch that was moving him. Refuse it outright.
+	if sess.seatIsEngineDriven(seat) {
+		return fail("That seat isn't yours to play.")
+	}
+
 	// They typed, so they are here. Hand back the wheel.
 	sess.actorStatusesPtr(seat).Autopilot = false
 
@@ -315,6 +324,33 @@ func (p *AdventurePlugin) nudgeStalledPartyTurn(sessionID string) {
 	p.announcePartyRound(ct, events, preamble, p.closePartyRound(ct))
 }
 
+// driveEngineSeat plays one engine-driven seat's turn and persists the result.
+// It is the seat-driver equivalent of a player typing `!attack`, for a seat that
+// will never type anything.
+//
+// It exists because the alternative — dispatching a combat command as that seat —
+// sends the turn back through beginCombatTurn, which reads any command from a
+// seat as "that player is back". For a human that is correct. For a seat with no
+// human it is fatal: it drops the latch that is the only thing moving them.
+func (p *AdventurePlugin) driveEngineSeat(sess *CombatSession, seat int) error {
+	players, enemy, err := p.partyCombatantsForSession(sess)
+	if err != nil {
+		return fmt.Errorf("rebuild for engine seat: %w", err)
+	}
+	ct := &combatTurn{
+		sess: sess, players: players, enemy: enemy,
+		seat: seat, uid: id.UserID(sess.seatUserID(seat)),
+	}
+	if _, err := p.runAutoSeatTurn(ct, seat); err != nil {
+		return err
+	}
+	if err := saveCombatSession(sess); err != nil {
+		return fmt.Errorf("save after engine seat turn: %w", err)
+	}
+	p.closePartyRound(ct)
+	return nil
+}
+
 // turnDeadlineLapsed reports whether the fight has sat on one member's turn past
 // partyTurnDeadline. LastActionAt is stamped by every saveCombatSession, and the
 // save that parked the fight on this seat's player_turn was the last one — so it
@@ -387,6 +423,12 @@ func (p *AdventurePlugin) announcePartyRound(ct *combatTurn, events []CombatEven
 	names := ct.seatNames()
 	acting, waiting := actingSeat(ct.sess, ct.players, ct.enemy)
 	for seat, uid := range ct.sess.SeatUserIDs() {
+		// The combat fan-out is seat-keyed, so it does not pass through
+		// expeditionAudience and does not inherit its companion filter. He fights;
+		// he is not written to about it.
+		if isCompanionUser(uid) {
+			continue
+		}
 		// Rendered once per reader: the flavor pool speaks in the second person,
 		// so each member's own events must be theirs and nobody else's.
 		body := RenderPartyTurnRound(events, names, ct.enemy.Name, seat)

internal/plugin/combat_seat_spells.go

@@ -0,0 +1,174 @@
+package plugin
+
+import (
+	"maunium.net/go/mautrix/id"
+)
+
+// Seat-scoped spellbook.
+//
+// Every spell lookup in the engine — known list, prepared flag, slot pool, slot
+// spend — is keyed on a Matrix user id and answered by a `dnd_*` table. That was
+// fine while every combatant was a player. The hired companion is not: he has no
+// row in dnd_character, dnd_known_spells or dnd_spell_slots, deliberately, because
+// a sheet on disk for him is the thing that would turn him into a real character
+// everywhere (player_meta, the leaderboard, !stats). His sheet is synthesized per
+// fight and thrown away.
+//
+// So every one of those lookups returned "nothing" for him, and the picker's very
+// first line — `c, _ := LoadDnDCharacter(uid); if c == nil { return "attack" }` —
+// sent him to swing a mace, every turn, forever. A hired Cleric could not heal.
+// Role-fill hands a lone fighter a Cleric, so that was the *common* case.
+//
+// These are the seat-scoped forms of those lookups. A human seat delegates to the
+// DB functions verbatim — same queries, same order, so solo combat and the balance
+// corpus are untouched. A companion seat is answered from his in-memory sheet and
+// a slot ledger on his seat's persisted statuses.
+//
+// Nothing here may write a row for the companion. That invariant is what
+// TestCompanion_SheetIsBelowMedianAndNeverPersisted pins, and the auto-migration
+// inside ensureCharForDnDCmd would violate it silently: handed a user with no
+// sheet, it *builds one at level 1 and saves it*. Hence seatCastSheet.
+
+// seatCompanionLoadout returns the class and level a companion seat fights as,
+// and whether the seat is the companion at all.
+func seatCompanionLoadout(sess *CombatSession, uid id.UserID) (DnDClass, int, bool) {
+	if sess == nil || !isCompanionSeat(uid) {
+		return "", 0, false
+	}
+	class, level := companionLoadoutForRun(sess.RunID)
+	return class, level, true
+}
+
+// seatCastSheet resolves the character behind a seat for the !cast path.
+//
+// A human goes through ensureCharForDnDCmd, exactly as before — including its
+// auto-migration for a player who predates Adv 2.0. The companion must NOT: that
+// migration would mint and persist a level-1 dnd_character row for him, quietly
+// making him a player and throwing away the class and level he was hired at. He
+// gets his synthetic sheet instead, built from the same class-priority pipeline a
+// real character of his level uses.
+func (p *AdventurePlugin) seatCastSheet(sess *CombatSession, uid id.UserID) (*DnDCharacter, error) {
+	if class, level, ok := seatCompanionLoadout(sess, uid); ok {
+		return companionSheet(class, level), nil
+	}
+	advChar, _ := loadAdvCharacter(uid)
+	return p.ensureCharForDnDCmd(uid, advChar)
+}
+
+// seatPickSheet is seatCastSheet for the auto-picker, which reads a sheet to
+// decide a turn and must never create one. Humans get LoadDnDCharacter, which is
+// what the picker has always called; a miss returns nil and the caller swings.
+func seatPickSheet(sess *CombatSession, uid id.UserID) *DnDCharacter {
+	if class, level, ok := seatCompanionLoadout(sess, uid); ok {
+		return companionSheet(class, level)
+	}
+	c, _ := LoadDnDCharacter(uid)
+	return c
+}
+
+// companionKnownSpells is the companion's spell list: the same default kit
+// ensureSpellsForCharacter grants a real character of that class and level, every
+// entry prepared (which is also what that function does — preparation is SP4 and
+// until it lands every granted spell is auto-prepared so !cast works).
+//
+// He gets the player kit on purpose. His below-median comes from the level penalty,
+// the never-Masterwork gear and the absent subclass/magic items — the layers a
+// player accumulates. Handing him a bespoke, weaker spell list would be a second
+// nerf hidden in a different file, and it would drift away from the tuned list the
+// moment anyone touched one and not the other.
+func companionKnownSpells(class DnDClass, level int) []knownSpellRow {
+	ids := defaultKnownSpells(class, level)
+	out := make([]knownSpellRow, 0, len(ids))
+	for _, sid := range ids {
+		out = append(out, knownSpellRow{SpellID: sid, Source: "companion", Prepared: true})
+	}
+	return out
+}
+
+// companionSlotPool is his slot table (total, used) — the class/level progression
+// every caster shares, less what he has already spent. `used` is the expedition's
+// ledger, NOT a per-fight one: he rations one pool across the run and gets it back
+// at camp, exactly as a human caster does.
+func companionSlotPool(class DnDClass, level int, used [6]int) map[int][2]int {
+	out := map[int][2]int{}
+	for lvl, total := range slotsForClassLevel(class, level) {
+		spent := 0
+		if lvl >= 0 && lvl < len(used) {
+			spent = min(used[lvl], total)
+		}
+		out[lvl] = [2]int{total, spent}
+	}
+	return out
+}
+
+// seatKnownSpells is listKnownSpells for a seat.
+func seatKnownSpells(sess *CombatSession, seat int, uid id.UserID) ([]knownSpellRow, error) {
+	if class, level, ok := seatCompanionLoadout(sess, uid); ok {
+		return companionKnownSpells(class, level), nil
+	}
+	return listKnownSpells(uid)
+}
+
+// seatSpellSlots is getSpellSlots for a seat.
+func seatSpellSlots(sess *CombatSession, seat int, uid id.UserID) (map[int][2]int, error) {
+	if class, level, ok := seatCompanionLoadout(sess, uid); ok {
+		return companionSlotPool(class, level, companionSlotsForRun(sess.RunID)), nil
+	}
+	return getSpellSlots(uid)
+}
+
+// seatKnowsSpell is playerKnowsSpell for a seat: (known, prepared, err).
+func seatKnowsSpell(sess *CombatSession, seat int, uid id.UserID, spellID string) (bool, bool, error) {
+	if _, _, ok := seatCompanionLoadout(sess, uid); ok {
+		known, err := seatKnownSpells(sess, seat, uid)
+		if err != nil {
+			return false, false, err
+		}
+		for _, k := range known {
+			if k.SpellID == spellID {
+				return true, k.Prepared, nil
+			}
+		}
+		return false, false, nil
+	}
+	return playerKnowsSpell(uid, spellID)
+}
+
+// consumeSeatSlot is consumeSpellSlot for a seat. The companion's spend lands on
+// the expedition's ledger — one pool for the whole run, refilled at camp — so he
+// rations his slots the way a human caster has to. Keying it by expedition also
+// keeps two parties who have each hired him from sharing a pool, which anything
+// keyed on his (single, shared) user id would have done.
+func consumeSeatSlot(sess *CombatSession, seat int, uid id.UserID, slotLevel int) (bool, error) {
+	class, level, ok := seatCompanionLoadout(sess, uid)
+	if !ok {
+		return consumeSpellSlot(uid, slotLevel)
+	}
+	used := companionSlotsForRun(sess.RunID)
+	if slotLevel < 1 || slotLevel >= len(used) {
+		return false, nil
+	}
+	pair, exists := companionSlotPool(class, level, used)[slotLevel]
+	if !exists || pair[0]-pair[1] <= 0 {
+		return false, nil
+	}
+	used[slotLevel]++
+	if err := setCompanionSlotsForRun(sess.RunID, used); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// refundSeatSlot is refundSpellSlot for a seat: the rollback half of the above,
+// called when the round the slot was spent on failed to resolve.
+func refundSeatSlot(sess *CombatSession, seat int, uid id.UserID, slotLevel int) error {
+	if _, _, ok := seatCompanionLoadout(sess, uid); !ok {
+		return refundSpellSlot(uid, slotLevel)
+	}
+	used := companionSlotsForRun(sess.RunID)
+	if slotLevel < 1 || slotLevel >= len(used) || used[slotLevel] <= 0 {
+		return nil
+	}
+	used[slotLevel]--
+	return setCompanionSlotsForRun(sess.RunID, used)
+}

internal/plugin/combat_seat_spells_test.go

@@ -0,0 +1,277 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The hired companion casts.
+//
+// He could not, and the reason was one line: every spell lookup in the engine is
+// keyed on a user id and answered by a dnd_* table, and he has no rows in any of
+// them — deliberately, because a sheet on disk is what would turn him into a real
+// character everywhere. So the picker's first statement (`LoadDnDCharacter(uid)`)
+// came back nil and returned "attack", every turn, for the whole fight.
+//
+// Role-fill hands a lone martial a Cleric. So the common case of the feature was a
+// healer who could not heal, in a party engine that had only just learned to let
+// anyone heal anyone (§1). These pin both halves: that he picks the heal, and that
+// picking it leaves no trace of him in the database.
+
+// hireForFight seeds an expedition with the companion hired into it, and returns
+// the run id his loadout is resolved against.
+func hireForFight(t *testing.T, expID string, owner id.UserID, class DnDClass, level int) string {
+	t.Helper()
+	seedExpedition(t, expID, owner, "active")
+	seatLeaderFixture(t, expID)
+	if err := hireCompanion(expID, class, level); err != nil {
+		t.Fatalf("hireCompanion: %v", err)
+	}
+	return "run-" + expID
+}
+
+// petePartyFight seats a hurt leader and the companion, and returns the turn.
+func petePartyFight(t *testing.T, p *AdventurePlugin, runID string, leader id.UserID, leaderHP int) *combatTurn {
+	t.Helper()
+	monster := dndBestiary["goblin"]
+	lead, _, _ := p.companionCombatant(ClassFighter, 8, monster, 2, 0)
+	lead.Name = "lead"
+	pete, _, _ := p.companionCombatant(ClassCleric, 6, monster, 2, 0)
+	pete.Name = companionDisplayName
+	enemy := Combatant{Name: "x", Stats: CombatStats{MaxHP: 500, AC: 12, Attack: 4, AttackBonus: 4}}
+
+	sess, err := p.startPartyCombatSession(runID, "enc", "goblin", &enemy, []CombatSeatSetup{
+		{UserID: leader, HP: leaderHP, HPMax: 100, Mods: lead.Mods, C: &lead},
+		{UserID: companionUserID(), HP: 60, HPMax: 60, Mods: pete.Mods, C: &pete, EngineDriven: true},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &combatTurn{
+		sess: sess, players: []*Combatant{&lead, &pete}, enemy: &enemy,
+		seat: 1, uid: companionUserID(),
+	}
+}
+
+// The headline: a hired Cleric, watching the leader bleed out, casts a heal on him.
+// Before the seat-scoped spellbook this returned ("attack", "") — he swung a mace
+// at the boss while the man who paid for him died.
+func TestCompanionSpells_HiredClericHealsTheLeader(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	leader := id.UserID("@lead:example.org")
+	runID := hireForFight(t, "exp-heal", leader, ClassCleric, 6)
+	ct := petePartyFight(t, p, runID, leader, 20) // leader at 20/100 — well under the 45% bar
+
+	kind, arg := p.pickAutoCombatActionForSeat(companionUserID(), ct.sess, 1)
+	if kind != "cast" {
+		t.Fatalf("the hired cleric picked %q %q with the leader at 20%% HP — he must heal", kind, arg)
+	}
+	if !strings.Contains(arg, "@lead") {
+		t.Fatalf("cast arg = %q, want the heal aimed at the leader's seat", arg)
+	}
+
+	// And it lands on the leader, not on himself.
+	action, settle, msg := p.castActionForSeat(ct, 1, arg)
+	if msg != "" {
+		t.Fatalf("castActionForSeat refused the companion's own pick: %s", msg)
+	}
+	settle(true)
+	eff := action.Effect
+	if eff == nil || eff.AllyHeal <= 0 {
+		t.Fatalf("effect = %+v, want an ally heal", eff)
+	}
+	if eff.AllySeat != 0 {
+		t.Errorf("heal landed on seat %d, want seat 0 (the leader)", eff.AllySeat)
+	}
+	if eff.PlayerHeal != 0 {
+		t.Errorf("the heal also healed the caster (%d HP) — it was redirected, not copied", eff.PlayerHeal)
+	}
+}
+
+// His slots are spent on his seat, and he leaves no rows behind.
+//
+// This is the invariant with teeth. castActionForSeat used to load the caster via
+// ensureCharForDnDCmd, whose auto-migration branch — handed a user with no sheet —
+// *builds one at level 1 and saves it*. Pointed at the companion that silently
+// makes him a player: a dnd_character row, a player_meta seed, a spellbook, and a
+// level-1 chassis in place of the level he was hired at.
+func TestCompanionSpells_SpendsHisSeatNotTheDatabase(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	leader := id.UserID("@lead:example.org")
+	runID := hireForFight(t, "exp-rows", leader, ClassCleric, 6)
+	ct := petePartyFight(t, p, runID, leader, 20)
+
+	action, settle, msg := p.castActionForSeat(ct, 1, "cure_wounds @lead")
+	if msg != "" {
+		t.Fatalf("the hired cleric could not cast cure wounds: %s", msg)
+	}
+	settle(true)
+	if action.Effect == nil || action.Effect.AllyHeal <= 0 {
+		t.Fatalf("effect = %+v, want an ally heal", action.Effect)
+	}
+
+	// The slot came off the expedition's ledger — which is where it has to live, so
+	// that it is still spent in the NEXT fight of the same run.
+	if used := companionSlotsForRun(ct.sess.RunID); used[1] != 1 {
+		t.Errorf("companion spent %v level-1 slots on the run's ledger, want 1", used[1])
+	}
+
+	for _, table := range []string{"dnd_character", "dnd_known_spells", "dnd_spell_slots", "player_meta"} {
+		var n int
+		if err := db.Get().QueryRow(
+			`SELECT COUNT(*) FROM `+table+` WHERE user_id = ?`, string(companionUserID()),
+		).Scan(&n); err != nil {
+			t.Fatalf("count %s: %v", table, err)
+		}
+		if n != 0 {
+			t.Errorf("casting wrote %d %s row(s) for the companion — he is not a player", n, table)
+		}
+	}
+}
+
+// He runs dry like anybody else, and then he swings. A companion with an infinite
+// spell pool is the "carry" the whole design says he must never be.
+func TestCompanionSpells_RunsOutOfSlots(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	leader := id.UserID("@lead:example.org")
+	runID := hireForFight(t, "exp-dry", leader, ClassCleric, 6)
+	ct := petePartyFight(t, p, runID, leader, 20)
+
+	total := companionSlotPool(ClassCleric, 6, [6]int{})[1][0]
+	if total <= 0 {
+		t.Fatal("a level-6 cleric has no level-1 slots — the slot table did not resolve")
+	}
+	for i := range total {
+		if ok, err := consumeSeatSlot(ct.sess, 1, companionUserID(), 1); err != nil || !ok {
+			t.Fatalf("slot %d/%d: consume = %v (%v), want it to succeed", i+1, total, ok, err)
+		}
+	}
+	if ok, _ := consumeSeatSlot(ct.sess, 1, companionUserID(), 1); ok {
+		t.Fatalf("the companion cast a %d-th level-1 spell out of a %d-slot pool", total+1, total)
+	}
+
+	// The refund half: a round that fails to resolve gives the slot back.
+	if err := refundSeatSlot(ct.sess, 1, companionUserID(), 1); err != nil {
+		t.Fatal(err)
+	}
+	if ok, _ := consumeSeatSlot(ct.sess, 1, companionUserID(), 1); !ok {
+		t.Error("a refunded slot was not castable again")
+	}
+}
+
+// His pool does NOT refill between fights, and it DOES come back at camp.
+//
+// This is the one the sweep caught and the unit tests did not. The first cut of
+// the spellbook parked his ledger on his combat seat — and a seat is per-session,
+// so every fight opened a fresh one and he walked in with full slots. A human
+// cleric rations a single pool across the whole run; rationing it IS the caster's
+// game. Handed an infinite pool, a gearless level-penalized hireling out-cleared a
+// same-level human cleric by 15pp in the sim.
+func TestCompanionSpells_PoolIsRationedAcrossTheRun(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	leader := id.UserID("@lead:example.org")
+	runID := hireForFight(t, "exp-ration", leader, ClassCleric, 6)
+
+	// Fight one: spend every level-1 slot he owns.
+	first := petePartyFight(t, p, runID, leader, 20)
+	total := companionSlotPool(ClassCleric, 6, [6]int{})[1][0]
+	for range total {
+		if ok, err := consumeSeatSlot(first.sess, 1, companionUserID(), 1); err != nil || !ok {
+			t.Fatalf("consume: %v (%v)", ok, err)
+		}
+	}
+
+	// Fight two, same run — a NEW combat session, which is exactly what used to
+	// hand him a fresh pool.
+	if err := markCombatSessionExpired(first.sess.SessionID); err != nil {
+		t.Fatal(err)
+	}
+	second := petePartyFight(t, p, runID, leader, 20)
+	if ok, _ := consumeSeatSlot(second.sess, 1, companionUserID(), 1); ok {
+		t.Error("the companion's spell slots refilled between fights — he is an infinite caster")
+	}
+
+	// ...and camp gives them back, the same way it does for every human.
+	if err := refreshCompanionSlots("exp-ration"); err != nil {
+		t.Fatal(err)
+	}
+	if ok, _ := consumeSeatSlot(second.sess, 1, companionUserID(), 1); !ok {
+		t.Error("camp did not restore the companion's slots — his pool only ever goes down")
+	}
+}
+
+// He carries his wounds between fights, and camp patches him up.
+//
+// He used to re-seat at full max HP for every single fight — "he arrives fresh
+// next time" was the close-out's stated intent — which is an infinite body. A
+// player bleeds across a 30-room run and only heals at camp; the hireling soaked
+// his share of every fight and then reset. In the sim his party fled 5 runs out of
+// 640 where the same party with a *human* cleric fled 56.
+func TestCompanion_CarriesWoundsBetweenFights(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader := id.UserID("@lead:example.org")
+	seedExpedition(t, "exp-hp", leader, "active")
+	seatLeaderFixture(t, "exp-hp")
+	if err := hireCompanion("exp-hp", ClassCleric, 6); err != nil {
+		t.Fatal(err)
+	}
+
+	// A fresh hire is at full.
+	if got := companionSeatHP("exp-hp", 100); got != 100 {
+		t.Errorf("a fresh hire seats at %d/100 HP, want full", got)
+	}
+
+	// He walks out of a fight on 30 HP; he walks into the next one on 30 HP.
+	if err := setCompanionHP("exp-hp", 30); err != nil {
+		t.Fatal(err)
+	}
+	if got := companionSeatHP("exp-hp", 100); got != 30 {
+		t.Errorf("he re-seated at %d/100 HP after ending a fight on 30 — the wound did not carry", got)
+	}
+
+	// Dropped in a fight, he comes back on his feet but barely — not as a corpse
+	// (there is no companion-death rule) and not at full.
+	if err := setCompanionHP("exp-hp", 0); err != nil {
+		t.Fatal(err)
+	}
+	if got := companionSeatHP("exp-hp", 100); got != 1 {
+		t.Errorf("after being dropped he seats at %d/100 HP, want 1", got)
+	}
+
+	// Camp puts him right, exactly as it does every human.
+	if err := refreshCompanionHP("exp-hp"); err != nil {
+		t.Fatal(err)
+	}
+	if got := companionSeatHP("exp-hp", 100); got != 100 {
+		t.Errorf("camp left him on %d/100 HP — his body only ever goes down", got)
+	}
+}
+
+// A hired martial is still a martial: the spellbook is the class's, not a blanket
+// grant, so hiring a Fighter does not quietly buy a caster.
+func TestCompanionSpells_MartialHasNoSpellbook(t *testing.T) {
+	setupEmptyTestDB(t)
+	p := &AdventurePlugin{}
+	leader := id.UserID("@lead:example.org")
+	runID := hireForFight(t, "exp-mart", leader, ClassFighter, 6)
+	ct := petePartyFight(t, p, runID, leader, 20)
+
+	if known, _ := seatKnownSpells(ct.sess, 1, companionUserID()); len(known) != 0 {
+		t.Errorf("a hired Fighter knows %d spells, want none", len(known))
+	}
+	if _, _, msg := p.castActionForSeat(ct, 1, "cure_wounds @lead"); msg == "" {
+		t.Error("a hired Fighter cast cure wounds")
+	}
+	kind, _ := p.pickAutoCombatActionForSeat(companionUserID(), ct.sess, 1)
+	if kind != "attack" {
+		t.Errorf("a hired Fighter picked %q, want attack", kind)
+	}
+}

internal/plugin/combat_seat_weight_test.go

@@ -0,0 +1,108 @@
+package plugin
+
+import "testing"
+
+// §2(a) — the enemy charges for what a seat BRINGS, not for the fact that it sat
+// down.
+//
+// Both scaling levers (the +15% boss HP and the 1 → 2.4 attacks-a-round action
+// economy) counted seats. A seat count charges the same for an under-levelled
+// friend, a hired NPC, and a true peer — so a below-median body cost a full seat's
+// worth of boss and did not give a full seat's worth back. Measured: hiring the
+// companion was *worse than going alone* (66.1% against solo's 69.0%) once his
+// free full-heal was taken away.
+//
+// The invariant that makes this safe to ship: every seat that IS a peer still
+// weighs exactly 1.0, so solo and a party of equals are byte-identical and the
+// balance corpus does not move. Only an unequal roster lands between the knots.
+
+func TestSeatWeight_APeerWeighsExactlyOne(t *testing.T) {
+	// The leader, and a friend of the leader's level: both full price.
+	if got := seatWeight(10, 10, false); got != 1.0 {
+		t.Errorf("a peer weighs %v, want exactly 1.0 — a party of equals must not move", got)
+	}
+	// Out-levelling the leader does not make the boss harder for everybody else.
+	if got := seatWeight(14, 10, false); got != 1.0 {
+		t.Errorf("a higher-level friend weighs %v, want 1.0 (capped)", got)
+	}
+}
+
+func TestSeatWeight_TheUnderLevelledAndTheHiredCostLess(t *testing.T) {
+	// The under-levelled friend — the case that has nothing to do with the
+	// companion and has been live since parties shipped.
+	half := seatWeight(5, 10, false)
+	if half >= 1.0 || half <= seatWeightFloor {
+		t.Errorf("a level-5 friend of a level-10 leader weighs %v, want between the floor and 1.0", half)
+	}
+	// The hireling pays the same level penalty AND the discount for everything a
+	// player accrues that he never will (subclass, magic items, Masterwork gear).
+	hired := seatWeight(9, 10, true)
+	peerAtSameLevel := seatWeight(9, 10, false)
+	if hired >= peerAtSameLevel {
+		t.Errorf("the hireling weighs %v and a human of his level weighs %v — he must cost the enemy less",
+			hired, peerAtSameLevel)
+	}
+	// But a body is never free: it is still one more thing the boss has to kill.
+	if got := seatWeight(1, 20, true); got < seatWeightFloor {
+		t.Errorf("a hopelessly under-levelled hireling weighs %v, below the floor %v", got, seatWeightFloor)
+	}
+}
+
+// The levers themselves: integer knots byte-exact, fractions in between.
+func TestSeatWeight_ScalingIsExactAtThePeerKnots(t *testing.T) {
+	// Solo and a party of peers reproduce the pre-§2(a) numbers exactly. This is
+	// the whole safety argument — if either of these drifts, the corpus is invalid.
+	for _, tc := range []struct {
+		weight float64
+		acts   float64
+		hp     float64
+	}{
+		{1, 1, 1.0},    // solo
+		{2, 2.4, 1.15}, // a duo of peers
+		{3, 5, 1.15},   // a trio of peers
+	} {
+		if got := partyActionExpectation(tc.weight); got != tc.acts {
+			t.Errorf("weight %v: enemy actions = %v, want exactly %v", tc.weight, got, tc.acts)
+		}
+		if got := partyEnemyHPScale(tc.weight); got != tc.hp {
+			t.Errorf("weight %v: enemy HP scale = %v, want exactly %v", tc.weight, got, tc.hp)
+		}
+	}
+
+	// A leader plus a hireling is strictly cheaper than a leader plus a peer, and
+	// strictly dearer than soloing. Bringing him must cost the boss *something* —
+	// that is what stops a free body from becoming a carry.
+	duoWithHire := 1 + seatWeight(9, 10, true)
+	if a := partyActionExpectation(duoWithHire); a <= 1 || a >= 2.4 {
+		t.Errorf("leader + hireling buys the enemy %v actions, want strictly between 1 and 2.4", a)
+	}
+	if h := partyEnemyHPScale(duoWithHire); h <= 1.0 || h >= 1.15 {
+		t.Errorf("leader + hireling scales boss HP by %v, want strictly between 1.0 and 1.15", h)
+	}
+}
+
+// A seat that is DOWN buys the enemy nothing. §2(b) fixed the head-count half of
+// this; the weight half has to hold too, or a corpse keeps paying for swings.
+func TestSeatWeight_TheDeadBuyTheEnemyNothing(t *testing.T) {
+	alive := &Combatant{SeatWeight: 1}
+	hire := &Combatant{SeatWeight: 0.6}
+	st := &combatState{actors: []*actor{
+		{c: alive, playerHP: 40},
+		{c: hire, playerHP: 0}, // dropped
+	}}
+	if got := livingWeight(st); got != 1 {
+		t.Errorf("living weight with a downed hireling = %v, want 1 (only the survivor pays)", got)
+	}
+	st.actors[1].playerHP = 20
+	if got := livingWeight(st); got != 1.6 {
+		t.Errorf("living weight with the hireling up = %v, want 1.6", got)
+	}
+}
+
+// An unset weight reads as a full peer, so every combatant built before this
+// existed — and every test that builds one by hand — is priced exactly as before.
+func TestSeatWeight_UnsetIsAPeer(t *testing.T) {
+	if got := combatantWeight(&Combatant{}); got != 1 {
+		t.Errorf("a combatant with no weight set counts %v, want 1", got)
+	}
+}

internal/plugin/combat_session.go

@@ -88,6 +88,24 @@ type ActorStatuses struct {
 	// and druids with no sustained DPS once their burst landed.
 	ConcentrationDmg int `json:"concentration_dmg,omitempty"`
 
+	// ArmedAbility is the id of the active ability this character armed and
+	// spent entering the fight (rage, second_wind, …). The resource is already
+	// debited and the character disarmed; this is the record that lets every
+	// rebuild of an in-flight fight re-apply the ability's mods, and lets the
+	// close-out know a rage fired. Empty when nothing was armed.
+	ArmedAbility string `json:"armed_ability,omitempty"`
+
+	// GrimHarvestSlot / GrimHarvestNecrotic snapshot the most recent damaging
+	// spell this seat cast, for the Necromancy Mage's post-combat kill-heal.
+	// The auto-resolve path carries the same pair on CombatModifiers, stashed
+	// once by applyPendingCast; the turn-based path can cast every round, so
+	// the stash lives here and each damaging cast overwrites it. Whether the
+	// heal actually fires is decided at close-out by grimHarvestHeal, which
+	// asks whether the *last* spell_cast event is the one that dropped the
+	// enemy to 0 — so a stale stash from an earlier, non-lethal cast is inert.
+	GrimHarvestSlot     int  `json:"grim_harvest_slot,omitempty"`
+	GrimHarvestNecrotic bool `json:"grim_harvest_necrotic,omitempty"`
+
 	// Once-per-fight class/race/subclass one-shots: the "already used" flags.
 	// Without persistence these reset every round on resume, letting a Halfling
 	// reroll a nat 1 or an Orc rage every single round of a turn-based fight.
@@ -103,7 +121,7 @@ type ActorStatuses struct {
 	// fight, set when its turn deadline lapses once (see partyTurnDeadline).
 	// Without the latch an away member taxes the party the full deadline every
 	// single round; with it, they cost one wait and then resolve instantly. Any
-	// combat command from that member clears it.
+	// combat command from that member clears it — they typed, so they are back.
 	//
 	// Like the Buff* deltas it is session-layer state with no combatState
 	// counterpart, so snapshotActor carries it over from the prior snapshot
@@ -111,6 +129,24 @@ type ActorStatuses struct {
 	// fight has no turn deadline, only the 1h session reaper.
 	Autopilot bool `json:"autopilot,omitempty"`
 
+	// EngineDriven marks a seat that has NO human behind it and never will: a
+	// hired companion today, an NPC ally or a Pete-led expedition tomorrow. It is
+	// the answer to "who owns this turn", and it is deliberately NOT the same
+	// question as Autopilot.
+	//
+	// Autopilot means "a human is away"; it is provisional, and a keystroke ends
+	// it. EngineDriven means "there is nobody to come back", and nothing clears it.
+	// Collapsing the two is a bug with teeth: the expedition autopilot drives a
+	// party by dispatching each seat's turn as a command from that seat, so an
+	// engine seat's own auto-played move arrived back at beginCombatTurn looking
+	// exactly like a player returning to the keyboard, and cleared the very latch
+	// that was moving it. The seat then stood in the fight doing nothing for the
+	// rest of the fight — while the enemy it had inflated by 15% killed the party.
+	//
+	// So the property lives on the seat, not on an identity check, and no command
+	// path can unset it.
+	EngineDriven bool `json:"engine_driven,omitempty"`
+
 	// Debuffs the enemy has stacked onto this character specifically.
 	PlayerAtkDrain int `json:"player_atk_drain,omitempty"`
 	PlayerACDebuff int `json:"player_ac_debuff,omitempty"`
@@ -221,23 +257,27 @@ func (s *ActorStatuses) applyBuffDelta(d turnBuffDelta) {
 // the Abjuration Arcane Ward is normally non-zero at fight start — the
 // turn-based build deliberately omits pre-combat consumables and queued casts —
 // but the full set is seeded for robustness. Returns true if anything was set.
-func seedCombatSessionOneShots(s *CombatSession, playerMods CombatModifiers) bool {
-	return seedActorOneShots(&s.Statuses.ActorStatuses, playerMods)
+func seedCombatSessionOneShots(s *CombatSession, seat CombatSeatSetup) bool {
+	return seedActorOneShots(&s.Statuses.ActorStatuses, seat)
 }
 
 // seedActorOneShots copies one character's fight-start one-shot resources onto
 // their persisted statuses. Seat 0's live on the session row; a party member's
 // live on their participant row, and each seat reads its own combatant's mods —
 // a party Abjurer brings their own Arcane Ward, not the leader's.
-func seedActorOneShots(st *ActorStatuses, playerMods CombatModifiers) bool {
+func seedActorOneShots(st *ActorStatuses, seat CombatSeatSetup) bool {
+	playerMods := seat.Mods
 	st.WardCharges = playerMods.WardCharges
 	st.SporeRounds = playerMods.SporeCloud
 	st.ReflectFrac = playerMods.ReflectNext
 	st.AutoCritFirst = playerMods.AutoCritFirst
 	st.ArcaneWardHP = playerMods.ArcaneWardHP
 	st.HealChargesLeft = playerMods.HealItemCharges
-	return st.WardCharges != 0 || st.SporeRounds != 0 || st.ReflectFrac != 0 ||
-		st.AutoCritFirst || st.ArcaneWardHP != 0 || st.HealChargesLeft != 0
+	st.ArmedAbility = seat.ArmedAbility
+	st.EngineDriven = seat.EngineDriven
+	return st.EngineDriven || st.WardCharges != 0 || st.SporeRounds != 0 || st.ReflectFrac != 0 ||
+		st.AutoCritFirst || st.ArcaneWardHP != 0 || st.HealChargesLeft != 0 ||
+		st.ArmedAbility != ""
 }
 
 // CombatParticipant is one party member's seat in a fight, from seat 1 up.
@@ -366,16 +406,30 @@ func (s *CombatSession) seatOf(userID id.UserID) (int, bool) {
 // turn silently rather than blocking the round on a corpse.
 func (s *CombatSession) seatAlive(seat int) bool { return s.seatHP(seat) > 0 }
 
-// seatIsAutopiloted reports whether a seat has been latched onto the auto-picker
-// by a lapsed turn deadline.
+// seatIsEngineDriven reports whether a seat has no human behind it at all — a
+// hired companion, an NPC ally. Permanent for the life of the fight; no command
+// clears it. Contrast seatIsAutopiloted, which is a human who stepped away.
+func (s *CombatSession) seatIsEngineDriven(seat int) bool {
+	return s.actorStatusesForSeat(seat).EngineDriven
+}
+
+// seatIsAutopiloted reports whether the engine, rather than a person, decides
+// this seat's action — because its human is away (a lapsed turn deadline) or
+// because it never had one.
+//
+// Every driver in the codebase reads this, which is exactly why the two reasons
+// share one accessor: the picker does not care WHY nobody is typing. What differs
+// is who is allowed to take the wheel back, and that question is asked in
+// beginCombatTurn against seatIsEngineDriven — never here.
 func (s *CombatSession) seatIsAutopiloted(seat int) bool {
-	return s.actorStatusesForSeat(seat).Autopilot
+	st := s.actorStatusesForSeat(seat)
+	return st.Autopilot || st.EngineDriven
 }
 
 // seatNeedsNoHuman reports whether the engine can resolve a seat's turn without
-// waiting on its player: it is down (forfeits silently) or latched onto
-// autopilot. driveCombatRound keeps stepping while this holds, so a round only
-// comes to rest on a live human's turn.
+// waiting on its player: it is down (forfeits silently), latched onto autopilot,
+// or has no human to wait for. driveCombatRound keeps stepping while this holds,
+// so a round only comes to rest on a live human's turn.
 func (s *CombatSession) seatNeedsNoHuman(seat int) bool {
 	return !s.seatAlive(seat) || s.seatIsAutopiloted(seat)
 }
@@ -467,7 +521,10 @@ func (p *AdventurePlugin) startPartyCombatSession(
 	if len(seats) == 0 {
 		return nil, fmt.Errorf("start combat session: empty roster")
 	}
-	enemyHP := enemy.Stats.MaxHP
+	// Party-only enemy HP bump (solo roster scales by 1.0). The per-turn rebuild
+	// in partyCombatantsForSession applies the identical scalar to the enemy's
+	// Stats.MaxHP, so the persisted current HP and the rebuilt max never drift.
+	enemyHP := scaledEnemyMaxHP(enemy.Stats.MaxHP, seatSetupWeight(seats))
 	owner := seats[0]
 	sess, err := startCombatSession(owner.UserID, runID, encounterID, enemyID,
 		owner.HP, owner.HPMax, enemyHP, enemyHP)
@@ -477,13 +534,13 @@ func (p *AdventurePlugin) startPartyCombatSession(
 
 	// Seat 0's one-shots live on the session row; seeding them is a mutation of
 	// sess.Statuses that the save below flushes along with the participants.
-	dirty := seedCombatSessionOneShots(sess, owner.Mods)
+	dirty := seedCombatSessionOneShots(sess, owner)
 
 	if len(seats) > 1 {
 		ps := make([]CombatParticipant, 0, len(seats)-1)
 		for i, s := range seats[1:] {
 			var st ActorStatuses
-			seedActorOneShots(&st, s.Mods)
+			seedActorOneShots(&st, s)
 			ps = append(ps, CombatParticipant{
 				Seat: i + 1, UserID: string(s.UserID), HP: s.HP, HPMax: s.HPMax, Statuses: st,
 			})
@@ -525,6 +582,16 @@ type CombatSeatSetup struct {
 	HPMax  int
 	Mods   CombatModifiers
 	C      *Combatant
+	// ArmedAbility is the ability id this seat consumed entering the fight, ""
+	// if they armed nothing. It is persisted onto the seat's statuses so every
+	// later rebuild can re-apply the ability without re-spending it.
+	ArmedAbility string
+	// EngineDriven seats this combatant with no human behind it — the hired
+	// companion today. It resolves from the opening round rather than after the
+	// 3-minute away-player deadline (nobody is coming, so waiting out a deadline
+	// would idle the fight and then announce him to the party as absent), and no
+	// command can hand the wheel back to a player who does not exist.
+	EngineDriven bool
 }
 
 // getActiveCombatSession returns the player's in-flight fight, or (nil, nil).

internal/plugin/combat_session_build.go

@@ -33,11 +33,18 @@ import (
 // + armed ability) and the monster's bestiary stat block with tier scaling and
 // the DM-mood combat tilt folded in. The returned dndChar is handed back so
 // callers can run post-combat subclass persistence without reloading it.
+//
+// armed is the ability id already consumed for this fight (consumeArmedAbility,
+// or armAbilityForFight's return on the auto-resolve paths); "" means none. The
+// build re-applies it rather than consuming, because the turn-based path calls
+// this once per player command and a consuming build would spend the ability on
+// round 1 and drop it for the rest of the fight.
 func (p *AdventurePlugin) buildZoneCombatants(
 	userID id.UserID,
 	monster DnDMonsterTemplate,
 	tier int,
 	dmMood int,
+	armed string,
 ) (player Combatant, enemy Combatant, dndChar *DnDCharacter, err error) {
 	tilt := dmMoodCombatTilt(dmMood)
 	char, err := loadAdvCharacter(userID)
@@ -64,10 +71,7 @@ func (p *AdventurePlugin) buildZoneCombatants(
 	applyRacePassives(&playerStats, &playerMods, dndChar)
 	applySubclassPassives(&playerStats, &playerMods, dndChar)
 	applyMagicItemEffects(&playerStats, &playerMods, userID)
-	trySimAutoArm(dndChar)
-	if firedName, fired := applyArmedAbility(dndChar, &playerMods); fired {
-		slog.Info("dnd: armed ability fired (turn-based build)", "user", userID, "ability", firedName)
-	}
+	applyAbilityByID(dndChar, armed, &playerMods)
 
 	enemyStats, enemyMods := monster.toCombatStats()
 	// Tier scaling mirrors runZoneCombat: only raise AC/AttackBonus to a
@@ -150,9 +154,36 @@ func (p *AdventurePlugin) partyCombatantsForSession(sess *CombatSession) ([]*Com
 
 	seats := sess.SeatUserIDs()
 	players := make([]*Combatant, len(seats))
+	levels := make([]int, len(seats))
+	companions := make([]bool, len(seats))
 	var enemy Combatant
 	for seat, uid := range seats {
-		player, e, _, err := p.buildZoneCombatants(id.UserID(uid), monster, int(zone.Tier), run.DMMood)
+		// The ability this seat armed was consumed once, at fight start, and its
+		// id parked on their statuses. Re-applying it here — not re-consuming —
+		// is what makes a rage last the whole fight instead of one round.
+		st := sess.actorStatusesForSeat(seat)
+
+		// The hired companion has no sheet to load — by design, because a
+		// player_meta row for him is the thing that would turn him into a real
+		// character everywhere. Synthesize his seat instead. This branch is
+		// load-bearing: buildZoneCombatants would fail on him, and one
+		// unbuildable seat fails the whole rebuild, which is what every human's
+		// !attack in the fight depends on.
+		if isCompanionUser(uid) {
+			class, level := companionLoadoutForRun(sess.RunID)
+			player, en, _ := p.companionCombatant(class, level, monster, int(zone.Tier), run.DMMood)
+			applySessionBuffs(&player, st)
+			players[seat] = &player
+			levels[seat], companions[seat] = level, true
+			if seat == 0 {
+				// Unreachable today (seat 0 is always the leader), but if it ever
+				// isn't, the enemy still has to come from somewhere.
+				enemy = en
+			}
+			continue
+		}
+
+		player, e, dc, err := p.buildZoneCombatants(id.UserID(uid), monster, int(zone.Tier), run.DMMood, st.ArmedAbility)
 		if err != nil {
 			return nil, nil, fmt.Errorf("seat %d (%s): %w", seat, uid, err)
 		}
@@ -161,8 +192,11 @@ func (p *AdventurePlugin) partyCombatantsForSession(sess *CombatSession) ([]*Com
 		// one-shots (ward/spore/…) live on their persisted statuses and flow
 		// through the turn engine's resume/commit cycle, so only the persistent
 		// stat deltas are applied here — and only that seat's own.
-		applySessionBuffs(&player, sess.actorStatusesForSeat(seat))
+		applySessionBuffs(&player, st)
 		players[seat] = &player
+		if dc != nil {
+			levels[seat] = dc.Level
+		}
 		if seat == 0 {
 			// The enemy build reads only (monster, tier, dmMood): every seat
 			// rebuilds the identical stat block, so seat 0's copy is the fight's.
@@ -170,9 +204,120 @@ func (p *AdventurePlugin) partyCombatantsForSession(sess *CombatSession) ([]*Com
 			enemy = e
 		}
 	}
+
+	// What each seat costs the enemy, priced against the leader. This runs after
+	// the loop and not inside it, because a seat's weight is relative to seat 0's
+	// level and the enemy's HP is scaled off the *summed* weight — neither is known
+	// until every seat is built.
+	applySeatWeights(players, levels, companions)
+
+	// Party-only enemy HP bump, re-derived each turn from the template so it never
+	// compounds. Matches the scalar startPartyCombatSession used for the initial
+	// persist; solo (one seat, weight 1) scales by 1.0.
+	if sess.IsParty() {
+		enemy.Stats.MaxHP = scaledEnemyMaxHP(enemy.Stats.MaxHP, partyWeight(players))
+	}
 	return players, &enemy, nil
 }
 
+// applySeatWeights prices every seat against the leader's level. Seat 0 is the
+// leader and always weighs a full 1.0.
+func applySeatWeights(players []*Combatant, levels []int, companions []bool) {
+	if len(players) == 0 {
+		return
+	}
+	leaderLevel := levels[0]
+	for i, c := range players {
+		if c == nil {
+			continue
+		}
+		c.SeatWeight = seatWeight(levels[i], leaderLevel, companions[i])
+	}
+}
+
+// seatFightStartMods re-derives the modifiers a finished fight's close-out still
+// needs: the Berserker's rage flag, which decides whether the character owes a
+// point of exhaustion, and the Necromancy Mage's Grim Harvest stash.
+//
+// It re-applies the seat's armed ability to an empty mod set rather than
+// rebuilding the whole combatant: no Apply writes to the character (they read
+// level and HP and write only mods), so this is pure, and the passive/equipment
+// layers a full build would add are not read by any post-combat hook.
+//
+// The Grim Harvest pair is not re-derived but read back off the seat's
+// statuses, where castActionForSeat parked it: the spell that stashed it was
+// cast mid-fight, not at fight start, and nothing in the character sheet still
+// remembers which one it was.
+func seatFightStartMods(sess *CombatSession, seat int, c *DnDCharacter) CombatModifiers {
+	var mods CombatModifiers
+	st := sess.actorStatusesForSeat(seat)
+	applyAbilityByID(c, st.ArmedAbility, &mods)
+	mods.GrimHarvestSlot = st.GrimHarvestSlot
+	mods.GrimHarvestNecrotic = st.GrimHarvestNecrotic
+	return mods
+}
+
+// seatCombatResult reconstructs, for one seat of a finished turn-based fight,
+// the slice of CombatResult that the post-combat hooks actually read. The turn
+// engine never builds a CombatResult — it persists a session and a shared event
+// log — so the close-out has to assemble one.
+//
+// MistyHealed is read back off the seat's event log rather than off a flag: the
+// turn engine's CombatResult is a scratch value it discards between steps, and
+// the log is the only thing that survives to the close-out. This is how
+// combat_pet_save has always been detected.
+//
+// SniperKilled stays false. Arina's proc is a pre-combat one-shot, not a
+// round-end effect, so seatEndOfRound does not carry it and the turn engine
+// still has no place to fire it — combat_sniper_kill remains unreachable from a
+// manual kill.
+//
+// NearDeath mirrors the auto-resolve engine's win threshold (below 15% of max);
+// its loss-side meaning is unused here, since the only hook that reads it gates
+// on PlayerWon.
+func seatCombatResult(sess *CombatSession, seat int) CombatResult {
+	hp, hpMax := sess.seatHP(seat), sess.seatHPMax(seat)
+	won := sess.Status == CombatStatusWon
+	events := eventsForSeat(sess.TurnLog, seat)
+	return CombatResult{
+		PlayerWon:   won,
+		Events:      events,
+		PlayerEndHP: hp,
+		EnemyEndHP:  sess.EnemyHP,
+		TotalRounds: sess.Round,
+		NearDeath:   won && hp > 0 && float64(hp) < float64(max(1, hpMax))*0.15,
+		MistyHealed: hasAction(events, "misty_heal"),
+	}
+}
+
+// hasAction reports whether the event log holds at least one event with the
+// given Action. The one-line "did this happen in the fight?" scan the close-out
+// uses to read a proc's outcome off the log rather than a flag.
+func hasAction(events []CombatEvent, action string) bool {
+	for _, e := range events {
+		if e.Action == action {
+			return true
+		}
+	}
+	return false
+}
+
+// postCombatBookkeepingForSeat is postCombatBookkeeping for one seat of a
+// terminal turn-based session — the bridge between what the turn engine
+// persisted and what the shared close-out expects.
+func (p *AdventurePlugin) postCombatBookkeepingForSeat(sess *CombatSession, seat int) {
+	uid := id.UserID(sess.seatUserID(seat))
+	// Loaded after the caller's persistDnDHPAfterCombat, so a Grim-Harvest-style
+	// hook that heals off HPCurrent reads the fight's real ending HP.
+	c, err := LoadDnDCharacter(uid)
+	if err != nil || c == nil {
+		slog.Error("combat: post-combat bookkeeping skipped, no sheet", "user", uid, "err", err)
+		return
+	}
+	mods := seatFightStartMods(sess, seat, c)
+	p.postCombatBookkeeping(uid, c, mods.BerserkerRage, seatCombatResult(sess, seat), mods)
+}
+
 // applySessionBuffs re-derives the persistent stat effect of every mid-fight
 // buff onto one rebuilt character. The buffs are stored as accumulated deltas
 // (diffTurnBuff produced them against that character's state at cast time), so

internal/plugin/combat_session_test.go

@@ -454,15 +454,23 @@ func TestApplySessionBuffs(t *testing.T) {
 func TestSeedCombatSessionOneShots(t *testing.T) {
 	// Arcane Ward is the one resource normally live at fight start.
 	s := &CombatSession{}
-	if !seedCombatSessionOneShots(s, CombatModifiers{ArcaneWardHP: 15}) {
+	if !seedCombatSessionOneShots(s, CombatSeatSetup{Mods: CombatModifiers{ArcaneWardHP: 15}}) {
 		t.Error("seed should report true when Arcane Ward is present")
 	}
 	if s.Statuses.ArcaneWardHP != 15 {
 		t.Errorf("ArcaneWardHP = %d, want 15", s.Statuses.ArcaneWardHP)
 	}
+	// The armed ability rides along, so a rebuild mid-fight can re-apply it.
+	armed := &CombatSession{}
+	if !seedCombatSessionOneShots(armed, CombatSeatSetup{ArmedAbility: "rage"}) {
+		t.Error("seed should report true when an ability was armed")
+	}
+	if armed.Statuses.ArmedAbility != "rage" {
+		t.Errorf("ArmedAbility = %q, want rage", armed.Statuses.ArmedAbility)
+	}
 	// Nothing to seed → false, statuses untouched.
 	empty := &CombatSession{}
-	if seedCombatSessionOneShots(empty, CombatModifiers{}) {
+	if seedCombatSessionOneShots(empty, CombatSeatSetup{}) {
 		t.Error("seed should report false with no fight-start resources")
 	}
 }

internal/plugin/combat_stats.go

@@ -157,12 +157,33 @@ func DerivePlayerStats(
 		}
 	}
 
-	// Pet modifiers
+	// Pet modifiers. Two pets each contribute at half weight — the combat mods
+	// are an average over the active pets, so a pair reads as roughly one full
+	// pet (flavor-forward, not a stat spike). A lone pet averages over one
+	// element, so x/1==x and 0.0+x==x reproduce the former values exactly,
+	// keeping the single-pet combat golden byte-identical. The engines roll one
+	// attack/deflect/whiff off these mods per round regardless of pet count, so
+	// the RNG draw order is unchanged too.
+	pets := make([]struct{ level, armor int }, 0, 2)
 	if char.HasPet() {
-		mods.PetAttackProc = petAttackChance(char.PetLevel)
-		mods.PetAttackDmg = 3 + char.PetLevel // per-attack variance added in engine
-		mods.PetDeflectProc = petDeflectChance(char.PetLevel, char.PetArmorTier)
-		mods.PetWhiffProc = 0.01 + float64(char.PetLevel)*0.005
+		pets = append(pets, struct{ level, armor int }{char.PetLevel, char.PetArmorTier})
+	}
+	if char.HasPet2() {
+		pets = append(pets, struct{ level, armor int }{char.Pet2Level, char.Pet2ArmorTier})
+	}
+	if n := len(pets); n > 0 {
+		var atk, defl, whiff float64
+		levelSum := 0
+		for _, pt := range pets {
+			atk += petAttackChance(pt.level)
+			defl += petDeflectChance(pt.level, pt.armor)
+			whiff += 0.01 + float64(pt.level)*0.005
+			levelSum += pt.level
+		}
+		mods.PetAttackProc = atk / float64(n)
+		mods.PetDeflectProc = defl / float64(n)
+		mods.PetWhiffProc = whiff / float64(n)
+		mods.PetAttackDmg = 3 + (levelSum*2+n)/(2*n) // 3 + rounded average level
 	}
 	if char.PetMorningDefense {
 		mods.DamageReduct *= 0.95 // 5% less damage

internal/plugin/combat_turn_engine.go

@@ -65,6 +65,19 @@ type turnActionEffect struct {
 	EnemyDamage int
 	PlayerHeal  int
 	EnemySkip   bool // control spell: enemy forfeits its attack this round
+
+	// AllyHeal heals ANOTHER seat instead of the caster — the thing the engine
+	// could not do until §1, and the reason a party cleric was a cleric in name
+	// only. Every heal in the engine wrote to the acting seat: MistyHealProc,
+	// HealItem, PlayerHeal above. Nothing could put a hit point on a friend, so
+	// the class whose entire identity is keeping other people alive could not.
+	// N3 shipped that way and no test noticed, because there was no party golden.
+	//
+	// Zero means no ally heal, which keeps every existing construction of this
+	// struct meaning exactly what it meant before. AllySeat is only read when
+	// AllyHeal > 0, so its zero value is never mistaken for "seat 0".
+	AllyHeal int
+	AllySeat int
 	// ConcentrationDmg arms a per-round aura tick when a concentration damage
 	// spell is cast: EnemyDamage is the burst that lands this round, this is
 	// what re-ticks at every round_end after. Zero for one-shot spells; a
@@ -414,10 +427,11 @@ func (te *turnEngine) step(action PlayerAction) ([]CombatEvent, error) {
 		te.stepPlayerTurn(action)
 		te.stampSeat(0, acting)
 	case CombatPhaseEnemyTurn:
+		// stepEnemyTurn self-stamps each attack-action to the seat it targeted: a
+		// party's enemy re-targets across the roster within one turn, so there is
+		// no single seat the whole phase lands on. Solo stamps seat 0 throughout,
+		// exactly as the old blanket stamp did.
 		te.stepEnemyTurn()
-		// stepEnemyTurn seats its target before anything resolves, and the whole
-		// phase lands on that one character.
-		te.stampSeat(0, te.st.seatIdx)
 	case CombatPhaseRoundEnd:
 		te.stepRoundEnd()
 	case CombatPhaseOver:
@@ -559,6 +573,25 @@ func (te *turnEngine) stepPlayerActionEffect(eff *turnActionEffect) {
 		hpCap := max(1, st.hpMax-st.maxHPDrain)
 		st.playerHP = min(hpCap, st.playerHP+eff.PlayerHeal)
 	}
+	// §1 — heal somebody else. The caster's cursor stays where it is; only the
+	// target's HP moves.
+	//
+	// A downed seat is NOT raised. Death in this engine is terminal for the fight
+	// (the close-out marks them, the hospital takes them), and a heal that
+	// resurrected a corpse would quietly rewrite the loss rules every close-out
+	// path depends on. Healing keeps people up; it does not bring them back.
+	if eff.AllyHeal > 0 && eff.AllySeat >= 0 && eff.AllySeat < len(st.actors) {
+		if tgt := st.actors[eff.AllySeat]; tgt.playerHP > 0 {
+			cap := max(1, tgt.hpMax-tgt.maxHPDrain)
+			before := tgt.playerHP
+			tgt.playerHP = min(cap, tgt.playerHP+eff.AllyHeal)
+			st.events = append(st.events, CombatEvent{
+				Round: st.round, Phase: turnCombatPhase.Name, Actor: "player", Action: "ally_heal",
+				Damage: tgt.playerHP - before, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
+				Seat: eff.AllySeat, Desc: eff.Label,
+			})
+		}
+	}
 	// Arm / replace the concentration aura. A new concentration cast overwrites
 	// the old one (5e: one concentration at a time); non-concentration casts
 	// leave any running aura alone.
@@ -615,34 +648,39 @@ func (te *turnEngine) stepEnemyTurn() {
 		return
 	}
 	te.st.seat(target)
-	// A control spell cast last phase forfeits the enemy's attack this round —
-	// unless the enemy is fear_immune, in which case the control fizzled and it
-	// acts as normal.
+	// A control spell cast last phase forfeits the enemy's whole turn (every
+	// attack-action) this round — unless the enemy is fear_immune, in which case
+	// the control fizzled and it acts as normal.
 	if te.st.enemySkipFirst {
 		te.st.enemySkipFirst = false
+		mark := len(te.st.events)
 		if enemyImmuneToControl(te.enemy, te.st) {
 			te.st.events = append(te.st.events, CombatEvent{
 				Round: te.st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "fear_resist",
 				PlayerHP: te.st.playerHP, EnemyHP: te.st.enemyHP,
 			})
+			te.stampSeat(mark, target)
 		} else {
 			te.st.events = append(te.st.events, CombatEvent{
 				Round: te.st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "spell_held",
 				PlayerHP: te.st.playerHP, EnemyHP: te.st.enemyHP,
 			})
+			te.stampSeat(mark, target)
 			te.advance()
 			return
 		}
 	}
 
-	// Monster ability fires at the top of the enemy turn. cleave / lifesteal
-	// resolve their own damage and stand in for the attack action this round;
-	// every other effect (poison / stun / enrage / armor_break) is a rider that
-	// leaves the multiattack below intact. applyAbility returns true when the
-	// player went down without a save.
+	// Monster ability fires once, at the top of the enemy turn, against the
+	// initial target. cleave / lifesteal resolve their own damage and stand in
+	// for the enemy's first attack-action this round; every other effect (poison
+	// / stun / enrage / armor_break) is a rider that leaves the multiattack below
+	// intact. applyAbility returns true when the player went down without a save.
 	abilityDealtDamage := false
 	if te.enemy.Ability != nil && turnAbilityFires(te.enemy.Ability, te.st, te.enemy) {
+		mark := len(te.st.events)
 		if applyAbility(te.st, te.st.c, te.enemy, &turnCombatPhase, te.result) {
+			te.stampSeat(mark, target)
 			// The target went down without a save. The fight only ends if it
 			// took the last member with it; otherwise the enemy has spent its
 			// turn on that kill.
@@ -653,57 +691,90 @@ func (te *turnEngine) stepEnemyTurn() {
 			}
 			return
 		}
+		te.stampSeat(mark, target)
 		switch te.enemy.Ability.Effect {
 		case "cleave", "lifesteal":
 			abilityDealtDamage = true
 		}
 	}
 
-	if !abilityDealtDamage {
-		// Pet defensive procs are a single proc per enemy turn: roll once, then
-		// spend it on the first swing only. Whiff makes that one swing a
-		// guaranteed miss; deflect halves its damage. Against a multiattack the
-		// remaining swings resolve normally — a single proc shouldn't nullify a
-		// boss's whole multiattack round. (This deliberately diverges from the
-		// auto-resolve engine's apply-to-all model.)
-		petWhiff := te.st.c.Mods.PetWhiffProc > 0 && te.st.randFloat() < te.st.c.Mods.PetWhiffProc
-		petDeflect := te.st.c.Mods.PetDeflectProc > 0 && te.st.randFloat() < te.st.c.Mods.PetDeflectProc
-		if petDeflect {
-			te.result.PetDeflected = true
-		}
-
-		// SRD multiattack: each profile entry is one attack roll resolved
-		// through the shared primitive. A registered elite/boss swings its full
-		// profile; everyone else gets a single attack from the template stats.
-		// resolveEnemyAttack returns true when the fight is decided — either the
-		// player went down without a death save, or a reflect consumable killed
-		// the enemy. Disambiguate by inspecting HP.
-		for i, atk := range enemyAttackProfile(te.sess.EnemyID, te.enemy.Stats) {
-			swing := *te.enemy
-			swing.Stats.Attack = atk.Damage
-			swing.Stats.AttackBonus = atk.AttackBonus
-			// Spend the proc on the first swing only; later swings see false.
-			swingWhiff := petWhiff && i == 0
-			swingDeflect := petDeflect && i == 0
-			decided := resolveEnemyAttack(te.st, te.st.c, &swing, &turnCombatPhase, te.result, swingWhiff, swingDeflect, false)
-			if te.st.playerHP <= 0 {
-				// The target is down. The enemy stops swinging at a corpse; the
-				// fight ends only if the roster is empty.
-				if !te.st.anyAlive() {
-					te.finish(CombatStatusLost)
-					return
-				}
-				break
-			}
-			if decided || te.st.enemyHP <= 0 {
-				te.finish(CombatStatusWon)
+	// The enemy takes enemyActionsThisRound() attack-actions, each its full
+	// SRD multiattack, re-targeting a fresh standing seat per action so a party's
+	// damage is spread across the roster rather than pinning the first target.
+	// A solo roster is exactly one action against its one seat — no re-target is
+	// drawn — so its event stream and RNG draws are unchanged. When the ability
+	// already dealt damage it was the first action, so one fewer follows; for solo
+	// that collapses to the old "the ability stood in for the attack" skip.
+	actions, reuseFirstTarget := enemyActionPlan(te.st, abilityDealtDamage)
+	for a := 0; a < actions; a++ {
+		if !(reuseFirstTarget && a == 0) {
+			tgt, alive := te.enemyTarget()
+			if !alive {
+				te.finish(CombatStatusLost)
 				return
 			}
+			te.st.seat(tgt)
+			target = tgt
+		}
+		if te.enemyAttackAction(target) {
+			return
 		}
 	}
 	te.advance()
 }
 
+// enemyAttackAction resolves one enemy attack-action — the full SRD multiattack
+// profile — against the seat the cursor already points at, and stamps every event
+// it emits to that seat (the party's enemy re-targets across the roster within one
+// turn, so the whole-turn blanket stamp in step() no longer holds). Registered
+// elites/bosses swing their full profile; everyone else gets a single attack from
+// the template stats.
+//
+// Returns true only when it decided the fight (te.finish has already been called),
+// so the caller ends the enemy turn. It returns false when the target dropped but
+// the roster is still alive — this action is over, and the caller re-targets the
+// next one.
+func (te *turnEngine) enemyAttackAction(seat int) (finished bool) {
+	mark := len(te.st.events)
+	// Pet defensive procs are a single proc per attack-action: roll once, then
+	// spend on the first swing only. Whiff makes that one swing a guaranteed miss;
+	// deflect halves its damage. Against a multiattack the remaining swings resolve
+	// normally — a single proc shouldn't nullify a boss's whole multiattack.
+	// (This deliberately diverges from the auto-resolve engine's apply-to-all.)
+	petWhiff := te.st.c.Mods.PetWhiffProc > 0 && te.st.randFloat() < te.st.c.Mods.PetWhiffProc
+	petDeflect := te.st.c.Mods.PetDeflectProc > 0 && te.st.randFloat() < te.st.c.Mods.PetDeflectProc
+	if petDeflect {
+		te.result.PetDeflected = true
+	}
+
+	for i, atk := range enemyAttackProfile(te.sess.EnemyID, te.enemy.Stats) {
+		swing := *te.enemy
+		swing.Stats.Attack = atk.Damage
+		swing.Stats.AttackBonus = atk.AttackBonus
+		swingWhiff := petWhiff && i == 0
+		swingDeflect := petDeflect && i == 0
+		decided := resolveEnemyAttack(te.st, te.st.c, &swing, &turnCombatPhase, te.result, swingWhiff, swingDeflect, false)
+		if te.st.playerHP <= 0 {
+			te.stampSeat(mark, seat)
+			// The target is down. The enemy stops swinging at a corpse; the fight
+			// ends only if the roster is empty, otherwise this action is over and
+			// the caller re-targets.
+			if !te.st.anyAlive() {
+				te.finish(CombatStatusLost)
+				return true
+			}
+			return false
+		}
+		if decided || te.st.enemyHP <= 0 {
+			te.stampSeat(mark, seat)
+			te.finish(CombatStatusWon)
+			return true
+		}
+	}
+	te.stampSeat(mark, seat)
+	return false
+}
+
 // turnAbilityFires decides whether a monster ability triggers this enemy turn.
 // The auto-resolve engine gates abilities on its named phase clock (Opening /
 // Clash / Decisive); the turn-based duel has no phase clock, so the phase tag
@@ -756,7 +827,9 @@ func (te *turnEngine) stepRoundEnd() {
 	// Concentration aura (Spirit Guardians et al.): the lingering spell bites
 	// the enemy each round it stays up. Concentration is per-caster, so every
 	// seat holding one pulses. Ticks before enemy regen so a lethal pulse
-	// settles the fight before the enemy knits its wounds back.
+	// settles the fight before the enemy knits its wounds back — and before
+	// Misty's crowd swings, so a caster whose aura would end the round is not
+	// robbed of the win by an end-of-round debuff.
 	for i := range st.actors {
 		st.seat(i)
 		if st.concentrationDmg <= 0 || st.enemyHP <= 0 || st.playerHP <= 0 {
@@ -772,6 +845,24 @@ func (te *turnEngine) stepRoundEnd() {
 			return
 		}
 	}
+	// Misty's crowd, then Misty's heal — per seat, after the round's other
+	// damage (including the concentration pulse above) has landed so the heal
+	// can answer it, which is the order endOfRoundForSeat uses. Both no-op (and
+	// draw no RNG) for a character with no Misty history, which is every
+	// simulated one.
+	for i := range st.actors {
+		st.seat(i)
+		if st.playerHP <= 0 {
+			continue
+		}
+		mark := len(st.events)
+		over := seatEndOfRound(st, st.c, CombatPhaseRoundEnd, te.result)
+		te.stampSeat(mark, i)
+		if over {
+			te.finish(CombatStatusLost)
+			return
+		}
+	}
 	st.seat(0)
 	// Regenerate (monster ability): the enemy knits its wounds at round end.
 	if st.enemyRegen > 0 && st.enemyHP > 0 && st.enemyHP < te.enemy.Stats.MaxHP {

internal/plugin/dnd.go

@@ -332,8 +332,22 @@ func LoadDnDCharacter(userID id.UserID) (*DnDCharacter, error) {
 	return c, nil
 }
 
+// sqlExecer is the subset of *sql.DB / *sql.Tx that saveDnDCharacterExec needs,
+// so the upsert can run either standalone or inside a caller's transaction.
+type sqlExecer interface {
+	Exec(query string, args ...any) (sql.Result, error)
+}
+
 // SaveDnDCharacter upserts the row.
 func SaveDnDCharacter(c *DnDCharacter) error {
+	return saveDnDCharacterExec(db.Get(), c)
+}
+
+// saveDnDCharacterExec runs the dnd_character upsert against any executor. Used
+// directly by SaveDnDCharacter and inside grantDnDXP's overflow→renown
+// transaction (adventure_renown.go), so the character save and the renown
+// credit commit atomically.
+func saveDnDCharacterExec(ex sqlExecer, c *DnDCharacter) error {
 	pending := 0
 	if c.PendingSetup {
 		pending = 1
@@ -346,7 +360,7 @@ func SaveDnDCharacter(c *DnDCharacter) error {
 	if c.OnboardingSent {
 		onboard = 1
 	}
-	_, err := db.Get().Exec(`
+	_, err := ex.Exec(`
 		INSERT INTO dnd_character (user_id, race, class, dnd_level, dnd_xp,
 		    str_score, dex_score, con_score, int_score, wis_score, cha_score,
 		    hp_current, hp_max, temp_hp, armor_class,

internal/plugin/dnd_abilities.go

@@ -410,22 +410,52 @@ func trySimAutoArm(c *DnDCharacter) string {
 	return ab.Name
 }
 
-// applyArmedAbility checks for a pre-armed ability on the character and
-// applies its effect to the player's CombatModifiers, then clears the armed
-// flag. Called from combat_bridge.go before SimulateCombat.
-func applyArmedAbility(c *DnDCharacter, mods *CombatModifiers) (string, bool) {
+// consumeArmedAbility disarms the character, returning the ability id that was
+// armed. It is the *mutating* half of arming: the flag is cleared and saved, so
+// it must run exactly once per fight, at fight start.
+//
+// It is split from applyAbilityByID because a turn-based fight rebuilds its
+// combatants from the DB on every player command. A rebuild that consumed would
+// fire the ability on round 1, clear the flag, and then hand every later round a
+// character with no ability at all — the player pays the resource for one round
+// of a buff that is supposed to span the fight. So the fight consumes once and
+// persists the id on the session; each rebuild re-applies it from there.
+//
+// An id that is no longer in the ability table is disarmed and reported as "".
+func consumeArmedAbility(c *DnDCharacter) string {
 	if c == nil || c.ArmedAbility == "" {
+		return ""
+	}
+	armed := c.ArmedAbility
+	c.ArmedAbility = ""
+	_ = SaveDnDCharacter(c)
+	if _, ok := dndActiveAbilities[armed]; !ok {
+		return ""
+	}
+	return armed
+}
+
+// applyAbilityByID folds an ability's effect into a freshly-derived set of
+// CombatModifiers. It is pure with respect to persistence — no DB write, no
+// disarm — so it is safe to call on every rebuild of an in-flight fight.
+//
+// abilityID is what consumeArmedAbility returned at fight start. Empty (nobody
+// armed anything) and unknown ids are both no-ops.
+func applyAbilityByID(c *DnDCharacter, abilityID string, mods *CombatModifiers) (string, bool) {
+	if c == nil || abilityID == "" {
 		return "", false
 	}
-	ab, ok := dndActiveAbilities[c.ArmedAbility]
+	ab, ok := dndActiveAbilities[abilityID]
 	if !ok {
-		c.ArmedAbility = ""
-		_ = SaveDnDCharacter(c)
 		return "", false
 	}
 	ab.Apply(c, mods)
-	firedName := ab.Name
-	c.ArmedAbility = ""
-	_ = SaveDnDCharacter(c)
-	return firedName, true
+	return ab.Name, true
+}
+
+// armAbilityForFight consumes whatever the character armed and applies it in one
+// step, for the auto-resolve callers that build a combatant and immediately
+// fight with it. A turn-based fight must not use this — see consumeArmedAbility.
+func armAbilityForFight(c *DnDCharacter, mods *CombatModifiers) (string, bool) {
+	return applyAbilityByID(c, consumeArmedAbility(c), mods)
 }

internal/plugin/dnd_abilities_test.go

@@ -146,7 +146,7 @@ func TestSpendAndRefreshResource(t *testing.T) {
 	}
 }
 
-func TestApplyArmedAbility_FighterSecondWind(t *testing.T) {
+func TestArmAbilityForFight_FighterSecondWind(t *testing.T) {
 	setupAbilitiesTestDB(t)
 	uid := id.UserID("@arm_fighter:example")
 	c := &DnDCharacter{
@@ -162,7 +162,7 @@ func TestApplyArmedAbility_FighterSecondWind(t *testing.T) {
 	}
 
 	mods := CombatModifiers{}
-	name, fired := applyArmedAbility(c, &mods)
+	name, fired := armAbilityForFight(c, &mods)
 	if !fired {
 		t.Fatal("ability did not fire")
 	}
@@ -181,7 +181,7 @@ func TestApplyArmedAbility_FighterSecondWind(t *testing.T) {
 	}
 }
 
-func TestApplyArmedAbility_MageMagicMissile(t *testing.T) {
+func TestArmAbilityForFight_MageMagicMissile(t *testing.T) {
 	setupAbilitiesTestDB(t)
 	uid := id.UserID("@arm_mage:example")
 	c := &DnDCharacter{
@@ -192,7 +192,7 @@ func TestApplyArmedAbility_MageMagicMissile(t *testing.T) {
 		t.Fatal(err)
 	}
 	mods := CombatModifiers{}
-	_, fired := applyArmedAbility(c, &mods)
+	_, fired := armAbilityForFight(c, &mods)
 	if !fired {
 		t.Fatal("magic missile did not fire")
 	}
@@ -202,10 +202,10 @@ func TestApplyArmedAbility_MageMagicMissile(t *testing.T) {
 	}
 }
 
-func TestApplyArmedAbility_NoArm(t *testing.T) {
+func TestArmAbilityForFight_NoArm(t *testing.T) {
 	c := &DnDCharacter{Class: ClassFighter, ArmedAbility: ""}
 	mods := CombatModifiers{}
-	_, fired := applyArmedAbility(c, &mods)
+	_, fired := armAbilityForFight(c, &mods)
 	if fired {
 		t.Error("fired with no armed ability")
 	}

internal/plugin/dnd_cast.go

@@ -1,7 +1,9 @@
 package plugin
 
 import (
+	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"math/rand/v2"
@@ -27,9 +29,11 @@ import (
 //   - Reaction spells (Shield, Counterspell, Absorb Elements) refuse with
 //     a "Phase 11" note — they require the boss turn-based engine.
 //
-// Cross-player targeting (--target @user) is deliberately deferred. SP2
-// supports self-target only. Heals on self work; ally buffs queue with the
-// caster as the target until SP3 wires up the multi-player resolution.
+// Cross-player targeting (`--target @user`, or a trailing `@user`) heals a human
+// on your expedition — see dnd_cast_target.go. Only heals may name somebody else
+// out of combat: UTILITY resolves on the caster, and everything else queues as a
+// PendingCast for the *caster's* next fight, where an ally target has nothing to
+// mean. In-combat targeting is splitCastTarget (combat_cmd.go).
 
 // PendingCast is the shape stored in dnd_character.pending_cast (JSON blob).
 // Keep this minimal — the combat layer resolves the actual numbers on fire.
@@ -97,6 +101,13 @@ func (p *AdventurePlugin) handleDnDCastCmd(ctx MessageContext, args string) erro
 		return p.dndCastDrop(ctx, c)
 	}
 
+	// An ally target — `--target @alex`, or a trailing `@alex` — comes off the
+	// string before the spell parser sees it, exactly as in combat. It is
+	// resolved (and refused) further down, once we know the spell is a heal: a
+	// target on anything else is a mistake, and refusing it early would cost us
+	// the "which spell?" half of the error message.
+	args, targetName := splitOutOfCombatTarget(args)
+
 	// Parse spell name + optional --upcast N.
 	tokens := strings.Fields(args)
 	upcast := 0
@@ -111,11 +122,6 @@ func (p *AdventurePlugin) handleDnDCastCmd(ctx MessageContext, args string) erro
 				}
 				i++
 			}
-		case "--target":
-			// Reserved for SP3 — accept and ignore for now.
-			if i+1 < len(tokens) {
-				i++
-			}
 		default:
 			spellTokens = append(spellTokens, tokens[i])
 		}
@@ -195,6 +201,23 @@ func (p *AdventurePlugin) handleDnDCastCmd(ctx MessageContext, args string) erro
 		}
 	}
 
+	// Resolve an ally target now — BEFORE anything is spent. Out of combat only a
+	// heal can land on somebody else: UTILITY resolves on the caster and
+	// everything else queues as a PendingCast for *this* caster's next fight, so
+	// a target on those would be accepted and then silently dropped.
+	var targetUser id.UserID
+	if targetName != "" {
+		if spell.Effect != EffectSpellHeal {
+			return p.SendDM(ctx.Sender, fmt.Sprintf(
+				"%s isn't a healing spell — outside a fight you can only cast those on someone else. Drop the target to cast it on yourself.", spell.Name))
+		}
+		uid, errMsg := resolveCastTargetOnExpedition(ctx.Sender, targetName)
+		if errMsg != "" {
+			return p.SendDM(ctx.Sender, errMsg)
+		}
+		targetUser = uid // empty when they named themselves — self-heal as usual
+	}
+
 	// Material cost (Revivify, Raise Dead).
 	if spell.MaterialCost > 0 {
 		if p.euro == nil || !p.euro.Debit(ctx.Sender, float64(spell.MaterialCost), "dnd_spell_component") {
@@ -220,6 +243,9 @@ func (p *AdventurePlugin) handleDnDCastCmd(ctx MessageContext, args string) erro
 	// debited above; if SaveDnDCharacter fails we refund.
 	switch spell.Effect {
 	case EffectSpellHeal:
+		if targetUser != "" {
+			return p.resolveAllyHealOutOfCombat(ctx, c, targetUser, spell, slotLevel)
+		}
 		return p.resolveHealOutOfCombat(ctx, c, spell, slotLevel)
 	case EffectUtility:
 		return p.resolveUtility(ctx, c, spell, slotLevel)
@@ -231,7 +257,10 @@ func (p *AdventurePlugin) handleDnDCastCmd(ctx MessageContext, args string) erro
 
 // ── Out-of-combat: HEAL ──────────────────────────────────────────────────────
 
-func (p *AdventurePlugin) resolveHealOutOfCombat(ctx MessageContext, c *DnDCharacter, spell SpellDefinition, slotLevel int) error {
+// rollOutOfCombatHeal is what the spell is worth in the caster's hands. It is a
+// property of the caster (their WIS, their domain), never of the body it lands
+// on, so an ally heal rolls exactly the same as a self-heal.
+func rollOutOfCombatHeal(c *DnDCharacter, spell SpellDefinition, slotLevel int) int {
 	dice, faces, _ := parseDamageDice(spell.DamageDice)
 	if dice == 0 {
 		dice, faces = 1, 8 // safety fallback
@@ -253,6 +282,11 @@ func (p *AdventurePlugin) resolveHealOutOfCombat(ctx MessageContext, c *DnDChara
 	}
 	heal += abilityModifier(c.WIS)
 	heal += lifeDomainHealBonus(c, spell, slotLevel)
+	return heal
+}
+
+func (p *AdventurePlugin) resolveHealOutOfCombat(ctx MessageContext, c *DnDCharacter, spell SpellDefinition, slotLevel int) error {
+	heal := rollOutOfCombatHeal(c, spell, slotLevel)
 
 	before := c.HPCurrent
 	c.HPCurrent = min(c.HPMax, c.HPCurrent+heal)
@@ -272,6 +306,51 @@ func (p *AdventurePlugin) resolveHealOutOfCombat(ctx MessageContext, c *DnDChara
 		renderSlotsBrief(ctx.Sender)))
 }
 
+// resolveAllyHealOutOfCombat puts the heal on somebody else's sheet. The slot is
+// already spent, so every failure below refunds it: a heal that lands on nobody
+// must not cost the caster anything.
+func (p *AdventurePlugin) resolveAllyHealOutOfCombat(ctx MessageContext, c *DnDCharacter, target id.UserID, spell SpellDefinition, slotLevel int) error {
+	refund := func(msg string) error {
+		if spell.Level > 0 {
+			_ = refundSpellSlot(ctx.Sender, slotLevel)
+		}
+		return p.SendDM(ctx.Sender, msg)
+	}
+
+	heal := rollOutOfCombatHeal(c, spell, slotLevel)
+	before, after, maxHP, err := healPartyMember(target, heal)
+
+	targetName := charName(target)
+	if targetName == "" {
+		targetName = target.Localpart()
+	}
+	casterName := charName(ctx.Sender)
+	if casterName == "" {
+		casterName = ctx.Sender.Localpart()
+	}
+
+	switch {
+	case errors.Is(err, errHealTargetFull):
+		return refund(fmt.Sprintf("**%s** is already at full health (%d/%d). Slot kept.", targetName, before, maxHP))
+	case errors.Is(err, errHealTargetDown):
+		// The same rule the combat path holds: a heal is not a resurrection.
+		return refund(fmt.Sprintf("**%s** is down — a heal won't bring them back. Slot kept.", targetName))
+	case errors.Is(err, sql.ErrNoRows):
+		return refund(fmt.Sprintf("**%s** hasn't run `!setup` yet, so there's no sheet to heal.", targetName))
+	case err != nil:
+		return refund("Couldn't apply the heal: " + err.Error())
+	}
+
+	_ = p.SendDM(target, fmt.Sprintf(
+		"🩹 **%s** casts **%s** on you — %d HP back (%d → %d / %d).",
+		casterName, spell.Name, after-before, before, after, maxHP))
+
+	return p.SendDM(ctx.Sender, fmt.Sprintf(
+		"🩹 **%s** on **%s** — restored %d HP (%d → %d / %d). %s",
+		spell.Name, targetName, after-before, before, after, maxHP,
+		renderSlotsBrief(ctx.Sender)))
+}
+
 // ── Out-of-combat: UTILITY ──────────────────────────────────────────────────
 
 func (p *AdventurePlugin) resolveUtility(ctx MessageContext, c *DnDCharacter, spell SpellDefinition, slotLevel int) error {
@@ -676,6 +755,7 @@ func renderCastHelp(c *DnDCharacter) string {
 	var b strings.Builder
 	b.WriteString("**Cast a spell**\n\n")
 	b.WriteString("Usage: `!cast <spell> [--upcast N]`\n")
+	b.WriteString("       `!cast <heal> @friend` to heal someone on your expedition.\n")
 	b.WriteString("       `!cast --drop` to clear queued/concentration.\n\n")
 	b.WriteString("Run `!spells` for your full list.\n\n")
 	if pc, ok := decodePendingCast(c.PendingCast); ok {

internal/plugin/dnd_cast_ally_e2e_test.go

@@ -0,0 +1,139 @@
+package plugin
+
+import (
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The whole `!cast cure wounds @friend` path, out of combat, through the real
+// handler: parse → class/known/prepared gates → slot debit → the ally's sheet.
+//
+// The seams are unit-tested next door; this exists for the one thing they cannot
+// see — that the slot ledger and the HP write agree about whether the heal
+// happened. A refund that does not fire is a slot a player paid for nothing, and
+// a refund that fires twice is a free heal.
+
+// castingCleric turns an existing sheet into a cleric who knows and has prepared
+// Cure Wounds, with slots to spend.
+func castingCleric(t *testing.T, uid id.UserID) {
+	t.Helper()
+	c, err := LoadDnDCharacter(uid)
+	if err != nil || c == nil {
+		t.Fatalf("load %s: %v", uid, err)
+	}
+	c.Class = ClassCleric
+	c.Level = 5
+	c.WIS = 16
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+	if err := setSpellSlotsForCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+	if err := addKnownSpell(uid, "cure_wounds", "class", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := setSpellPrepared(uid, "cure_wounds", true); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func slotsUsed(t *testing.T, uid id.UserID, level int) int {
+	t.Helper()
+	slots, err := getSpellSlots(uid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return slots[level][1]
+}
+
+func setCharHP(t *testing.T, uid id.UserID, hp int) {
+	t.Helper()
+	c, err := LoadDnDCharacter(uid)
+	if err != nil || c == nil {
+		t.Fatalf("load %s: %v", uid, err)
+	}
+	c.HPCurrent = hp
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCastAlly_OutOfCombat_HealsTheFriendAndSpendsOneSlot(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, member := seatedMember(t, "e2eheal")
+	castingCleric(t, leader)
+	setCharHP(t, member, 5) // of 20
+
+	p := &AdventurePlugin{}
+	if err := p.handleDnDCastCmd(MessageContext{Sender: leader}, "cure wounds @"+member.Localpart()); err != nil {
+		t.Fatalf("cast: %v", err)
+	}
+
+	mc, _ := LoadDnDCharacter(member)
+	if mc.HPCurrent <= 5 {
+		t.Fatalf("the friend is still on %d HP; the heal landed on nobody", mc.HPCurrent)
+	}
+	// The caster must NOT have healed themselves — the bug this whole section exists for.
+	if lc, _ := LoadDnDCharacter(leader); lc.HPCurrent != lc.HPMax {
+		t.Fatalf("caster HP moved to %d/%d; the heal landed on the caster", lc.HPCurrent, lc.HPMax)
+	}
+	if used := slotsUsed(t, leader, 1); used != 1 {
+		t.Fatalf("level-1 slots used = %d, want exactly 1", used)
+	}
+}
+
+// Naming a full-HP ally must cost nothing: the slot is debited before the target
+// is touched, so this is the refund path firing for real.
+func TestCastAlly_OutOfCombat_FullHPAllyRefundsTheSlot(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, member := seatedMember(t, "e2efull")
+	castingCleric(t, leader)
+
+	p := &AdventurePlugin{}
+	if err := p.handleDnDCastCmd(MessageContext{Sender: leader}, "cure wounds @"+member.Localpart()); err != nil {
+		t.Fatalf("cast: %v", err)
+	}
+	if used := slotsUsed(t, leader, 1); used != 0 {
+		t.Fatalf("level-1 slots used = %d after healing a full-HP ally; the slot was not refunded", used)
+	}
+}
+
+// A target nobody can reach is refused before anything is spent.
+func TestCastAlly_OutOfCombat_StrangerCostsNothing(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, _ := seatedMember(t, "e2estranger")
+	castingCleric(t, leader)
+
+	p := &AdventurePlugin{}
+	if err := p.handleDnDCastCmd(MessageContext{Sender: leader}, "cure wounds @nobody"); err != nil {
+		t.Fatalf("cast: %v", err)
+	}
+	if used := slotsUsed(t, leader, 1); used != 0 {
+		t.Fatalf("level-1 slots used = %d after naming a stranger; nothing should have been spent", used)
+	}
+}
+
+// A target on a spell that cannot use one is refused, rather than quietly
+// dropping the target and firing the spell at the caster — which is what the old
+// "accept and ignore" parse did.
+func TestCastAlly_OutOfCombat_TargetOnANonHealIsRefused(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, member := seatedMember(t, "e2enonheal")
+	castingCleric(t, leader)
+	if err := addKnownSpell(leader, "guiding_bolt", "class", true); err != nil {
+		t.Fatal(err)
+	}
+
+	p := &AdventurePlugin{}
+	if err := p.handleDnDCastCmd(MessageContext{Sender: leader}, "guiding bolt @"+member.Localpart()); err != nil {
+		t.Fatalf("cast: %v", err)
+	}
+	if used := slotsUsed(t, leader, 1); used != 0 {
+		t.Fatalf("level-1 slots used = %d; a targeted non-heal must be refused before it is paid for", used)
+	}
+	if lc, _ := LoadDnDCharacter(leader); lc.PendingCast != "" {
+		t.Fatalf("guiding bolt queued as %q; the target should have refused the cast outright", lc.PendingCast)
+	}
+}

internal/plugin/dnd_cast_target.go

@@ -0,0 +1,156 @@
+package plugin
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Out-of-combat ally targeting for `!cast` — the other half of §1.
+//
+// splitCastTarget (combat_cmd.go) resolves a target against the people *in the
+// fight*. Out of combat there is no fight, so the equivalent set is the people
+// on your expedition: the party is who you are standing next to. Healing a
+// stranger across the world is not a thing a cleric at camp can do, and scoping
+// it to the party keeps the two `!cast` paths answering the same question.
+//
+// Only heals may name somebody else. Everything else `!cast` can do out of
+// combat either resolves on the caster (UTILITY) or queues as a PendingCast for
+// **the caster's** next fight — an ally target on those would be silently
+// dropped, which is how `--target` came to be swallowed in the first place.
+
+// splitOutOfCombatTarget peels an ally target off a `!cast` argument, using the
+// same two spellings the combat path accepts: the `--target @alex` flag, and a
+// plain trailing `@alex`. The bare form requires the `@` here (unlike in combat,
+// where the roster disambiguates) so a trailing spell word is never mistaken for
+// a name.
+//
+// Returns (remainingArgs, name). name is empty when no target was named.
+func splitOutOfCombatTarget(args string) (string, string) {
+	fields := strings.Fields(args)
+	for i := 0; i < len(fields); i++ {
+		if !strings.EqualFold(fields[i], "--target") {
+			continue
+		}
+		if i+1 >= len(fields) {
+			return args, ""
+		}
+		name := strings.TrimPrefix(fields[i+1], "@")
+		fields = append(fields[:i], fields[i+2:]...)
+		return strings.Join(fields, " "), name
+	}
+	if len(fields) == 0 {
+		return args, ""
+	}
+	if last := fields[len(fields)-1]; strings.HasPrefix(last, "@") {
+		if name := strings.TrimPrefix(last, "@"); name != "" {
+			return strings.Join(fields[:len(fields)-1], " "), name
+		}
+	}
+	return args, ""
+}
+
+// resolveCastTargetOnExpedition maps a named target to a human on the caster's
+// active expedition. errMsg is non-empty and player-facing on any failure; a
+// caster who names somebody must never fall through to healing themselves,
+// because that quietly burns the slot on the wrong body.
+func resolveCastTargetOnExpedition(caster id.UserID, name string) (id.UserID, string) {
+	exp, _, err := activeExpeditionFor(caster)
+	if err != nil {
+		return "", "Couldn't look up your expedition."
+	}
+	if exp == nil {
+		return "", "You're not travelling with anyone. `!cast` on yourself, or join a party first."
+	}
+	seats, err := partyHumans(exp.ID, exp.UserID)
+	if err != nil {
+		return "", "Couldn't look up your party."
+	}
+	for _, s := range seats {
+		uid := string(s.UserID)
+		if strings.EqualFold(uid, name) || strings.EqualFold(id.UserID(uid).Localpart(), name) {
+			if s.UserID == caster {
+				// Naming yourself is just casting it on yourself.
+				return "", ""
+			}
+			return s.UserID, ""
+		}
+		// Character name, which is what players actually call each other.
+		if n := charName(s.UserID); n != "" && strings.EqualFold(n, name) {
+			if s.UserID == caster {
+				return "", ""
+			}
+			return s.UserID, ""
+		}
+	}
+	if strings.EqualFold(name, companionDisplayName) {
+		return "", companionDisplayName + " patches himself up at camp. Save the slot."
+	}
+	return "", fmt.Sprintf("**%s** isn't on your expedition. You can only heal someone you're travelling with.", name)
+}
+
+// errHealTargetFull / errHealTargetDown are the two ways an ally heal declines
+// to spend the slot. Both are recoverable: the caller refunds.
+var (
+	errHealTargetFull = errors.New("target already at full HP")
+	errHealTargetDown = errors.New("target is down")
+)
+
+// healPartyMember applies a heal to somebody else's sheet.
+//
+// It does NOT take the target's advUserLock. Gifting sets the precedent
+// (adventure_gifting.go): mutate the other player's row with one guarded
+// statement rather than a read-modify-write under two locks. Two clerics healing
+// each other at the same instant would otherwise take those locks in opposite
+// orders and deadlock the pair of them.
+//
+// The clamp lives in SQL for the same reason — read, add, cap and write are one
+// statement, so a heal landing between a concurrent heal's read and write cannot
+// push anybody past their maximum.
+func healPartyMember(target id.UserID, amount int) (before, after, maxHP int, err error) {
+	tx, err := db.Get().Begin()
+	if err != nil {
+		return 0, 0, 0, err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	err = tx.QueryRow(
+		`SELECT hp_current, hp_max FROM dnd_character WHERE user_id = ?`,
+		string(target)).Scan(&before, &maxHP)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, 0, 0, sql.ErrNoRows
+	}
+	if err != nil {
+		return 0, 0, 0, err
+	}
+	switch {
+	case before <= 0:
+		// A heal is not a resurrection — the same rule the combat path holds.
+		return before, before, maxHP, errHealTargetDown
+	case before >= maxHP:
+		return before, before, maxHP, errHealTargetFull
+	}
+
+	if _, err = tx.Exec(
+		`UPDATE dnd_character
+		    SET hp_current = MIN(hp_max, hp_current + ?),
+		        updated_at = CURRENT_TIMESTAMP
+		  WHERE user_id = ? AND hp_current > 0`,
+		amount, string(target)); err != nil {
+		return before, before, maxHP, err
+	}
+	if err = tx.QueryRow(
+		`SELECT hp_current FROM dnd_character WHERE user_id = ?`,
+		string(target)).Scan(&after); err != nil {
+		return before, before, maxHP, err
+	}
+	if err = tx.Commit(); err != nil {
+		return before, before, maxHP, err
+	}
+	return before, after, maxHP, nil
+}

internal/plugin/dnd_cast_target_test.go

@@ -0,0 +1,102 @@
+package plugin
+
+import (
+	"errors"
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The out-of-combat half of §1. `--target` was parsed and thrown away here since
+// SP2 ("reserved for SP3, accept and ignore"), so a party cleric standing over a
+// bleeding friend between fights could do precisely nothing for them.
+
+func TestSplitOutOfCombatTarget(t *testing.T) {
+	cases := []struct {
+		name, args, wantRest, wantTarget string
+	}{
+		{"flag", "cure wounds --target @alex", "cure wounds", "alex"},
+		{"flag mid-string", "cure wounds --target @alex --upcast 3", "cure wounds --upcast 3", "alex"},
+		{"flag without the @", "cure wounds --target alex", "cure wounds", "alex"},
+		{"trailing mention", "cure wounds @alex", "cure wounds", "alex"},
+		{"no target", "cure wounds", "cure wounds", ""},
+		// A trailing bare word is a spell word, not a name — the `@` is what makes
+		// it a target out of combat. Getting this wrong eats half of "cure wounds".
+		{"bare trailing word is not a target", "healing word", "healing word", ""},
+		{"upcast digit is not a target", "cure wounds --upcast 3", "cure wounds --upcast 3", ""},
+		{"dangling flag", "cure wounds --target", "cure wounds --target", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rest, target := splitOutOfCombatTarget(tc.args)
+			if rest != tc.wantRest || target != tc.wantTarget {
+				t.Fatalf("splitOutOfCombatTarget(%q) = (%q, %q), want (%q, %q)",
+					tc.args, rest, target, tc.wantRest, tc.wantTarget)
+			}
+		})
+	}
+}
+
+// The target set is the expedition, not the world: you can heal the person you
+// are travelling with, and nobody else.
+func TestResolveCastTarget_OnlyThePartyIsReachable(t *testing.T) {
+	setupEmptyTestDB(t)
+	leader, member := seatedMember(t, "casttarget")
+
+	uid, errMsg := resolveCastTargetOnExpedition(leader, member.Localpart())
+	if errMsg != "" || uid != member {
+		t.Fatalf("leader → member = (%q, %q); want the member, no error", uid, errMsg)
+	}
+
+	// Somebody with a sheet, but not on this expedition.
+	stranger := id.UserID("@stranger-casttarget:example.org")
+	zoneCmdTestCharacter(t, stranger, 1)
+	if _, errMsg := resolveCastTargetOnExpedition(leader, stranger.Localpart()); errMsg == "" {
+		t.Fatal("healed a stranger across the world; only the party is reachable")
+	}
+
+	// Naming yourself is just casting it on yourself: no target, no error. A
+	// refusal here would make `!cast cure wounds @me` cost a slot for nothing.
+	if uid, errMsg := resolveCastTargetOnExpedition(leader, leader.Localpart()); uid != "" || errMsg != "" {
+		t.Fatalf("self-target = (%q, %q); want the self-heal path, silently", uid, errMsg)
+	}
+}
+
+func TestHealPartyMember_ClampsAtMaxAndWillNotRaiseTheDead(t *testing.T) {
+	setupEmptyTestDB(t)
+	target := id.UserID("@heal-target:example.org")
+	zoneCmdTestCharacter(t, target, 1) // HPMax 20
+
+	setHP := func(hp int) {
+		c, err := LoadDnDCharacter(target)
+		if err != nil || c == nil {
+			t.Fatalf("load: %v", err)
+		}
+		c.HPCurrent = hp
+		if err := SaveDnDCharacter(c); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// A heal bigger than the wound tops out at max rather than overflowing.
+	setHP(15)
+	before, after, maxHP, err := healPartyMember(target, 100)
+	if err != nil || before != 15 || after != 20 || maxHP != 20 {
+		t.Fatalf("overheal = (%d → %d / %d, %v); want clamped to 20", before, after, maxHP, err)
+	}
+
+	// Already full: decline so the caller can refund. Spending a slot to heal
+	// zero HP is the kind of thing players never forgive.
+	if _, _, _, err := healPartyMember(target, 10); !errors.Is(err, errHealTargetFull) {
+		t.Fatalf("healing a full-HP ally = %v; want errHealTargetFull", err)
+	}
+
+	// Down: a heal is not a resurrection. Same rule the combat path holds.
+	setHP(0)
+	if _, _, _, err := healPartyMember(target, 10); !errors.Is(err, errHealTargetDown) {
+		t.Fatalf("healing a downed ally = %v; want errHealTargetDown", err)
+	}
+	if c, _ := LoadDnDCharacter(target); c == nil || c.HPCurrent != 0 {
+		t.Fatal("the downed ally was raised by a heal")
+	}
+}

internal/plugin/dnd_class_balance.go

@@ -25,7 +25,7 @@ import (
 //
 // Bypassed deliberately (Phase 0 simplifying constraints, doc §2):
 //
-//   - DB-touching layers: applyMagicItemEffects, applyArmedAbility, and
+//   - DB-touching layers: applyMagicItemEffects, armAbilityForFight, and
 //     the SaveDnDCharacter inside applyPendingCast. The harness is pure
 //     Go; tests run without a sqlite instance.
 //   - Race passives beyond Human (+1 all): neutral baseline, again per §2.

internal/plugin/dnd_combat.go

@@ -1,10 +1,12 @@
 package plugin
 
 import (
+	"fmt"
 	"log/slog"
 	"time"
 
 	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
 	"maunium.net/go/mautrix/id"
 )
 
@@ -305,6 +307,13 @@ func ensureDnDCharacterForCombat(userID id.UserID, char *AdventureCharacter) (*D
 	c := autoBuildCharacter(userID, char)
 	c.AutoMigrated = true
 	c.PendingSetup = false
+	// Seed the canonical player_meta row before handing back a confirmed
+	// character. Auto-migration otherwise mints a player_meta-less character
+	// (the camcast straggler) that fails every legacy-layer command with
+	// "sql: no rows". No-op for legacy players who already have the row.
+	if err := ensurePlayerMetaSeed(userID); err != nil {
+		return nil, false, fmt.Errorf("seed player_meta: %w", err)
+	}
 	if err := SaveDnDCharacter(c); err != nil {
 		return nil, false, err
 	}
@@ -481,10 +490,23 @@ func formatN(n int, word string) string {
 // wound layered with the fresh equipment cushion. There is no scale
 // conversion; persistDnDHPAfterCombat is the inverse direct copy.
 func applyDnDHPScaling(stats *CombatStats, c *DnDCharacter) {
-	if c == nil || c.HPMax <= 0 || c.HPCurrent >= c.HPMax {
+	if c == nil || c.HPMax <= 0 {
 		return
 	}
-	startHP := c.HPCurrent + stats.HPBonus
+	// Well-rested temporary HP (from a long rest at a T2+ home) is a cushion
+	// layered above the fight's MaxHP. It is dormant (0) for anyone not
+	// currently rested — including every scenario in the balance corpus and
+	// the class-balance harness, which never sets it — so the full-HP fast
+	// path below stays byte-identical for them and the golden does not move.
+	if c.TempHP > 0 {
+		stats.MaxHP += c.TempHP
+	}
+	if c.HPCurrent >= c.HPMax {
+		// Full HP: StartHP=0 sentinel already means "enter at MaxHP", which
+		// now includes the +TempHP cushion.
+		return
+	}
+	startHP := c.HPCurrent + stats.HPBonus + c.TempHP
 	if startHP < 1 {
 		startHP = 1
 	}
@@ -554,4 +576,85 @@ func markAdventureDead(userID id.UserID, source, location string) {
 	if err := saveAdvCharacter(char); err != nil {
 		slog.Error("dnd: kill on combat loss", "user", userID, "err", err)
 	}
+	emitDeathNews(userID, location)
+}
+
+// emitDeathNews files a BULLETIN death dispatch to Pete's adventure news. No-op
+// unless the seam is enabled. Uses the character name (never the Matrix handle);
+// skips silently if the name is unknown.
+//
+// Bulletin, not priority: the room watched the character go down in TwinBee's
+// narration, and a priority fact is what makes Pete post a live beat — he'd be
+// breaking the news to the people who were there. The site row and the digest
+// still carry it.
+func emitDeathNews(userID id.UserID, location string) {
+	// Gate before the char lookups: markAdventureDead fires per-member on a
+	// party wipe and in the sim harness, so skip the DB reads when disabled.
+	if !peteclient.Enabled() || !newsEmissionOn() {
+		return
+	}
+	name := charName(userID)
+	if name == "" {
+		return
+	}
+	lvl := charLevel(userID)
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("death:%s:%d", eventToken(userID, fmt.Sprintf("%d", ts)), ts),
+		EventType:  "death",
+		Tier:       "bulletin",
+		Subject:    name,
+		Zone:       location,
+		Level:      lvl,
+		Outcome:    "lost",
+		OccurredAt: ts,
+	}, userID, "")
+}
+
+// emitRetreatNews files a BULLETIN when an expedition ends with the player
+// walking out alive.
+//
+// Until this existed the news had no way to say "it went badly but nobody
+// died", so it never said it. Pete's whole taxonomy was arrival, companion_hire,
+// death, milestone, rival_result and zone_first — every one of them a win, a
+// death, or an introduction. A run that simply fell apart emitted nothing, and
+// the feed showed a realm where adventurers only ever triumph or die.
+//
+// That was not a rare gap. Before §6, a cleric retreated on 167 of 500
+// simulated expeditions: a third of that class's runs ended in a way the news
+// was structurally incapable of reporting. Casters did not look unlucky in the
+// feed — they looked absent.
+//
+// Bulletin, not priority: a retreat is a bad day, not a funeral. A death already
+// files its own priority dispatch from markAdventureDead, and a wipe that killed
+// someone must not ALSO be reported as a retreat — hence the reason gate rather
+// than an "expedition ended" catch-all. An idle reap is excluded too: a player
+// who closed their laptop did not flee anything, and Pete announcing that they
+// were driven from the field would be a lie about a person by name.
+func emitRetreatNews(userID id.UserID, reason string, zoneID ZoneID, day int) {
+	switch reason {
+	case lossCombatRetreat, lossCombatFlee:
+	default:
+		return // a death tells its own story; an idle reap is not a story
+	}
+	if !peteclient.Enabled() || !newsEmissionOn() {
+		return
+	}
+	name := charName(userID)
+	if name == "" {
+		return
+	}
+	zone := zoneOrFallback(zoneID)
+	ts := nowUnix()
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("retreat:%s:%d", eventToken(userID, fmt.Sprintf("%d", ts)), ts),
+		EventType:  "retreat",
+		Tier:       "bulletin",
+		Subject:    name,
+		Zone:       zone.Display,
+		Level:      charLevel(userID),
+		Count:      day, // the day they got to before it fell apart
+		Outcome:    "retreated",
+		OccurredAt: ts,
+	}, userID, "")
 }

internal/plugin/dnd_expedition.go

@@ -160,6 +160,9 @@ func startExpedition(userID id.UserID, zoneID ZoneID, runID string, supplies Exp
 	if isHol, _ := isHolidayToday(); isHol {
 		startMood = 55
 	}
+	if b := activeOmen().StartMoodBonus; b > 0 { // N7/B3 the Omen
+		startMood += b
+	}
 	exp := &Expedition{
 		ID:            newExpeditionID(),
 		UserID:        string(userID),
@@ -224,6 +227,28 @@ func getActiveExpedition(userID id.UserID) (*Expedition, error) {
 	return e, err
 }
 
+// ownedLiveExpedition returns the expedition this player owns and has not yet
+// finished with — 'active' or 'extracting'. An extracted expedition is not
+// over: it holds its roster for the whole resume window (releaseParty is not
+// called on it), so the owner is still the only person who can close it.
+//
+// Active rows sort first, so a leader who owns both — extracted from one, then
+// started another — resolves to the one they are standing in.
+func ownedLiveExpedition(userID id.UserID) (*Expedition, error) {
+	row := db.Get().QueryRow(`
+		SELECT`+expeditionSelectCols+`
+		  FROM dnd_expedition e
+		 WHERE e.user_id = ?
+		   AND e.status IN ('active', 'extracting')
+		 ORDER BY (e.status = 'active') DESC, e.start_date DESC
+		 LIMIT 1`, string(userID))
+	e, err := scanExpedition(row)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	return e, err
+}
+
 // getExpedition fetches by ID regardless of status. Test/admin use.
 func getExpedition(id string) (*Expedition, error) {
 	row := db.Get().QueryRow(`
@@ -321,6 +346,42 @@ func updateSupplies(expID string, s ExpeditionSupplies) error {
 	return err
 }
 
+// withExpeditionSupplies serializes one read-modify-write of the shared supply
+// pool. updateSupplies rewrites supplies_json wholesale, so a caller that folds
+// its delta onto an *Expedition it read earlier silently discards anything that
+// landed in between — a member's pooled packs, another writer's spend. Handlers
+// run one goroutine per event, so those writers genuinely interleave.
+//
+// fn is handed a freshly-read expedition under the pool's own lock and returns
+// the supplies to persist. Callers that keep using their own *Expedition
+// afterwards must copy the returned pool back onto it.
+//
+// advUserLock cannot stand in here: it is keyed by sender, so two members
+// racing the same expedition row take two different mutexes and exclude nobody.
+func (p *AdventurePlugin) withExpeditionSupplies(
+	expID string, fn func(fresh *Expedition) (ExpeditionSupplies, error),
+) (ExpeditionSupplies, error) {
+	mu := p.advExpeditionLock(expID)
+	mu.Lock()
+	defer mu.Unlock()
+
+	fresh, err := getExpedition(expID)
+	if err != nil {
+		return ExpeditionSupplies{}, err
+	}
+	if fresh == nil {
+		return ExpeditionSupplies{}, fmt.Errorf("expedition %s not found", expID)
+	}
+	next, err := fn(fresh)
+	if err != nil {
+		return ExpeditionSupplies{}, err
+	}
+	if err := updateSupplies(expID, next); err != nil {
+		return ExpeditionSupplies{}, err
+	}
+	return next, nil
+}
+
 // updateCamp persists camp state. Pass nil to break camp.
 func updateCamp(expID string, c *CampState) error {
 	var arg any
@@ -349,9 +410,18 @@ func setExpeditionRunID(expID, runID string) error {
 	return err
 }
 
-// abandonExpedition flags the active expedition as abandoned. Idempotent.
+// abandonExpedition flags the player's live expedition as abandoned. Idempotent.
+//
+// It spans 'extracting' as well as 'active': an extracted expedition still owns
+// its roster, so abandoning is the leader's only way to free their party
+// without paying to `!resume` first. Character reset (dnd_setup) leans on this
+// too — a rerolled leader who left an extracted party behind would otherwise
+// strand every member until the sweeper reaped the row.
+//
+// One row per call, active first, so the run-spawn rollback in expeditionCmdStart
+// tears down the expedition it just created rather than an older extracted one.
 func abandonExpedition(userID id.UserID) error {
-	e, err := getActiveExpedition(userID)
+	e, err := ownedLiveExpedition(userID)
 	if err != nil {
 		return err
 	}

internal/plugin/dnd_expedition_camp.go

@@ -190,10 +190,18 @@ func (p *AdventurePlugin) campPitch(ctx MessageContext, exp *Expedition, kind st
 		}
 	}
 
-	exp.Supplies.Current -= cost
-	if err := updateSupplies(exp.ID, exp.Supplies); err != nil {
+	// The affordability check above ran against `exp` as it was read, and
+	// nightRolloverBurn may have moved the pool since. Deduct against the pool
+	// as it stands — the same arithmetic, just not onto a stale snapshot.
+	pooled, err := p.withExpeditionSupplies(exp.ID, func(fresh *Expedition) (ExpeditionSupplies, error) {
+		next := fresh.Supplies
+		next.Current -= cost
+		return next, nil
+	})
+	if err != nil {
 		return p.SendDM(ctx.Sender, "Couldn't deduct supplies: "+err.Error())
 	}
+	exp.Supplies = pooled
 	camp := &CampState{
 		Active:        true,
 		Type:          kind,
@@ -317,6 +325,13 @@ func applyCampRest(e *Expedition, kind string) string {
 	if kind == CampTypeStandard || kind == CampTypeFortified || kind == CampTypeBase {
 		_ = refreshAllResources(uid)
 		_ = refreshSpellSlots(uid)
+		// The companion sleeps at the same fire. His slots and his wounds are not
+		// dnd_spell_slots / dnd_character rows — he has none — so nothing above
+		// reaches him, and without these two his pool and his body would only ever
+		// go down. Camp is where a caster gets their slots back and a body gets
+		// patched up, and he is at the camp.
+		_ = refreshCompanionSlots(e.ID)
+		_ = refreshCompanionHP(e.ID)
 		_ = ReplenishHarvestNodes(e)
 	}
 

internal/plugin/dnd_expedition_cmd.go

@@ -95,6 +95,10 @@ func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string
 		return p.expeditionCmdParty(ctx)
 	case "leave":
 		return p.expeditionCmdLeave(ctx)
+	case "hire":
+		return p.expeditionCmdHire(ctx, rest)
+	case "dismiss":
+		return p.expeditionCmdDismiss(ctx)
 	case "extract":
 		return p.handleExtractCmd(ctx, "")
 	case "resume":
@@ -122,7 +126,9 @@ func expeditionHelpText() string {
 	b.WriteString("`!expedition invite @user` — they buy their own supplies into the party pool\n")
 	b.WriteString("`!expedition accept` / `!expedition decline` — answer an invite\n")
 	b.WriteString("`!expedition party` — who's with you\n")
-	b.WriteString("`!expedition leave` — turn back for town (members only)\n\n")
+	b.WriteString("`!expedition leave` — turn back for town (members only)\n")
+	b.WriteString("`!expedition hire [class]` — pay Pete to fill the role you're missing\n")
+	b.WriteString("`!expedition dismiss` — send Pete home\n\n")
 	b.WriteString("**Mid-expedition:**\n")
 	b.WriteString("`!extract` — bail safely (resumable for 7 days)\n")
 	b.WriteString("`!resume [loadout]` — resume an extracted expedition\n")
@@ -283,6 +289,12 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 			formatRespecDuration(remaining)))
 	}
 	zoneTok, packTok := splitFirstWord(rest)
+	// N5/D1c: the campaign finale is reached here but is not a normal zone — it
+	// runs a single auto-resolved boss fight with its own unlock gate, no
+	// supplies, no walk. Intercept before the zone/loadout machinery.
+	if strings.EqualFold(zoneTok, "epilogue") {
+		return p.handleEpilogueEncounter(ctx)
+	}
 	available := zonesForLevel(c.Level)
 	zoneID, ok := resolveZoneInput(zoneTok, available)
 	if !ok {
@@ -322,6 +334,37 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 			"You're already on expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
 			zone.Display, existing.CurrentDay))
 	}
+	// A leader who extracted still holds their roster for the resume window, and
+	// `!resume` only ever reaches the *newest* extracted row. Starting fresh on
+	// top of one would orphan it: unreachable, un-reapable until the sweeper
+	// catches it, with every member still seated and refused a run of their own.
+	//
+	// Only a row with a roster blocks. A solo extraction strands nobody, so
+	// walking away from it stays a normal thing to do.
+	if pending, _ := getResumableExpedition(ctx.Sender); pending != nil {
+		switch {
+		case extractionLapsed(pending, time.Now().UTC()):
+			// Past the window — reap it here rather than make them wait an hour
+			// for the sweeper, and let the new expedition proceed. Route through
+			// the shared reap so the freed members hear about it, same as the
+			// sweeper and `!expedition abandon` do.
+			if err := p.reapLapsedExtraction(pending); err != nil {
+				slog.Warn("expedition: reap lapsed on start", "expedition", pending.ID, "err", err)
+			}
+		default:
+			// A roster still holds; block. On a roster-read error, assume it is
+			// occupied and refuse — proceeding would orphan a party we could not
+			// confirm was empty, the one outcome this guard exists to prevent. A
+			// solo extraction (n == 1) strands nobody, so walking away is fine.
+			n, err := partySize(pending.ID)
+			if err != nil || n > 1 {
+				zone, _ := getZone(pending.ZoneID)
+				return p.SendDM(ctx.Sender, fmt.Sprintf(
+					"You extracted from **%s** on Day %d and your party is still waiting on you. `!resume` to lead them back in, or `!expedition abandon` to let it go — until you do one or the other, none of them can start a run of their own.",
+					zone.Display, pending.CurrentDay))
+			}
+		}
+	}
 
 	cost := float64(purchase.Cost())
 	if p.euro == nil {
@@ -340,41 +383,10 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	}
 
 	zone := zoneForCaps
-	// Holiday perk: a complimentary standard pack is added to the supplies
-	// snapshot without inflating the coin cost. Bypasses the per-tier cap
-	// on purpose — it's a freebie on top of whatever the player bought.
-	suppliesPurchase := purchase
-	if isHol, _ := isHolidayToday(); isHol {
-		suppliesPurchase.StandardPacks++
-	}
-	supplies := makeSupplies(zone.Tier, suppliesPurchase)
-
-	// Debit coins; bail on debit failure (race / cap).
-	if !p.euro.Debit(ctx.Sender, cost, "expedition outfitting: "+string(zoneID)) {
-		return p.SendDM(ctx.Sender, "Couldn't debit outfitting cost (try again).")
-	}
-
-	exp, err := startExpedition(ctx.Sender, zoneID, "", supplies)
+	_, supplies, startLine, err := p.beginExpedition(ctx.Sender, c.Level, zone, purchase, "expedition outfitting")
 	if err != nil {
-		// Refund on persistence failure.
-		p.euro.Credit(ctx.Sender, cost, "expedition outfitting refund")
-		return p.SendDM(ctx.Sender, "Couldn't start expedition: "+err.Error())
+		return p.SendDM(ctx.Sender, err.Error())
 	}
-
-	// R2 — auto-spawn the DungeonRun for the starting region. Per-room
-	// harvest depends on this; the existing zone-run !advance/!retreat
-	// commands now operate on this run while the expedition is active.
-	if _, err := ensureRegionRun(exp, c.Level); err != nil {
-		// Refund and tear the expedition row back down — without a
-		// linked run, harvest and rooms can't function.
-		_ = abandonExpedition(ctx.Sender)
-		p.euro.Credit(ctx.Sender, cost, "expedition outfitting refund (run-spawn failed)")
-		return p.SendDM(ctx.Sender, "Couldn't outfit the first region: "+err.Error())
-	}
-
-	// Log the start with prewritten flavor.
-	startLine := flavor.Pick(flavor.ExpeditionStart)
-	_ = appendExpeditionLog(exp.ID, 1, "narrative", "expedition started", startLine)
 	markActedToday(ctx.Sender)
 
 	var b strings.Builder
@@ -396,6 +408,65 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	return p.SendDM(ctx.Sender, b.String())
 }
 
+// beginExpedition performs the non-interactive half of starting an expedition:
+// supply freebies, the coin debit, persistence, the starting region's run, and
+// the opening log entry. It refunds and tears down on every failure path, so a
+// caller holding an error owes the player nothing.
+//
+// Callers own the balance check, the eligibility guards, and the player-facing
+// messaging. This is the shared transaction under `!expedition start` and the
+// boredom ticker (gogobee_boredom_plan.md §4); the returned errors are written
+// as complete player-facing sentences so both callers can surface them as-is.
+//
+// It deliberately does NOT call markActedToday — an expedition the player did
+// not ask for must not spend their daily action or count as them showing up.
+func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone ZoneDefinition, purchase SupplyPurchase, reason string) (*Expedition, ExpeditionSupplies, string, error) {
+	if p.euro == nil {
+		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Coin system unavailable — try again later.")
+	}
+	cost := float64(purchase.Cost())
+
+	// Holiday perk: a complimentary standard pack is added to the supplies
+	// snapshot without inflating the coin cost. Bypasses the per-tier cap
+	// on purpose — it's a freebie on top of whatever the player bought.
+	suppliesPurchase := purchase
+	if isHol, _ := isHolidayToday(); isHol {
+		suppliesPurchase.StandardPacks++
+	}
+	if pk := activeOmen().SupplyFreebiePacks; pk > 0 { // N7/B3 the Omen
+		suppliesPurchase.StandardPacks += pk
+	}
+	supplies := makeSupplies(zone.Tier, suppliesPurchase)
+
+	// Debit coins; bail on debit failure (race / cap).
+	if !p.euro.Debit(uid, cost, reason+": "+string(zone.ID)) {
+		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't debit outfitting cost (try again).")
+	}
+
+	exp, err := startExpedition(uid, zone.ID, "", supplies)
+	if err != nil {
+		// Refund on persistence failure.
+		p.euro.Credit(uid, cost, "expedition outfitting refund")
+		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't start expedition: %s", err)
+	}
+
+	// R2 — auto-spawn the DungeonRun for the starting region. Per-room
+	// harvest depends on this; the existing zone-run !advance/!retreat
+	// commands now operate on this run while the expedition is active.
+	if _, err := ensureRegionRun(exp, charLevel); err != nil {
+		// Refund and tear the expedition row back down — without a
+		// linked run, harvest and rooms can't function.
+		_ = abandonExpedition(uid)
+		p.euro.Credit(uid, cost, "expedition outfitting refund (run-spawn failed)")
+		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't outfit the first region: %s", err)
+	}
+
+	// Log the start with prewritten flavor.
+	startLine := flavor.Pick(flavor.ExpeditionStart)
+	_ = appendExpeditionLog(exp.ID, 1, "narrative", "expedition started", startLine)
+	return exp, supplies, startLine, nil
+}
+
 // raidContentWarning returns a TwinBee-voiced heads-up for zones whose
 // boss is tuned for a party rather than a solo adventurer. T5 zones
 // (Dragon's Lair / Abyss Portal) have boss HP / damage curves that the
@@ -610,6 +681,15 @@ func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
 	}
+	if exp == nil {
+		// An extracted expedition is still the owner's to close — it holds the
+		// roster until the resume window lapses. Without this, a leader who
+		// wanted out had to pay to `!resume` first just to abandon.
+		if exp, err = getResumableExpedition(ctx.Sender); err != nil {
+			return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		}
+		isLeader = exp != nil
+	}
 	if exp == nil {
 		return p.SendDM(ctx.Sender, "No active expedition to abandon.")
 	}
@@ -619,15 +699,37 @@ func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
 			"Only your party leader can abandon the expedition. `!expedition leave` to walk out alone.")
 	}
 	zone, _ := getZone(exp.ZoneID)
+	extracted := exp.Status == ExpeditionStatusExtracting
+	audience := expeditionAudience(exp) // read before abandonExpedition disbands the roster
 	if err := abandonExpedition(ctx.Sender); err != nil {
 		return p.SendDM(ctx.Sender, "Couldn't abandon: "+err.Error())
 	}
 	markActedToday(ctx.Sender)
 	_ = retireAllRegionRuns(exp)
 	_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative", "expedition abandoned", "")
-	if err := p.SendDM(ctx.Sender, fmt.Sprintf(
+	// An extracted party is standing in town, not in the dungeon: their supplies
+	// are already spent and their loot is already banked. Say the true thing.
+	body := fmt.Sprintf(
 		"Expedition in **%s** abandoned on Day %d. Supplies are forfeit. The dungeon remembers.",
-		zone.Display, exp.CurrentDay)); err != nil {
+		zone.Display, exp.CurrentDay)
+	if extracted {
+		body = fmt.Sprintf(
+			"You let the expedition in **%s** go. Day %d is where it ends — loot, XP, and coins are kept. The dungeon remembers.",
+			zone.Display, exp.CurrentDay)
+	}
+	// The roster is being disbanded out from under the members; they hear it from
+	// their leader rather than discovering it the next time a command works again.
+	for _, uid := range audience {
+		if uid == ctx.Sender {
+			continue
+		}
+		if err := p.SendDM(uid, fmt.Sprintf(
+			"Your leader called off the expedition in **%s** on Day %d. You're free to start a run of your own.",
+			zone.Display, exp.CurrentDay)); err != nil {
+			slog.Warn("expedition: abandon DM failed", "user", uid, "expedition", exp.ID, "err", err)
+		}
+	}
+	if err := p.SendDM(ctx.Sender, body); err != nil {
 		return err
 	}
 	// Emergence seam: see maybeRollPetArrivalOnEmerge.

internal/plugin/dnd_expedition_cycle.go

@@ -82,34 +82,39 @@ type nightRolloverResult struct {
 // to finish the rollover; legacy deliverBriefing interleaves processOvernightCamp
 // between the two so a fortified camp's −5 lands before drift's +3.
 func (p *AdventurePlugin) nightRolloverBurn(e *Expedition) (float32, error) {
-	// D5-c: Ranger forage runs before the daily burn so the +SU lands on
-	// today's supplies, not tomorrow's. Logged so the end-of-day digest
-	// can surface the gain; pure no-op for non-Ranger characters.
-	if c, err := LoadDnDCharacter(id.UserID(e.UserID)); err == nil && c != nil {
-		if gain := applyRangerForage(e, c, nil); gain > 0 {
-			_ = appendExpeditionLog(e.ID, e.CurrentDay, "forage",
-				fmt.Sprintf("ranger forage +%g SU", gain),
-				flavor.Pick(flavor.HarvestForageSuccess))
-		}
-	}
-	burnOverride := applyZoneTemporalPreBurn(e, e.CurrentDay+1)
-	var newSupplies ExpeditionSupplies
 	var burn float32
-	if burnOverride.Multiplier > 0 {
-		// The temporal override replaces the harsh/siege multiplier, not the
-		// roster's: a party still eats N × 0.8 rations inside a time-warped zone.
-		burn = e.Supplies.DailyBurn * burnOverride.Multiplier * float32(expeditionBurnRatePct(e.ID)) / 100
-		newSupplies = e.Supplies
-		newSupplies.Current -= burn
-		if newSupplies.Current < 0 {
-			newSupplies.Current = 0
+	// Forage and burn land in one write, so they resolve together against the
+	// pool as it stands now — not as `e` last saw it.
+	newSupplies, err := p.withExpeditionSupplies(e.ID, func(fresh *Expedition) (ExpeditionSupplies, error) {
+		// D5-c: Ranger forage runs before the daily burn so the +SU lands on
+		// today's supplies, not tomorrow's. Logged so the end-of-day digest
+		// can surface the gain; pure no-op for non-Ranger characters.
+		if c, cerr := LoadDnDCharacter(id.UserID(fresh.UserID)); cerr == nil && c != nil {
+			if gain := applyRangerForage(fresh, c, nil); gain > 0 {
+				_ = appendExpeditionLog(fresh.ID, fresh.CurrentDay, "forage",
+					fmt.Sprintf("ranger forage +%g SU", gain),
+					flavor.Pick(flavor.HarvestForageSuccess))
+			}
 		}
-		newSupplies.ForagedToday = false
-	} else {
-		harsh := e.ThreatLevel > 60 || zoneTemporalHarsh(e)
-		newSupplies, burn = applyExpeditionDailyBurn(e, harsh, e.SiegeMode)
-	}
-	if err := updateSupplies(e.ID, newSupplies); err != nil {
+		burnOverride := applyZoneTemporalPreBurn(fresh, fresh.CurrentDay+1)
+		if burnOverride.Multiplier > 0 {
+			// The temporal override replaces the harsh/siege multiplier, not the
+			// roster's: a party still eats N × 0.8 rations inside a time-warped zone.
+			burn = fresh.Supplies.DailyBurn * burnOverride.Multiplier * float32(expeditionBurnRatePct(fresh.ID)) / 100
+			next := fresh.Supplies
+			next.Current -= burn
+			if next.Current < 0 {
+				next.Current = 0
+			}
+			next.ForagedToday = false
+			return next, nil
+		}
+		harsh := fresh.ThreatLevel > 60 || zoneTemporalHarsh(fresh)
+		next, b := applyExpeditionDailyBurn(fresh, harsh, fresh.SiegeMode)
+		burn = b
+		return next, nil
+	})
+	if err != nil {
 		return 0, err
 	}
 	if err := advanceExpeditionDay(e.ID); err != nil {
@@ -395,6 +400,9 @@ func (p *AdventurePlugin) deliverBriefing(e *Expedition, now time.Time) error {
 
 	line := pickMorningBriefing(e.CurrentDay)
 	body := renderMorningBriefing(e, line, burn)
+	if sl := p.shadowBriefingLine(e); sl != "" {
+		body += "\n" + sl + "\n"
+	}
 	if restSummary != "" {
 		body += "\n💤 _" + restSummary + "_\n"
 	}
@@ -508,6 +516,9 @@ func (p *AdventurePlugin) deliverBriefingEventAnchored(e *Expedition, priorBrief
 
 	line := pickMorningBriefing(e.CurrentDay)
 	body := renderMorningBriefing(e, line, burn)
+	if sl := p.shadowBriefingLine(e); sl != "" {
+		body += "\n" + sl + "\n"
+	}
 	if forced {
 		body += "\n_The autopilot stalled overnight; the day rolled over without rest._\n"
 	}

internal/plugin/dnd_expedition_extract.go

@@ -30,6 +30,7 @@ import (
 const (
 	extractResumeWindow      = 7 * 24 * time.Hour
 	forcedExtractCoinTaxFrac = 0.20
+	extractionSweepInterval  = time.Hour
 )
 
 var (
@@ -94,21 +95,40 @@ func forcedExtractExpedition(expID, reason string) (*Expedition, int, error) {
 	return e, tax, nil
 }
 
+// The reasons a run can end badly. They were bare strings at four call sites;
+// they are constants now because the news seam has to tell them apart — a
+// retreat is a story and a death is a different story, and an idle reap is
+// neither.
+const (
+	lossCombatDeath   = "combat death"
+	lossCombatRetreat = "combat retreat" // solo: ran out the phase clock and withdrew
+	lossCombatFlee    = "combat flee"    // party: the turn engine broke off
+	lossIdleTimeout   = "run idle-timeout (§4.3 stale-run reap)"
+)
+
 // forceExtractExpeditionForRunLoss bridges run-loss call sites (turn-based
 // elite/boss death or flee, exploration combat death, patrol-interrupt
 // death) into the forced-extract flow. Those sites already abandon the
 // zone run, but without flipping the wrapping expedition the ambient
 // ticker keeps DMing about a dungeon the player walked away from. No-op
 // when there is no active expedition for this user.
+//
+// It is also the one chokepoint every bad ending passes through, which makes it
+// where the retreat dispatch is filed. Read the expedition BEFORE the extract:
+// forcedExtractExpedition stamps it 'abandoned' and zeroes the live fields, so
+// afterwards there is no day count left to report.
 func forceExtractExpeditionForRunLoss(userID id.UserID, reason string) {
 	exp, err := getActiveExpedition(userID)
 	if err != nil || exp == nil {
 		return
 	}
+	day, zoneID := exp.CurrentDay, exp.ZoneID
 	if _, _, err := forcedExtractExpedition(exp.ID, reason); err != nil {
 		slog.Warn("expedition: force-extract on run loss",
 			"user", userID, "expedition", exp.ID, "reason", reason, "err", err)
+		return
 	}
+	emitRetreatNews(userID, reason, zoneID, day)
 }
 
 // finalizeExpeditionOnZoneClear bridges the run-complete seam (boss down,
@@ -169,7 +189,17 @@ func (p *AdventurePlugin) finalizeExpeditionOnZoneClear(userID id.UserID, runID
 	exp.Status = ExpeditionStatusComplete
 	_ = retireAllRegionRuns(exp)
 	p.rollZoneTreasure(userID, exp.ZoneID, advTreasureWeightZoneClear)
-	return p.AwardCompletionMilestones(exp, false)
+	lines := p.AwardCompletionMilestones(exp, false)
+	// N6/D3: the Shadow's payoff for this zone — a crow (player was first) or a
+	// waiting journal page (the Shadow cleared it first). Appended after the
+	// milestone lines so the campaign beat reads last.
+	if sl := p.shadowOnPlayerZoneClear(userID, exp.ZoneID); sl != "" {
+		lines = append(lines, sl)
+	}
+	// News: boss down means the zone is cleared. Realm-first → PRIORITY,
+	// repeat → BULLETIN. No-op unless the Pete seam is enabled.
+	emitZoneClearNews(userID, exp)
+	return lines
 }
 
 // midZoneRegionClear reports whether the just-completed run (runID) is the
@@ -218,6 +248,94 @@ func getResumableExpedition(userID id.UserID) (*Expedition, error) {
 	return e, err
 }
 
+// extractionLapsed reports whether an 'extracting' row is past its resume
+// window and should be reaped. A NULL completed_at counts as lapsed: the column
+// is the only clock the window has, and a row without one can never expire.
+func extractionLapsed(e *Expedition, now time.Time) bool {
+	return e.CompletedAt == nil || now.Sub(*e.CompletedAt) > extractResumeWindow
+}
+
+// loadLapsedExtractions returns every extracted expedition whose resume window
+// has closed, regardless of owner.
+func loadLapsedExtractions(now time.Time) ([]*Expedition, error) {
+	rows, err := db.Get().Query(`
+		SELECT`+expeditionSelectCols+`
+		  FROM dnd_expedition e
+		 WHERE e.status = 'extracting'
+		   AND (e.completed_at IS NULL OR e.completed_at < ?)`,
+		now.Add(-extractResumeWindow))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanExpeditionRows(rows)
+}
+
+// sweepLapsedExtractions closes out every extraction whose seven-day window has
+// run out, which releases its roster.
+//
+// Without this the window is a promise the code never keeps. `handleResumeCmd`
+// expires a lapsed row lazily, but only the *leader* can call `!resume` — so a
+// leader who quits, forgets, or simply starts a different expedition leaves the
+// row 'extracting' forever, and releaseParty (which fires only on a terminal
+// status) never runs. Every member stays seated, and assertNotAdventuring keeps
+// refusing them a run of their own. `!expedition leave` is their escape, but a
+// player should not have to find it.
+func (p *AdventurePlugin) sweepLapsedExtractions(now time.Time) {
+	exps, err := loadLapsedExtractions(now)
+	if err != nil {
+		slog.Error("expedition: load lapsed extractions", "err", err)
+		return
+	}
+	for _, e := range exps {
+		if err := p.reapLapsedExtraction(e); err != nil {
+			slog.Warn("expedition: expire lapsed extraction", "expedition", e.ID, "err", err)
+			continue
+		}
+	}
+}
+
+// reapLapsedExtraction closes one lapsed extraction and tells its roster the
+// way back has shut. It is the single reap-with-notify path: the hourly
+// sweeper loops it, and expeditionCmdStart calls it when a player starts a new
+// expedition on top of one whose window has already closed — so a member is
+// never silently unseated by whichever path happens to reach the row first.
+//
+// The audience is read before the close-out: completeExpedition disbands the
+// roster, and expeditionAudience reads that roster.
+func (p *AdventurePlugin) reapLapsedExtraction(e *Expedition) error {
+	audience := expeditionAudience(e)
+	if err := completeExpedition(e.ID, ExpeditionStatusFailed); err != nil {
+		return err
+	}
+	zone, _ := getZone(e.ZoneID)
+	body := fmt.Sprintf(
+		"🕯 **The way back has closed — %s**\n\nYour extracted expedition sat past its seven-day resume window, and the dungeon reshaped without you. Day %d is where it ends.\n\nThe loot, XP, and coins you carried out are still yours. `!expedition list` when you're ready for the next one.",
+		zone.Display, e.CurrentDay)
+	for _, uid := range audience {
+		if err := p.SendDM(uid, body); err != nil {
+			slog.Warn("expedition: lapsed-extraction DM failed", "user", uid, "expedition", e.ID, "err", err)
+		}
+	}
+	return nil
+}
+
+// expeditionExtractionSweepTicker reaps lapsed extractions hourly. The window is
+// seven days, so the cadence only bounds how long a freed member waits to hear
+// about it.
+func (p *AdventurePlugin) expeditionExtractionSweepTicker() {
+	ticker := time.NewTicker(extractionSweepInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-ticker.C:
+			p.sweepLapsedExtractions(time.Now().UTC())
+		}
+	}
+}
+
 // resumeExpedition flips an extracting row back to 'active' with fresh
 // supplies. Threat/temporal/region state are preserved as-is.
 func resumeExpedition(expID string, supplies ExpeditionSupplies) error {
@@ -323,8 +441,9 @@ func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error
 	if exp == nil {
 		return p.SendDM(ctx.Sender, "No extracted expedition to resume. Use `!expedition start <zone>` to begin a new one.")
 	}
-	if exp.CompletedAt == nil || time.Since(*exp.CompletedAt) > extractResumeWindow {
-		// Expire it so it doesn't keep resurfacing.
+	if extractionLapsed(exp, time.Now().UTC()) {
+		// Expire it so it doesn't keep resurfacing. The hourly sweeper would get
+		// here on its own; this keeps the refusal and the reap in one breath.
 		_ = completeExpedition(exp.ID, ExpeditionStatusFailed)
 		return p.SendDM(ctx.Sender,
 			"That extraction is past its 7-day resume window — the dungeon has reshaped without you. Start a new expedition.")