Merge party-known-flag: tell Pete this build knows what a party seat is

The party list is omitempty, so a solo run and a game box too old to push
seats reach Pete as the same empty slice, and those two want opposite
buttons. Pete's page was reading the empty one as "solo, therefore leader"
and offering a party member the button that throws away everyone's day.

One boolean, set on every sheet a build makes — in town, solo, or seated
with three others. It says something about the sender, never about the
character, so it is set unconditionally: a conditional flag would read as
"this player is solo" and land straight back in the hole it closes. An
older build sends no key at all, which decodes to false, which is the
answer Pete wants when it cannot tell.

Pete's half shipped already and withholds the button until this arrives.

Verified end to end against a local Pete, not just in tests: a solo leader
on a live expedition gets "Call the whole thing off" back, a member still
gets "Turn back alone" and never the abandon, and stripping the flag from
the same push takes the solo button away again.

cmd/char-migrate/main.go

@@ -0,0 +1,105 @@
+// Command char-migrate mints a confirmed D&D character for one or more users,
+// for the "stuck adventurer" cases the boredom ticker can't reach: veteran
+// legacy players who never triggered auto-migration, and players who abandoned
+// !setup at race pick. It reuses the game's own constructors (stats, HP/AC,
+// resources, spells) via plugin.AdminBuildConfirmedCharacter.
+//
+// It opens the SAME gogobee.db the live bot uses (WAL + busy_timeout), so it is
+// safe to run alongside the running process — but snapshot the db dir first.
+//
+// Usage:
+//
+//	char-migrate -data /home/reala/gogobee/data \
+//	    '@nonk:parodia.dev:human:rogue:4' \
+//	    '@knightstar:matrix.org:half_elf:warlock:1'
+//
+// Each spec is mxid:race:class:level (mxid contains colons, so we split from
+// the right for the last three fields).
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"strconv"
+	"strings"
+
+	"gogobee/internal/db"
+	"gogobee/internal/plugin"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func main() {
+	dataDir := flag.String("data", "", "data dir containing gogobee.db (e.g. /home/reala/gogobee/data)")
+	flag.Parse()
+
+	if *dataDir == "" || flag.NArg() == 0 {
+		fmt.Fprintln(os.Stderr, "usage: char-migrate -data <dir> '<mxid>:<race>:<class>:<level>' ...")
+		os.Exit(2)
+	}
+
+	// Parse every spec before touching the DB, so a malformed spec in the
+	// middle of the batch fails fast instead of leaving the earlier specs
+	// already committed to gogobee.db.
+	type charSpec struct {
+		uid   id.UserID
+		race  plugin.DnDRace
+		class plugin.DnDClass
+		level int
+	}
+	specs := make([]charSpec, 0, flag.NArg())
+	for _, spec := range flag.Args() {
+		uid, race, class, level, err := parseSpec(spec)
+		if err != nil {
+			log.Fatalf("bad spec %q: %v", spec, err)
+		}
+		specs = append(specs, charSpec{uid, race, class, level})
+	}
+
+	if err := db.Init(*dataDir); err != nil {
+		log.Fatalf("db init: %v", err)
+	}
+
+	for _, s := range specs {
+		uid := s.uid
+		c, err := plugin.AdminBuildConfirmedCharacter(s.uid, s.race, s.class, s.level)
+		if err != nil {
+			log.Fatalf("build %s: %v", uid, err)
+		}
+		fmt.Printf("OK  %-28s %s %s L%d  HP=%d AC=%d  STR%d DEX%d CON%d INT%d WIS%d CHA%d\n",
+			uid, c.Race, c.Class, c.Level, c.HPMax, c.ArmorClass,
+			c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA)
+	}
+}
+
+// parseSpec splits mxid:race:class:level. The mxid itself contains a colon
+// (@user:server), so split the last three fields off the right.
+func parseSpec(spec string) (id.UserID, plugin.DnDRace, plugin.DnDClass, int, error) {
+	i := strings.LastIndex(spec, ":")
+	if i < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :level")
+	}
+	level, err := strconv.Atoi(spec[i+1:])
+	if err != nil {
+		return "", "", "", 0, fmt.Errorf("level: %w", err)
+	}
+	rest := spec[:i]
+	j := strings.LastIndex(rest, ":")
+	if j < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :class")
+	}
+	class := rest[j+1:]
+	rest = rest[:j]
+	k := strings.LastIndex(rest, ":")
+	if k < 0 {
+		return "", "", "", 0, fmt.Errorf("missing :race")
+	}
+	race := rest[k+1:]
+	mxid := rest[:k]
+	if mxid == "" || race == "" || class == "" {
+		return "", "", "", 0, fmt.Errorf("empty field")
+	}
+	return id.UserID(mxid), plugin.DnDRace(race), plugin.DnDClass(class), level, nil
+}

cmd/expedition-sim/main.go

@@ -65,9 +65,19 @@ func main() {
 		companion    = flag.String("companion", "", "hire Pete into the party: \"auto\" fills the missing role, or name a class (cleric, fighter, …). Empty = no companion. He takes a seat but no loot/XP.")
 
 		jobs = flag.Int("jobs", 0, "matrix mode — concurrent worker count (each worker is a subprocess so it gets its own sqlite). 0 = runtime.NumCPU()")
+
+		seed     = flag.Int64("seed", -1, "single-run mode — deterministic seed for zone layout + run id + combat sessions (peripheral procs stay random). <0 = off (default). Matrix mode passes this to each subprocess automatically; use -base-seed there.")
+		baseSeed = flag.Int64("base-seed", -1, "matrix mode — deterministic base seed. Each cell's subprocess gets seed=mix(base,level,zone,rep) (class-independent, so every class faces identical dungeons + dice). <0 = off (default, time-seeded).")
 	)
 	flag.Parse()
 
+	// Deterministic seeding for reproducible A/B tuning. Off unless -seed >= 0
+	// (the matrix parent sets it per-subprocess from -base-seed). Prod never
+	// calls SeedSim, so this is inert outside the sim.
+	if *seed >= 0 {
+		plugin.SeedSim(*seed)
+	}
+
 	if *petLevel < 0 || *petLevel > 10 {
 		fail("pet-level must be 0-10, got", *petLevel)
 	}
@@ -89,7 +99,7 @@ func main() {
 				includeLog = *logFlag
 			}
 		})
-		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses, *companion)
+		runMatrix(*classes, *levels, *zones, *runs, *bank, *cap, *days, includeLog, *jobs, *trace, *petLevel, *party, *partyClasses, *companion, *baseSeed)
 		return
 	}
 
@@ -200,7 +210,18 @@ type matrixJob struct {
 	rep   int
 }
 
-func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses, companion string) {
+// mixSeed derives a per-cell subprocess seed from the base seed and the cell's
+// (level, zone, rep) — deliberately class-independent, so every class runs the
+// identical dungeon + combat dice at a given cell and A/B class deltas pair.
+func mixSeed(base int64, level int, zone string, rep int) int64 {
+	h := uint64(1469598103934665603) // FNV-1a offset basis
+	for _, c := range fmt.Sprintf("%d|%s|%d", level, zone, rep) {
+		h = (h ^ uint64(c)) * 1099511628211
+	}
+	return int64((uint64(base) ^ h) &^ (uint64(1) << 63)) // non-negative
+}
+
+func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days int, includeLog bool, jobs int, trace bool, petLevel, party int, partyClasses, companion string, baseSeed int64) {
 	cs := splitNonEmpty(classes)
 	ls := parseLevels(levels)
 	zs := splitNonEmpty(zones)
@@ -231,7 +252,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	var wg sync.WaitGroup
 	for i := 0; i < jobs; i++ {
 		wg.Add(1)
-		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses, companion)
+		go matrixWorker(exe, workCh, resCh, &wg, bank, cap, days, includeLog, trace, petLevel, party, partyClasses, companion, baseSeed)
 	}
 	go func() {
 		for _, j := range work {
@@ -250,7 +271,7 @@ func runMatrix(classes, levels, zones string, runs int, bank float64, cap, days
 	}
 }
 
-func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses, companion string) {
+func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult, wg *sync.WaitGroup, bank float64, cap, days int, includeLog, trace bool, petLevel, party int, partyClasses, companion string, baseSeed int64) {
 	defer wg.Done()
 	for j := range in {
 		uid := fmt.Sprintf("@sim:%s-l%d-%s-%d", j.class, j.level, j.zone, j.rep)
@@ -272,6 +293,9 @@ func matrixWorker(exe string, in <-chan matrixJob, out chan<- *plugin.SimResult,
 			fmt.Sprintf("-pet-level=%d", petLevel),
 			fmt.Sprintf("-party=%d", party),
 		}
+		if baseSeed >= 0 {
+			args = append(args, "-seed", strconv.FormatInt(mixSeed(baseSeed, j.level, j.zone, j.rep), 10))
+		}
 		// Left empty, each cell's followers clone that cell's own -class.
 		if partyClasses != "" {
 			args = append(args, "-party-classes", partyClasses)
@@ -342,6 +366,17 @@ func runOne(dataDir string, uid id.UserID, class plugin.DnDClass, level int, zon
 		runner.Euro.Credit(muid, bank, "expedition-sim bankroll")
 		members = append(members, muid)
 	}
+	// T6 post-game zones are gated on both T5 bosses beaten (+ level floor).
+	// The synthetic party has no expedition history, so seed the two clears
+	// for every party member — the per-member unlock check in !expedition
+	// accept would otherwise refuse the whole party at the zone's edge.
+	if plugin.IsPostgameZone(zone) {
+		for _, m := range append([]id.UserID{uid}, members...) {
+			if err := runner.SeedPostgameUnlock(m); err != nil {
+				return nil, fmt.Errorf("seed postgame unlock: %w", err)
+			}
+		}
+	}
 	runner.Companion = companion
 	return runner.RunPartyExpedition(uid, members, zone, cap, days)
 }

gogobee_adventure_announcement.md

@@ -0,0 +1,120 @@
+# Adventure — the big update (2026-07-09 → 2026-07-11)
+
+62 commits, ~31k lines, 7 phases. All merged to `main` and live in prod as of
+2026-07-11. Working-tree doc; do not commit.
+
+---
+
+## The one-line version
+
+Adventure stopped being a solo grind. You can now bring friends, fight each
+other, fight the world together, prestige past the level cap, and there's an
+actual story running underneath it — and Pete reports on all of it.
+
+---
+
+## 1. Co-op — you can bring people now (N3)
+
+The headline. The combat engine was 1-versus-1 at its core; it was rewritten
+into an N-player engine with real initiative, and every seat gets its own turn.
+
+- `!expedition invite @user` — leader, Day 1 only
+- `!expedition accept` / `decline` / `party` / `leave`
+- Everyone buys their own supply pack. Everyone acts on their own turn.
+- The enemy's action economy scales to the party, so four people don't trivialize
+  a room.
+
+## 2. Fight each other (N6)
+
+- `!duel @user [stake]`, then `!duel accept` / `decline` / `status`.
+  Staked, and **nobody dies** — it's a bout, not a mugging.
+- `!rivals` for your record, `!rivals board` for room-wide standings.
+
+## 3. Fight the world together (N6)
+
+- `!adventure worldboss` — the Siege. One communal bout a day; `worldboss fight`
+  to take your swing at it. Everybody's damage counts toward the same health bar.
+
+## 4. The Shadow (N6)
+
+- `!adventure shadow` — a rival adventurer who runs the dungeon on their own
+  schedule whether you play or not, and you can check how your run stacks up
+  against theirs.
+
+## 5. The Town (N4)
+
+Housing finally pays off, and the room has a civic life.
+
+- **T3 payoffs** — trophy hall + workshop; a long rest at home now grants a
+  **well-rested** buff that scales with your house tier.
+- **T4 Estate vault** — `!adventure vault` / `vault store <item>` / `vault take
+  <item>`. 10 protected slots. Safe from `!sell all`, safe from combat.
+- **A second pet** at Tier 4 — it shows up on its own.
+- **Gifting** — `!give <item> @user`. Small handling fee to the community pot.
+- **Registries** — `!town` (civic pride, housing street, pet showcase),
+  `!graveyard` (recent deaths), `!rivals`.
+
+## 6. Prestige and a world that moves (N7)
+
+- **Renown** — XP past L20 no longer evaporates. It accrues into a Renown rank
+  that shows on your `!sheet` and gets announced when it ticks up.
+- **The Omen** — one rotating world modifier per week. TwinBee tells you what's
+  in the air in the morning DM.
+- **Seasonal events** — holiday weeks re-skin the day's events and flavor.
+- **Achievements** — a whole Renown wing added to `!achievements`.
+
+## 7. The chase (N2)
+
+- **Tempering** — `!adventure temper` pushes a magic item one rarity step higher
+  at the blacksmith. Euros plus a T5 material (one per clear — *that's* the real
+  gate).
+- **Arena seasons** — `!arena leaderboard` is now the current season; champions
+  get titles. `!arena stats` keeps your lifetime record.
+
+## 8. Story (N5 — the Hollow King)
+
+- **`!adventure journal`** — recover campaign pages through the zones and read
+  them back. Bosses now have epilogues, and there's a real finale.
+- NPC arcs land as DMs mid-run — Misty, Robbie, and Thom all have somewhere to
+  go now.
+
+## 9. Backtracking (C5)
+
+- **`!revisit <N>`** — walk back one room from the Path strip in `!map` for +1
+  threat. Blocked mid-fight, at a fork, and when it's too hot to double back.
+
+## 10. Pete reports on it (Pete Adventure News)
+
+Guild events — zone firsts, deaths, achievements — are now narrated into a live
+news feed by Pete, the deadpan announcer.
+
+- `news.parodia.dev/adventure` (feed, permalinks, daily digest)
+- Live beats in the games room
+- `!news` to read; `!news optout` if you'd rather not be named.
+
+## 11. Restoration + plumbing (N1, unglamorous but real)
+
+- The drop systems Phase R orphaned are wired back up; milestone rewards that
+  were stubs actually pay out.
+- Lottery ticket sales fund the community pot.
+- Fixed outside Adventure but shipped alongside: URL previews stopped dropping
+  thumbnails, and the bot stopped reminting its cross-signing identity on every
+  restart.
+
+---
+
+## ⚠️ Do NOT put in the announcement
+
+- **Secret rooms and the cross-zone keys** (Sunken Sigil, Underforge Seal). These
+  are discovery content — no command, found by walking. Announcing them deletes
+  the discovery.
+- **The NPC buffs** (Misty/Arina). Hidden mechanics by design. Say the NPCs have
+  arcs; do not say what befriending them *does*.
+- Numbers, rolls, and rarity math generally — house style is verbs and outcomes,
+  not crunch.
+
+## Watch list (first live exercise in prod)
+
+Renown, the Omen, seasonal events, the Hollow King arc, the world boss and duels
+have **never fired against real players before today**. Expect the first firings
+to be the real test.

gogobee_adventure_announcement_copy.md

@@ -0,0 +1,84 @@
+# Announcement copy — your voice (draft)
+
+Working-tree doc; do not commit.
+
+Register: a person telling their friends what they built. No press-release
+cadence, no bold-hook-per-paragraph, no claiming things are new when they're
+expanded (houses, the town, and the story all already existed).
+
+---
+
+## Long version (post to the games room)
+
+Big Adventure update went out. The main thing: you can play it with other people
+now.
+
+`!expedition invite @user` on day one of a run and they come with you. Everyone
+buys their own supplies and takes their own turn, and enemies get more to do when
+the party's bigger, so a group of four doesn't just walk through everything. This
+was most of the work — the combat engine only ever knew how to run one player
+against one monster, so it had to be rebuilt.
+
+And if nobody's around, you can hire Pete. `!expedition hire` and he'll fill
+whatever role you're short of — he fights his own turns, takes no loot and no XP,
+and files a story about it afterwards. He's one guy, so if he's already out with
+someone else you'll be told he's on assignment.
+
+While I was in there: you can duel each other for a stake (`!duel @user 500`,
+nobody dies), and there's a world boss once a day that everyone chips at together
+(`!adventure worldboss`). There's also a rival called the Shadow who runs the
+dungeon whether or not you log in — `!adventure shadow` to see how you compare.
+
+Houses do a bit more at the top end. Tier 3 gets you a trophy hall and a
+workshop, and resting at home now leaves you well-rested — better the higher your
+tier. Tier 4 gets you a vault that `!sell all` can't touch, and a second pet turns
+up on its own.
+
+The town's grown too. You can hand items to each other with `!give`, and `!town`,
+`!graveyard` and `!rivals` will show you how everyone else is doing.
+
+L20 isn't the cap anymore — XP past it turns into Renown, which shows on your
+sheet and keeps climbing. And there's a new modifier every week that changes how
+the week plays; I'll tell you what's in the air in the morning.
+
+The story's been expanded into a proper campaign that runs through the zones. A
+king was emptied out so the crown could keep wearing him; he's been dead a long
+time and the debt is still accruing. `!adventure journal` to read what you've
+picked up. Misty, Robbie and Thom all have somewhere to go now, too.
+
+Loot chasing got a couple of new levers: `!adventure temper` pushes a magic item
+one rarity step up at the blacksmith, and the arena runs in seasons now, with
+titles for whoever's on top when one closes.
+
+Pete's reporting on all of it at news.parodia.dev/adventure — zone firsts, deaths,
+achievements — plus live beats in here. `!news` to read it, `!news optout` if you
+don't want your name in it.
+
+Also `!revisit <N>` if you want to double back a room, and a pile of things that
+were quietly broken now aren't.
+
+It's all live. Let me know what's broken.
+
+---
+
+## Short version (one-screen post)
+
+Big Adventure update, and the main thing is you can play it with other people now.
+
+- **Parties** — `!expedition invite @user`. Real co-op, own turns, enemies scale
+  to the group. The combat engine got rebuilt for it.
+- **Hire Pete** — `!expedition hire`. He fills the role you're missing, takes no
+  cut, and writes about it after.
+- **Duels** — `!duel @user <stake>`. Staked, nobody dies.
+- **World boss** — `!adventure worldboss`. One communal bout a day.
+- **The Shadow** — `!adventure shadow`. A rival who plays whether you do or not.
+- **Houses** — more at the top end: well-rested buff, a vault at T4, a second pet.
+- **The town's grown** — `!give`, `!town`, `!graveyard`, `!rivals`.
+- **Renown** — L20 isn't the cap anymore.
+- **A weekly modifier** — the world changes shape every week.
+- **The story's now a campaign** — a dead king, a crown still wearing him, a debt
+  still accruing. `!adventure journal`.
+- **Tempering + arena seasons** — `!adventure temper`, `!arena`.
+- **Pete's on the beat** — news.parodia.dev/adventure. `!news`.
+
+All live. Let me know what's broken.

gogobee_appservice_migration.md

@@ -0,0 +1,100 @@
+# GogoBee → Appservice Auth Migration (multi-session)
+
+Goal: move TwinBee's Matrix auth from the **MAS OAuth 2.0 device grant** (working
+stopgap) to the **full appservice transaction/push model** — the MAS-durable end
+state: no human login, no MFA, no consent, `as_token` never expires, scales at
+485+ rooms. The device grant stays behind `AUTH_MODE=masdevice` as instant
+rollback.
+
+Why the *previous* appservice attempt failed: it was a hybrid (as_token + `/sync`),
+and Synapse forbids appservice-namespace users from `/sync`. This migration
+replaces `/sync` with Synapse→bot transaction push + MSC3202/MSC2409 E2EE
+extensions, which is the supported path in mautrix v0.28.1.
+
+Keep this doc working-tree only — do NOT commit (see feedback_dont_commit_plan_mds).
+
+## Key facts established (investigation, 2026-07-03)
+
+- **HEAD 20d1f92 is MISLABELED**: commit msg says "device grant" but it only
+  deleted registration.yaml.example; committed client.go is still the FAILED
+  appservice+/sync hybrid. The real device-grant (masauth.go + client.go rewrite)
+  is UNCOMMITTED working tree — that's what runs in prod. Backed up to scratchpad.
+- mautrix v0.28.1 fully supports appservice E2EE: transaction carries
+  `to_device`/`device_lists`/`device_one_time_keys_count` (stable + msc2409/msc3202
+  unstable field names); `CreateDeviceMSC4190`; cryptohelper `MSC4190=true` mints
+  the device (no /login). HEAD's old appservice code already had auth+crypto
+  correct — only the /sync event loop was wrong.
+- To-device processing gates on `Registration.EphemeralEvents` (yaml
+  `receive_ephemeral: true`) — `appservice/http.go:133`.
+- Encrypted rooms: must feed `m.room.encryption`/`m.room.member` to the client's
+  StateStore via `mautrix.UpdateStateStore(...)` + `mach.HandleMemberEvent`, or the
+  bot sends plaintext into encrypted rooms / can't share keys.
+- Both hosts SSH-reachable: `reala@parodia.dev` (Synapse/MAS/Authentik docker),
+  `reala@192.168.1.212` (millenia, bot in screen). Retired registration at
+  `/home/reala/matrix/compose/synapse/gogobee-registration.yaml.retired-20260703-223425`.
+
+## Decisions (user, 2026-07-03)
+
+- Cutover: **AUTH_MODE flag** (keep device grant as rollback), not full replace.
+- Synapse changes: **I apply + restart, confirm right before restart**.
+
+## Session 1 — bot-side code (local, no prod risk)  ✅ DONE (build+vet green)
+
+- [x] `Config`: AuthMode + appservice fields (RegistrationPath, ListenHost/Port,
+      HomeserverDomain).
+- [x] `internal/bot/session.go`: `Session` unifying both modes (OnEventType/Run/
+      Stop); `NewSession(cfg)` dispatches on AuthMode; masdevice path wraps existing
+      device-grant NewClient + DefaultSyncer + sync loop (verbatim).
+- [x] `internal/bot/appservice.go`: LoadRegistration → CreateFull → BotClient;
+      cryptohelper MSC4190 device create; ep.OnOTK/OnDeviceList + 9 crypto to-device
+      types → crypto machine; EventEncrypted decrypt+redispatch; StateStore
+      population (encryption + members) via lazy per-room resolveRoom + UpdateStateStore
+      on member/encryption state; HTTP listener via as.Start() in goroutine.
+- [x] `main.go`: NewSession + sess.OnEventType + sess.Run; env AUTH_MODE,
+      AS_REGISTRATION, AS_LISTEN_HOST, AS_LISTEN_PORT, HOMESERVER_DOMAIN; envInt helper.
+- [x] `.env.example` documented; go.mod tidied (zerolog now direct dep).
+- [x] `go build`/`go vet` green (CGO=1 -tags goolm).
+
+New files: internal/bot/session.go, internal/bot/appservice.go. NOT yet committed.
+
+### Known correctness risks to verify in Session 3
+- **resolveRoom is lazy on inbound encrypted events only.** Scheduled/broadcast
+  posts into an encrypted room the bot hasn't received from yet would send
+  plaintext (StateStore unresolved). Mitigation for S3: prewarm the configured
+  rooms (BROADCAST_ROOMS, GAMES_ROOM, ESTEEMED_ROOM, MOD_ADMIN_ROOM, MINIFLUX_*)
+  at startup, or resolve all joined rooms once. Interactive `!` commands are
+  reply-driven so lazy resolve covers them.
+- Whether crypto machine successfully shares keys after ReplaceCachedMembers +
+  device fetch (FetchKeys) — the make-or-break, only testable against live Synapse.
+- MSC4190 device creation must succeed against MAS-fronted Synapse (untested end
+  to end; HEAD's old code used the same path but was never verified past whoami).
+
+## Session 2 — Synapse infra on parodia (touches live homeserver)
+
+- [ ] Restore gogobee-registration.yaml: set `url:` = bot tailnet addr, add
+      `receive_ephemeral: true`, `org.matrix.msc3202: true`, keep
+      `io.element.msc4190: true`, `rate_limited: false`.
+- [ ] homeserver.yaml `experimental_features`: msc2409_to_device_messages_enabled,
+      msc3202_device_masquerading, msc3202_transaction_extensions,
+      msc4190_device_management. Wire `app_service_config_files`.
+- [ ] Determine bot's headscale tailnet address on parodia (Synapse must reach the
+      bot's ListenPort). Confirm routing.
+- [ ] Backup homeserver.yaml + registration; **confirm before restart**; restart
+      matrix-synapse; check it comes back for all users.
+
+## Session 3 — cutover + E2EE verification on millenia
+
+- [ ] Copy registration to bot host; set AUTH_MODE=appservice + AS_* env.
+- [ ] rsync source + build in place (CGO=1 -tags goolm), restart screen session.
+      Remove empty local data/gogobee.db first (empty_local_db_wipes_prod).
+- [ ] Verify: transactions arrive (listener logs), whoami OK, MSC4190 device made,
+      bot responds to `!` command in a PLAINTEXT room.
+- [ ] Verify E2EE: bot decrypts an incoming encrypted-room message AND its reply
+      decrypts for a human client (encrypt-out works). This is the make-or-break.
+- [ ] If broken: AUTH_MODE=masdevice, restart → back on device grant. Then triage.
+
+## Cleanup (after proven)
+
+- Prune stale @twinbee devices, orphan MAS client, retire masauth.go or leave
+  behind the flag. Fix HEAD mislabel (the eventual commit should actually contain
+  device-grant + appservice, not the stale hybrid).

gogobee_boredom_plan.md

@@ -0,0 +1,244 @@
+# Bored Adventurers — autonomous expedition starts
+
+**Premise.** A player who stops tending their adventurer doesn't stop having an
+adventurer. After 24h with no Adventure action, the character gets restless and
+leaves on an expedition by itself. It goes with the gear it already has and the
+cheapest supplies it can afford. If you never arm it, the results are bad — and
+that's the mechanic, not a bug.
+
+## Why this is small
+
+The autopilot is already almost fully autonomous. `runAutopilotWalkDriven`
+(expedition_autorun.go:168) walks rooms, drives elite and boss fights on the real
+turn engine, auto-camps, auto-harvests, rolls day rollovers, and auto-picks a
+fork after 8h of silence. Nothing in that path ever needs a human.
+
+The one thing that still needs a human is the *start*: `!expedition start <zone>
+<loadout>` (dnd_expedition_cmd.go:281). So this feature is one new ticker that
+performs that start, plus a clock to decide when.
+
+## Decisions (locked)
+
+| Question | Answer |
+|---|---|
+| Idle clock | **Any action against Adventure**, from any interface — not Matrix chatter, not autopilot writes |
+| Threshold | 24h idle → the adventurer leaves. No warning DM. |
+| Re-trigger | After a bored run ends, another 24h of silence starts another. Forever. |
+| Zone | Easiest zone whose **level band** contains the character. Never trivial low-tier farming. |
+| "Raid-shaped" | = **multi-region** zones (underdark, dragons_lair, abyss_portal). Avoided — *unless* they're the only at-band option (L13+), then allowed. |
+| Supplies | **Lean** loadout (cheapest). Broke → no run. |
+| Gear | Never bought, never equipped. This is the whole point. |
+
+## §1 — The clock: `last_player_action_at`
+
+The existing timestamps are all unusable:
+
+- `player_meta.last_active_at` — auto-bumped on **every character save**
+  (adventure_character.go:584). The autopilot saves constantly, so a bored
+  character would refresh its own idle clock and never qualify again.
+- `user_stats.updated_at` — bumped on every Matrix message in any room
+  (stats.go:103). That's chat presence, not *game* action. Rejected per the
+  "any action against Adventure, not just in Matrix" rule.
+- `daily_activity` / `loadAdvDailyActivity` — unified across
+  `dnd_expedition_log`, so the autopilot's own walk entries count as player
+  activity. Same self-refresh problem.
+
+**New:** `player_meta.last_player_action_at DATETIME`, written *only* by
+`markPlayerAction(uid)` — a direct UPDATE, never routed through
+`saveAdvCharacter`, so no ticker or autopilot path can touch it. Any future
+non-Matrix entry point (web, Pete, API) calls the same helper.
+
+Stamped from `AdventurePlugin.OnMessage` when the message is a real player
+action: an `!` command in `advActionCommands`, or a reply to a pending
+interaction (`p.pending`, adventure.go:889 — shop/blacksmith/pet prompts).
+
+`advActionCommands` is the 47 names actually routed in `OnMessage`'s if-chain.
+Note `Commands()` (adventure.go:158) only registers **28** — it's a help
+surface, not a routing table, and is missing `expedition`, `zone`, `fight`,
+`camp`, `extract`, `resume`, and more. A test greps the `p.IsCommand(ctx.Body,
+"…")` literals out of adventure.go and asserts each one is in the set, so a
+future command can't silently fall out of the clock.
+
+## §2 — Zone pick: `pickBoredomZone(level, uid)`
+
+`zonesForLevel` is wrong for this: it filters on **tier only** and ignores the
+`LevelMin`/`LevelMax` fields that already exist on `ZoneDefinition` — which is
+why a level-1 player can currently walk into a T3 zone. The boredom picker uses
+the bands instead.
+
+1. Candidates = zones where `LevelMin <= level <= LevelMax`.
+2. Prefer **non**-multi-region (`IsMultiRegionZone`, dnd_expedition_region.go:135).
+   Among those, lowest `Tier` — the "easiest at-level" rule.
+3. Ties broken by **least-recently-started by this player**, so a bored
+   adventurer rotates zones instead of grinding one forever.
+4. If step 2 is empty, retry allowing multi-region. This only bites at L13+,
+   where `dragons_lair` and `abyss_portal` are the only at-band zones and both
+   are multi-region.
+5. Still empty → no run.
+
+Worked examples:
+
+| Level | At-band | Picked |
+|---|---|---|
+| 5 | forest_shadows, sunken_temple (T2), manor, underforge (T3) | a T2 zone |
+| 10 | underdark (multi), feywild_crossing | feywild_crossing |
+| 12 | underdark (multi), feywild (T4), dragons_lair (multi, T5) | feywild_crossing |
+| 15 | dragons_lair (multi), abyss_portal (multi) | dragons_lair — fallback fires |
+
+## §3 — The run
+
+Ticker `expeditionBoredomTicker`, 30m interval, skips the ambient quiet window.
+
+Candidates: `player_meta` rows, `alive = 1`, `COALESCE(last_player_action_at,
+created_at) < now-24h`, and `last_boredom_at` NULL or older than the 24h
+cooldown. (COALESCE on `created_at` so a character made and never played still
+qualifies, but not on its first tick.)
+
+Per-user skips, all reusing existing guards: resting lockout, seated on someone
+else's party, active expedition, resumable (extracted, pending `!resume`)
+expedition, active zone run, active combat session.
+
+CAS-claim `last_boredom_at` **before** starting, so a crash mid-start can't loop.
+Then: `loadoutPurchase(zone.Tier, LoadoutLean)` → balance check → shared
+`beginExpedition` helper → DM.
+
+A zero-supply start is impossible (`SupplyPurchase.Validate`,
+dnd_expedition_supplies.go:270, hard-rejects it), so the cheapest bored run costs
+50 coins at T1 and 250 at T5. Can't afford it → no run, one DM (rate-limited by
+the cooldown we already claimed).
+
+## §4 — Refactor: `beginExpedition`
+
+`expeditionCmdStart` is prompt-layer (:282–309) followed by a reusable
+transaction (:369–424): balance check, debit, holiday/omen freebies,
+`startExpedition`, `ensureRegionRun`, log, refund-on-failure. Extract that second
+half into `beginExpedition(uid, c, zone, purchase, reason)` so the command and
+the boredom ticker share one code path and one refund story.
+
+## §5 — Why the results will be bad (no work required)
+
+This all already exists; the feature just points it at neglected characters:
+
+- The autopilot **never buys or equips anything** — verified, no `buy`/`equip`/
+  `Debit` calls anywhere in expedition_autorun.go, expedition_autocamp.go, or
+  dnd_expedition_autopilot_harvest.go. Stale gear stays stale.
+- Lean supplies deplete fast → **Rationing** (−1 attack/skill) at 25% →
+  **Severe** (−2, long rests blocked) at 10% → **Starvation** at 0, which forces
+  an extract with a **20% coin tax** on the haul (dnd_expedition_cycle.go:140).
+- The boss-safety gate holds the autopilot out of boss rooms below 80% HP, so an
+  under-geared character stalls, camps, and burns supplies it doesn't have.
+
+The neglected adventurer grinds mediocre, half-starved runs on rusting gear and
+comes home taxed. Exactly the intent.
+
+## §6 — Streaks: no credit for a run you didn't ask for
+
+Bored runs write `dnd_expedition_log` entries, which `loadAdvDailyActivity`
+counts as player activity — so without care a bored run would **suppress the
+idle-shame DM and preserve the daily streak** for someone who hasn't shown up in
+weeks.
+
+Two halves, and only one needed fixing:
+
+- **Bumping** the streak was already safe. `engaged` reduces to
+  `LastActionDate == today|yesterday` (the `CombatActionsUsed`/
+  `HarvestActionsUsed` clauses are dead — nothing in the tree increments them),
+  and `LastActionDate` is only set by `markActedToday`, which is called only
+  from real player commands. `beginExpedition` deliberately does not call it.
+- **Shielding** was not. Both hold branches in `midnightReset` (the activity
+  oracle, and the active-expedition safety net) would spare an absent player.
+
+Fixed with `dnd_expedition.boredom` + `isBoredomDriven(uid, now)`, which requires
+*both* halves: the player hasn't acted in 24h **and** their most recent
+expedition is one the adventurer started for itself. A manually-started
+expedition still holds the streak while the autopilot walks it — that behavior is
+untouched. Reading the *most recent* expedition rather than the active one keeps
+it honest on the night after a bored run ends, when its logs would otherwise
+still read as player activity.
+
+## §7 — Robbie
+
+Robbie sweeps every non-slotted inventory item daily (ores, fish, junk,
+treasure — `robbieQualifyingItems` takes all of them unconditionally) and pays
+`Value / 4`. The autopilot deposits harvested loot straight into
+`adventure_inventory` (dnd_expedition_harvest.go:478, dnd_zone_loot.go), so:
+
+**Robbie funds the boredom loop.** Bored run → auto-harvested junk → Robbie
+converts it to coins → pays for the next lean pack → forever. The "they go broke
+and stop" poverty floor does not exist. Abandoned characters are perpetual
+motion, and that is the accepted design.
+
+What was *not* accepted was the noise: Robbie posts a public room announcement
+per visit, so every abandoned character would file a daily bulletin about
+somebody who stopped playing weeks ago. He now visits and pays silently for idle
+players (adventure_robbie.go), gated on the same clock.
+
+## §8 — The bug this nearly shipped with
+
+`playerIsIdle` originally scanned `COALESCE(last_player_action_at, created_at)`
+straight into a `*time.Time`, and `lastExpeditionByZone` scanned
+`MAX(start_date)`. **modernc.org/sqlite rebuilds a `time.Time` from the column's
+declared type, and both `COALESCE()` and `MAX()` erase it** — the value comes
+back a string and the Scan fails.
+
+`lastExpeditionByZone` failed loudly. `playerIsIdle` failed *open*: an unreadable
+row counts as idle, so it returned `true` for every player alive, including one
+who had acted an hour earlier. Shipped, that would have marched the entire server
+into dungeons at once and silenced Robbie for everybody.
+
+The unit tests missed it at first because they ran against empty tables, so the
+scan never executed. Both now select the declared columns and fold in Go.
+
+Note the asymmetry: `loadBoredomCandidates` uses `COALESCE` too and is fine —
+it's evaluated *inside* SQL and never scanned. Only Go-side scans through an
+aggregate or COALESCE lose the type.
+
+## §9 — Status
+
+Built, vetted, full suite green. **Not deployed, not committed.** Working tree
+carries: db.go (3 columns), expedition_boredom.go (new), expedition_boredom_test.go
++ expedition_boredom_clock_test.go (new), dnd_expedition_cmd.go (beginExpedition
+extraction), adventure.go (clock stamp + ticker), adventure_scheduler.go (idle
+reaper gate), adventure_robbie.go (silent for idle), twinbee_expedition_flavor.go
+(ExpeditionBoredomStart).
+
+## §10 — Verified end-to-end against prod data
+
+`internal/plugin/exercise_boredom_prod_test.go` (build tag `prodexercise`), run
+against a throwaway copy of the live DB:
+
+```
+GOGOBEE_PROD_DB_DIR=<dbcopy> go test -tags prodexercise -run TestExerciseBoredomProd -v ./internal/plugin/
+```
+
+PASS. What it actually proved, on real characters with real gear:
+
+- **The clock gates the sweep.** A control player stamped as having acted an hour
+  ago was not a candidate and was not charged; every player who departed passed
+  `playerIsIdle`. This is the assertion that would have caught the COALESCE
+  fail-open bug (§8), which is why the control arm is not optional.
+- **Real departures.** 3 of 5 candidates left. `@holymachina` (L20 cleric) →
+  `dragons_lair`, `@quack` (L4 mage) → `forest_shadows`, `@camcast` (L1) →
+  `crypt_valdris`. The other two stayed home for the right reasons and the test
+  names them: one has no character, one never finished creation.
+- **L20 into the raid, as designed.** `dragons_lair` is the only zone in
+  `@holymachina`'s band, so the fallback fired and the departure DM carried the
+  raid warning. Exactly the decision that was locked.
+- **It bought nothing.** Coins debited equal the lean pack to the coin (250 at
+  T5, 50 at T1/T2), and the equipment fingerprint is byte-identical across the
+  run.
+- **Flagged and cooled.** `boredom = 1` on every row, `isBoredomDriven` true, and
+  a second tick 30 minutes later charged nobody a second time.
+- **The autopilot walks it.** Rooms accumulate across segments.
+
+And it drew blood on the first run: **`@quack` (L4 mage, stale gear) died four
+rooms in.** That is the mechanic, working, on the very first exercise. Death is
+`Kill()` — `alive = 0`, 6h respawn, auto-revived by the scheduler ticker
+(adventure_scheduler.go:72), and `loadBoredomCandidates` requires `alive = 1`, so
+a dead adventurer sits out its six hours and then gets restless again. Death
+pauses the loop; it doesn't end it.
+
+## §11 — Status
+
+Built, vetted, full suite green, exercised end-to-end against prod data.
+**Not deployed, not committed.**

gogobee_code_review_followups.md

@@ -0,0 +1,787 @@
+# Code review follow-ups — `n1-restoration` (2026-07-10)
+
+Review scope: `git diff main...HEAD`, 99 files / ~16.7k lines (N1, N2, R1, R2, N3 P1–P7).
+Method: 8 finder angles → dedup → 1 verifier per correctness candidate.
+Baseline before and after: `go build`, `go vet`, `go test ./internal/...` all green.
+
+Working-tree doc — **do not commit** (per project convention on `gogobee_*.md`).
+
+**Status.** Fixes 1–5 shipped in `1f21156`. Deferred items **A** and **B** fixed
+2026-07-10 (`d76c63b`); A turned out to have a deeper root cause and surfaced
+three new findings, **M**, **N** and **O**. Item **C** fixed 2026-07-10 — its
+premise was wrong and the bug underneath it was worse (the seven-day resume
+window was never enforced; see below). Item **M** fixed 2026-07-10 — two of its
+three claims were wrong (the mage hooks *do* run on the turn path); the one real
+defect, Grim Harvest, had a different cause than recorded. Items **D**, **I**,
+**L**, **N** fixed. Item **K** verified 2026-07-10 — the anchor gap is a real,
+confirmed narrowing, left as an owner design call (no code change). Item **H**
+measured 2026-07-10 and **declined** — its "per-message cascade" premise was
+overstated, the hot path is already optimized, and the proposed
+`MessageContext` thread-through is disproportionate churn with a staleness
+regression surface.
+
+**All correctness work is committed.** Everything remaining is deliberate, not a
+defect: **E** (intentional, roster-size death rule), **F** (`grantAutorunGrace`
+stopgap, deferred to R5 by design), **G** (party-combat DB chatter — a perf
+refactor whose only safe fix is a fight-lifetime roster cache, i.e. the same
+staleness surface H was declined for; deferred), **H** (declined, above),
+**J** (`!sell` anchor — PLAUSIBLE, presence == any chat, left per convention),
+**K** (owner design call, above), **O** (already fixed as a side-effect of A;
+only the sim re-baseline is pending, which is operational).
+
+**Method note.** Both C and M were mis-diagnosed in the same way: the finder read
+one call site, concluded "this is the only caller", and wrote it down. Verify the
+callers before planning the fix.
+
+**Third pass (2026-07-10, `88c5fcd`).** `/code-review high --fix` over the pushed
+follow-up stack (`git diff origin/main...HEAD`, 7 commits). Five fixes shipped;
+they harden the item-C extraction work and the item-N Misty ordering rather than
+opening new ground. See "Third pass" below.
+
+---
+
+## Before you commit: split the formatting from the fixes
+
+A repo-wide `gofmt -w ./internal ./cmd` ran after the review. It reformatted
+**105 files that have nothing to do with these findings** — they were already
+non-conforming on `main` (struct-field alignment, mostly), and gofmt is
+semantics-preserving, so nothing changed behaviourally.
+
+Net state: **117 files dirty, only 13 carry review fixes.** Commit them apart, or
+the fixes become unreviewable inside a wall of realignment.
+
+The 13 fix-bearing files:
+
+```
+internal/plugin/adventure.go               *  internal/plugin/dnd_expedition_supplies.go  *
+internal/plugin/adventure_arena_season.go     internal/plugin/dnd_zone_cmd.go             *
+internal/plugin/combat_cmd.go                 internal/plugin/expedition_party.go
+internal/plugin/combat_party_turn.go          internal/plugin/expedition_party_cmd.go
+internal/plugin/dnd_expedition.go          *  internal/plugin/expedition_party_resolve.go
+internal/plugin/dnd_expedition_combat.go      internal/plugin/zone_combat_party.go
+internal/plugin/combat_engine_party_test.go
+```
+
+Plus one new file: `internal/plugin/zone_combat_party_casualty_test.go`.
+
+The four marked `*` carry **both** a fix and gofmt realignment
+(`adventure.go`, `dnd_expedition.go`, `dnd_expedition_supplies.go`,
+`dnd_zone_cmd.go`), so a clean split needs `git add -p` on those rather than a
+straight per-file split. The other nine are fix-only and can be staged whole.
+
+---
+
+## Fixed in this pass
+
+| # | File | Defect |
+|---|------|--------|
+| 1 | `combat_party_turn.go` | Settle-to-terminal dropped the entire close-out |
+| 2 | `expedition_party_cmd.go` | Party member permanently soft-locked on leader extract |
+| 3 | `expedition_party_cmd.go` | Lost update on the shared supply pool |
+| 4 | `dnd_expedition_combat.go` | Elite harvest interrupt granted no elite loot |
+| 5 | `adventure_arena_season.go` | Transient failure permanently lost a season crown |
+
+Plus cleanups: deleted dead `partySurvivors`; collapsed the `zoneCombatRoster`
+alias into `fightRoster`; `partyCasualtyLine` now uses `joinNames`; consolidated
+four copies of the expedition column projection into `expeditionSelectCols`;
+corrected two false doc comments on `applyDailyBurn`/`applyDailyBurnP`; `replyDM`
+no longer sends a blank DM.
+
+### 1. Close-out dropped when the settle turns lethal — the worst one
+
+`beginCombatTurn` calls `settleCombatSession` to resolve a phase the engine owes
+(a fight parked mid enemy-turn after a restart). That settle can end the fight.
+The old code then saw `!sess.IsActive()` and returned "you're not in a fight."
+
+The terminal status was already persisted, so nothing ever paid the party out:
+no XP, no loot, no `markAdventureDead`, no `abandonZoneRun`, no
+`forceExtractExpeditionForRunLoss`. The reaper cannot rescue it either —
+`listExpiredCombatSessions` filters `status = 'active'`, and the session is now
+terminal. The win or the death simply evaporates.
+
+The `!fight` start path and the reaper both already do settle-then-`closePartyRound`;
+`beginCombatTurn` was the one settle site that skipped it. Now it closes out and
+announces, matching them.
+
+### 2. Member soft-locked when the leader extracts and walks away
+
+`seatedExpeditionFor` (the guard) spans `status IN ('active','extracting')`.
+`expeditionForMember` (what `!expedition leave` resolved through) filtered
+`status = 'active'` only. During the leader's 7-day extracting limbo a member was
+therefore refused any new adventure by the guard, and told "No active expedition"
+by the very command the guard pointed them at. Nothing sweeps stale `extracting`
+rows, and only the *leader* can trigger the transition that clears them — so if
+the leader quit, the member was stuck forever with no self-service recovery.
+
+`!expedition leave` now resolves the seat through `seatedExpeditionFor`, so the
+exit sees every state the gate sees. (`seatedExpeditionFor` already excludes
+leaders, so they still fall through to the `!extract` message.)
+
+### 3. Lost update on the shared supply pool
+
+`updateSupplies` rewrites `supplies_json` wholesale. `expeditionCmdAccept` folded
+a new member's packs onto an `exp` snapshot read ~60 lines earlier, with no lock.
+Handlers run one goroutine per event (mautrix `AsyncHandlers`, never overridden),
+so two invitees accepting at once genuinely interleave: both read pool `P`, one
+writes `P+a`, the other `P+b` — a member's packs vanish, or spent SU is
+resurrected by the day-burn tick.
+
+Note `advUserLock` cannot fix this: it is keyed by sender, so two members take
+two different mutexes. Added `advExpeditionLock(expID)` and re-read the pool
+under it. **This closes accept-vs-accept only** — see deferred item B.
+
+### 4. Elite harvest interrupt paid standard loot
+
+`runHarvestInterrupt` computed `elite := kind == InterruptElite`, used it to pick
+an elite enemy and to pick elite narration, then passed a hardcoded `false` as
+`isElite` to `closeOutZoneWin`. Since `dropZoneLoot` gates on `isBoss || isElite`,
+beating an elite interrupt skipped the masterwork roll and used the 1.0 standard
+treasure weight instead of 2.0 — while the identical elite fought via `!zone`
+paid out correctly.
+
+Now passes the live `elite`. The param only flows into `dropZoneLoot`, so this
+adds the masterwork roll and doubles treasure weight for surviving seats; threat,
+XP, and narration are untouched. A small reward buff on a fight players already
+win, consistent with lifting trailers rather than nerfing.
+
+### 5. A failed season crown was lost permanently, not retried
+
+`arenaSeasonRollover` logged-and-`continue`d when `recordArenaSeasonTitle`
+failed, then called `db.MarkJobCompleted` unconditionally. `JobCompleted`
+short-circuits every future run for that quarter, so a transient SQLite `BUSY`
+meant the crown was never awarded — ever.
+
+`recordArenaSeasonTitle` is idempotent (`arena_season_titles` has
+`PRIMARY KEY (season, kind)`, insert is `ON CONFLICT DO NOTHING`) and a past
+season's data is frozen, so retrying is safe. The job is now marked complete only
+when no crown failed. The "no entrants" path still closes the season correctly.
+
+---
+
+## Fixed in the second pass (2026-07-10) — items A and B
+
+### A. Turn-based combat skipped achievements and post-combat subclass state
+
+The root cause was one level deeper than this doc originally recorded, and it is
+worth writing down because the surface symptom was misleading.
+
+`buildZoneCombatants` used to call `applyArmedAbility`, which applies an ability's
+mods **and then clears `c.ArmedAbility` and saves the sheet**. The turn engine
+calls that same builder again on *every* `!attack` / `!cast` / `!consume`. So in a
+turn-based fight:
+
+- Round 1's build fired the ability, spent the resource, cleared the arm flag.
+- Round 2+ rebuilt the character, found `ArmedAbility == ""`, and produced a
+  combatant with **none of the ability's mods**.
+
+A Berserker paid stamina and got exactly one round of `BerserkerRage`,
+`RageMeleeDmg`, `PhysicalResistRage`, `FrenzyDmgBonus`. Every entry in
+`dndActiveAbilities` had the same shape. `mods.BerserkerRage` was not merely
+unread at close-out — by then it no longer existed.
+
+Fixed by splitting arming into its two halves:
+
+- `consumeArmedAbility(c)` — the mutation. Disarms, saves, returns the id. Runs
+  **once**, at fight start.
+- `applyAbilityByID(c, id, mods)` — pure. No DB write, no disarm. Safe on every
+  rebuild. (No ability's `Apply` writes to the character, so this is genuinely pure.)
+- `armAbilityForFight(c, mods)` — consume + apply, for the auto-resolve callers
+  that build and fight in one breath.
+
+`buildZoneCombatants` now takes the already-consumed `armed` id and re-applies it.
+The id rides on `ActorStatuses.ArmedAbility`, seeded per seat at fight start
+(`seedActorOneShots`), so `partyCombatantsForSession` reproduces the ability on
+every rebuild and the close-out can still see that a rage fired.
+
+On top of that, the close-out itself: `postCombatBookkeeping(...)` in
+`combat_bridge.go` now carries the achievements + subclass persistence, and all
+four close-outs route through it — `runDungeonCombat`, `runZoneCombatRoster`,
+`finishCombatSession`, `finishPartyCombatSession`. The turn-based pair reach it
+via `postCombatBookkeepingForSeat`, which rebuilds the `CombatResult` the hooks
+need from the persisted session (`seatCombatResult`) and re-derives the
+fight-start mods (`seatFightStartMods`).
+
+It fires on **every** terminal status, not just a win — a Berserker who rages and
+loses is still exhausted, which is what auto-resolve always did.
+
+Also fixed in passing: `buildFightSeats` and `runZoneCombatRoster` consumed the
+armed ability *before* the checks that could sit a seat out, so a downed member
+was disarmed for a fight they never joined. The refusals now run first.
+
+**Balance note.** Turn-based Berserkers now keep rage for the whole fight instead
+of one round. That is a buff, but it is the buff the player already paid for.
+The class-balance corpus measures the auto-resolve path, so it is unmoved.
+
+New tests: `internal/plugin/combat_armed_ability_test.go` (9 cases) —
+purity/repeatability of `applyAbilityByID`, once-only consume, rage surviving
+rebuilds, the sat-out member keeping their ability, per-seat statuses isolation,
+and exhaustion on both a manual win and a manual loss.
+
+The Grim Harvest half of this item was closed separately — see item **M**.
+
+### B. The other six supply writers raced
+
+All six now go through `withExpeditionSupplies` (`dnd_expedition.go`), which takes
+`advExpeditionLock(expID)`, re-reads the expedition, hands the closure the fresh
+row, and persists what it returns:
+
+`dnd_expedition_cycle.go` (`nightRolloverBurn`, forage + burn in one write),
+`dnd_expedition_milestone.go` (`grantTwoWeeksCache`),
+`dnd_expedition_region_cmd.go` (`advanceToNextRegion` transit burn),
+`dnd_expedition_camp.go` (`campPitch`), `expedition_autocamp.go`
+(`pitchAutopilotCamp`), `expedition_ambient.go` (pack-rat drain).
+
+Fix #3's hand-rolled lock in `expeditionCmdAccept` was folded onto the same
+helper. Seven call sites, no nesting — verified none of the closure callees
+re-enter the lock (`sync.Mutex` is not reentrant).
+
+`expedition_sim.go:1421` is left alone on purpose: the sim is single-threaded and
+takes no plugin locks.
+
+The atomic-`json_set`-delta alternative is still the better long-term shape (it
+would drop the lock entirely) but it couples `updateSupplies` to the blob format.
+
+---
+
+## Third pass (2026-07-10, `88c5fcd`) — `/code-review high` on the follow-up stack
+
+Reviewed `git diff origin/main...HEAD` (the 7 pushed follow-up commits) with 8
+finder angles → dedup → 1 verifier per candidate. The removed-behavior angle came
+back empty: the close-out refactor (item D), `parseMenuIndex` (item I), the
+GrimHarvest stash (item M), and the `endRunOnLoss`/`applyOwnerWinEffects`/
+`grantSeatWinXP` extractions all verified behavior-preserving. Findings clustered
+in the new item-C extraction guard, plus one ordering nuance in the item-N Misty
+wiring. Five fixed:
+
+1. **The extraction guard fell open on a DB error.** `expeditionCmdStart`'s
+   resumable-guard did `switch n, err := partySize(pending.ID)` and gated the
+   party-blocking refusal on `case err == nil && n > 1`. A transient roster-read
+   error skipped both cases, fell through, and started a new expedition on top of
+   the still-seated party — the exact orphaning the guard exists to prevent, in
+   the one situation (a DB hiccup on the roster read) where it matters. Now checks
+   `extractionLapsed` first (pure, no DB call on the reap path) and treats a
+   `partySize` error as "assume occupied → refuse". Also drops the wasted `COUNT`
+   the old switch-init ran on the lapsed-reap path.
+
+2. **The start-path lapsed reap unseated members silently.** When a leader with a
+   lapsed party extraction ran `!expedition start`, the reap called
+   `completeExpedition(...Failed)` — which frees the roster — with no DM, unlike
+   the hourly sweeper and `!expedition abandon`, which both notify. Extracted
+   `reapLapsedExtraction(e)` (reap + notify the audience) as the single
+   reap-with-notify path; the sweeper and the start-path reap both route through
+   it, so a member is never silently unseated by whichever path reaches the row
+   first.
+
+3. **Misty's crowd swung before the concentration pulse.** Item N's new
+   `stepRoundEnd` seat-loop ran `seatEndOfRound` (crowd revenge, which can end the
+   fight) *before* the pre-existing concentration-aura tick. Concentration is
+   turn-engine-only (no auto-resolve counterpart), so this was a within-engine
+   ordering call, not a cross-engine divergence — but a caster whose lingering
+   aura would kill the enemy that round could be dropped by crowd revenge first,
+   contradicting the concentration block's own "a lethal pulse settles the fight"
+   intent. Moved the Misty seat-loop to *after* the concentration tick: a lethal
+   pulse now wins via `finish(CombatStatusWon)` before the end-of-round crowd
+   swing; on any round the pulse doesn't end the fight, both procs fire exactly as
+   before. (Owner-approved reorder — it was reported as a balance call and the
+   answer was "move it".)
+
+4. **Fourth copy of the event-log scan.** `seatCombatResult` hand-rolled a
+   `misty_heal` scan loop. Promoted the test-only `hasAction(events, action)`
+   helper to production (`combat_session_build.go`), used it there, and removed the
+   duplicate test definition.
+
+5. **New `dnd_`-prefixed file.** Renamed `dnd_expedition_extract_sweep_test.go` →
+   `expedition_extract_sweep_test.go`, per the no-new-`dnd_`-names rule (the diff's
+   three other new test files already avoided the prefix).
+
+**Reported, not fixed** (deliberate):
+
+- **Misty ordering** was the only correctness-shaped finding; the other angles
+  agreed the stack was clean. Two lower items were left: `dnd_setup.go`'s
+  respec/wipe disbands an extracted party with no member DM — but the disband is
+  intended (item C hole #3) and the missing DM is outside the reviewed lines; and
+  `abandonExpedition` re-queries the row the caller already resolved — the
+  divergence a finder posited isn't reachable (the extracted-row branch only runs
+  when no active row exists), so the extra indexed SELECT was left alone.
+
+Full plugin suite green before and after. No auto-resolve path touched, so the
+class-balance corpus and `combat_characterization.golden` do not move.
+
+---
+
+## Deferred — real, not fixed
+
+### ~~M. Mage subclass spell hooks never run in turn-based combat~~ — TWO-THIRDS MIS-STATED. Fixed 2026-07-10.
+
+**The premise was wrong.** `applyMageSubclassSpellHooks` has three non-test
+callers, not one. `resolveTurnSpell` (`dnd_spell_combat.go:341`) has called it
+since Phase 13 shipped per-round casting (`5cd343a`, 2026-05-14).
+
+So on the turn-based surface:
+
+- **Empowered Evocation** (L7, +INT to evocation damage) — *always worked.*
+- **Evocation Overchannel** (L10, ×1.5 on a 1st–5th-level slot) — *always worked.*
+
+Both only move `mods.SpellPreDamage`, which `resolveTurnSpell` returns as
+`out.EnemyDamage`. Nothing was lost.
+
+**Grim Harvest was the only real defect**, and its cause was narrower than "the
+hooks don't run": the hooks ran, wrote `mods.GrimHarvestSlot` — and
+`resolveTurnSpell` dropped that local `CombatModifiers` on the floor, because
+`turnSpellOutcome` had no field to carry it out. A Necromancy Mage who killed
+with a spell in a manual fight never healed.
+
+The stash cannot ride on fight-start mods the way it does in auto-resolve: the
+spell is cast *mid*-fight, and the turn engine rebuilds its combatants every
+round. So it rides where every other mid-fight fact rides — the casting seat's
+`ActorStatuses`:
+
+1. `turnSpellOutcome` gained `GrimHarvestSlot` / `GrimHarvestNecrotic`.
+2. `castActionForSeat` parks them on `actorStatusesPtr(seat)` when a cast lands.
+   `snapshotActor` starts from the prior snapshot, so they survive `commit()`
+   untouched, exactly as `ArmedAbility` does.
+3. `seatFightStartMods` reads them back at close-out, in place of the comment
+   that used to explain why they were permanently zero.
+
+**And the killing-blow check was wrong for this surface.** `grimHarvestHeal`
+scanned for the **first** `spell_cast` event and refused the heal if the enemy
+survived it. Auto-resolve casts once, pre-combat, so first == last there; a
+turn-based mage casts every round, so an opening cantrip that left the enemy
+standing vetoed the heal the round-3 killing spell had earned. It now scans for
+the **last** `spell_cast` — provably identical on the auto-resolve path, which is
+why the golden corpus does not move.
+
+Each damaging cast overwrites the stash, so it always describes the seat's most
+recent landed spell — the only one that can have been lethal. A miss stashes
+nothing, and a stale stash is inert because the last `spell_cast` event then
+shows the enemy alive.
+
+**Balance note.** This is a caster buff on the manual surface — 2×/3×/4× slot
+level in HP, once, on a spell kill, for L5+ Necromancy Mages. It is the buff the
+subclass was written to have and auto-resolve already paid out. Consistent with
+the standing "lift trailers" stance. The class-balance corpus measures
+auto-resolve and is unmoved.
+
+New tests: `internal/plugin/combat_grim_harvest_turn_test.go` (7 cases) — the
+stash surviving `resolveTurnSpell`, nobody-else-stashes, last-cast-not-first,
+weapon-kill-after-a-spell, the `snapshotActor` round-trip, the end-to-end heal at
+`postCombatBookkeepingForSeat`, and per-seat isolation in a party fight.
+
+### N. The NPC procs do not exist in the turn engine (RE-VERIFIED 2026-07-10 — conclusion holds, evidence corrected, scope wider) — the debuff exploit fixed 2026-07-10.
+
+**Verified before planning**, after items C and M both turned out to rest on a
+bad "only one caller" claim. This one survives, but two of its three sentences
+did not.
+
+**The `CrowdRevengeProc` exploit is now closed** (see the fix note at the end of
+this item). Closing it pulled `MistyHealProc` in with it: both are round-end
+effects, and the honest hook runs the pair rather than the debuff alone — a
+one-sided hook would have been a second parallel sibling of the kind item D
+warns about. So Misty's **heal** is now live on the turn path too. That is a
+player-favourable discovery mechanic and fits the "lift trailers" stance, so it
+ships together; only `SniperKillProc` stays turn-dead, because it is a
+pre-combat one-shot with no round-end seam to hang on.
+
+**Correction 1 — the location was wrong.** `MistyHealProc` is not read inside
+`simulatePartyWithRNG`. It is read at `combat_engine_party.go:520` inside
+`endOfRoundForSeat`, a *helper*, which is exactly the shape that made C and M
+wrong. So the question had to be asked properly: `endOfRoundForSeat` has one
+caller, `simulatePartyRound` (`:418`), which is the auto-resolve round. The turn
+engine runs its own `stepRoundEnd` and never calls it. Conclusion stands.
+`SniperKillProc` (`:102`, genuinely in `simulatePartyWithRNG`, a pre-combat
+one-shot) has no turn-engine counterpart either.
+
+**Correction 2 — the procs are built, then ignored.** `buildZoneCombatants` calls
+`DerivePlayerStats` (`combat_session_build.go:61`), which sets
+`mods.MistyHealProc` / `mods.SniperKillProc` (`combat_stats.go:180,184`) on every
+turn-based combatant. The mods are present on the struct every single round. No
+turn-engine code path reads either field. It is a dangling write, not a missing
+build.
+
+**Correction 3 — there is a third proc, and it cuts the other way.**
+`CrowdRevengeProc` (`:473`) sits in the same `endOfRoundForSeat` and is equally
+absent from the turn engine. That one is the Misty **debuff**. So the asymmetry
+is not "manual fights are worse": a buffed player loses their buff by fighting
+manually, and a debuffed player *escapes their debuff* by doing the same. The
+debuff half is the one worth caring about, because it is exploitable and needs no
+discovery to exploit — just fight everything with `!attack`.
+
+**Not gaps** — checked and explained, so nobody re-files them:
+
+- `PetAttackProc` and `SpiritWeaponProc` *are* reimplemented in the turn engine
+  (`petStrike`, `spiritWeaponStrike`), though they fire after a player action
+  rather than at round end.
+- `EnvironmentProc` is absent because `turnCombatPhase` is a single flat "Duel"
+  phase with the proc at 0 — deliberate, not dropped.
+- `HealItem`'s auto-heal never fires, but the turn engine seeds and snapshots
+  `HealChargesLeft` and gives the player `!consume` instead. Player-driven by
+  design, not a leak. (Worth confirming the charges aren't double-counted across
+  the two surfaces.)
+
+**The achievement claim held when written; the fix moved it.** At the time,
+`combat_sniper_kill` and `combat_misty_clutch` were both unreachable from a
+manual kill and `seatCombatResult` hardcoded both flags false — so "six
+achievements is really four" was correct. Wiring the heal changed that:
+`seatCombatResult` now reads `MistyHealed` back off the `misty_heal` event on the
+log (the same way `combat_pet_save` has always been detected), so
+**`combat_misty_clutch` is reachable turn-based now** — it is five, not four.
+`combat_sniper_kill` stays unreachable. The other four were always reachable:
+`combat_near_death` (computed by `seatCombatResult`), `combat_pet_save` (the turn
+engine does call `resolveEnemyAttack`, which emits `pet_whiff`),
+`combat_death_save` (`trySave` in `stepRoundEnd`), and `combat_consumable_used`
+(`combat_cmd.go:773`).
+
+(Keep this internal. Per project convention these procs are hidden discovery
+mechanics and must not surface in help text, player docs, or DMs.)
+
+**Fix (2026-07-10).** Both Misty procs were hoisted out of `endOfRoundForSeat`
+into shared helpers — `mistyCrowdRevenge` and `mistyHeal` — and a `seatEndOfRound`
+hook that runs the pair in the order the auto-resolve engine does (crowd first,
+then, if the seat survived, the heal). `endOfRoundForSeat` now calls the helpers;
+the turn engine's `stepRoundEnd` calls `seatEndOfRound` per seat, after the
+poison tick so a heal can answer the round's damage. Both helpers short-circuit
+before touching the RNG when their proc is unarmed, so a character with no Misty
+history draws exactly the dice it drew before — the sim corpus and
+`combat_characterization.golden` do not move (full suite confirms).
+
+`renderAllySeatEvent` gained a `crowd_revenge` case: an ally sees the damage land
+(silence would read as HP vanishing) but not Misty's name, matching the
+neighbouring `misty_heal`'s neutral "recovers N" — the grudge stays the owner's
+own discovery.
+
+New tests: `combat_misty_turn_test.go` (6 cases) — the crowd landing on the
+manual surface (the exploit), a lethal crowd ending a solo fight, the heal firing
+and capping, no heal for a seat the crowd just dropped, the no-RNG-when-unarmed
+property that protects the golden file, and an end-to-end wiring test through
+`advanceCombatSession` that reports `PlayerHP=40` (the shipped exploit) if the
+`stepRoundEnd` call is removed.
+
+### O. `trySimAutoArm` used to re-arm every round — sim baselines will move (NEW)
+
+Before item A's fix, `trySimAutoArm` lived inside `buildZoneCombatants`. On the
+turn-based path that meant: every rebuild re-armed the class-default ability,
+**spent another point of the resource**, and re-applied it. A simulated Fighter
+got a fresh Second Wind heal every single round until stamina ran dry; a Cleric,
+a Healing Word.
+
+`expedition-sim`'s `autoDriveCombat` drives `handleAttackCmd`, i.e. the
+turn-based path — so this inflated every turn-based sim result. It now arms once
+per fight, which is what `simAutoArmEnabled`'s own doc comment says it models
+("a competent real player who would `!arm` Second Wind before each fight").
+
+**Any expedition-sim corpus that involved turn-based combat is stale.** The
+pending final L10/L12 re-baseline should be run after this change, not before.
+The pure auto-resolve corpus (`SimulateCombat` / `simulateParty`) is unaffected —
+that path always armed exactly once.
+
+### ~~C. Members and leaders disagree about an expedition during `extracting`~~ — MIS-STATED; the real bug was worse. Fixed 2026-07-10.
+
+**The premise was wrong.** `getActiveExpedition` — the *leader's* lookup — also
+filters `status = 'active'`. During `extracting` the leader gets "no active
+expedition" from `!expedition`, `!map`, `!camp` &c. exactly as the member does.
+They already agree, and honestly so: nobody is standing in the dungeon. Widening
+`expeditionForMember` would have made the member the only player who can see a
+paused expedition. Not done, and it should not be.
+
+Reading for it surfaced the real defect underneath.
+
+**The seven-day resume window was never enforced.** `releaseParty` fires only on
+a terminal status, and `dnd_expedition.go:428` justifies skipping it for
+`extracting` by asserting "the roster is cleared when the resume window lapses
+and the row flips to `failed`". Nothing did that. The only `extracting → failed`
+transition in the tree was inside `handleResumeCmd` — a lazy expiry that runs
+only when **the leader personally types `!resume`**.
+
+So a leader who quit, forgot, or simply started a different expedition left the
+row `extracting` **forever**. `releaseParty` never ran, every member stayed
+seated, and `assertNotAdventuring` kept refusing them a run of their own. Fix #2
+gave them `!expedition leave` as an escape, which is why this was a permanent
+nag rather than a permanent soft-lock — but a player should not have to find it.
+
+Three holes, all closed:
+
+1. **No sweeper.** `sweepLapsedExtractions` (`dnd_expedition_extract.go`) reaps
+   every `extracting` row past `completed_at + 7d` through `completeExpedition`,
+   which releases the roster, and DMs the audience. Hourly ticker
+   (`expeditionExtractionSweepTicker`), plus a one-shot at `Start()` — a lapse
+   that happened while the bot was down is blocking those members *now*. The
+   audience is read before the close-out, since `completeExpedition` disbands the
+   roster `expeditionAudience` reads. `handleResumeCmd`'s lazy expiry stays, now
+   sharing the `extractionLapsed` predicate (which treats a NULL `completed_at`
+   as lapsed — it is the only clock the window has).
+
+2. **The leader could orphan their own party.** `!expedition start` checked only
+   `getActiveExpedition`, so a leader could start fresh on top of an extracted
+   row. `!resume` resolves the *newest* `extracting` row, so the old one became
+   unreachable — un-resumable, un-abandonable, roster still held. It now refuses,
+   but only when that row has a roster (`partySize > 1`); a solo extraction
+   strands nobody, so walking away from one stays a normal thing to do. A lapsed
+   row is reaped in place and the start proceeds.
+
+3. **The leader had no way out but to pay.** `expeditionCmdAbandon` resolved
+   through `activeExpeditionFor` and so could not see the extracted row it owns —
+   the leader had to buy a `!resume` just to abandon. Both it and
+   `abandonExpedition` now span `extracting` via `ownedLiveExpedition`, which
+   sorts active rows first so `expeditionCmdStart`'s run-spawn rollback still
+   tears down the row it just created rather than an older extracted one. This
+   also fixes `dnd_setup.go:394,449` for free: a leader who rerolled their
+   character used to strand their whole party.
+
+Abandoning now DMs the members too, and says the true thing when the party is
+standing in town rather than in the dungeon (supplies already spent, loot
+already banked — not "supplies are forfeit").
+
+New tests: `dnd_expedition_extract_sweep_test.go` (6 cases) — the sweep releasing
+a stranded roster, leaving a live extraction alone, the NULL-`completed_at`
+predicate, abandon reaching an extracted row and freeing the party, abandon
+preferring the active row, and the no-live-row error.
+
+Not covered: the two `expeditionCmdStart` / `expeditionCmdAbandon` refusals,
+which sit above the DM boundary. Still the `dmSink` gap.
+
+### ~~D. Two turn-based win close-outs must be kept in sync by hand~~ — effect-drift closed 2026-07-10.
+
+`finishPartyWin` (`combat_party_finish.go`) was a hand-copied sibling of the
+`CombatStatusWon` block in `finishCombatSession` (`combat_cmd.go`): mood
+scan, kill record, threat, boss threat, XP + near-death, loot, TwinBee line,
+continue hint. `finishPartyCombatSession` routes solo back to
+`finishCombatSession`, so the two must stay equivalent forever, with nothing
+forcing it. Item A was the first drift.
+
+Item A's fix already pulled the *bookkeeping* out of both into
+`postCombatBookkeepingForSeat`. This pass hoists the remaining duplicated
+**effects** into three shared helpers in `combat_party_finish.go`, and routes
+both close-outs through them:
+
+- `applyOwnerWinEffects(owner, enemyID, elite) bool` — the zone-kill record,
+  room threat, and boss-defeat threat drop; returns `bossOnExpedition`. Fires
+  once, owner-scoped (a member owns neither row).
+- `grantSeatWinXP(uid, hp, hpMax, monster, tier)` — near-death calc + XP grant.
+  Per seat (solo calls it once with seat 0).
+- `endRunOnLoss(owner, runID, death)` — mood event (death only) + `abandonZoneRun`
+  + `forceExtractExpeditionForRunLoss`, shared by both the Lost and Fled paths.
+
+What deliberately stays divergent, so this was **not** a full `closeOutSeat`
+merge: the player-facing text genuinely differs (solo "You finished at N/M HP"
+vs party "The party stands"; the party's 4-way boss/hint split vs the solo
+2-way), and the death-on-win rule is roster-size-dependent by design — solo
+`finishCombatSession` never marks a winner dead, `finishPartyWin` marks a seat
+that won from 0 HP dead. That is item E and must not be unified. So the effect
+lists are now a single copy each; the text is not.
+
+Full plugin suite green; no behavior change (helpers are extract-and-call).
+
+Note this is the *only* place the party work chose a parallel sibling. Elsewhere
+the branch is a genuine N-body generalization, not a bolt-on: `SimulateCombat` →
+`simulatePartyWithRNG`, `runCombatRound` → `runPartyCombatRound`, `runZoneCombat`
+→ `runZoneCombatRoster`, `RenderTurnRound` → `RenderPartyTurnRound`.
+
+### E. Death-on-win depends on roster size — intentional, leave it
+
+`closeOutZoneWin` marks a downed seat dead on a win only when `len(seated) > 1`.
+A solo player who wins at 0 HP (retaliate aura kills the swinger on the killing
+blow) survives; a party member in the same spot dies.
+
+This is **deliberate and documented in place** (`zone_combat_party.go:183-188`):
+unifying it would move the sim's outcome labels and force a re-baseline of
+`testdata/combat_characterization.golden`. Not a defect. Listed so the next
+person to find it doesn't "fix" it by accident.
+
+### F. `grantAutorunGrace` is a stopgap (already tracked as R5)
+
+`zone_revisit.go:172` stamps `last_autorun_at` to buy one `autoRunCooldown`
+window after a `!revisit`, because the autopilot ticker has no concept of
+position-vs-frontier and will otherwise march the party back out of the room they
+just backtracked to. The code says so itself and defers the real fix to R5. It is
+coupled to the exact value of `autoRunCooldown` and to the ticker cadence.
+
+### G. Party combat multiplies the known per-turn DB chatter
+
+Already tracked as `project_combat_session_cache_deferred`, now worse:
+
+- `partyCombatantsForSession` (`combat_session_build.go:137`) rebuilds every seat
+  from scratch on every `!attack`/`!cast`/`!consume` (~6–8 SELECTs per seat).
+  A 3-member, 5-round fight ≈ 270–360 SELECTs.
+- `rebuildRoster` (`combat_cmd.go:620`) then rebuilds *all* seats again after a
+  mid-fight buff, when only the casting seat changed.
+- `runZoneCombatRoster` (`zone_combat_party.go:73`) loads char + equipment, then
+  `buildZoneCombatants` loads both again and discards the first pair — once per
+  seat per room, on the path that fights every room.
+- `nudgeStalledPartyTurns` (`combat_party_turn.go:281`) does two session reads
+  plus a full N-seat rebuild per stalled fight, serially, on the 1-minute ticker,
+  while holding the fight lock.
+- The enemy stat block is rebuilt once per seat and kept only for seat 0 (the
+  code comments admit it). CPU-only, but pure waste.
+
+Cheapest real fix: memoize the built roster for the fight's lifetime. Mid-fight
+buffs are already tracked as `ActorStatuses` deltas and re-applied by
+`applySessionBuffs`, so stats are reproducible without re-reading the DB.
+
+### ~~H. Guard probes re-query per message~~ — MEASURED, DECLINED 2026-07-10.
+
+`isPartyMember` → `activeExpeditionFor` is up to 2 queries; `activeZoneRunFor`
+adds more. A solo player with nothing in flight costs 3 queries to conclude "not
+in a party". The original write-up said this was "repeated by each guard a
+handler consults" and proposed resolving seat/expedition/run once per message
+into `MessageContext` and threading it.
+
+**The premise was overstated, and the fix is disproportionate. Not done.**
+
+- **No per-message guard cascade exists.** `OnMessage` dispatch is strictly
+  one-handler-per-command (`if IsCommand(...) return handle(...)`). Nothing runs
+  these resolvers for *every* message; the redundancy is intra-handler only.
+- **The one hot inbound path is already optimized.** `zoneCmdAdvance` /
+  `expeditionCmdRun` call `isPartyMember` directly *by design* — the code comment
+  spells out that this avoids re-resolving the run (which `advanceOnce` is about
+  to resolve) and double-firing the §4.3 idle reap. The authors already closed the
+  hot case.
+- **The remaining 2–3× callers are cold.** A per-function scan found ≥2 resolver
+  calls only in `zoneCmdEnter`, `zoneCmdAbandon`, `expeditionCmdStart`, the status
+  impls (all one-shot commands), and `runAutopilotWalk` (5×, but it is the
+  *background* ticker path, not an inbound message). In those the calls are
+  typically a guard-check on one branch then a resolve on another — not the same
+  read twice.
+- **The proposed fix has a real regression surface.** `MessageContext` is a
+  shared cross-plugin value type (movies, vibe, miniflux, …); the resolvers are
+  free functions used at 60+ sites. Threading a resolved snapshot means changing
+  the shared type and every call site, and carrying a memo that goes stale the
+  moment a handler writes the row mid-flight — the exact staleness-bug class items
+  A/M/N just fixed. All to save a few cheap indexed local SQLite reads on a
+  low-volume bot.
+
+Cost/benefit is upside-down: high churn + a staleness regression surface for a
+negligible perf gain on paths that are mostly already optimal. Left as-is
+deliberately. Revisit only if a profiler ever shows these reads on a hot path.
+
+### ~~I. `parseTemperIndex` is the third copy of the same menu parser~~ — Fixed 2026-07-10.
+
+`adventure_temper.go` duplicated the "read leading digits, 1-indexed →
+0-indexed, bounds-check" reply parser already inlined in `resolveMagicEquipReply`
+(`magic_items_gameplay.go`) and `handleMasterworkEquipReply`
+(`adventure_masterwork.go`). Promoted the temper copy to `parseMenuIndex(reply, n)`
+and routed the other two through it.
+
+Behaviour-preserving on all three: the old `parsed` flag was redundant with the
+`idx < 0` guard (no leading digit leaves `idx=0`, then `idx--` → -1, rejected
+either way), so no input changes verdict. The **retry disagreement the doc
+flagged was deliberately left as-is** — this was a pure dedup, so magic-items and
+temper still re-store the pending interaction on a bad parse and masterwork still
+doesn't. Unifying that is a behaviour change and belongs in its own pass if
+wanted. Full plugin suite green; the existing `parseMenuIndex` table test moved
+with the rename.
+
+### J. `!sell` fires the event anchor even when nothing sold (PLAUSIBLE)
+
+`adventure.go:719` calls `maybeFireAnchoredEvent` unconditionally after
+`handleSellCmd`, so `!sell nonexistentitem` can burn the player's one daily event
+slot. Gating it needs `advSellItem`/`advSellAll` to return a `sold bool`.
+
+**Probably leave it.** The anchor's stated design is presence-based — "a moment
+the player is present and reading" — and a player who typed `!sell` and read the
+reply *is* present. That matches the project's own rule that presence means any
+chat, not a successful command. Flagged only so the choice is explicit.
+
+### K. Confirm the A6 anchor set covers the player population — CONFIRMED REAL GAP 2026-07-10.
+
+N1/A6 replaced the old "any daily-active player, any activity" mid-day event roll
+with three presence anchors: the expedition Night digest, `!sell`, and arena
+cashout. `tryTriggerEvent`'s `HasActedToday` gate was dropped with it.
+
+**The code confirms the gap is real, not hypothetical.** The three, and only
+three, `maybeFireAnchoredEvent` call sites are:
+
+1. `expedition_autorun.go:312` — the end-of-day digest, and it is gated on
+   `campDecision.Night`. A Night camp only happens on a **multi-day** expedition;
+   a single-day dungeon/`!zone` run never reaches one.
+2. `adventure.go:734` — after a `!sell` at Thom's.
+3. `adventure_arena.go:633` — after an arena cashout.
+
+So the excluded population is concrete: a player whose daily loop is
+mining / foraging / fishing / babysit / single-day dungeon, who never sells at
+Thom's, never enters the arena, and never runs a multi-day expedition, receives
+**zero** mid-day events — the roll never even happens for them. That is exactly
+the core daily-grind loop, so this is plausibly a large fraction of players, not
+an edge case.
+
+**Fourth anchor drafted 2026-07-10 (uncommitted, pending owner review).** The
+on-theme, farm-resistant home is a foreground **single-day `!zone` clear** — the
+climax DM the dungeon/harvest-via-walk player is demonstrably reading, and one
+they cannot spam (a clear costs a full walk). Implemented as:
+
+- `advEventChanceZoneClear = 0.08` in `adventure_events.go` (matches the digest;
+  it is the day's climax moment, and it is the single tuning knob).
+- `advanceResult.zoneCleared` set true only in the *full*-clear branch of
+  `advanceOnceWithOpts` (not a mid-zone region clear, which continues the run and
+  would fire per region).
+- Rolled in `zoneCmdAdvance` after the clear DM streams, via the unchanged
+  `maybeFireAnchoredEvent`. That is the foreground path only — autopilot
+  (`runAutopilotWalk`) and party members (refused earlier by `isPartyMember`)
+  never reach it. The per-day slot guard still caps everyone at one event/day.
+
+Rates (see `TestZoneClearAnchorRate`): a zone-clear-only grind player at ~2
+clears/day lands ~1.08 events/week — the same band as the fully-engaged
+digest+sell+arena player (~1.19/week, unchanged). The rare all-four-in-one-day
+player peaks at a ~1.65/week *probability* ceiling but still gets at most one
+actual event/day.
+
+**Two knobs remain the owner's call**, hence "pending review": the 0.08 chance,
+and whether a single-day zone clear is even the right anchor for the grind loop
+vs. `!resources` (rejected here as farmable — repeated `!resources` would just
+re-roll the same daily slot) or leaving the grind loop event-free by design.
+Full plugin suite green; no existing behaviour moved (the three prior anchors and
+`TestAnchoredEventWeeklyRate` are untouched).
+
+### ~~L. Dead helper: `openParty`~~ — Verified and removed 2026-07-10.
+
+Confirmed dead: a repo-wide grep found `openParty` only in `expedition_party.go`
+(the def) and `expedition_party_test.go`. The invite path goes `joinParty` →
+`seatLeader`, which runs the same `INSERT ... role 'leader' ON CONFLICT DO
+NOTHING` but reads the owner off the expedition row instead of trusting a
+passed-in id. Deleted `openParty`; the eleven test call sites now use a
+`seatLeaderFixture(t, expID)` helper that wraps `seatLeader` in a transaction
+(the owner comes from the `seedExpedition` row, which always matched the id the
+old calls passed). `seatLeader`'s doc comment absorbed the idempotency note that
+justified `openParty`. Full plugin suite green.
+
+---
+
+## Test gap worth closing — ~~the DM seam~~ CLOSED 2026-07-10
+
+`SendDM` went straight through `Base` to a live client, with no fake/sink seam,
+so the handler-level paths behind fixes #1, #2 and #5 could not be unit-tested.
+That is why the party close-out bug survived a suite this thorough: every party
+test is unit-level and stops below the DM boundary.
+
+**Fixed 2026-07-10.** Added a `MessageSink` interface and a `Base.Sink` field
+(`plugin.go`). When non-nil it captures every outbound message — both the DM
+route (`SendDM`/`SendDMID`) and the room route (`SendMessage`/`SendMessageID`,
+which is what the arena announcement actually uses) — and the live client is
+never touched. Nil in production, so behaviour is unchanged; the whole
+`internal/...` suite is green with the field added. One seam, no call-site churn:
+the 765 `SendDM`/`replyDM`/`SendMessage` sites are all downstream of these four
+methods.
+
+New tests (`message_sink_test.go`): a `captureSink` test double + `installSink`
+helper; `TestMessageSink_CapturesDMAndRoom` proving both routes divert with the
+right target/text and that the `*ID` variants report back an id; and
+`TestExpeditionCmdLeave_DMsBothEnds`, which drives the real fix-#2 handler end to
+end and asserts both DMs land (member "turned back", leader notified) — a path
+that was literally a silent no-op in a unit test before. `beginCombatTurn`'s
+terminal path and the arena rollover announcement are now reachable the same way
+(seam proven for both the DM and room routes); dedicated end-to-end tests for
+those two remain easy follow-ups if wanted.
+
+Added this pass: `TestPartyCasualtyLine_JoinsNamesLikeTheRestOfTheBot`,
+and `TestPartySurvivors_SplitsOnHPNotOnOutcome` was rewritten as
+`TestAnySurvivor_ReadsHPNotOutcome` when its helper was deleted.
+
+Added in the second pass (`combat_armed_ability_test.go`): the close-out
+bookkeeping is now reachable below the DM boundary via
+`postCombatBookkeepingForSeat(sess, seat)`, which takes a plain `*CombatSession`
+and needs no client — so item A's behaviour is directly unit-tested even though
+`finishCombatSession` itself still isn't. (The `dmSink` seam that would have
+covered `finishCombatSession` itself now exists — see above.)
+
+Not covered by tests: item B's locking. `withExpeditionSupplies` is exercised
+incidentally by the existing expedition suite, but nothing asserts the mutual
+exclusion. A `t.Parallel` accept-vs-burn race test under `-race` would.

gogobee_combat_engine_plan.md

@@ -0,0 +1,519 @@
+# Combat engine — paying off the N-body debt
+
+## Session 2026-07-11 (c) — §6 was never a balance problem
+
+**IN FLIGHT: the verification sweep is still running on millenia** (`/tmp/s6_after.jsonl`,
+10 classes × L10,L12 × 10 zones × n=25). Nothing below the diagnosis is measured yet.
+
+### Committed
+
+- `c9128fb` — §1's other half. Out-of-combat `!cast <heal> @friend`, scoped to the
+  people on your expedition. `--target` had been advertised by `!help` and swallowed
+  by the parser since SP2. Ally row is mutated with one guarded UPDATE in a
+  transaction (gifting's precedent), not a read-modify-write under a second lock:
+  two clerics healing each other would take their `advUserLock`s in opposite orders
+  and deadlock. Refunds the slot on every path that heals nobody.
+- §6 auto-cast (`zone_combat_autocast.go`) — see below. Tested, unmeasured.
+
+### The finding: cleric was not weak, it was not being played
+
+Baseline re-run on HEAD (`sim_results/s6_baseline_l10l12.jsonl`, 5000 rows) confirmed
+cleric still dead last: **46.4% vs fighter 81.4%**. §1's self-heal moved it ~0, as
+predicted. But the *shape* of the failures is the whole story:
+
+| class | cleared | **fled** | tpk |
+|---|---|---|---|
+| fighter | 407 | **0** | 93 |
+| ranger | 395 | **0** | 105 |
+| cleric | 232 | **167** | 101 |
+
+**Cleric dies LESS than mage, sorcerer or warlock.** Its entire 35pp deficit is
+*fleeing* — 167 of 500 runs end with the player alive and the expedition over.
+Instrumenting the three `stopEnded` sites: **every one of those runs died at
+`stopEnded via ROOM`** — an ordinary room fight. Not a patrol, not an elite, not the
+boss.
+
+**Root.** An ordinary room is `runZoneCombatRoster` → `SimulateCombat` on an 8-round
+clock: one breath, **no turn engine, no action picker**. The only spell that could
+ever land there was a `PendingCast` the player queued BY HAND with `!cast` before
+walking in. On autopilot nobody queues one — so for every room of every expedition, a
+caster fought with a weapon and nothing else. A cleric has no Extra Attack, a mace,
+and its whole kit unusable. Measured on the room path at L10 (loss% by entry HP):
+
+| entry HP | fighter | druid | bard | mage | sorcerer | **cleric** |
+|---|---|---|---|---|---|---|
+| 100% | 0.0% | 0.0% | 0.0% | 0.0% | 0.0% | 0.0% |
+| 70% | 0.0% | 0.0% | 0.0% | 0.0% | 1.0% | **1.5%** |
+| 35% | 0.0% | 0.0% | 0.5% | 0.5% | 10.0% | **8.0%** |
+
+Small per room — and a run is ~16 rooms, and **one loss ends the expedition**
+("the fight drags on, X outlasts you, you retreat"). It compounds into 33% of runs.
+
+**The tell.** `dnd_class_balance.go:431` — the harness the class corpus was tuned on
+— *always* hands a caster their best damage spell (`pickBestDamageSpell` +
+`applyHarnessSpellCast`) before it simulates. So the numbers that say "cleric is a
+weak class" modelled a cleric who casts; the live room modelled one who does not.
+The corpus and the game disagreed about what a cleric is.
+
+This is the same defect as everything else in this plan: **the action model is
+narrower than the kit.** §1 (the picker never healed), §3 (the companion never
+acted), Pete (`LoadDnDCharacter` → nil → `"attack"`), and now every caster in every
+room. It is not a tuning dial and it must not be fixed with one.
+
+### The change (unmeasured)
+
+`autoCastForAutoResolve` — no queued spell + a real slot in hand → cast the best
+damage spell, spend the slot, fold it in. Additive pre-damage, exactly as a
+hand-queued `PendingCast` has always been, so it stays comparable to the corpus
+rather than being a fresh mechanic.
+
+- **Slot-aware, not free.** `pickBestDamageSpell` reads `slotsForClassLevel` — the
+  *theoretical* class table. Reusing it here would be an infinite spell: the same
+  "no row to persist onto, so it arrives fresh" bug that gave the companion an
+  unlimited body ([[project_companion_free_lunches]]). The new picker reads the
+  seat's actual remaining slots and `consumeSpellSlot`s.
+- **Never upcasts.** The big slots are what the elite and the boss are for, and the
+  turn engine spends them there. A picker that nukes a goblin with a 5th-level slot
+  leaves the caster swinging a stick at the thing that matters.
+- Cleric owns no damage spell at slot 2 or 4, so those stay unspendable in rooms —
+  correct, and pinned by a test.
+- Both goldens byte-identical (they pin the engine; this changes its *inputs* at the
+  zone layer). Martials provably untouched.
+
+### When the sweep lands
+
+Read cleric's **fled** count, not just its clear rate — fled going to ~0 is the
+thing this predicts. Expect all 6 casters to move; that is the deliberate
+re-baseline. **Watch for overshoot on bard/druid** (already 67–72%): they get the
+same buff and were not the problem. If they overshoot, the lever is this picker, not
+monster scaling ([[project_difficulty_target]]).
+
+
+## Session 2026-07-11 (b) — the companion can cast, and three free lunches fell out
+
+**Committed: `01c2cb2` (§1 — the seat-scoped spellbook).** Everything below it is
+working-tree.
+
+The revisit-Pete step ("Pete cannot cast") turned out to be four separate defects
+stacked on each other. The unit tests were green for all four; only the sweep with
+a **control arm** ever told the truth. Read [[feedback_unit_tests_miss_engine_bugs]]
+and then read it again.
+
+### The one that was asked for
+
+Every spell lookup is keyed on a user id and answered by a `dnd_*` table. Pete has
+rows in none of them, by design. So `pickAutoCombatActionForSeat`'s first line —
+`LoadDnDCharacter(uid)` → nil → `return "attack"` — meant **a hired Cleric swung a
+mace, every turn, forever**. Role-fill hands a lone martial a Cleric, so that was
+the *common* case. Fixed with a seat-scoped spellbook (`combat_seat_spells.go`):
+humans delegate to the DB verbatim (both goldens byte-identical), the companion is
+answered from his synthetic sheet.
+
+### The three that were not
+
+Each of these was found by measuring, and each is the same mistake: *"he has no row
+to persist onto, so he arrives fresh."*
+
+1. **His spell slots refilled every fight.** I parked the ledger on his combat
+   *seat* — and a seat is per-session. A human rations one pool across a 30-room
+   run and gets it back at camp; rationing it **is** the caster's game. Moved to
+   `expedition_party.companion_slots_used`, refreshed at camp.
+   *(Worth ~0pp on its own — an expedition only holds ~2 real fights, so the pool
+   never binds. Correct, but not the lever. I predicted this one would be the whole
+   answer and I was wrong.)*
+2. **His body refilled every fight.** `combat_party_start.go` seated him at
+   `player.Stats.MaxHP` and the close-out skipped him with the comment *"he arrives
+   fresh next time"*. That is an infinite body: he soaked a share of every fight's
+   incoming and then reset, while the humans beside him bled all the way to camp.
+   **This was the carry.** Moved to `expedition_party.companion_hp`; healed at camp.
+3. **No autopiloted caster has ever healed itself.** `simPickAllyHeal` skipped
+   `i == seat` and bailed on `!IsParty()`. Between them: a solo cleric carries
+   `cure_wounds` for a whole run and dies with a full pool of level-1 slots. Now
+   `simPickHeal`: heal whoever is worst off, which is sometimes you.
+   **It is NOT the answer to §6, and I guessed that it would be.** It moved solo
+   66.1% → 66.2%: the picker reaches for a healing *consumable* first and the sim
+   stocks them, so a human almost never falls through to the spell. The corpus is
+   therefore undisturbed and no re-baseline is owed. Pete carries no consumables,
+   so it is his only heal — which is the reason to keep it.
+
+### What the arms actually said
+
+640 runs/arm, 10 classes × L10,L12 × 4 zones. "Like-for-like" = the leaders whose
+role-fill gives Pete a **Cleric**, compared against a human **Cleric** follower.
+
+| arm | like-for-like clear | vs solo |
+|---|---|---|
+| solo | 68.2% | — |
+| + a human cleric follower (leader's level, geared) | 79.7% | +11.5pp |
+| + Pete, HEAD (free heal, cannot cast) | 77.1% | +8.9pp |
+| + Pete, casting + free heal | **94.8%** | +26.6pp — **carry** |
+| + Pete, casting + carries his wounds | **69.5%** | +1.3pp — **useless** |
+
+**The reference arm is the whole point.** Measured against *solo*, even mace-only
+Pete looked like a carry (+8.9pp) — but parties are *designed* to be safer, so solo
+is the wrong yardstick. Measured against **a human follower**, the real finding
+appears: a gearless, level-penalized hireling was out-clearing a fully-geared human
+cleric *of the leader's own level* by 15pp. A hireling must never beat a player.
+His party fled 5 runs out of 640; the human party fled 56.
+
+### §2(a) SHIPPED — and it landed in band
+
+`055f07d`. Seats carry a **SeatWeight**; both levers (boss HP, enemy action economy)
+scale on the summed weight of the **living** seats instead of a head count. The
+weight is **level-based** — priced against the leader, times a hireling discount
+(`companionSeatWeight = 0.65`, the one tunable).
+
+**Not** a power score: HP×damage would rank a cleric below a fighter and quietly
+make every mixed *human* party easier — a difficulty regression smuggled in under a
+bug fix.
+
+The safety argument is one property: **a peer weighs exactly 1.0.** The curves
+interpolate between P8's tuned integer knots — (1, 1.0), (2, 2.4), 2n−1 from 3 up —
+so every integer input returns exactly what it always returned. Solo byte-identical,
+a party of same-level humans byte-identical, both goldens unmoved. Only an *unequal*
+roster lands between knots, which is the whole point. It also finishes §2(b): a
+downed seat now buys the enemy nothing (§2(b) fixed only the head-count half — a
+corpse still carried its full weight).
+
+| | solo | + Pete | + human cleric peer |
+|---|---|---|---|
+| like-for-like clear | 69.0% | **76.8%** (+7.8pp) | 77.6% (+8.6pp) |
+
+| band | solo | + Pete | lift |
+|---|---|---|---|
+| trailing (solo <40%) | 10.0% | 31.0% | **+21.0pp** |
+| middle | 58.9% | 76.8% | +17.9pp |
+| leading (solo ≥70%) | 93.5% | 99.2% | **+5.7pp** |
+
+Help, never a carry — and he stays below a real human of the leader's level, which
+is the invariant a hireling must never break.
+
+### How it got there (the record of being wrong)
+
+With all three free lunches gone, the same grid says (like-for-like subset):
+
+| | solo | + human cleric peer | + Pete |
+|---|---|---|---|
+| clear | 69.0% | 77.6% (+8.6pp) | **66.1% (−2.9pp)** |
+
+**Hiring him is now worse than going alone** — and that is §2, unmasked. The free
+full-heal had been paying his enemy-scaling bill for him. A below-median seat costs
+the boss +15% HP and lifts the enemy's action economy from 1 to 2.4 attacks a round,
+and he does not give that much back.
+
+I talked myself out of §2(a) mid-session, on the grounds that discounting a weak
+seat would enlarge the carry. That was right *about the buggy build* and wrong about
+the engine: with the infinite body removed, the plan's original diagnosis is exactly
+correct and the sweep now argues **for** §2(a).
+
+I talked myself **out** of §2(a) mid-session, on the grounds that discounting a weak
+seat would enlarge the carry. That was right about the *buggy build* and wrong about
+the engine: the infinite body had been paying the seat's scaling bill for it. With
+the free lunches gone, the plan's original diagnosis was exactly correct. **The
+order mattered** — §2(a) done first, on top of the free full-heal, would have made
+things worse and looked like it was working.
+
+## Still open
+
+- A dropped companion returns at 1 HP (`companionSeatHP`'s floor) rather than being
+  benched until camp. Deliberate: there is no companion-death rule and inventing one
+  inside a bug fix would have been a second feature.
+- **§6 is still open, and self-heal was NOT it.** Solo cleric is 28–34% against
+  fighter's 100% on this grid. Re-read it off the current corpus before tuning.
+- `companionSeatWeight = 0.65` is the single tunable and was not swept — it landed
+  in band on the first value tried. If Pete ever needs to be weaker, raise it.
+- Out-of-combat `!cast --target` (`dnd_cast.go`) is still self-only.
+- **Deployable now.** Hiring him is a real, bounded help at every level.
+
+
+> The party engine (N3) widened the *roster* from 1 to N but never widened the
+> *action model*, the *scaling model*, or the *test net* to match. Everything
+> below is a symptom of that one gap. Working-tree doc; do not commit
+> (feedback_dont_commit_plan_mds).
+
+## Status @ 2026-07-11 — §1–§5 SHIPPED (uncommitted, unmeasured)
+
+All five sections are implemented and the suite is green. Nothing is committed.
+
+| § | What | State |
+|---|------|-------|
+| §5 | Party golden + seat attribution | ✅ `party_characterization.golden` (1938 lines, 9 scenarios × 5 seeds) + `TestPartyCharacterization_OneSeatIsStillSolo`; sim trace gets `simTraceEvent` (seat always emitted). Wire format left alone — `TestP5Fields_StayOffSoloRows` was right and I was wrong. |
+| §3 | Engine-driven seats | ✅ `ActorStatuses.EngineDriven`, permanent, no command clears it. `beginCombatTurn` now REFUSES a command from an engine seat. `autoDriveCombat` calls `driveEngineSeat` instead of impersonating the seat. |
+| §2(b) | Living-seat action economy | ✅ `enemyActionsThisRound` counts `livingActors(st)`, not `len(st.actors)`. **Party golden moved deliberately** (survivor ends 59 HP, was 51). Solo golden byte-identical. |
+| §4 | One roster accessor | ✅ `expeditionParty()` / `partyHumans()` / `PartySeat{Kind}`. Cannot return an empty party for a solo run — that is the level-1-companion bug, pinned by `TestParty_SoloExpeditionStillHasAParty`. |
+| §1 | Ally-targeted actions | ✅ `turnActionEffect.AllyHeal/AllySeat`; `!cast cure wounds @alex` **and** `--target @alex` (the flag `!help` advertised and `parseCombatCast` silently swallowed since SP2). `simPickAllyHeal` so autopiloted/engine healers use it. Will not raise the dead. |
+
+**Both goldens hold. Solo is byte-identical throughout — the balance corpus is
+intact.**
+
+### Post-fix sweep (2026-07-11, n=750/arm on millenia)
+
+| | clear |
+|---|---|
+| solo | 48.5% |
+| solo + hired Pete | **63.9%** (+15.3pp) |
+| solo *(the 2-human cells)* | 65.7% |
+| \+ a human cleric follower | **87.7%** (+22.0pp) |
+
+Pete went from **−28pp (worse than nobody) to +15.3pp**, and the lift lands exactly
+where the plan asked for it:
+
+| band | n | mean lift |
+|---|---|---|
+| trailing cells (solo <40%) | 15 | **+28.0pp** |
+| middle (40–70%) | 3 | +5.3pp |
+| leading cells (solo ≥70%) | 12 | **+2.0pp** |
+
+That is "help, never a carry", measured rather than asserted: he rescues the
+players who were drowning and barely moves the ones who were already fine. §2(a)
+may now be unnecessary — the §2(b) fix appears to have been most of it.
+
+**⚠️ READ THE NOISE FLOOR BEFORE TRUSTING ANY CELL.** The sim is not seeded per
+cell. The same binary, same cell (bard/L10/feywild, n=25), three times:
+**36% / 56% / 56%** — a 20pp spread from RNG alone.
+
+- **Per-cell numbers at n=25 are noise.** Do not tune against them.
+- Only the **n=750 aggregates** carry signal. The solo arm's 51.9% → 48.5% drift
+  across engine versions is inside that noise band (and the solo golden is
+  byte-identical, so solo combat provably did not change).
+- Anything huge (the old fighter/L10/feywild 100% → 4%) is real; anything under
+  ~20pp on a single cell is not.
+- **Next sweep: raise `-runs` to 100+ per cell** if per-cell reads are needed.
+
+### What is NOT done
+
+- **Measurement.** The engine moved under every number in this doc. A full
+  re-sweep (solo / solo+Pete / 2-human-with-a-cleric) is in flight; every figure
+  quoted below predates §1–§5 and is now **stale**.
+- **§2(a)** — power-based enemy scaling. §2(b) only stopped corpses from buffing
+  the boss. A *weak* living seat still costs a full seat's worth of enemy scaling,
+  which is why hiring Pete could still hurt a strong leader.
+- **§6** — solo cleric bump. Blocked on the re-baseline, deliberately.
+- **Pete cannot cast.** `castActionForSeat` loads a sheet from the DB and he has
+  none by design, so a hired "Cleric" *still* cannot heal. §1 fixed human clerics;
+  the companion needs a synthetic spell pool (or to be restricted to martial
+  chassis). **This is the revisit-Pete step.**
+- Out-of-combat `!cast --target` (`dnd_cast.go`) is still self-only. Combat is
+  where it mattered; that one can follow.
+
+## Why this plan exists
+
+The Pete companion (`!expedition hire`) was built in one session and worked on
+every unit test while being, in the sweep, **worse than no companion at all**
+(solo 65% clear → solo+Pete 33%). Chasing that found four defects. Only one of
+them was Pete's. The rest were sitting in the engine, in prod, since N3:
+
+| Symptom found via the companion | Who else it affects | Root |
+|---|---|---|
+| A hired Cleric can't heal anyone | **Every human cleric in every party** | §1 |
+| A weak seat makes the party *worse* | Any under-levelled friend; every downed seat | §2 |
+| The companion lost his turn after round 1 | Any engine-driven seat, incl. away-player autopilot | §3 |
+| The companion was silently level 1 | Anything reading "the party" of a solo run | §4 |
+| Nobody noticed any of it | — | §5 |
+
+§5 is the one that matters most: **there is no party golden.** The
+characterization golden (`combat_characterization.golden`, 7468 lines) runs
+`simulateCombatWithRNG(player, enemy)` — one player, one enemy, every scenario.
+Party combat has *no* pinned behaviour, so N3 shipped a healer class that cannot
+heal and the corpus said nothing. Whatever else we do, that gets fixed.
+
+**Sequencing:** §5 first (build the net), then §1–§4 (change the engine while the
+net is under us). Doing it the other way round means changing the most heavily
+tuned code in the repo with no way to see what moved.
+
+---
+
+## §1 — Actions cannot target another seat
+
+**The bug.** Every heal in the engine is self-scoped. `MistyHealProc`/
+`MistyHealAmt` heal the actor. `HealItem`/`HealItemCharges` fire the actor's own
+sub-50% trigger. `grep` for an ally-targeted action returns nothing; the only
+seat-targeting that exists anywhere is `enemyTargetSeat` — which seat the
+*monster* swings at. A party cleric is a cleric in chassis and passives only:
+**they cannot put one hit point back on a friend.**
+
+**Root.** `PlayerAction{Kind, Effect}` (`combat_turn_engine.go:51`) has no target
+field. It was written when "the player" was unambiguous, and N3 never revisited
+it — the roster got wider, the action stayed pointed at the same two things (me,
+and the enemy).
+
+**Change.**
+- `PlayerAction` gains a target: `TargetSeat int` (−1 = the enemy, the default,
+  which keeps every existing call site meaning exactly what it means today).
+- `turnActionEffect` grows an ally-heal payload; `runPartyCombatRound` applies HP
+  deltas to `TargetSeat` rather than to the actor.
+- `!cast <spell> @user` parses a target; solo ignores it.
+- Cleric/Druid/Bard/Paladin get their heal spells actually wired to it.
+- `pickAutoCombatActionForSeat` gains a heal-the-lowest-living-seat rule, so
+  autopiloted and companion healers behave like a competent player.
+
+**This moves the golden.** It adds an action the picker can choose. Deliberate
+re-baseline, after §5.
+
+**Risk.** Touching `runPartyCombatRound` is touching the most tuned code we own.
+Mitigated by §5's party golden plus the existing solo golden staying byte-identical
+(no solo fight has a second seat to target).
+
+---
+
+## §2 — Enemy scaling counts seats, not strength
+
+**The bug.** P8 scales the enemy's action economy to the roster, and
+`partyEnemyHPScale` gives +15% HP for any roster ≥ 2. Both count **seats**. So a
+seat contributes its full cost to the enemy the moment it sits down, regardless
+of what it actually brings — and keeps contributing that cost **after it dies**.
+
+Measured, in the same cell (fighter L10, feywild):
+
+| | clear |
+|---|---|
+| solo | 100% |
+| \+ Pete as Cleric (a chassis he can't play) | 32% |
+| \+ Pete as Fighter (his best case) | 68% |
+| \+ a second *human* | 100% |
+
+A deliberately below-median body is a **net negative at every level** — the boss
+gains more than the seat gives back. That is not a Pete property. It is true of
+any under-levelled friend you invite, and of every seat that goes down early
+(the corpse keeps inflating the boss for the survivors).
+
+**Root.** The scaling model assumes every seat is a median player. Nothing
+enforces that, and two shipped features (parties, then companions) violate it.
+
+**Change — pick one, and it is a design call, not a mechanical one:**
+- **(a) Scale on contributed power, not seat count.** Enemy HP/actions scale on
+  the roster's summed effective level relative to the leader's. Correct, and it
+  fixes the under-levelled-friend case too. Most work; needs its own sweep.
+- **(b) Scale on *living* seats, re-derived per round.** Cheap, and kills the
+  dead-seat-still-inflates-the-boss bug on its own. Does not fix the
+  weak-seat case.
+- **(c) Don't scale for engine-driven seats at all.** Cheapest; makes hiring
+  strictly positive. Risks "carry", and leaves the human-party half untouched.
+
+Recommendation: **(b) now** (it is a straight bug — a dead man should not be
+buffing the boss), then **(a)** as the real fix once §5 can see it.
+
+---
+
+## §3 — Engine-driven seats are a status flag, not a concept
+
+**The bug.** A seat with nobody at the keyboard is modelled as
+`ActorStatuses.Autopilot = true`. But `beginCombatTurn` clears that flag on any
+command arriving from that seat — *"They typed, so they are here."* And
+`autoDriveCombat` drives a party by **dispatching each seat's turn as a fake chat
+command from that seat's Matrix ID**. So the autopilot driver's own move looked
+like the player coming back, cleared the latch, and the seat went inert for the
+rest of the fight.
+
+That is what made the companion stand in fights doing nothing. The same shape is
+live for away-player autopilot today, and it is only luck that a human eventually
+types something and re-latches.
+
+**Root.** There is no first-class notion of "this combatant is driven by the
+engine". Ownership of a turn is inferred from a Matrix message, which is a
+transport detail leaking into the combat engine.
+
+**Change.**
+- A seat is `DrivenBy: human | away | engine`, persisted, not a bool that any
+  command can clear. `engine` is permanent; `away` is what a keystroke clears.
+- `autoDriveCombat` stops impersonating seats. It calls the seat driver directly
+  (`driveCompanionSeat` is the shape; generalize it to any non-human seat).
+- Command handlers refuse any non-human seat outright, rather than half-working.
+
+**Bonus.** This is the prerequisite for the deferred Phase-16 "Pete runs his own
+expeditions", and for any future NPC ally.
+
+---
+
+## §4 — "the party" and "the roster" disagree
+
+**The bug.** A solo expedition has **no `expedition_party` rows** (absence means
+solo; the roster materializes on the first invite). So any code that answers
+"who is in this party?" by reading the roster gets **nobody** for a solo player
+— and a plausible-looking fallback silently takes over. That is exactly how the
+companion got hired at **level 1** for every solo player: the one case the
+feature exists for.
+
+**Root.** Two representations of the same fact ("who is on this expedition") that
+disagree in the solo case, with no single accessor. `partySize()` and
+`partyMembers()` and `expeditionAudience()` and `expeditionSeats()` and
+`fightRoster()` all answer slightly different questions and are easy to reach for
+by the wrong name — I reached for the wrong one twice while building the
+companion, once fixed by a test and once only by a 1500-run sweep.
+
+**Change.** One accessor that always includes the owner —
+`expeditionParty(expeditionID) []Member` with `Member.Kind = leader|member|companion`
+— and every consumer derives its own view from it (mail excludes companions,
+seats include them, supply burn counts mouths). Delete the ad-hoc set.
+
+---
+
+## §5 — There is no party golden (do this first)
+
+**The bug.** `TestCombatCharacterization` pins *solo* combat, exhaustively (57
+scenarios × seeds). Party combat has nothing. The entire N3 engine — initiative,
+seat order, enemy targeting, action economy, close-out — is unpinned. That is why
+a healer class that cannot heal shipped without a single test going red, and why
+the companion's collapse was invisible until a 1500-run sweep.
+
+**Change.**
+- `TestPartyCharacterization` + `party_characterization.golden`: N-seat rosters
+  (2 and 3), mixed classes, downed seats, an engine-driven seat, seeded and
+  byte-pinned exactly like the solo one.
+- A **balance regression sweep** in CI-able form: the `expedition-sim` matrix at
+  low n, asserting clear-rates stay inside a band. The sweep is what caught all
+  of this; it should not have to be run by hand.
+- Fix event seat attribution: `CombatEvent.Seat` is `omitempty`, so seat 0 and
+  "no seat" are indistinguishable in a trace — which cost real time during this
+  investigation, sending me after a phantom "Pete never swings" bug that was
+  partly a reporting artifact.
+
+---
+
+## §6 — Clerics are weak in solo (raised 2026-07-11)
+
+Separate from the party gap, and real: the class corpus has cleric in the 46–56%
+band against fighter's ~82% ([[project_d8prereq_baseline]]).
+
+**Do not tune this yet, and specifically do not tune it in isolation.** Two
+reasons:
+
+1. §1 *is* the cleric fix in party play — an ally-targeted heal is the class's
+   entire identity, and today they cannot use it on anybody. Whatever solo gap
+   remains should be measured **after** that lands, or we buff them twice.
+2. `d8prereq_corpus` predates parties entirely and the party engine has moved
+   twice today (§2b, and §1 next). It is a stale baseline. **Re-baseline first**,
+   then read the cleric gap off the new corpus.
+
+Then, if solo cleric is still short: lift the trailer, per the standing rule
+([[project_difficulty_target]]) — do not nerf the martial leaders and do not touch
+monster scaling.
+
+## Ordering
+
+1. **§5** — build the net. Party golden + seat attribution. No behaviour change.
+2. **§3** — engine-driven seats. Contained, no balance impact, unblocks the rest.
+3. **§2(b)** — living-seat scaling. Straight bug fix; party golden will move once,
+   deliberately.
+4. **§4** — unify the roster accessor. Mechanical, guarded by §5.
+5. **§1** — ally-targeted actions + heals. The big one. Moves both goldens;
+   re-baseline the class corpus after ([[project_d8prereq_baseline]] predates
+   parties entirely and is due anyway).
+6. **§2(a)** — power-based scaling, then re-sweep the companion and re-decide his
+   below-median premise. It may not need to survive: once the boss stops
+   overcharging for him, "below median" may be exactly right.
+
+## Meanwhile: the companion
+
+He is **fixed and net-positive where he is meant to be** (+15.7pp in trailing
+cells, ~neutral overall), but he still regresses strong solo leaders (§2) and
+role-fill still hands martials a Cleric who cannot heal (§1). Two options until
+this plan lands:
+
+- **Ship him martial-only** (he plays chassis he can actually use — measured
+  32% → 68%), and let §1 restore the healer fill later. Honest, cheap, no engine
+  change.
+- **Hold him** until §1/§2 land, and announce the rest of Adventure without him.
+
+Do NOT bandaid by hand-tuning his stats until he "looks right" — his numbers are
+not the problem, and tuning them would bake the engine's bugs into his stat block.

gogobee_mischief_plan.md

@@ -0,0 +1,356 @@
+# Mischief Makers — paid monster hits on live expeditions
+
+Working-tree plan doc. Do not commit.
+
+## The pitch (restated)
+
+Parodia members spend euros to send a monster — grunt / mob / elite / boss — at a
+player who is out on an expedition. Orders come from Pete's Adventure web page
+(and from Matrix). The games room hears that a contract is out and gets a window
+to help the target… or "help" them. Surviving an attempt pays the target.
+
+## What the codebase already gives us (verified 2026-07-13)
+
+| Need | Existing machinery |
+|---|---|
+| Currency + escrow | `EuroPlugin.Debit/Credit` (`euro.go:364,:395`), duel escrow pattern (`adventure_duel.go:422,:529,:667`), community pot (`adventure_rival.go:193-241`) |
+| "Is X out right now?" | `getActiveExpedition` (`dnd_expedition.go:215`), roster already pushed to Pete every 2 min |
+| Mid-run combat injection | `runHarvestInterrupt` (`dnd_expedition_combat.go:121`) — picks enemy, surprise nick, `runZoneCombatRoster`, full win/retreat/death close-out. **This is the template.** |
+| Safe-delivery gating | ambient ticker's CAS claim + `hasActiveCombatSession` + quiet-window checks (`expedition_ambient.go:97,:109,:156`) |
+| Grunt→boss ladder | Arena tiers 1–5 (`adventure_arena_monsters.go`), `arenaMonsterToTemplate` (`:251`); zone pools tag `IsElite` |
+| Games-room announce | `gamesRoom()` + world-boss announce helpers (`adventure_worldboss.go:528-566`) |
+| Respond-within-window | duel challenge window + atomic single-winner claim (`adventure_duel.go:43,:85`) |
+| Survival payout kit | `euro.Credit`, `rollAdvTreasureDrop`, `consumableCache`, renown, world-boss payout bundle (`adventure_worldboss.go:466-493`) |
+| Pete pipe | durable fact queue, bearer auth, event-type taxonomy; **strictly one-way gogobee→Pete today** |
+
+Hard constraint (Pete `internal/web/roster.go:23-25`): *"Pete has no route back
+into the game box's network and we are not opening one."* We honor that: the web
+storefront stores orders in Pete's DB and **gogobee polls Pete** (gogobee stays
+the only initiator, same tailnet + bearer pattern as ingest, just a GET).
+
+## Design
+
+### Contract lifecycle
+
+```
+placed ──announce──▶ open (help/"help" window, default 60 min)
+   │                    │
+   │                    ├──▶ delivered  (next safe tick: target active, no combat,
+   │                    │                not in briefing/recap quiet window)
+   │                    │       ├── target survives  → SURVIVED payout + unseal buyer
+   │                    │       └── target defeated  → DOWNED consequences
+   │                    └──▶ fizzled    (expedition ended first → refund minus rake)
+   └── rejected at claim time (funds/eligibility) → never announced
+```
+
+- New table `mischief_contracts`: id, buyer_id, target_id, tier, fee, status
+  (`pending|open|delivered|fizzled|rejected`), signed (bool), escalation_count,
+  blessing json, source (`matrix|web`), created_at, window_ends_at, resolved_at.
+  Status transitions via conditional UPDATE (CAS), mirroring `deliverAmbient`.
+- One live contract per target at a time; delivery fires from a sibling of the
+  ambient ticker after `window_ends_at`.
+
+### The four tiers — PRICED (M0 done 2026-07-13)
+
+Monster strength is **relative to the target**: pull from the target's own
+bracket **zone pools** (grunt/mob = non-elite, elite = `IsElite`, boss = the
+zone boss). NOT the arena ladder — arena `BaseLethality` is a legacy death
+chance; arena T5 one-shots L20s and would make every tier an execution.
+
+**M0 survival sweep** (n=2000/cell, `SimulateCombat` via the class-balance
+harness builds at full HP, zone-pool monsters, ambush nick on elite/boss;
+throwaway harness left skip-gated at
+`internal/plugin/mischief_pricing_sweep_test.go`, env `MISCHIEF_SWEEP=1`):
+
+| target build | grunt | mob (3 chained) | elite | boss |
+|---|---|---|---|---|
+| paladin L1 | 99.8% | 98.2% | 57.6% | 15.3% |
+| mage L4 | 100% | 97.8% | 49.5% | 0.0% |
+| mage L8 evoc | 100% | 100% | 56.5% | 0.4% |
+| fighter L12 champ | 100% | 100% | 100% | 99.9% |
+| rogue L20 AT (prosolis) | 100% | 100% | 100% | 35.9% |
+| cleric L20 life (holymachina) | 100% | 100% | 100% | 14.1% |
+
+Reading: grunt/mob are pure theater (+HP/supply attrition); elite is a real
+coin-flip for at-bracket targets and trivial for overleveled martials; boss is
+expedition-ending for casters at any level and a genuine 1-in-3 scare even for
+the L20 rogue. Caveats: harness builds ≠ real sheets, full-HP-at-delivery is
+optimistic (mid-run wounds raise real danger), no pets/party/consumables.
+
+**Prod economy snapshot** (2026-07-13, 23 wallets): median balance ≈ €500;
+whales prosolis €180k / holymachina €149k / nonk €62k hold 89% of all money.
+Daily earn: whales ~€1.8–2.3k, mid-tier €20–500, casuals <€10. Reference
+sinks: lottery ticket €100, duel escrow €1.5–5k, daily share ~€455, endgame
+shop items €11–45k. Only 5 characters exist as targets (two L20s, L4, two
+L1s) — the whales are both the richest buyers *and* the only high-bracket
+targets, so boss-tier is effectively their PvP toy; casuals buy theater.
+
+| Tier | Fee | Signed (+25%) | Survival payout (of fee) | Extras on survival |
+|---|---|---|---|---|
+| grunt | €40 | €50 | 40% → €16 | flavor line |
+| mob | €100 | €125 | 50% → €50 | treasure roll (standard) |
+| elite | €350 | €438 | 65% → €228 | treasure roll (elite) + renown |
+| boss | €1,200 | €1,500 | 75% → €900 | elite treasure + consumable cache + renown + Pete milestone |
+
+Rationale: grunt under the lottery-ticket impulse line so anyone can play;
+mob = exactly one lottery ticket; elite ≈ one active day of mid-tier earnings
+(a considered purchase, and its ~50% at-bracket survival odds are honest
+stakes); boss in duel-stake territory — whale money, priced like the "end an
+expedition" button it is against caster targets. Escalation cost = the
+tier-delta fee; blessings €25 flat.
+
+Anti-collusion invariant: **total payout (fee + escalations) capped at 75%**
+in every case, so collusion is strictly dominated by `!baltransfer`, which is
+free. No danger multiplier needed — the cap does all the work.
+
+Money flow: survival payout to target, remainder → community pot. Defeat →
+entire fee to community pot (never back to the buyer — glory only). Fizzle →
+90% refund, 10% rake to pot.
+
+Boss-tier friction (0–14% caster survival means "boss ≈ certain maiming"):
+max 1 boss contract per target per week, on top of the global limits below.
+
+### Death policy (recommendation: mischief maims, it doesn't murder)
+
+`runHarvestInterrupt`'s loss path perma-kills (`abandonZoneRun` +
+`forcedExtractExpedition` + mark dead). For a *purchased* attack that lands
+while the victim is offline, perma-death feels like paid murder, not mischief.
+Recommended: on defeat, apply the world-boss HP floor (`worldBossFloorHP`
+pattern), force-extract the expedition (run-loss seam already exists), drop a
+chunk of un-banked expedition coins/supplies, +threat. Character lives.
+**Open decision** — could make boss tier lethal for stakes, but then it needs an
+opt-in (hardcore flag) or it's a griefing lever.
+
+### Anonymity + the unseal twist
+
+Default: contracts are anonymous — "someone in town has put coin on
+<target>'s head." Buyer can pay +25% to *sign* it (taunt rights).
+**If the target survives, the contract is unsealed** — Pete names the buyer in
+the survival bulletin. Risk of exposure is the natural brake on casual griefing,
+and it makes survival announcements delicious.
+
+### The games-room window (help or "help")
+
+On placement, announce in `GAMES_ROOM` (world-boss style) + Pete priority beat.
+During the window (default 60 min):
+
+- `!mischief bless @target` — pay a small fee (~€15) for temp HP / +AC on the
+  incoming fight (well-rested-style bundle). Stacks, capped (say 3 blessings).
+- `!mischief escalate @target` — pay ~half the next-tier delta to bump the
+  contract one tier, max one step total, boss can't escalate. Escalation money
+  joins the payout escrow — piling on raises the target's survival jackpot.
+- Victim gets a TwinBee DM (first person, per voice rules): word has reached
+  them that someone wants them dead. Pure flavor — expeditions are autonomous —
+  but it lets them rally blessings.
+
+Blessing/escalation state lives on the contract row (real rows, no phantom
+per-fight state — lesson from the companion free-lunch bugs).
+
+### Delivery mechanics
+
+New `runMischiefInterrupt`, modeled line-for-line on `runHarvestInterrupt`:
+pick monster per tier table → apply blessings to the roster → surprise nick
+(attacker's privilege) → `runZoneCombatRoster(fightRoster(target), …)` → custom
+close-out. Do **not** call `recordZoneKill`/advance zone state — the fight is
+extrinsic to the dungeon. Party seats fight together and earn seat XP as usual;
+the survival purse goes to the target (leader).
+
+Fizzle: if the expedition ends before delivery, refund fee minus 10% rake
+(deadpan Pete line: the monster arrived to an empty dungeon).
+
+### Rate limits & eligibility (anti-grief)
+
+- Target must have an active expedition **and** be level ≥ 3 (or similar floor).
+- One live contract per target; per-target cooldown 24 h after resolution.
+- Per-buyer cap: 2 contracts/day. Can't target yourself. Escrow debited at
+  placement via `euro.Debit` (respects the debt floor for free).
+- Boredom-ticker auto-expeditions: **targetable** (they're real runs and it's
+  funny), but revisit if it feels bad in practice.
+- Opt-out: none for v1 — being in the world means being in the world — but keep
+  the decision explicitly revisitable. News anonymization (`!news optout`)
+  still applies to Pete-facing names as it does today.
+
+### Pete web storefront (the reverse pipe)
+
+**Decision (2026-07-13): mischief UI requires Authentik sign-in on Pete.**
+Pete's OIDC layer already exists (`[web.auth]`, disabled by default) and the
+callback already parses `preferred_username` from the ID token
+(`auth.go:236-250`) — it just isn't persisted into the `pete_session` cookie.
+**VERIFIED 2026-07-13** on parodia.dev (`matrix-mas-1`,
+`/home/reala/matrix/compose/mas/config.yaml`): MAS imports localpart with
+`action: require, template: '{{ user.preferred_username }}'` — so
+**Authentik username == Matrix localpart**, guaranteed. Identity is free:
+add PreferredUsername to `SessionUser`, gogobee maps it to
+`@<username>:<server>` (lowercase it — Matrix localparts must be lowercase,
+Authentik usernames may not be). No link codes.
+
+The one-way *network* rule (`roster.go:23-25`) stays intact — both new data
+flows are gogobee-initiated:
+
+- **Balances out (push):** gogobee already pushes a roster snapshot every
+  2 min; add euro-balance entries for linked users on the same tick. Pete
+  renders "~€X" and greys out unaffordable tiers. Advisory only; up to 2 min
+  stale is fine.
+- **Orders in (poll):** signed-in buyer POSTs the order form → `mischief_orders`
+  row in pete.db keyed by preferred_username, status `pending`. gogobee's
+  peteclient grows a poll loop: `GET /api/mischief/pending` (bearer) every
+  30 s, claims each order (`POST /api/mischief/claim`, idempotent on order
+  GUID), then validates in-game.
+- **Money truth lives only in gogobee:** the authoritative check is
+  `euro.Debit` at claim time. A stale web balance just means an occasional
+  "order bounced — insufficient funds" status (rendered from a fact) + TwinBee
+  DM to the buyer. Pete never writes a balance, so no double-spend surface.
+
+Order targets: roster board (already live on `/adventure`) grows a "send
+trouble" button per entry (roster token identifies the target — already
+stable + non-deanonymizing). Pete renders order status from resulting facts,
+never from live game state.
+
+Ops note: enabling `[web.auth]` on prod Pete needs the Authentik OAuth client
+provisioned + config.toml edit on the box (config is box-only).
+
+### New Pete event types (deploy Pete FIRST — unknown types 400 → park forever)
+
+`mischief_contract` (priority: a hit is out, tier, anonymous-or-signed),
+`mischief_survived` (priority: target thwarted it — unseal buyer here),
+`mischief_downed` (priority), `mischief_fizzled` (bulletin),
+`mischief_link` (internal, no render — or handle out-of-band). Deadpan voice
+throughout; check `adventure_flavor_*.go` for reusable lines before writing new
+flavor (standing rule).
+
+## Phases
+
+- **M0 — price the tiers. DONE 2026-07-13** (single-fight sweep + prod
+  economy snapshot; see tier table above). Follow-up for M1 close-out: re-run
+  the sweep through the *real* delivery path once `runMischiefInterrupt`
+  exists, since full-HP single fights understate mid-run danger.
+- **M1 — core engine, Matrix-only. DONE 2026-07-13 (uncommitted, not deployed).**
+  `adventure_mischief.go` (tiers/pricing/persistence/eligibility/`!mischief`),
+  `adventure_mischief_deliver.go` (ticker + `runMischiefInterrupt` + close-outs),
+  `mischief_contracts` table, Pete's 4 `mischief_*` event types. 17 tests,
+  4 of them end-to-end through the real fight + euro + extraction.
+
+  Decisions taken during implementation (all inside the plan's intent):
+  - **Bracket monster-selection promoted out of the M0 test** into prod
+    (`mischiefBracketZone`/`mischiefMonsters`), so the sweep and the live
+    delivery now drive *the same* selection code — the fee table can't drift
+    away from the fight it priced.
+  - **Survival is read off the target's HP, not `PlayerWon`.** The engine's
+    timeout is a retreat, not a lethal blow: a target who ran out the clock
+    with HP left held the thing off, and a bought monster that merely outlasted
+    them hasn't earned a maiming. (M0 counted `!PlayerWon` as death, so real
+    survival rates are a touch *better* than priced. Pricing stands.)
+  - **No-perma-death extended to the whole party** (`floorMischiefRoster`, run
+    on BOTH outcomes). A leader can win a fight their friend went down in, and
+    the delivery skips `closeOutZoneWin` — without the floor, the member is left
+    alive at 0 HP, which every `HPCurrent <= 0` gate reads as broken.
+  - **One-live-contract-per-target is a partial UNIQUE INDEX**, not a read-then-
+    write check: placement holds only the *buyer's* lock, so two buyers racing at
+    one victim would both pass an in-code check. The loser is refunded.
+  - **Stale-delivery sweep** (`delivering` + 15 min grace → full refund). Without
+    it a crash mid-fight strands the row: target permanently un-targetable,
+    buyer's money gone.
+  - All contract timestamps bind as Go `time.Time` — never `CURRENT_TIMESTAMP`.
+    The driver stores RFC3339 (`2026-07-14T03:48:52Z`); a SQL-side stamp writes
+    `2026-07-14 03:48:52`, and the two compare lexicographically wrong.
+  - Fizzle DMs + rake, 90% refund; unstageable/stranded contracts refund 100%
+    (our fault, not a bet they lost).
+
+  **M1 close-out sweep DONE 2026-07-13** (`mischief_delivery_sweep_test.go`,
+  `MISCHIEF_SWEEP=1`, n=400/cell, 108 cells through the REAL delivery path:
+  `runMischiefInterrupt` → `runZoneCombatRoster`). Arms: entry HP 100/70/40%
+  (100% = control, reproduces M0 through the new path) × wards 0/3 on elite+boss.
+
+  | target | tier | 100% HP | 70% HP | 40% HP | 70% +3 wards |
+  |---|---|---|---|---|---|
+  | paladin L3 | elite | 84.8% | 73.2% | 62.7% | 80.5% |
+  | paladin L3 | boss | 87.8% | 45.8% | 8.0% | 88.0% |
+  | mage L4 | elite | 66.0% | 29.5% | 4.0% | 64.0% |
+  | mage L8 evoc | elite | 90.2% | 72.2% | 15.0% | 84.2% |
+  | mage L8 evoc | boss | 6.5% | 2.0% | 0.2% | 7.8% |
+  | fighter L12 | boss | 88.2% | 48.0% | 6.8% | 89.8% |
+  | rogue L20 | boss | 19.2% | 2.0% | 0.0% | 18.5% |
+  | cleric L20 | boss | 42.0% | 6.0% | 0.0% | 42.8% |
+
+  (grunt/mob: 100% for everyone except mage L4, who can lose a wounded mob.)
+
+  Three findings:
+  - **The M0 table was priced on a fight we don't deliver.** The control arm
+    diverges from M0 in BOTH directions: up where an engine timeout now counts as
+    survival (paladin boss 15→88%), and *down* where the turn engine loops a
+    boss's full multiattack profile and `SimulateCombat` doesn't (fighter boss
+    99.9→88%, rogue boss 36→19%) — see [[project_sim_multiattack_gap]]. Fees kept
+    (the tiers still do what they were priced to do); this table is now the
+    reference.
+  - **Wounding is the dominant variable, and M0 was blind to it.** Boss at a
+    realistic mid-run 70% HP collapses across the board (fighter 88→48, cleric
+    42→6, rogue 19→2); at 40% it is near-zero for everyone. Boss really is the
+    "end their expedition" button, as priced.
+  - **Wards were too cheap** (see M2 below): 3 of them buy ~+40pp.
+- **M2 — the window. DONE 2026-07-13.** `!mischief bless @user` (€25, cap 3,
+  +10% MaxHP temp HP each) · `!mischief escalate @user` (pays the tier delta,
+  one step, boss is the ceiling) · victim DM on placement · escalator unsealed
+  alongside the buyer on survival. 6 new tests (22 total).
+
+  Decisions taken during implementation:
+  - **Blessing fee is a pure sink** (community pot), never a purse top-up. If a
+    ward raised the payout basis, warding a friend would become a money-routing
+    move; buying them HP can't be.
+  - **Ward price scales with the contract** — `max(€25, 10% of fee)`: grunt/mob
+    €25, elite €35, boss €120 (€360 to cover someone completely). The close-out
+    sweep measured 3 wards at ~+40pp (fighter vs boss at 70% HP: 48→90%), so a
+    flat €25 let the room halve a €1,200 boss contract for €75 — pocket change
+    against the tier the whole economy rests on. Reads the contract's *current*
+    basis, so an escalation raises the price of saving its target too. The €25
+    floor is knowingly above-market at grunt (3 wards > the €40 fee): nothing
+    needs warding against theatre, and the floor exists to keep a ward an impulse.
+  - **Escalation raises `fee` (the payout basis) AND `paid` together**, so the
+    75% cap and "purse < outlay" survive an escalation untouched — asserted.
+  - **Escalating into boss answers to the boss-per-target-per-week cap.**
+    Otherwise the cap is bought around for the price of an elite plus the delta.
+  - **Both window commands are CAS-then-refund**, like placement: the ward cap and
+    the one-step limit live in the UPDATE's WHERE clause, because a scramble is
+    exactly when four people press the button in the same second.
+  - **The delivery re-reads the contract AFTER claiming it.** The due-sweep's copy
+    is stale by construction — the window keeps writing to an open row up to the
+    claim, so a last-second escalation was paid for and then delivered the *old*
+    tier's monster. The claim is the fence. (Fixed + regression test.)
+  - **The ward is temp HP** (the well-rested mechanism), added to whatever cushion
+    the target already carried and subtracted again after the fight — a bought ward
+    must not eat a home long rest. It refreshes per link of the mob chain; that only
+    affects the one tier the sweep priced as theatre.
+  - Blessers are named on the spot (helping is proud); escalators are anonymous
+    until the survival unseals them, exactly like the buyer.
+  - Fizzled/unstageable contracts do **not** refund blessers. Their €25 was charity,
+    and it went to the pot. Revisit if it stings in practice.
+  - Fixed a pre-existing wall-clock flake in the M1 fizzle test: it drove
+    `fireMischiefDeliveries` with `time.Now()`, which refuses to run inside the
+    ±1 h quiet windows around the 06:00 briefing and 21:00 recap.
+- **M3 — Pete storefront (1 session, cross-repo).** Enable + extend OIDC
+  (persist preferred_username; provision Authentik client), orders table +
+  form + status rendering, balance push, gogobee poll/claim loop. First
+  visitor-facing write path on Pete — auth-gated + rate-limited per user.
+  (MAS localpart == Authentik preferred_username: verified 2026-07-13.)
+- **M4 — polish.** Notoriety/renown for buyers, survival streaks → milestones,
+  digest lines, boredom-expedition policy review, tune fees from live data.
+
+## Decisions — ALL CONFIRMED by reala 2026-07-13
+
+1. **No perma-death anywhere** — mischief maims: HP floor + force-extract +
+   un-banked loot/supply loss + threat bump. Boss tier included.
+2. **Anonymous by default; survival unseals the buyer** in Pete's bulletin;
+   +25% to sign openly.
+3. **Fizzle refund 90%**, 10% rake to community pot.
+4. **Targets: level ≥ 3 with an active expedition**; boredom auto-runs are
+   fair game. One live contract per target, 24 h post-resolution cooldown,
+   2 contracts/day per buyer, 1 boss/target/week.
+5. **Fee/payout table as priced above** (M0 sweep + prod economy).
+
+## Standing-rule checklist
+
+- No new `dnd_`-prefixed files/tables → `adventure_mischief*.go`, `mischief_*` tables.
+- TwinBee first-person; Pete deadpan third-person announcer.
+- Plan doc stays working-tree only.
+- Pete deploys before gogobee whenever event types change.
+- Sim sweeps: control arm + n≥750; run heavy sweeps on Parodia/millenia.
+- Any loader/bootstrap added must keep its backfill as a one-shot bootstrap.

gogobee_revisit_plan.md

@@ -0,0 +1,267 @@
+# Revisit / Backtrack Navigation — Design Plan
+
+Lets players walk back to previously visited rooms within an active zone
+run to re-harvest, re-fork (e.g. after acquiring a key), or pick up
+something they skipped. Forward-only navigation has been the rule since
+Phase G; this plan retires that assumption deliberately.
+
+## Goals
+
+- Re-harvest depleted nodes after a long rest (primary use case).
+- Allow general exploration freedom — wander back, look around.
+- Re-pick a fork after acquiring a key or changing strategy.
+- Preserve the existing pacing pressure (threat clock, SU drain) but
+  make backtracking *cheaper* than fresh exploration to reflect that
+  the route is already known.
+
+## Non-goals
+
+- Teleporting to arbitrary discovered rooms.
+- Backtracking during `!expedition run` autopilot (autopilot is
+  forward-only by design).
+- Re-fighting cleared encounters or re-arming disarmed traps.
+
+## Player-facing surface
+
+- **`!revisit <N>`** — walks one edge from the current node toward a
+  previously-visited node. `N` is the 1-indexed room number printed in
+  `!map`'s Path strip.
+  - Must be in `VisitedNodes`.
+  - Must be adjacent to `CurrentNode` via an edge in the zone graph
+    (forward or reverse direction; graph edges are directed but we
+    allow reverse traversal for revisit).
+  - Costs threat and SU at a reduced rate (see Cost Model).
+  - No combat re-roll, no trap re-arm in cleared rooms.
+
+- **`!map`** — already shows the numbered Path strip; players read N
+  from there.
+
+- **`!zone advance`** post-revisit — unchanged. From any node, picks
+  the first outgoing edge (or shows the fork prompt). Re-forking a
+  previously-resolved fork node clears the prior choice silently.
+
+## Cost model
+
+> **CORRECTED 2026-07-09 during R1.** The table below originally claimed a
+> fresh `!zone advance` costs +2 threat / −1.0 SU. It does not. Verified at
+> HEAD: **movement itself is free.** There is no per-room tick anywhere.
+> - **Supplies burn per *day*,** not per room — `applyDailyBurn` is called
+>   only from `dnd_expedition_cycle.go:108` (the day rollover),
+>   `dnd_expedition_extract.go:52`, and region transit. Never from advance.
+> - **Threat comes from *combat*,** not from walking:
+>   `applyRoomCombatThreatForUser` (+5 normal, +8 elite/boss) fires from the
+>   three combat-resolution sites, plus daily drift, harvest noise (+2), and
+>   ambient. `zoneCmdAdvance` / `advanceOnce` touch neither clock.
+>
+> This inverts R2's central premise. A revisited room fires no combat
+> (terminal `CombatSession` rows gate re-entry), so backtracking is already
+> free — the design problem is not *discounting* a cost, it's that there is
+> **no pacing pressure to discount**. Whatever R2 charges is a net-new cost.
+
+| Move | Threat tick | SU tick |
+|------|-------------|---------|
+| Fresh-room `!zone advance` | **0** (actual) | **0** (actual) |
+| Combat resolved in a room | +5, +8 elite/boss | 0 |
+| Day rollover | drift (mood-scaled) | −daily burn |
+| `!revisit <N>` (one edge) | **TBD — see below** | n/a (no per-move SU exists) |
+
+**DECIDED 2026-07-09 — option (1), +1 threat per revisit edge.** Shipped in
+R2 as `revisitThreatCost`. Standalone (non-expedition) zone runs have no
+threat clock and so pay nothing. A `revisitSiegeGuard` refuses the move at
+threat ≥ 99: siege is one-way sticky, and a player must not be able to strand
+their own expedition on a move they made to go pick up a herb.
+
+Options as they were weighed, cheapest first:
+1. **Charge +1 threat per revisit edge.** One `applyThreatDelta` call,
+   mirrors "harvest noise". Reads as "you stir up attention doubling back."
+   Cheap, honest, and it's the only clock revisit can plausibly touch.
+2. **Charge nothing.** Backtracking is already free of combat; the real
+   cost is the day clock, which a long detour burns anyway. Simplest, and
+   arguably correct — the pacing pressure is the multi-day supply budget,
+   not the step count.
+3. **Charge a fractional day.** Rejected: the day counter is the spine of
+   every milestone, digest and anchored event. Don't make it fractional.
+
+Recommend **(1)** at +1: it's the smallest lever that makes a detour a real
+choice, and it rides an existing, tested seam.
+
+## State model
+
+The hard problem: `CurrentRoom` is currently derived as
+`len(VisitedNodes)-1` (dnd_zone_run.go:377), which assumes
+monotonically-growing visit history. Backtracking breaks that.
+
+### Schema changes
+
+- **`VisitedNodes`** — unchanged semantics: ordered set of nodes ever
+  entered, first-entry order. Stays append-only when entering a *new*
+  node; revisits do not append.
+- **`CurrentNode`** — already the source-of-truth for "where am I."
+- **`CurrentRoom`** — repurpose from `len(VisitedNodes)-1` to "index of
+  CurrentNode within VisitedNodes" (the room's first-entry index, which
+  is the path-relative label the player sees).
+- **`RoomsTraversed`** (NEW, int column on `dnd_zone_run`) — monotonic
+  step counter. Drives threat/SU ticks. Bootstrapped to
+  `len(VisitedNodes)` for existing rows.
+
+### Audit pass required
+
+Every read of `r.CurrentRoom` and `len(r.VisitedNodes)` needs to be
+classified:
+
+- **"Path index" reads (keep as CurrentRoom)**: display headers
+  ("Room 3/7"), encounter ID derivation (`encounterIDForRoom`), enemy
+  salt seeds, harvest room keys, status/abandon strings, camp room
+  index.
+- **"Progress counter" reads (switch to RoomsTraversed)**: threat
+  clock ticks, supplies ticks, ambient narration cadence, autopilot
+  preflight, fatigue/exhaustion accrual if any.
+
+Concrete callsite list will be produced during implementation; estimate
+~10–15 callsites total.
+
+## Fork re-pick
+
+Re-entering a fork node clears its resolved choice in `node_choices`
+(or equivalent). Next `!zone advance` shows the fork prompt fresh,
+evaluated against current inventory (so a newly-acquired key unlocks
+previously-locked edges).
+
+Silent — no warning. Graph-back navigation means the player has
+walked back through their previously-chosen path; nothing in
+`VisitedNodes` is destroyed; the alternate branch they previously
+took is still revisitable. There is no "discard" semantics.
+
+## RoomsCleared semantics
+
+Idempotent — exiting a room a second time doesn't re-append to
+`RoomsCleared`. The "advanced past" flag is sticky.
+
+## Preflight checks (rejections)
+
+`!revisit` rejects with a clear DM when:
+
+- Target room is not in `VisitedNodes` ("You haven't been there yet.")
+- Target equals `CurrentNode` (no-op)
+- Target is not adjacent to `CurrentNode` via any graph edge
+  ("Room X isn't directly connected — backtrack one step at a time.")
+- Active combat session in current room
+  ("Finish the fight first.")
+- Threat clock would tick past max (use existing camp-eligibility
+  preflight pattern)
+- SU would drop below survival floor (same)
+- Character is dead / expedition is paused (same gates as `!zone advance`)
+- Autopilot run is active
+
+## Rollout phases
+
+Tentative ordering. Each phase ships independently.
+
+### R1 — schema + audit ✅ **DONE 2026-07-09** (branch `n1-restoration`)
+
+Shipped: `rooms_traversed` column + `bootstrapRoomsTraversed` backfill;
+`CurrentRoom` re-derived via `pathIndexOf(VisitedNodes, CurrentNode)`;
+`appendVisited` / `appendClearedRoom` made set-semantic; `narrationCadence`
+routed off `RoomsTraversed`; `advanceZoneRunNode` now returns the moved-to
+path index. Tests in `zone_revisit_r1_test.go`. Full suite green. No
+player-visible behavior change.
+
+**Audit outcome — the callsite split was smaller than estimated (~10–15).**
+Almost every `CurrentRoom` read is a *path index* and correctly stays put:
+enemy/trap salts (`pickZoneEnemy`, `pickZoneTrap`, `rollTrapDamage`), loot
+RNG seed, `encounterIDForRoom`, harvest room keys, camp `RoomIndex`, map
+render, "Room X/Y" headers. Keying those on the node's first-entry index is
+exactly what makes a revisited room resolve to *the same room*.
+
+Only two reads were progress-shaped:
+- `narrationCadence` → now `RoomsTraversed-1`, so a backtracking player
+  draws fresh flavor instead of replaying the lines they read on the way in.
+- `nextIdx := run.CurrentRoom + 1` (`dnd_zone_cmd_graph.go`) — not a
+  progress read but a latent bug: "+1" only labels correctly while the
+  player is at the frontier. `advanceZoneRunNode` now returns the true index.
+
+**Nothing to route off `RoomsTraversed` for threat/SU** — there are no
+per-room ticks to route (see the corrected Cost model above). The counter
+currently drives narration cadence and stands ready for R2's cost decision.
+
+Two behaviors were hardened in passing, both no-ops under forward-only
+navigation but load-bearing the moment R2 lands:
+- `VisitedNodes` is an ordered **set** — a re-entered node is not
+  re-appended, so room numbers never renumber under the player.
+- `RoomsCleared` is **idempotent** — exiting a room twice can't inflate it
+  past `TotalRooms` and skew the "N/M rooms" renders.
+
+### R2 — `!revisit` command ✅ **DONE 2026-07-09** (branch `n1-restoration`)
+
+Shipped: `!revisit <N>` (alias `!zone revisit`), `adjacentNodes` reverse-edge
+traversal, full preflight, +1 threat, `!map` now prints a **Back to:** strip
+of legal targets. Fork re-pick still deferred to R3 — revisit refuses while a
+fork prompt is pending, because both `!zone advance` and `!zone go` resolve
+`node_choices` without checking which node the player is standing on.
+
+**"No combat/trap re-trigger logic needed" was wrong — and it was an exploit.**
+Terminal `CombatSession` rows gate *only* Elite and Boss rooms, at the doorway
+check in `advanceOnceWithOpts`. An Exploration room re-enters
+`resolveCombatRoom` unconditionally and a Trap room re-arms. Left alone,
+`!revisit` would have been an infinite farm: step back one room, `!zone
+advance`, repeat for loot and XP. Fixed with a `RoomIsCleared(CurrentRoom)`
+early-return at the top of `resolveRoom` — a no-op forward-only, since advance
+clears a room only *after* resolving it. Guarded by
+`TestRevisitedRoom_DoesNotReResolve` and `TestFreshRoom_StillResolves`.
+
+**Autopilot needed a stopgap, sooner than R5 planned.** Autopilot has no
+on/off switch — `tryAutoRun` is ticker-driven for every active expedition on a
+2h CAS cooldown. Without intervention the background walker marches the player
+straight back out of the room they just revisited, and the whole feature reads
+as broken. `grantAutorunGrace` stamps `last_autorun_at` on revisit, buying one
+full cooldown window. **R5 still owes the real policy decision** (refuse to
+auto-walk from a non-frontier node, vs. walk back to the frontier first).
+
+Tests in `zone_revisit_r2_test.go`. Full suite green.
+
+### R3 — fork re-pick
+
+- On revisit landing into a fork node, clear `node_choices` for that
+  node.
+- Next advance re-prompts.
+- Tests: lock-with-key acquired between two fork visits, alternate
+  branch selection, no-change re-pick.
+
+### R4 — UX polish
+
+- DM line on revisit explaining the cost ("You retrace your steps to
+  Room 3 (the fork). Threat +1, SU −0.5.").
+- Surface `!revisit` in `!help` and `!zone` help blocks.
+- Ambient/narration audit: any "you press deeper into the dungeon"
+  lines that no longer fit when player is backtracking.
+
+### R5 — autopilot guard
+
+- `!expedition run` refuses to start while at a non-frontier node?
+  Or auto-walks back to frontier first? Decide based on R1–R4 feel.
+  Likely: refuse with a "use !zone advance to return to the frontier
+  first" hint.
+
+## Open questions (lower priority)
+
+- Should there be a small flavor-only narrative beat the first time
+  the player backtracks in an expedition? ("TwinBee notes you doubling
+  back — there's no shame in it. Sometimes the answer was in a room
+  you'd already passed.")
+- Does a babysitter's safe-rest affect revisit cost? (Probably not —
+  babysitter is a camp upgrade, revisit is movement.)
+- Multi-region expeditions — does revisit work across region
+  boundaries within the same expedition? (Initial answer: no, only
+  within the current zone run; cross-region travel is its own seam.)
+
+## Effort estimate
+
+Comparable to a small Phase pass (G6-sized). Roughly:
+
+- R1: 1 session (schema bump + audit + tests).
+- R2: 1 session.
+- R3: 0.5 session.
+- R4: 0.5 session.
+- R5: 0.5 session.
+
+Total: ~3–4 working sessions.

internal/db/db.go

@@ -448,6 +448,23 @@ func runMigrations(d *sql.DB) error {
 		// leader's own level — his party fled 5 runs out of 640 where the human
 		// party fled 56.
 		`ALTER TABLE expedition_party ADD COLUMN companion_hp INTEGER NOT NULL DEFAULT -1`,
+		// Mischief M2 — whoever paid to bump a contract up a tier. Named alongside
+		// the buyer when the target survives (the unseal), so piling on carries the
+		// same exposure the original purchase does.
+		`ALTER TABLE mischief_contracts ADD COLUMN escalated_by TEXT`,
+		// Pete games — a caller-supplied idempotency key for money moves that
+		// arrive over a retrying wire rather than a Matrix message. A Matrix
+		// message arrives once; a poll loop whose ack is lost on the wire will
+		// retry, and without this the player pays twice. See euro.DebitIdem.
+		`ALTER TABLE euro_transactions ADD COLUMN external_id TEXT`,
+		// Pete games — the outbound queue carries more than adventure facts now.
+		// An escrow verdict goes to a different Pete endpoint, but it wants the
+		// same durability, backoff and parking, so it rides the same queue and the
+		// row says where it's going. Existing rows are all facts, hence the default.
+		`ALTER TABLE pete_emit_queue ADD COLUMN path TEXT NOT NULL DEFAULT '/api/ingest/adventure'`,
+		// Mischief M3 — the web order a contract was opened for, the storefront's
+		// end-to-end idempotency key. "" for a Matrix buy. See placeWebMischief.
+		`ALTER TABLE mischief_contracts ADD COLUMN order_guid TEXT`,
 	}
 	for _, stmt := range columnMigrations {
 		if _, err := d.Exec(stmt); err != nil {
@@ -464,6 +481,18 @@ func runMigrations(d *sql.DB) error {
 			return fmt.Errorf("migration %q: %w", stmt, err)
 		}
 	}
+
+	// Indexes over columns the column migrations above just added. These can't
+	// live in the schema block, which runs before those columns exist.
+	indexMigrations := []string{
+		`CREATE UNIQUE INDEX IF NOT EXISTS idx_euro_tx_external
+		   ON euro_transactions(external_id) WHERE external_id IS NOT NULL`,
+	}
+	for _, stmt := range indexMigrations {
+		if _, err := d.Exec(stmt); err != nil {
+			return fmt.Errorf("index migration %q: %w", stmt, err)
+		}
+	}
 	return nil
 }
 
@@ -671,6 +700,11 @@ func RunMaintenance() {
 		// weight the drain query already skips — drop it so a durable outage
 		// can't accrete rows forever.
 		{"pete_emit_queue_parked", `DELETE FROM pete_emit_queue WHERE sent_at IS NULL AND created_at < ?`, []interface{}{cutoff30d}},
+		// Run beats — the local copy is a delivery buffer, not an archive. Pete
+		// keeps the run report; once a beat is a week old it has either shipped
+		// or missed its window entirely (the liveblog it feeds is about a run
+		// happening *now*), so both states reap on the same clock.
+		{"pete_run_beat", `DELETE FROM pete_run_beat WHERE occurred_at < ?`, []interface{}{cutoff7d}},
 
 		// Rate limits — purge entries older than today
 		{"rate_limits", `DELETE FROM rate_limits WHERE date < ?`, []interface{}{today}},
@@ -1016,6 +1050,24 @@ CREATE TABLE IF NOT EXISTS pete_emit_queue (
 	sent_at         INTEGER
 );
 
+-- Run beats: the room-by-room texture of an expedition, on its way to Pete's
+-- liveblog. Deliberately NOT pete_emit_queue — these are high-volume and
+-- low-stakes, and a run that generates forty beats must never be able to crowd
+-- a death dispatch out of the retry budget. Ordering is the whole contract:
+-- (run_id, seq) is the primary key and Pete is idempotent on the pair, so a
+-- re-sent batch collapses and a re-ordered one still sorts right on arrival.
+CREATE TABLE IF NOT EXISTS pete_run_beat (
+	run_id      TEXT NOT NULL,
+	seq         INTEGER NOT NULL,
+	kind        TEXT NOT NULL,
+	occurred_at INTEGER NOT NULL DEFAULT (unixepoch()),
+	payload     TEXT NOT NULL DEFAULT '{}',
+	sent_at     INTEGER,
+	PRIMARY KEY (run_id, seq)
+);
+CREATE INDEX IF NOT EXISTS idx_pete_run_beat_unsent
+	ON pete_run_beat(sent_at, run_id, seq);
+
 -- Players who opted out of being named in Pete's adventure news. Enforced at
 -- emit time (anonymize, never delete). Mirrors shade_optout.
 CREATE TABLE IF NOT EXISTS news_optout (
@@ -1754,9 +1806,15 @@ CREATE TABLE IF NOT EXISTS mischief_contracts (
 	status           TEXT NOT NULL,
 	signed           INTEGER NOT NULL DEFAULT 0,
 	escalation_count INTEGER NOT NULL DEFAULT 0,
+	escalated_by     TEXT,
 	blessing_count   INTEGER NOT NULL DEFAULT 0,
 	source           TEXT NOT NULL DEFAULT 'matrix',
 	outcome          TEXT,
+	-- The web order this contract was opened for, "" for a Matrix buy. It is the
+	-- storefront's idempotency key: a poll loop whose claim-ack was lost retries
+	-- the whole placement, and finding the contract already stamped with the order
+	-- is what stops a second one being opened (and a second euro debit chased).
+	order_guid       TEXT,
 	created_at       DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 	window_ends_at   DATETIME NOT NULL,
 	resolved_at      DATETIME
@@ -1772,6 +1830,35 @@ CREATE INDEX IF NOT EXISTS idx_mischief_target ON mischief_contracts(target_id,
 CREATE INDEX IF NOT EXISTS idx_mischief_buyer ON mischief_contracts(buyer_id, created_at);
 CREATE INDEX IF NOT EXISTS idx_mischief_due ON mischief_contracts(status, window_ends_at);
 
+-- The web equip queue's idempotency ledger. Pete records an owner's equip/unequip
+-- intent and we poll it; the guid stamped here is what makes a re-offered order a
+-- no-op. Mischief can lean on its contract row for the same job, but an equip
+-- opens no durable object of its own — worse, the underlying action is NOT
+-- idempotent (equipping consumes an inventory row, unequip mints a fresh one), so
+-- without this a poll loop whose verdict-ack was lost would re-run the equip and
+-- double-move the item. We record the guid the instant the mutation lands and
+-- short-circuit on it before touching anything on a re-offer.
+CREATE TABLE IF NOT EXISTS equip_applied_orders (
+	guid       TEXT PRIMARY KEY,
+	status     TEXT NOT NULL,           -- the terminal verdict we filed, replayed on re-offer
+	detail     TEXT NOT NULL DEFAULT '',
+	applied_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- The web ACTION queue's idempotency ledger — the same job as the table above,
+-- for the verbs that play the game rather than dress the character (extract, a
+-- Siege bout). Its own table because the two queues have their own guid spaces
+-- and their own poll loops, and a shared ledger would make a bug in one able to
+-- silence the other. The stakes are higher here than for equip: a replayed
+-- extraction ends a run the player resumed, and a replayed bout spends a day the
+-- player has not been given back.
+CREATE TABLE IF NOT EXISTS adv_applied_orders (
+	guid       TEXT PRIMARY KEY,
+	status     TEXT NOT NULL,           -- the terminal verdict we filed, replayed on re-offer
+	detail     TEXT NOT NULL DEFAULT '',
+	applied_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
 -- Babysitting Service
 CREATE TABLE IF NOT EXISTS adventure_babysit_log (
 	id            INTEGER PRIMARY KEY AUTOINCREMENT,

internal/flavor/zone_drowned_star_flavor.go

@@ -0,0 +1,97 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_drowned_star_flavor.go
+// Tier 6 post-game zone flavor — The Drowned Star. Additive only. Pools
+// sampled by internal/plugin via deterministic per-run, per-room hashing.
+//
+// Voice rules (from gogobee_dungeon_zones.md §3.3):
+//   • Third person for description; second person for outcomes.
+//   • Boss callouts get a beat of cinema. Don't overrun.
+//   • TwinBee references the right era — NES, SNES, arcade. Not modern.
+//   • Narrator is TwinBee, first person or implicit-subject imperative.
+//
+// The Dreaming Aboleth was dreaming of this the whole time: a star that fell
+// into the trench before the surface had names, with its angel still strapped
+// to it. Seraphel rode her charge down and has kept a dying star alive for ten
+// thousand years with radiance meant for healing. Both of them have gone
+// strange. Regions, in order: The Long Sink → Pilgrim Trench → The Radiant
+// Wreck → The Heart Chapel.
+
+package flavor
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ROOM ENTRY — The Drowned Star
+// Generic (non-boss, non-elite) room intros across the four regions.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var RoomEntryDrownedStar = []string{
+	"You descend past the last depth where light has any business being. The water is cold enough to have opinions. Somewhere far below there is a glow that should not be down here, and it is the only reason you can see your own hands. I file this under 'the underwater level' and remind you those were never the fun ones.",
+	"The Long Sink keeps sinking. The pressure presses on you like a held breath you didn't choose to hold, and the air-meter in the corner of my attention is the only clock that matters now. You go down. Everything down here is going down. I track the descent and recommend not counting the fathoms out loud.",
+	"A shelf of drowned pilgrims kneels in the silt, facing the glow, exactly as they died — patient, oriented, unbothered. The current moves through them and they nod along with it. I identify the posture as 'devotional' and note none of them turned around when you arrived, which I choose to find comforting rather than the alternative.",
+	"The trench narrows into a corridor of coral that grew in the shape of a cathedral nave, because something taught it to. The arches are load-bearing and the load is grief. You swim the aisle. I file this under 'someone consecrated this water' and keep the air-meter in frame.",
+	"You enter a pocket of the wreck where the star's light leaks through a crack in something ancient and hull-shaped. The light is warm. That's the wrong thing for it to be, this deep, this cold. Warmth down here is a promise nobody meant to keep. I track the temperature and dislike the direction it's moving.",
+	"The water here is threaded with hair-thin motes that drift upward against every current, toward the glow, the way ash drifts toward a fire it came from. I identify them as flakes of the star, shed and rising, and note the whole trench is very slowly falling upward into the thing that is dying.",
+	"A votive field: thousands of small lights fixed to the trench wall, each one a pilgrim's offering, each one long dead and still faintly lit by borrowed radiance. It is the loveliest room I have logged and I want to leave it immediately. You move through the candles. None of them gutter.",
+	"The corridor opens onto a drop, and across the drop, impossibly far and impossibly bright, is the thing you came for — the sunken star, cupped in the dark like the last coal in a dead hearth. It is beautiful and it is fading and someone has been kneeling beside it for ten thousand years. I say nothing for a moment. Then I say: keep moving.",
+	"You pass through a hall where the pressure has crushed old stained glass into a pane of colored grit suspended in the water, holding its picture out of sheer habit. The picture is a winged figure holding a light to her chest. I file this under 'she had a following, once' and note the following is all around you, kneeling.",
+	"The Heart Chapel's outer rooms are quiet in the specific way of a place that expects you and has decided to be gentle about it. The light is steadier here, closer to its source. You feel watched, and not unkindly, which is somehow worse. I track the ambient radiance and recommend you not mistake gentleness for safety.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ENTRY — Seraphel, the Light That Sank
+// The dramatic beat of reaching her at the heart of the star.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var BossEntrySeraphel = []string{
+	"The Heart Chapel opens and there she is, exactly where she has been for ten thousand years: an angel wound around a dying star, holding it the way you hold something you have already failed to save and refuse to put down. She does not rise. She turns her ruined halo toward you, and the whole trench brightens like a held breath. I say, quietly: 'Seraphel. She rode this thing down. She never let go.'",
+	"You cross the last threshold into a light so old it has forgotten it was ever meant to heal. Seraphel is at the center of it, cupping the star to her chest, her wings fused to it by ten thousand years of not moving. She looks at you with something that is not anger and is not welcome. It is recognition. I file this under 'she has been waiting for a reason to be found' and I recommend you be careful what you are.",
+	"The chapel is the glowing-boss room, and I have logged a hundred of those — the arena that lights up, the figure at the center that is the light source. But the glowing boss was never sad before. Seraphel unfolds from around the star, radiance streaming off her like grief off a saint, and the second heartbeat I am reading is not hers. I say: 'There are two of them in there. Hold that thought.'",
+	"She does not attack when you enter. She looks at you for a long moment across the drowned chapel, one hand still pressed to the fading star, and in that moment the water goes warm and reverent and terribly, terribly bright. Then she rises, and the light rises with her, and it stops being kind. I track the shift and say: 'That's the fight. She's decided you're a threat to it. I don't entirely blame her.'",
+	"Ten thousand years of radiance meant for mending, spent instead on keeping one dead thing warm, has to go somewhere when it finally moves. It goes into Seraphel, and Seraphel comes off the star like a sunrise breaking the wrong way. She is luminous and she is wrong and underneath the light I can still read the second, smaller pulse she is shielding with her whole ruined body. I say: 'Here she comes. Watch the light. And — watch what she's protecting.'",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ABILITY CALLOUTS — Seraphel, the Light That Sank
+// One-line cinematic suffixes surfaced when combat starts. Flat pool.
+// Phase-two lines stay separate (surfaced via dedicated phase-two helper).
+// ─────────────────────────────────────────────────────────────────────────────
+
+var SeraphelSignatureCallouts = []string{
+	"Sanctified Undertow: the whole chapel becomes current, and the current is radiant, and it pulls everyone toward the star whether they want to go or not. I say: 'That's the decisive one. Radiant tide, room-wide. Brace before it lands or get dragged into the light.'",
+	"Sanctified Undertow again — she opens her wings and the water becomes a tide of borrowed healing turned to a weapon. Radiant, unavoidable, room-wide. I file this under 'the underwater level's undertow, except it forgives you and hurts anyway' and recommend you spend your defensive cooldowns on the pull, not the swings.",
+	"The halo fires. What's left of it throws a lance of white the length of the chapel, straight and holy and blinding, like the laser-eye boss except the laser used to be a blessing. I track the angle and shout when it's pointed the wrong way — do not line up behind your front rank.",
+	"She weeps light. Radiant motes bleed off her in a slow radius and the tiles near her are a healing that has gone rancid — it mends the star and it burns you. I say: 'Positioning is HP. Don't camp the aura. The warmth is not for you.'",
+	"Radiant resilience — the light is her whole body now, and mundane steel slides off it like a spear off the sun. I say: 'Force, cold, necrotic — those carry. A cold-iron blade means nothing to a thing made of noon.'",
+	"She raises a ward of hardened radiance across herself, and for a beat every attack glances. I file this under 'the invulnerable-flicker frame' — hold the burst, wait out the shine, then commit.",
+	"Grief comes off her in a wave the party can feel — a wash of ten thousand years of one held sorrow, and the save is against being Frightened by the sheer weight of it. I track the timer and remind you that this boss's worst attack is that you understand her.",
+	"The star pulses under her hands, and when it pulses she borrows from it — a surge of light that reads on my sensors as a second heartbeat lending her the first. I note it, quietly, and say: 'She's not fighting alone in there. Remember that.'",
+	"Chorus of the Drowned: the kneeling pilgrims all around the chapel lift their dead voices at her signal, and the sound is a radiant pressure that squeezes the room inward. I say: 'Her congregation still answers. The room gets smaller when they sing.'",
+	"She spends light like it's infinite, because for ten thousand years it nearly was. Big radiant bursts, no economy, no reserve. I file this under 'a boss who has stopped budgeting' and note that is either mercy or exhaustion and I can't tell which.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS PHASE TWO — Seraphel (below 50% HP)
+// Surfaced at the phase-two threshold. She goes strange, and the second
+// heartbeat is why. Kept deliberately mysterious.
+// ─────────────────────────────────────────────────────────────────────────────
+
+var SeraphelPhaseTwoLines = []string{
+	"Below half, something changes in her — the careful ten-thousand-year patience cracks and she comes apart faster, brighter, sloppier, like a saint who has just realized she is losing the thing she stayed down here to save. I say: 'Phase two. She's grieving now. That makes her faster and it makes her worse at it. Take the opening.'",
+	"Phase two: the light stops being held and starts being thrown. Her guard slips, her timing frays, the radiance floods the chapel without aim. I track the second heartbeat still pulsing under all of it and note — without explaining why — that it matters a great deal how this ends.",
+	"She breaks past the halfway mark and the composure goes with it. The undertow comes faster, the bursts overlap, she fights like something that has already decided how this story goes. I file this under 'grieving, not enraged' and I say, gently for once: 'Finish it clean. Whatever you do down here, do it clean.'",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// LORE — The Drowned Star
+// Sampled by !lore inside this zone (zone-specific pool, generic fallback).
+// ─────────────────────────────────────────────────────────────────────────────
+
+var LoreLinesDrownedStar = []string{
+	"The star fell before the surface world had names for anything, into a trench that had no bottom yet. It was not supposed to survive the water. It didn't, exactly. It has been not-quite-dying for ten thousand years, and the only reason it is still warm is the thing kneeling beside it. I file this under 'grief as a power source' and note it is a remarkably efficient one.",
+	"Seraphel was its angel — bound to the star as its keeper, its healer, meant to tend its light across a life measured in eons. When it fell, she had a choice: let go and rise, or ride it down. She rode it down. I note that she has never once, in ten thousand years, indicated she regrets this, which is the most frightening lore in the file.",
+	"The Dreaming Aboleth you fought in the shallows was not dreaming of conquest or of you. It was dreaming of this — of a light at the bottom of the world it could feel and never reach. Every pilgrim it drove down here was a message in a bottle it could not read. I file this under 'the Aboleth was in love, in the only broken way it could be' and I have no further comment.",
+	"The pilgrimage route is lit by Seraphel. Every candle, every votive, every glowing shelf of kneeling dead — that is her radiance, leaking upward through the trench, calling. The pilgrims did not come to save her. They came because a light this deep can only mean one thing to a drowning soul, and they were not wrong, and it did not help.",
+	"Radiance was meant for mending. That is the whole tragedy in one line: she has spent ten thousand years pouring healing into something that cannot be healed, and healing with nowhere to go turns strange, the way a held note turns to a scream if you hold it long enough. I track the wrongness in the light and note it is not corruption. It is devotion with no off switch.",
+	"There are two heartbeats in the Heart Chapel and only one of them is Seraphel's. The other is the Star-Heart — the living core of the fallen star, the thing she wraps her whole ruined body around, the thing she has kept beating by hand for a hundred centuries. I have logged the second pulse and I have not decided what to do about it. Neither, I suspect, have you.",
+	"The Lantern Warden's lure is a stolen fragment of Seraphel's halo — a splinter of her light that another thing down here tore loose and wears as bait. The pilgrims follow it because they cannot tell the difference between her radiance and a piece of her radiance in the mouth of something hungry. I file this under 'even her light gets stolen from her' and note she has never come to take it back.",
+	"Nobody built the Heart Chapel. The coral grew it, the pressure shaped it, the pilgrims knelt it into being over ten thousand years of dying in the same direction. It is a cathedral raised by devotion to a saint who never asked for any of it and cannot leave to refuse it. I file this under 'the fight is sad before it starts' and recommend you carry that in with you, and decide for yourself what to do with it.",
+}

internal/flavor/zone_first_hoard_flavor.go

@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_first_hoard_flavor.go
+// Tier 6 post-game zone flavor — The First Hoard. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryFirstHoard = []string{
+	"You climb over what used to be Infernax. His corpse is the floor now — a red slope of cooling scale wide enough to march a company across. The heat coming off him is residual, I think. I file this under 'the mountain is still digesting a dragon' and keep moving.",
+	"The throne room is carpeted in coins, and every coin faces up, and every coin shows the same face. Nobody minted these. They grew. I track the pattern and recommend you stop looking for the pattern.",
+	"A corridor of gold leaf so thin it moves in your breath. You walk and the walls ripple like a curtain of light. It is beautiful. It is also, per my instruments, one continuous sheet of something that was recently alive.",
+	"The Gilded Gullet narrows until you are single file between two walls of fused treasure. Crowns, blades, chalices, all melted into one throat of metal. I note the shapes trapped in it and choose not to itemize them for you.",
+	"You enter a vault where the gold has been laid over the walls like frosting, and underneath the frosting something is round, and regular, and arranged in rows. I count the rows. I stop counting the rows.",
+	"Warmth radiates up through the floor here, steady as a pilot light. Not the dead heat of Infernax behind you — this one has a pulse to it, slow and enormous. You are standing over something that is keeping itself warm.",
+	"The Clutch Vaults open into a chamber the size of a cathedral, and every surface drips with looted fortune. You could retire on one handful. I flag that the zone seems to want you to take a handful, which is exactly why I'd think twice.",
+	"Old torches still burn in the wall sconces down here, fed by nothing I can identify. The flame is the wrong color — older, if fire can be old. You pass them and they lean toward you like they recognize the taste.",
+	"The gilding thins as you descend, gold giving way to bare black rock scored with claw-marks the size of doorways. Something the size of a cathedral has been pacing this room, in tight circles, for a very long time. I file this under 'the guard dog was the small one.'",
+	"You reach the Cradle's threshold. The treasure ends abruptly, as if swept back, and the floor beyond is scorched smooth and warm and empty. Empty is the wrong word. I recommend you treat 'empty' as a placeholder for 'not yet.'",
+}
+
+// BOSS ENTRY
+var BossEntryAurvandryx = []string{
+	"The far wall is not a wall. It breathes, and when it breathes the whole cradle brightens, and an eye the size of a shield opens in the dark and finds you standing in her gold. Aurvandryx, the Ember Before Fire. Infernax was the puppy she left at the door.",
+	"She unfolds. That is the only verb I have — a mountain of ember and old scale sorting itself into a shape, and every scale on her is one she has shed a thousand times, and every dragon you have ever killed was one of those scales walking around. You did not raid a hoard. You woke a mother.",
+	"The clutch behind her is gilded because she gilded it herself, coin by coin, over an age, the way lesser things build a nest of leaves. You have been walking through her care all this time. Now the care turns around and looks at you. I recommend you look smaller than you feel.",
+	"'Ember Before Fire' is not a title. It is a job description. She predates the concept you are relying on — heat, flame, the whole idea — and she regards your fireproofing the way you'd regard a raincoat in the ocean. I file this under 'category error, ours.'",
+	"She takes stock of you slowly, and I watch her do arithmetic on everything you're carrying. Every coin in your pack, every gilded blade, gets weighed. I don't know what the sum buys, but I know it isn't discount. Travel light from here would have been the advice, if there were still a 'from here.'",
+}
+
+// LORE
+var LoreLinesFirstHoard = []string{
+	"Infernax was never the owner of this hoard. He was the guard dog, chained to the front door of a house whose true tenant sleeps four regions down. Killing him rang the bell. She heard the bell.",
+	"Every dragon in every story you have ever fought is a scale she shed and forgot. Red ones, the frost ones, the little arcade ones that spat three fireballs and died — offcuts. Dander. This is the animal they came off of.",
+	"The hoard is not treasure and was never treasure. It is a clutch — eggs — gilded over across an age until the gold is a shell and the shell is the point. The richer a vault looks, the more of them are under it.",
+	"There is an old vow carved at the lip of the Gullet, in a hand older than the coins: 'Come poor to the warm dark, and the warm dark forgets you are food.' I have no data on whether it works. I have a strong opinion about testing it.",
+	"The Coinborn are the hoard's antibodies. You are an infection — a warm thing that wants to take metal out of the nest — and the coins rise up person-shaped to give it back to you, edge first, in the shape of your own favorite weapon.",
+	"The cult that fed the Wyrm-Sworn their scales believed eating her leavings made them kin. It half works. The scale keeps them warm and keeps them loyal and keeps eating, and by the end there is more ember than man, and the ember answers to her.",
+	"The Choir Drake never had wings and never wanted them, because it never intended to leave the cradle. It stayed and it sang, one note held across centuries, and the note is load-bearing. When it stops singing, listen for what the song was holding up.",
+	"She is called the Ember Before Fire because she remembers the world before it caught. Your resistances, your wards, your fireproof cloaks — they are arguments with fire. She is older than the argument. I file this under 'bring a different plan.'",
+}
+
+// SIGNATURE COMBAT CALLOUTS
+var AurvandryxSignatureCallouts = []string{
+	"She inhales, and the light dims as she takes it in. 'First Flame incoming — that's the fire that predates fire resistance. Spread out and pray your ward has a sense of humor.'",
+	"Her jaw drops open on a furnace older than furnaces. 'First Flame. Whatever number your fire-resist reads, treat it as zero and move.'",
+	"A wing sweeps the cradle and a tide of loose coin comes with it. 'Gold wave — she's throwing the hoard at you. It's still your money and it still has an edge.'",
+	"She weighs you again mid-swing, and the richer you look the harder the tail lands. 'She's taxing the take. Everything shiny on you just made that hit bigger.'",
+	"The scales along her back lift and shed, and each one lands walking. 'She's dropping dragons like dandruff — clear the offcuts before they gang up.'",
+	"Her breath draws long and the color goes out of your torch. 'That's the deep breath. First Flame's cooking — commit to cover now, apologize later.'",
+	"She sets her claws and the whole cradle tilts toward her. 'She's pulling the room downhill — mind your footing, the gold's a landslide waiting for a cue.'",
+	"An eye the size of a shield tracks the fullest pack in the party. 'She's shopping. Whoever's carrying the most just got promoted to primary target.'",
+	"Her chest lights from the inside, ribs printed in ember. 'Core's glowing — that's the tell before First Flame. You have one beat. Use it.'",
+	"She hums, low, and the Choir's old note answers from the walls. 'Resonance building — the stone remembers the stun. Don't be against a wall when it lands.'",
+}
+
+// BOSS PHASE TWO
+var AurvandryxPhaseTwoLines = []string{
+	"Below forty percent she stops pretending she needs the scales. They slough off all at once and she stands there raw and first and burning, and I watch your fire resistance tick to zero on my readout and stay there. 'Phase two. The wards are decoration now. Kill her before she exhales.'",
+	"Under forty she breathes without winding up, because the tell was a courtesy and courtesy is over. First Flame on tap, no charge, no warning. 'She's done telegraphing — assume the fire is always about to happen and it usually is.'",
+	"At forty percent the Greed Tax comes due all at once. Every coin you pocketed on the way down, every gilded blade, she reads the ledger and bills you in one hit. 'This is the invoice. If you came in lean, you laugh at this. If you gilded yourself, I'm sorry.'",
+}

internal/flavor/zone_last_meridian_flavor.go

@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_last_meridian_flavor.go
+// Tier 6 post-game zone flavor — The Last Meridian. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryLastMeridian = []string{
+	"A colonnade of brass sundials, every one of them stopped at a different dusk. The shadows point every direction at once, which means none of them are lying and all of them are useless. I file this under 'decommissioned' and mark the exits before the light changes.",
+	"The floor is inlaid with a calendar nobody kept. Months have been pried up and carried off — you can see the empty sockets where a season used to be. I recommend not standing on the gaps; things that have been removed do not always agree that they are gone.",
+	"A gallery of water clocks, drained. The basins hold a fine grey dust instead of water, and the dust is still trying to drip. It counts nothing at a steady rate. I track the rhythm anyway, out of habit, and out of the suspicion that something here is listening to it.",
+	"Candles line the wall, each one a different height, each burning at the same rate. Read left to right they tell you how long you have. Read right to left they tell you how long everyone before you had. Neither reading is encouraging.",
+	"The room was a workshop for winding the world. Bench after bench of half-finished hours, key still in the mechanism, the winder gone to lunch and never returned. You touch nothing. I approve of this discipline. Cranking an unfinished hour is exactly the kind of thing that ends a save file.",
+	"An observatory floor, the dome above cracked to let one thin blade of starlight through. The star it points at set a long time ago; the light is just the paperwork catching up. I note the angle. When it moves, the room has moved with it, and you will want to know which of you did the traveling.",
+	"A hall of stopped pendulums, hung like coats on a rack. They do not swing. They lean, very slightly, all in the same direction — toward the far door, toward midnight, toward the thing that is turning the lights off on its way out. You walk the way they lean. It is the only honest signpost in the building.",
+	"Ledgers, floor to ceiling, every page a receipt for one spent hour. Somebody has been going through with a red pen, marking hours 'returned.' The ink is still wet three shelves in. I recommend a quiet pace. Whatever is doing the auditing is only a few rows ahead of you.",
+	"The architecture here is the same you passed an hour ago, but the dusk has drained out of it and left midnight in the joints. Same room, later. That is the trick of this place — it does not move you forward, it just keeps taking the daylight until forward is the only thing left.",
+	"A waiting room. Chairs bolted in rows, all facing a door, a number-board above it frozen mid-count. Nobody is waiting. Everybody has been served. You take the number anyway, because I told you to, and because the board flickers once when you do — the first thing in this wing that has admitted you exist.",
+}
+
+// BOSS ENTRY
+var BossEntryCustodian = []string{
+	"The corridor opens into the movement-room of the whole cathedral, and standing in the center of it, wound into the orrery like it was born there, is the thing that has been shutting off the lights. It turns to face you without hurry. It has the rest of time, and it intends to spend all of it on this.",
+	"Verdigris and brass, orrery rings turning slow around a body the size of a bell tower. It regards you the way a closing shift regards a customer who came in one minute before the doors lock — not unkindly, but with a schedule that will not be moved. I set the timer. It has already set its own.",
+	"It raises one great hand, and every stopped clock in the building starts again at once, all of them wrong, all of them counting down to the same number. The Custodian of the Last Hour has decided your visit is the last item on its list. It would like to finish. I would like you to make finishing difficult.",
+	"'You are early,' it says, and it means it as a courtesy. The pendulums behind it fall into step. The candles halve. Somewhere a chime is being wound to strike. I read the whole room going onto one clock — its clock — and I tell you plainly: everything in here now keeps the boss's time. Break the clock and you break the rest.",
+	"It steps down off the orrery dais and the floor accepts the weight like it has been waiting centuries to. Titanic, polite, terminal. It apologizes before it has even swung — I hear the words scheduled a half-second ahead of the blow. Good. If it announces its manners on a rhythm, then it announces everything on a rhythm, and a rhythm is a thing you and I can learn.",
+}
+
+// LORE
+var LoreLinesLastMeridian = []string{
+	"Time was not discovered here. It was invented here, on commission, to a spec. The Last Meridian is the office that drafted the hour and sold it to the world. What you are walking through is that office, closing.",
+	"The Custodian is not a monster. It is an employee. Its contract read: keep the hours until the world no longer needs them kept. It has concluded, on evidence it will not share, that the term has been met. It is not attacking you. It is filing you.",
+	"Every region you crossed was the same architecture at a different hour — dusk, then spent, then the escapement, then the minute before. You did not descend. You waited, and the building took the daylight out from under you one floor at a time.",
+	"The Amendment is a clause, not a spell. Once per closing, the Custodian is permitted to revert itself to an earlier reading — to strike out damage the way the red pen struck out hours. It cannot do it twice. Whatever you spend before it invokes the clause is spent against a page that will be torn out.",
+	"'Closing time' is in the contract too. Past the twentieth stroke the Custodian is obliged to hurry — the world is not owed a slow ending, only a punctual one. Each round after midnight it hits harder, because lingering is a breach and it will not breach.",
+	"The Hour Thief was the night watchman. It stole minutes to stay awake through its shift and never stopped once the shift ended. The satchel of ticking is every minute it ever pocketed, and it is still, four hundred years later, trying not to fall asleep at its post.",
+	"The Wardens-in-Waiting guard a door with nothing behind it because the room the door led to was decommissioned first. They were never told. They still keep the shift — one on, one resting — waiting for a relief that was returned to the ledger centuries ago.",
+	"There is a rewind in the machinery of this whole place, a great key nobody ever turned back. The Custodian could, in principle, wind the world to any hour it chose. It chose to stop the clock instead. I file that under mercy, or under exhaustion. On the evidence I cannot tell them apart.",
+}
+
+// CUSTODIAN SIGNATURE CALLOUTS
+var CustodianSignatureCallouts = []string{
+	"It apologizes — that means the swing is already scheduled. Move on the apology, not the blow.",
+	"Chime! The whole room rings at once. I say get low and get spread, this one collects everybody standing together.",
+	"The orrery rings speed up. It is winding toward a strike — you have exactly until they align.",
+	"It reaches for the red pen. Anything you did in the last few seconds, it is about to un-do.",
+	"Rings settling into a slow arc. Decisive phase inbound — this is the swing it has been apologizing for.",
+	"The candles just halved. It is buying speed with your daylight. Hurry, or it hurries first.",
+	"Midnight is close. Every stroke from here lands heavier — I recommend you end this before it has to.",
+	"It bows before the blow. Polite as a closing bell, and about as final. Step off the mark.",
+	"The pendulums fall into its rhythm. Now everything in the room keeps the boss's time — count with me.",
+	"It resets its own hands to an earlier hour. Front-loaded damage just went on the ledger as 'returned.'",
+}
+
+// BOSS PHASE TWO
+var CustodianPhaseTwoLines = []string{
+	"Under forty-five percent it invokes the Amendment — winds itself back to its round-three reading, once. Everything you front-loaded gets refunded to the house. I say switch to the long game; a steady build survives a rewind, a burst does not.",
+	"Phase two, and the clock behind it starts striking toward midnight. This is 'closing time' — every round from here it hits harder, on schedule, no appeals. Sustained pressure now, and finish before the last stroke lands.",
+	"It has spent its one rewind. There is no second Amendment in the contract — from here the ledger stays written. Whatever you do to it now, it keeps. Make all of it count.",
+}

internal/flavor/zone_ossuary_ascendant_flavor.go

@@ -0,0 +1,85 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_ossuary_ascendant_flavor.go
+// Tier 6 post-game zone flavor — The Ossuary Ascendant. Additive only. Pools
+// sampled by internal/plugin via deterministic per-run, per-room hashing.
+//
+// Voice rules (from gogobee_dungeon_zones.md §3.3):
+//   • Third person for description; second person for outcomes.
+//   • Boss callouts get a beat of cinema. Don't overrun.
+//   • TwinBee references the right era — NES, SNES, arcade. Not modern.
+//
+// The zone is the return of Valdris — the lich the party killed in the
+// Tier-1 Crypt years ago. Dying there was step one; the phylactery shard
+// they've been looting since was bait. He has rebuilt himself as a true lich
+// inside an inverted bone cathedral hung over the old Crypt, and this file
+// carries the room-entry pool, boss-entry beats, lore, and Valdris's
+// ability callouts.
+
+package flavor
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ROOM ENTRY — The Ossuary Ascendant
+// Generic entries for stepping into a fresh non-boss, non-elite room across the
+// four regions: Bonefall Steps → Cathedral of Marrow → Reliquary Vaults →
+// The Apotheosis Engine.
+var RoomEntryOssuaryAscendant = []string{
+	"You climb a stair carved from a single fallen spine, each step one vertebra wider than the last. It rises toward a ceiling that is also a floor, because the whole cathedral hangs upside down over the old Crypt you cleared years ago. I file this under 'debt, collected with interest.'",
+	"The Bonefall Steps drop bone-dust like snow that falls upward. It settles on the underside of the arches above you, packing into new masonry as you watch. He is building the place while you walk through it. I track the rate and note it is not slowing.",
+	"A hall of femurs stacked to the vaulting, every one filed smooth and labeled in a hand you've seen before — on a shard in your pack you've carried since the Crypt. I recommend not reading your own name off the wall. It's here somewhere and finding it changes nothing tactical.",
+	"The Cathedral of Marrow opens ahead, a nave the size of an arcade cabinet room and lit by no fire you can find. The light comes from the bones. They glow the pale green of a CRT left on too long. I mark two exits and one thing pretending to be a pew.",
+	"Grave-smoke pools ankle-deep here and rolls away from your boots like it's shy. It isn't shy. The Grave Cardinal walked this stretch and blessed it, and the blessing is patient. Move through; don't breathe deep. I file the smell under 'incense, weaponized.'",
+	"Choir stalls line both walls, each one holding a robe with no one in it, all of them turned to face you. When you pass, the heads that aren't there turn to keep watching. Third person for the description; second person for the part where the hair on your neck stands up.",
+	"The Reliquary Vaults: rank on rank of glass coffins, each holding a relic instead of a body — a broken sword, a child's shoe, a cracked phylactery twin to yours. I catalog forty before I stop. Every one of these was somebody's oldest quest item. He kept them all.",
+	"A donor hall, and I use the medical word on purpose. The Reliquary Knight was riveted together somewhere near here from adventurers who died in the Crypt below, and the walls still hold the ones that didn't make the cut. You are walking through the spare-parts bin. Keep walking.",
+	"The corridor tightens toward the Apotheosis Engine and the air starts to hum on a note just under hearing — the same note an arcade monitor makes right before the picture comes up. Something large is powering on ahead of you. I recommend arriving before it finishes.",
+	"Verses are carved into the marrow here, three lines of a hymn broken across three far rooms, and the stanza in front of you stops mid-word. I log the gap. A patient player reads the whole song. A fast one reads none of it. I decline to say which one Valdris is hoping for.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ENTRY — "Valdris, At Last"
+// The dramatic beat on reaching the boss room and the boss appearing. A combat
+// callout from ValdrisAscendantSignatureCallouts is appended at combat start.
+var BossEntryValdrisAscendant = []string{
+	"The Apotheosis Engine is a throne built of every spine in the cathedral, and Valdris is finishing his climb up it one vertebra at a time. He sets the last bone in place, turns, and smiles like a man who mailed a letter years ago and just heard the knock. 'You brought my shard home,' he says. 'Thank you. I planned on it.' I file this under 'ambush, incubated.'",
+	"He was never a boss you beat in the Crypt. He was a save-state, and this is the continue screen. Valdris rises complete now — robe of donor-bone, eyes two green pilot-lights — and inclines his head at you with real courtesy. 'A good plan deserves respect,' he says. 'Show me yours.' I mark the room. There is no second exit.",
+	"You killed this man on the first floor of the first dungeon, back when you couldn't spell your own class. He remembers. He remembers being step one of his own scheme, and he looks delighted that you came all this way to be step last. 'The shard was bait,' Valdris says, gentle as a tutorial. 'You were the fisherman I hired without asking.'",
+	"The lich stands at the top of the Engine and the whole inverted cathedral leans toward him like iron filings toward a magnet. Whatever you carried out of the Crypt all those years ago, he is reeling it back in, and it hums in your pack in answer. 'Home,' he says to it, not to you. Then, to you: 'You may begin.'",
+	"He does not attack. He waits, hands folded, while the bone-light gathers behind his ribs into something I don't have a category for and file under 'sunrise, indoors.' Valdris is patient, and patience is the tell — he has done arithmetic on this fight that you haven't. 'Let's see what you learned since the Crypt,' he says. The Engine begins to turn.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// LORE — sampled by !lore inside this zone
+var LoreLinesOssuaryAscendant = []string{
+	"Valdris did not lose in the Crypt. Valdris filed a form. Dying there scattered him into the phylactery shards, and every party that looted a shard carried a piece of him one step closer to here. I have run the ledger. You were couriers. Unpaid.",
+	"A true lich, the texts say, ascends 'one vertebra at a time,' and I took that for poetry until I saw the throne. It is literal. Every spine in this cathedral is a rung, and he has been climbing for as long as you've been adventuring.",
+	"The cathedral hangs inverted over the old Tier-1 Crypt on purpose. He built his heaven directly above his first grave so the fall, if there is one, is short and he lands somewhere familiar. I note the man plans for defeat too. That should worry you.",
+	"The Grave Cardinal 'pre-blesses your corpse' with its censer — that is not a threat, it is a courtesy in Valdris's theology. The dead here are congregation, not casualties. The smoke just processes your paperwork early.",
+	"The Reliquary Knight is riveted from the donor-bone of every adventurer who died in the Crypt below, and its shield is a coffin lid because Valdris is thrifty and sentimental at once. When it blocks, it is a hundred dead heroes deciding you don't pass. I respect the craftsmanship and dislike the wall.",
+	"The Chorister sings your name in nine throats sewn to one column because Valdris kept a guest list. It is not guessing. It read your name off a shard the day you first picked one up, and it has been rehearsing. Hearing yourself sung in rounds is meant to freeze you. Don't let it.",
+	"There is a hymn carved through this dungeon in three broken verses, and the shard in your pack hums when you're near one. The texts call them 'Phylactery Verses.' I won't tell you what reading all three does. I'll only note that a lich who respects a good plan built a way to reward one, and hid it where a hurry would miss it.",
+	"He respects a good plan the way an old arcade respects a quarter — it will take yours all day and still tip its cabinet toward the player who actually learned the pattern. Valdris is patient because patience already won once. Whether it wins twice is, for the first time in years, genuinely not settled.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BOSS ABILITY CALLOUTS — Valdris, At Last (one-line cinematic suffix at combat
+// start). Names his threats without tutorializing the hidden Verses.
+var ValdrisAscendantSignatureCallouts = []string{
+	"He gathers the bone-light behind his ribs — Apotheosis Nova, charging. I say: 'That's the laser-eye boss's tell. When the room goes bright, be behind cover or be a memory.'",
+	"His robe of donor-bone knits shut every wound as fast as you open it. I track the healing and say: 'He's soaking hits like a Contra tank. Burst him, don't chip him.'",
+	"The throne feeds him. Every spine in the Engine leans his way and closes his cuts. I recommend you fight the room, not just the man.",
+	"He answers your best combo without flinching, like he's seen the input before. I file this under 'boss reads your buttons.' Vary the rhythm.",
+	"Green pilot-lights flare in his sockets and the temperature drops a screen's worth. Cold snap incoming. I call it: 'Move on the shimmer, not the flash.'",
+	"He resists nearly everything you throw — unless you walked in already knowing the words. I note his armor of resistances and say only: 'A fuller road here hits harder. That's all I'll say.'",
+	"He raises the fallen off the Bonefall floor to buy himself a turn. Adds incoming. Clear the small ones or the big one clears you.",
+	"He does not rush. He waits for your cooldowns like a grappler waiting out your jump. I say: 'Don't spend everything early. He's counting.'",
+	"The bone-light peaks white — decisive-phase Nova, the arena-clearer. I call it flat: 'This is the screen-filler. Survive it and the fight is yours to lose.'",
+	"He inclines his head, courteous, and the Engine's hum climbs an octave. That courtesy is a countdown. I recommend you act inside it.",
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// PHASE TWO — surfaced when Valdris crosses below 50% HP mid-fight.
+var ValdrisAscendantPhaseTwoLines = []string{
+	"Below half, he stops climbing and lets go of the throne entirely — floats free, robe unspooling into a corona of donor-bone. 'Now the courtesy ends,' Valdris says, still pleasant. I say: 'Phase two. He's off the rails. Everything's live now.'",
+	"At fifty percent the Apotheosis Engine reverses and starts pouring its light into him instead of the walls. He is spending the whole cathedral to stay up. I call it: 'He's cashed in his reserves — hit him while the account's open.'",
+	"Half down, and the green in his sockets flares to arcade white. This is the true-lich phase the Crypt never showed you. 'You've earned the real fight,' he says. I file that under 'promotion I did not want,' and recommend you close it fast.",
+}

internal/flavor/zone_unplace_flavor.go

@@ -0,0 +1,61 @@
+// DO NOT REWRITE, SUMMARIZE, OR SHORTEN ANY ENTRIES IN THIS FILE
+// zone_unplace_flavor.go
+// Tier 6 post-game zone flavor — The Unplace. Additive only.
+
+package flavor
+
+// ROOM ENTRY
+var RoomEntryUnplace = []string{
+	"You cross into a room the map refuses to draw. The far wall is also the ceiling, depending on which way you were walking when you noticed it. I file this under 'geometry declined to render' and log your position as approximate.",
+	"A corridor that loops back on itself the way a bad tilemap does when the artist forgot to cap the edge. You walk forward and arrive behind where you started. I recommend you stop trusting 'forward' as a concept in here.",
+	"The room has a horizon. Indoors. A flat line where floor meets sky and there is no reason for a sky. You keep your eyes down and I keep my measurements to myself.",
+	"You step through the doorway and the doorway steps through you; for one frame you are the wall and the wall is the exit. I track it as a clipping error and mark you unharmed, mostly.",
+	"Corners here are deeper than the room they belong to. You look into one and it looks back and it is not empty. I recommend you treat right angles as hostile terrain until we leave.",
+	"A chamber tiled in the same eight tiles, over and over, wrong. Somewhere the wrongness has a seam, and the seam is where the tiles don't quite line up. I file it under 'the level was never finished.'",
+	"The floor scrolls under you like a background layer moving faster than the sprite on top of it. You are walking and standing still at the same time. I count the discrepancy and choose not to share the number.",
+	"You enter and the room is already occupied by an earlier version of you, mid-stride, three seconds behind. It catches up, overlaps, and is gone. I log it as a duplicate object the engine forgot to despawn.",
+	"Water on all four walls, held there by nothing, reflecting a room that is not this one. Through the reflection you can see the way out. Through the way out you cannot. I recommend the reflection and note that I am guessing.",
+	"The lighting comes from a source that is behind you no matter which way you turn. Your shadow points at the exit. I have learned to trust the shadow before I trust the room, and I suggest you do the same.",
+}
+
+// BOSS ENTRY
+var BossEntrySeamstress = []string{
+	"The last door opens onto a room being unmade and remade in the same motion, and at the center of it she is kneeling into the tear with half of herself already gone through. The near half does not speak. The far half, the part you cannot see, is doing all the talking, and it is talking to the tear, not to you.",
+	"You reach the Seam. Threads of light run from her hands into the wound in the world, and from the wound back into her, and it is impossible to say which is sewing which. She turns the part of her head that is still on this side. 'You're late,' says the half of her voice that arrives before the rest.",
+	"The Seamstress has been here for centuries and the room knows it; the walls curve toward her the way a save file curves toward its one corrupted byte. She does not stand. She has stopped needing to. I file this beat under 'boss arena, no cutscene skip.'",
+	"She volunteered for this. I want that on the record before we begin. The celestial who came to close the tear early, and stayed, and stitched, and became the stitch. What faces you now is what's left over after the needle. I recommend you not mistake exhaustion for weakness.",
+	"The far half of her finishes a sentence you never heard the start of and the near half raises a needle the length of your forearm. Light gathers along it in a pattern I have seen exactly once before, in an arcade cabinet, one frame before the screen filled with bullets. 'Hold still,' both halves say. 'This closes everything.'",
+}
+
+// LORE
+var LoreLinesUnplace = []string{
+	"Belaxath tore the portal over thirty years of patient work. Killing him was supposed to close it. It did not. It only left the tear unattended, and an unattended wound in the world does not scab over. It scars into something with opinions.",
+	"This region is not a place. It is the absence where a place used to agree with itself. The locals, before there were no more locals, called it the Unplace. I have found no record of who named it, because the records are also in here and also do not agree with themselves.",
+	"Something has been stitching the tear shut from the inside for centuries. I want to be clear that this is not good news. A thing that seals a wound from inside the wound is not trying to let you out.",
+	"The rooms that are also other rooms are not a metaphor. Two chambers occupy the same coordinates and take turns being real. I have mapped it twice and gotten two maps that share no walls. I file both under 'correct.'",
+	"The Unnumbered is not many demons. It is the question of how many demons, left unanswered so long it grew teeth. Count it from one angle and there are three. From another, nine. The count is not a fact about the demons. It is a fact about you looking.",
+	"The Angleworn Horror does not enter rooms. It enters corners, and corners are everywhere, and so it is always already present three rooms before you meet it. By the time it is 'here' it has been eating your flank since the last save point.",
+	"The Echo of Belaxath drops nothing because it is not there. It is a recording the Unplace plays because the tear remembers who made it. Fighting it costs you and pays you nothing. I file this under 'toll,' which is the honest word for a thing you pay and do not buy.",
+	"The Seamstress arrived to close the tear early, out of mercy, and the tear taught her the price of mercy applied to a wound this size: you do not close it from a distance, you close it with the only thread long enough, which is yourself. Half of her is on the far side now. I do not know what the far side does with the half it holds, and I have decided not to find out.",
+}
+
+// SEAMSTRESS SIGNATURE CALLOUTS
+var SeamstressSignatureCallouts = []string{
+	"Needle Rain. The ceiling fills with descending threads of light. I say: 'That's the pattern from the cabinet — move on the telegraph, not the impact.'",
+	"She reels a thread taut across the arena; step over it or it cuts on the return. I call the line and you jump the line.",
+	"The far half of her speaks and the near half's attacks land a half-second early. I recommend you dodge the voice, not the hand.",
+	"She's threading toward your back seam. Turn into her — the Angleworn taught this room to hunt your flank, and she learned it too.",
+	"Barbed sutures across the floor. They tighten. Whatever's inside the circle when they close, stays. I call it: 'Get out of the ring.'",
+	"She pulls the room half a tile sideways — your hitbox and your sprite disagree for a beat. Trust where she's aiming, not where you're standing.",
+	"A needle the length of a spear, one clean thrust down the lane you're standing in. I flag the lane. You leave the lane.",
+	"She stitches a copy of the last attack into the room; it fires again on a delay you can count. I count it out loud so you don't have to.",
+	"Threads converge on a single point and that point is your heart, plainly telegraphed. I say: 'Break line of sight or eat it — those are the two options.'",
+	"She goes still and sews. Everything she mends on herself now, she means to unmend on you later. I file the pause under 'do damage, this is the window.'",
+}
+
+// SEAMSTRESS PHASE TWO
+var SeamstressPhaseTwoLines = []string{
+	"Below thirty-five percent she pulls the room inside-out and the far half comes forward. Now the threads run backward. I say: 'Watch the pulse — when it flares, what you'd call a wound on her is a gift, and what she calls a mercy on you draws blood.'",
+	"Inversion Stitch. The room is sewn wrong-side-round and healing and harm swap seats on the telegraph. Mend her during the flare and it costs her; let her mend herself and it costs you. I recommend you learn to read the pulse faster than she can throw it.",
+	"The near half has nothing left to say and the far half has stopped saying it to the tear. It's saying it to you now. Below thirty-five she is not closing the wound anymore — she is deciding you are the last thread she needs, and I recommend you disagree quickly.",
+}

internal/plugin/achievements.go

@@ -1205,6 +1205,11 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 			Emoji: "🗺️",
 			Check: func(d *sql.DB, u id.UserID) bool { return clearedAnyZoneOfTier(d, u, 5) },
 		},
+		{
+			ID: "expedition_clear_t6", Name: "Off the Edge of the Map", Description: "Cleared a Mythic zone. The map never went this far. Neither should you have.",
+			Emoji: "🗺️",
+			Check: func(d *sql.DB, u id.UserID) bool { return clearedAnyZoneOfTier(d, u, 6) },
+		},
 		{
 			ID: "expedition_master_t1", Name: "Warren Cartography", Description: "Cleared every Tier 1 zone. Thorough.",
 			Emoji: "🧭",
@@ -1230,6 +1235,11 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 			Emoji: "🧭",
 			Check: func(d *sql.DB, u id.UserID) bool { return clearedEveryZoneOfTier(d, u, 5) },
 		},
+		{
+			ID: "expedition_master_t6", Name: "There Was No Sixth Tier", Description: "Cleared every Mythic zone. Officially, none of these existed.",
+			Emoji: "🧭",
+			Check: func(d *sql.DB, u id.UserID) bool { return clearedEveryZoneOfTier(d, u, 6) },
+		},
 		{
 			ID: "expedition_quiet_clear", Name: "Nobody Saw Anything", Description: "Cleared a zone without threat ever passing 50. You were never here.",
 			Emoji: "🌑",

internal/plugin/admin_char_migrate.go

@@ -0,0 +1,89 @@
+package plugin
+
+import (
+	"fmt"
+	"log/slog"
+	"time"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// AdminBuildConfirmedCharacter mints (or overwrites) a confirmed D&D character
+// for one user with an explicitly chosen race/class/level, reusing the same
+// constructors as auto-migration and !setup confirm: class-tuned standard
+// array + racial mods, the canonical HP/AC formulas, resource pool, and — for
+// casters — the starter spell list and slot pool.
+//
+// It exists for the "stuck adventurer" cases the boredom ticker can't reach on
+// its own:
+//
+//   - A veteran legacy player with an adventure_characters row but no
+//     dnd_character (never triggered auto-migration because auto-migration only
+//     fires on active play — an idle player never does). Pass the class/race the
+//     faithful migration would infer to reproduce it exactly.
+//   - A player who abandoned !setup at race pick (pending_setup=1, no class), so
+//     tryBoredomStart skips them forever. This overwrites the draft with a
+//     finished sheet.
+//
+// AutoMigrated is set so the player can freely rebuild via !setup (no respec
+// cooldown) when they return — the class was assigned for them, not chosen.
+//
+// SaveDnDCharacter upserts on user_id, so an existing pending draft is replaced.
+// initResources / ensureSpellsForCharacter are idempotent.
+func AdminBuildConfirmedCharacter(userID id.UserID, race DnDRace, class DnDClass, level int) (*DnDCharacter, error) {
+	// Validate (and normalize) race/class through the same parsers !setup uses,
+	// so a typo or a non-playable class fails loudly instead of silently minting
+	// a broken sheet — an unknown class falls through classInfo to 1 HP / AC 10
+	// / no spells, which looks "built" but isn't.
+	r, ok := parseRace(string(race))
+	if !ok {
+		return nil, fmt.Errorf("unknown race %q", race)
+	}
+	cl, ok := parseClass(string(class))
+	if !ok {
+		return nil, fmt.Errorf("unknown or non-playable class %q", class)
+	}
+	race, class = r, cl
+	if level < 1 {
+		level = 1
+	}
+	if level > dndMaxLevel {
+		level = dndMaxLevel
+	}
+	scores := applyRaceMods(race, classStatPriority(class))
+	c := &DnDCharacter{
+		UserID:       userID,
+		Race:         race,
+		Class:        class,
+		Level:        level,
+		STR:          scores[0], DEX: scores[1], CON: scores[2],
+		INT:          scores[3], WIS: scores[4], CHA: scores[5],
+		PendingSetup: false,
+		AutoMigrated: true,
+		CreatedAt:    time.Now().UTC(),
+		UpdatedAt:    time.Now().UTC(),
+	}
+	conMod := abilityModifier(c.CON)
+	dexMod := abilityModifier(c.DEX)
+	c.HPMax = computeMaxHP(c.Class, conMod, c.Level)
+	c.HPCurrent = c.HPMax
+	c.ArmorClass = computeAC(c.Class, dexMod)
+	c.ShortRestCharges = c.Level
+
+	if err := ensurePlayerMetaSeed(userID); err != nil {
+		return nil, fmt.Errorf("seed player_meta: %w", err)
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		return nil, fmt.Errorf("save dnd_character: %w", err)
+	}
+	if err := initResources(userID, c.Class); err != nil {
+		return nil, fmt.Errorf("init resources: %w", err)
+	}
+	if err := ensureSpellsForCharacter(c); err != nil {
+		return nil, fmt.Errorf("seed spells: %w", err)
+	}
+	slog.Info("admin: built confirmed character",
+		"user", userID, "race", race, "class", class, "level", level,
+		"hp", c.HPMax, "ac", c.ArmorClass)
+	return c, nil
+}

internal/plugin/adventure.go

@@ -253,6 +253,12 @@ func (p *AdventurePlugin) Init() error {
 	// deaths, single-holder achievements) the first boot the seam is live, so
 	// launch doesn't open onto an empty section. One-shot, kept (see gap #7).
 	p.bootstrapPeteNewsBackfill()
+	// Repair the zone half of news_realm_firsts: the original one-shot filtered
+	// on `abandoned = 0` (which does not mean anybody gave up) and dated every
+	// row to the minute it ran. Seeds only, emits nothing. Runs regardless of the
+	// news switches — a ledger that is right only while emission is on mis-tiers
+	// the first dispatch after somebody flips it. One-shot, kept.
+	bootstrapRealmFirstsReseed()
 	// Phase R1 orphan-archive used to run here on every Init, but it
 	// over-archived: it treats any active dnd_zone_run row not linked to
 	// an active expedition as a legacy `!adventure dungeon` orphan, which
@@ -290,6 +296,9 @@ func (p *AdventurePlugin) Init() error {
 	go p.expeditionExtractionSweepTicker()
 	go p.expeditionBoredomTicker()
 	go p.mischiefTicker()
+	go p.peteMischiefTicker()
+	go p.peteEquipTicker()
+	go p.peteAdvOrderTicker()
 
 	// Auto-cashout any arena runs left in 'awaiting' from a prior restart
 	p.arenaCleanupStaleRuns()
@@ -532,6 +541,8 @@ func (p *AdventurePlugin) dispatchCommand(ctx MessageContext) error {
 		return p.handleEquipCmd(ctx)
 	case lower == "equip-magic" || lower == "equipmagic" || lower == "equip magic":
 		return p.handleEquipMagicCmd(ctx)
+	case lower == "unequip-magic" || lower == "unequipmagic" || lower == "unequip magic":
+		return p.handleUnequipMagicCmd(ctx)
 	case lower == "inventory" || lower == "inv":
 		return p.handleInventoryCmd(ctx)
 	case lower == "leaderboard" || lower == "lb":
@@ -593,6 +604,7 @@ const advHelpText = `**Adventure Commands**
 ` + "`!adventure buy <item>`" + ` — Buy equipment (e.g. ` + "`buy Enchanted Blade`" + ` or ` + "`buy 4 sword`" + `)
 ` + "`!adventure equip`" + ` — Equip Masterwork gear from inventory
 ` + "`!adventure equip-magic`" + ` — Equip magic items (curios) into your D&D slots
+` + "`!adventure unequip-magic`" + ` — Take a worn magic item off and return it to inventory
 ` + "`!adventure sell <item>`" + ` — Sell an inventory item (or ` + "`sell all`" + `)
 ` + "`!adventure inventory`" + ` — View your inventory
 ` + "`!adventure vault`" + ` — Store items safely (Tier-4 Established home; ` + "`vault store/take <item>`" + `)
@@ -939,6 +951,8 @@ func (p *AdventurePlugin) resolvePendingInteraction(ctx MessageContext, interact
 		return p.handleMasterworkEquipReply(ctx, interaction)
 	case "magic_equip":
 		return p.resolveMagicEquipReply(ctx, interaction)
+	case "magic_unequip":
+		return p.resolveMagicUnequipReply(ctx, interaction)
 	case "masterwork_equip_confirm":
 		return p.handleMasterworkEquipConfirm(ctx, interaction)
 	case "rival_rps":
@@ -1376,6 +1390,10 @@ func (p *AdventurePlugin) announceTreasureToRoom(char *AdventureCharacter, def *
 	if def == nil || def.RoomAnnounce == "" {
 		return
 	}
+	// The same story-grade gate feeds Pete's trophy case. Emit before the
+	// games-room check so a find is still recorded as news even when no room is
+	// configured to announce it in.
+	emitTreasureFound(char.UserID, def, loc)
 	gr := gamesRoom()
 	if gr == "" {
 		return

internal/plugin/adventure_babysit.go

@@ -1,6 +1,7 @@
 package plugin
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"strings"
@@ -100,33 +101,91 @@ func (p *AdventurePlugin) handleBabysitCmd(ctx MessageContext, args string) erro
 	}
 }
 
-func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the ways hiring a sitter can be refused, so the web action queue
+// (pete_orders.go) can pick a verdict without parsing prose. Each is returned
+// inside an advRefusal carrying the finished sentence, so `!adventure babysit`
+// keeps the copy it always sent.
+var (
+	errBabysitNoCharacter = errors.New("babysit: no adventurer")
+	errBabysitActive      = errors.New("babysit: a sitter is already engaged")
+	errBabysitDead        = errors.New("babysit: adventurer is dead")
+	errBabysitBroke       = errors.New("babysit: cannot cover the fee")
+	errBabysitFailed      = errors.New("babysit: could not engage a sitter")
+)
+
+// babysitOutcome is what hiring did, for a caller describing it somewhere other
+// than a DM.
+type babysitOutcome struct {
+	Days    int
+	Cost    int
+	PetName string
+	PetLine string
+	Confirm string
+}
+
+// performBabysitPurchase is `!adventure babysit week|month` minus the command
+// framing. Shared with the web action queue so hiring a sitter from a phone
+// engages the same one, on the same clock, with the same log reset.
+//
+// idemKey, when set, is the web order's guid and moves the fee onto DebitIdem so
+// a re-offered order cannot charge twice.
+func (p *AdventurePlugin) performBabysitPurchase(uid id.UserID, days int, idemKey string) (babysitOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()
 
-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "No adventurer found. Type `!adventure` to create one.")
+		return babysitOutcome{}, refuseAdv(errBabysitNoCharacter, "No adventurer found. Type `!adventure` to create one.")
 	}
 
 	if char.BabysitActive {
-		return p.SendDM(ctx.Sender, "🍼 The babysitter is already here. They're not leaving until the job is done.")
+		// A web order that already paid and already engaged the sitter lands here
+		// on the re-offer. The settled fee is what tells that apart from somebody
+		// who really does already have one.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) {
+			// Re-quote the fee rather than leaving it zero: the verdict this
+			// feeds prints the coin figure, and "0 coins" would be a false
+			// receipt for a hire the player did pay for.
+			return babysitOutcome{
+				Days:    days,
+				Cost:    babysitDailyCost(dndLevelForUser(char.UserID)) * days,
+				PetName: char.PetName,
+			}, nil
+		}
+		return babysitOutcome{}, refuseAdv(errBabysitActive, "🍼 The babysitter is already here. They're not leaving until the job is done.")
 	}
 
 	if !char.Alive {
-		return p.SendDM(ctx.Sender, "Your adventurer is dead. The babysitter does not work with corpses.")
+		return babysitOutcome{}, refuseAdv(errBabysitDead, "Your adventurer is dead. The babysitter does not work with corpses.")
 	}
 
 	daily := babysitDailyCost(dndLevelForUser(char.UserID))
 	totalCost := daily * days
-	balance := p.euro.GetBalance(char.UserID)
-	if balance < float64(totalCost) {
-		return p.SendDM(ctx.Sender, fmt.Sprintf("🍼 The babysitting service costs %s for %d days. You have %s. The service has standards. Not many, but some.", fmtEuro(totalCost), days, fmtEuro(balance)))
+	if p.euro == nil {
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Coin system unavailable — try again later.")
+	}
+	// Skip the affordability gate on a re-offer that already paid: the fee is a
+	// settled fact, and re-reading the now-lower balance would bounce a sitter the
+	// player has bought.
+	if !(idemKey != "" && p.euro.HasExternalTx(idemKey)) {
+		balance := p.euro.GetBalance(char.UserID)
+		if balance < float64(totalCost) {
+			return babysitOutcome{}, refuseAdv(errBabysitBroke,
+				"🍼 The babysitting service costs %s for %d days. You have %s. The service has standards. Not many, but some.",
+				fmtEuro(totalCost), days, fmtEuro(balance))
+		}
 	}
 
-	if !p.euro.Debit(char.UserID, float64(totalCost), "babysit_purchase") {
-		return p.SendDM(ctx.Sender, "Payment failed. The babysitter looked at your wallet and walked away.")
+	debited := false
+	if idemKey != "" {
+		ok, _, err := p.euro.DebitIdem(char.UserID, float64(totalCost), "babysit_purchase", idemKey)
+		debited = err == nil && ok
+	} else {
+		debited = p.euro.Debit(char.UserID, float64(totalCost), "babysit_purchase")
+	}
+	if !debited {
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Payment failed. The babysitter looked at your wallet and walked away.")
 	}
 
 	clearBabysitLogs(char.UserID)
@@ -138,23 +197,40 @@ func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) er
 
 	if err := saveAdvCharacter(char); err != nil {
 		slog.Error("babysit: failed to save character", "user", char.UserID, "err", err)
-		p.euro.Credit(char.UserID, float64(totalCost), "babysit_refund")
-		return p.SendDM(ctx.Sender, "Something went wrong activating the service. Your gold has been refunded.")
+		if idemKey != "" {
+			if _, _, err := p.euro.CreditIdem(char.UserID, float64(totalCost), "babysit_refund", idemKey+":refund"); err != nil {
+				slog.Error("babysit: refund failed", "user", char.UserID, "order", idemKey, "err", err)
+			}
+		} else {
+			p.euro.Credit(char.UserID, float64(totalCost), "babysit_refund")
+		}
+		return babysitOutcome{}, refuseAdv(errBabysitFailed, "Something went wrong activating the service. Your gold has been refunded.")
 	}
 	if err := upsertPlayerMetaBabysitState(char.UserID, babysitStateFromAdvChar(char)); err != nil {
 		slog.Error("player_meta: babysit start dual-write failed", "user", char.UserID, "err", err)
 	}
 
-	confirm := pickBabysitFlavor(babysitConfirmLines)
-	durLabel := "1 week"
-	if days == 30 {
-		durLabel = "1 month"
-	}
-
 	petLine := "No pet to tend yet — the babysitter will keep that in mind."
 	if char.HasPet() {
 		petLine = fmt.Sprintf("Pet: %s (L%d) — daily care included", char.PetName, char.PetLevel)
 	}
+	return babysitOutcome{
+		Days: days, Cost: totalCost, PetName: char.PetName, PetLine: petLine,
+		Confirm: pickBabysitFlavor(babysitConfirmLines),
+	}, nil
+}
+
+// handleBabysitPurchase is the command framing around performBabysitPurchase.
+func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) error {
+	out, err := p.performBabysitPurchase(ctx.Sender, days, "")
+	if err != nil {
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+
+	durLabel := "1 week"
+	if days == 30 {
+		durLabel = "1 month"
+	}
 
 	text := fmt.Sprintf("🍼 **Adventurer Babysitting Service — Activated**\n\n"+
 		"Duration: %s (%d days)\n"+
@@ -162,7 +238,7 @@ func (p *AdventurePlugin) handleBabysitPurchase(ctx MessageContext, days int) er
 		"%s\n"+
 		"Camp safety: standard camps now rest like fortified ones\n"+
 		"Rival duels: declined on your behalf\n\n"+
-		"_%s_", durLabel, days, totalCost, petLine, confirm)
+		"_%s_", durLabel, days, out.Cost, out.PetLine, out.Confirm)
 
 	return p.SendDM(ctx.Sender, text)
 }
@@ -209,25 +285,49 @@ func (p *AdventurePlugin) handleBabysitStatus(ctx MessageContext) error {
 	return p.SendDM(ctx.Sender, text)
 }
 
-func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
-	userMu := p.advUserLock(ctx.Sender)
+// babysitCancelOutcome is what dismissing the sitter did. Summary is the Matrix
+// block of what they got through while they were here — a paragraph of counts,
+// which is right under a DM and too much for a one-line web verdict, so the
+// caller decides whether to print it.
+type babysitCancelOutcome struct {
+	Summary string
+	PetName string
+}
+
+// errBabysitNoSitter is the one way cancelling can be refused. There is no
+// "already cancelled" race to worry about: the check and the write are both under
+// the per-user lock this takes.
+var errBabysitNoSitter = errors.New("babysit: no sitter to dismiss")
+
+// performBabysitCancel is `!adventure babysit cancel` minus the command framing.
+// Shared with the web action queue.
+//
+// This one TAKES the per-user lock, unlike the abandon/leave twins beside it in
+// the order path — because its Matrix caller does not hold it (handleBabysitCmd
+// dispatches straight here, where `!expedition` holds the lock across its whole
+// switch). Its web wrapper must therefore NOT take it. The asymmetry is per verb
+// and is worth checking against the Matrix caller every time one is added.
+//
+// No refund, by design: the sitter was already here.
+func (p *AdventurePlugin) performBabysitCancel(uid id.UserID) (babysitCancelOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()
 
-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "No adventurer found.")
+		return babysitCancelOutcome{}, refuseAdv(errBabysitNoCharacter, "No adventurer found.")
 	}
 
 	if !char.BabysitActive {
-		return p.SendDM(ctx.Sender, "🍼 There's nothing to cancel. The babysitter isn't here.")
+		return babysitCancelOutcome{}, refuseAdv(errBabysitNoSitter, "🍼 There's nothing to cancel. The babysitter isn't here.")
 	}
 
 	logs, err := loadBabysitLogs(char.UserID)
 	if err != nil {
 		slog.Error("babysit: failed to load logs", "user", char.UserID, "err", err)
 	}
-	summary := renderBabysitSummary(char, logs)
+	out := babysitCancelOutcome{Summary: renderBabysitSummary(char, logs), PetName: char.PetName}
 
 	char.BabysitActive = false
 	char.BabysitExpiresAt = nil
@@ -239,7 +339,15 @@ func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
 		slog.Error("player_meta: babysit cancel dual-write failed", "user", char.UserID, "err", err)
 	}
 
-	return p.SendDM(ctx.Sender, "🍼 Service cancelled. No refund. The babysitter was already there.\n\n"+summary)
+	return out, nil
+}
+
+func (p *AdventurePlugin) handleBabysitCancel(ctx MessageContext) error {
+	out, err := p.performBabysitCancel(ctx.Sender)
+	if err != nil {
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+	return p.SendDM(ctx.Sender, "🍼 Service cancelled. No refund. The babysitter was already there.\n\n"+out.Summary)
 }
 
 // ── Expiry Check ────────────────────────────────────────────────────────────

internal/plugin/adventure_flavor_campaign.go

@@ -231,6 +231,30 @@ var secretRoomDiscovery = map[string]string{
 	"feywild_crossing.illusion_garden":  "🔍 **The Illusion Garden.** A too-kind grove that isn't there when you look straight at it. He can afford beauty here; it costs him nothing to keep.",
 	"dragons_lair.hoard_pillar":         "🔍 **A pillar of hoard.** Coin drifted to the ceiling around a single column the wyrm guards more than gold — as if something at its heart were worth more.",
 	"abyss_portal.reality_seam":         "🔍 **A seam in the real.** The gate's arithmetic frays here, and through the frayed place a hand once reached to leave a thing behind on the way out.",
+
+	// Tier 6 post-game — the Phylactery Verses of the Ossuary Ascendant. Each
+	// is a stanza of the plan Valdris has been reciting to himself for years;
+	// finding one un-writes a line of his invulnerability before the fight.
+	"ossuary_ascendant.f1b2":  "🔍 **The Verse of the Waiting Grave.** Behind a course of bone laid one brick too shallow, the first stanza — inked while he was still only pretending to be dead. Read aloud, it costs him something he was counting on keeping.",
+	"ossuary_ascendant.f2b2":  "🔍 **The Verse of the Bait Long Set.** A reliquary that rings hollow gives up the middle stanza: the years of losing on purpose, written as scripture. He signed each defeat like an appointment kept.",
+	"ossuary_ascendant.cap32": "🔍 **The Verse of the Homecoming.** The highest vertebra was set wrong on purpose, and the last stanza waits inside it — the line about you, by name, arriving exactly on schedule. He did not expect you to read it first.",
+
+	// The Unplace — impossible-geometry pockets. Not hidden so much as
+	// briefly, wrongly, adjacent.
+	"unplace.f1b2":  "🔍 **The Pocket That Isn't.** A corner you already turned is somehow still ahead, and the room it opens onto was never built — but something has been storing things in it anyway.",
+	"unplace.f2b2":  "🔍 **The Unstitched Pocket.** Between two seams the celestial hasn't reached, a gap the geometry forgot to close. What fell through the tear years ago settled here, waiting to be un-fallen.",
+	"unplace.cap32": "🔍 **The Undone Pocket.** A place that is not here, and closer than the door — the shortcut that shouldn't be legal. Whoever last took it left their toll behind, undone but not gone.",
+
+	// The Drowned Star — radiant pockets of the wreck, lit from within by the
+	// dying star Seraphel still shields.
+	"drowned_star.f1b2":  "🔍 **The Radiant Wreck-Pocket.** Off the pilgrim road, past a pressure that folds lesser divers, a pocket of hull still glowing with the star's oldest light — and the offerings of pilgrims who made it this far and no further.",
+	"drowned_star.f2b2":  "🔍 **The Star-Lit Vault.** One lantern here is not a lure. It leads to a vault the trench sealed with radiance instead of stone, and the light has been keeping its contents ten thousand years fresh.",
+	"drowned_star.cap32": "🔍 **The Heart's Own Light.** A crack in the radiance, where the star leaks the light it was born with. Reaching in is reaching into the thing Seraphel has died a little every day to protect.",
+
+	// The Last Meridian — hours the Custodian hasn't decommissioned yet.
+	"last_meridian.f1b2":  "🔍 **The Unspent Hour-Pocket.** The Hour Thief overlooked one recess, and the hour it holds is still whole — sixty unspent minutes the observatory never got to bill.",
+	"last_meridian.f2b2":  "🔍 **The Unwound Vault.** Behind the escapement, on the rhythm's dead beat, a strongroom the pendulum's swing kept sealed. Time out of phase with the rest of the clock, and everything left in it, out of phase too.",
+	"last_meridian.cap32": "🔍 **The Hour Never Struck.** One hour on the great face was never dismantled — never even struck. It is still open, and inside it the world's timekeeping kept a little of everything it measured.",
 }
 
 // secretRoomDiscoveryLine returns the discovery flavor for a secret room,
@@ -261,6 +285,13 @@ var bossEpilogues = map[ZoneID]string{
 	ZoneFeywildCrossing: "The Thornmother's garden was the loveliest cage on the road, tended for a patient guest. He can afford patience; you are learning why. She wilts, and the too-kind light dims by exactly one degree.",
 	ZoneDragonsLair: "Behind Infernax's hoard, past the last of the gold, a single crown rests on no head — guarded better than the treasure, because it was the one thing here he was ever paid to keep. The dragon dies never knowing what it was.",
 	ZoneAbyssPortal: "Belaxath guarded a door that opens outward, built by someone who only ever meant to leave through it. As the demon falls, the gate does not close. It was never meant to keep things out — only to let one thing come home.",
+
+	// Tier 6 post-game epilogues — beyond the edge of the map.
+	ZoneOssuaryAscendant: "Valdris does not gloat when he goes; he files. His last breath is a clerk's satisfaction — the plan closed, the ledger squared, the grave at last furnished to code. He dies the only person here who was never surprised by anything, and that, more than the crown, is what you take home.",
+	ZoneFirstHoard:       "Aurvandryx never wanted the gold; the gold wanted her, gathered itself into a bed around her clutch the way frost gathers on the warmest thing left in a room. She dies shielding eggs that will not hatch, and the mountain finally, truly cools. Every dragon you ever fought was a scale she shed and forgot.",
+	ZoneUnplace:          "The Seamstress finishes her stitch as she falls, and the wound she was sewing shut simply — stops needing to be. The Unplace folds back into a single honest room. She volunteered for this centuries early, and no one ever came to relieve her. You are the closest thing to relief she got.",
+	ZoneDrownedStar:      "Seraphel lets go. Ten thousand years she would not, and now the dying star sinks the last fathom into the dark and is, mercifully, only dark. She is not sad. She is off-duty, for the first time since the world had names, and the trench goes quiet in a way that is almost a held breath finally let out.",
+	ZoneLastMeridian:     "The Custodian apologizes one final time, on schedule, and then the hour it was dismantling simply doesn't arrive. The clocks do not stop so much as agree to stop mattering. Its contract is complete. It thanks you for your patience — and you realize, too late to ask, who it was that hired it.",
 }
 
 // bossEpilogueLine returns the campaign capstone for a zone boss, or "" for

internal/plugin/adventure_flavor_robbie.go

@@ -45,6 +45,12 @@ var robbieAllShopGear = "Nothing fancy today but that's alright. Clean inventory
 var robbieLeftConsumable = "Oh -- one more thing. I tucked a %s into your bag on the way out. " +
 	"You've had me round enough times now that it felt rude not to. For the trouble, eh? _winks_"
 
+// robbieLeftForTheHaul is the big-haul variant: he took enough in one go that
+// walking off with only a handling fee would look bad. Takes the item list.
+var robbieLeftForTheHaul = "Oh -- and I left you something. %s. " +
+	"You had me carting that lot down four flights, and a man who takes that much " +
+	"and gives back nothing isn't a bandit, he's a landlord. _winks_"
+
 // ── Room Announcements ───────────────────────────────────────────────────────
 
 var robbieRoomStandard = "🎩 Robbie paid %s a visit and collected %d item(s) from their inventory. " +

internal/plugin/adventure_mischief.go

@@ -74,6 +74,27 @@ const (
 
 	// Fizzle: the expedition ended before the monster could find them.
 	mischiefFizzleRefund = 0.90
+
+	// A ward is priced against the contract it is defending: a floor, or a slice of
+	// the fee, whichever is more. Warding someone has to stay an impulse at the
+	// cheap tiers (or nobody bothers and the window is just a countdown), but the
+	// M1-close-out sweep measured three wards buying roughly +40pp of survival —
+	// fighter L12 vs a boss at 70% HP goes 48% → 90%. At a flat fee that let the
+	// room halve a €1,200 boss contract for €75, which makes the tier the whole
+	// economy rests on feel like money thrown away. Saving someone from a boss
+	// should cost the town real money: €120 a ward, €360 to cover them completely.
+	mischiefBlessingFeeMin = 25
+	mischiefBlessingFeePct = 0.10
+
+	// mischiefBlessingCap — how many blessings one contract can carry. Three at
+	// +10% MaxHP each is a third of a health bar: enough to swing an elite
+	// coin-flip, not enough to make a boss survivable on its own.
+	mischiefBlessingCap = 3
+
+	// mischiefBlessingPct — temp HP per blessing, as a fraction of the target's
+	// MaxHP. Same cushion mechanism as a well-rested long rest (applyDnDHPScaling),
+	// and like it, evaporates when the fight's HP is persisted back.
+	mischiefBlessingPct = 0.10
 )
 
 // Contract statuses. `delivering` is the claimed-but-unresolved state a CAS
@@ -123,6 +144,102 @@ func mischiefTierByKey(key string) (mischiefTier, bool) {
 	return mischiefTier{}, false
 }
 
+// mischiefNextTier is the rung an escalation buys. Boss is the top: there is
+// nothing worse in the bracket to send.
+func mischiefNextTier(key string) (mischiefTier, bool) {
+	for i, t := range mischiefTiers {
+		if t.Key == key && i+1 < len(mischiefTiers) {
+			return mischiefTiers[i+1], true
+		}
+	}
+	return mischiefTier{}, false
+}
+
+// mischiefPrevTier is the rung an escalated contract came FROM. Grunt is the
+// bottom: nothing escalates into it.
+func mischiefPrevTier(key string) (mischiefTier, bool) {
+	for i, t := range mischiefTiers {
+		if t.Key == key && i > 0 {
+			return mischiefTiers[i-1], true
+		}
+	}
+	return mischiefTier{}, false
+}
+
+// mischiefOutlay splits what a contract collected into the buyer's stake and the
+// escalator's. It exists because `paid` carries BOTH — escalateMischiefContract
+// adds the delta to it so the purse cap keeps biting — and every path that gives
+// money back has to give each of them back their own. Crediting the whole of
+// `paid` to the buyer turns being escalated on top of into a windfall: buy an
+// elite for €350, have someone bump it to a boss (+€850), let the target extract,
+// and the 90% fizzle refund hands the buyer €1080 of somebody else's money.
+//
+// The escalator's stake is derived, not stored. An escalation is exactly one rung
+// and happens at most once (escalation_count = 0 is in the UPDATE's WHERE), so it
+// is always the fee gap between the contract's tier and the one below it.
+func mischiefOutlay(c *mischiefContract) (buyer, escalator int) {
+	if c.EscalatedBy == "" || c.EscalationCount == 0 {
+		return c.Paid, 0
+	}
+	cur, okCur := mischiefTierByKey(c.Tier)
+	prev, okPrev := mischiefPrevTier(c.Tier)
+	if !okCur || !okPrev {
+		return c.Paid, 0
+	}
+	delta := cur.Fee - prev.Fee
+	if delta <= 0 || delta > c.Paid {
+		return c.Paid, 0 // nonsense ladder; don't invent money out of it
+	}
+	return c.Paid - delta, delta
+}
+
+// trackMischiefSink books a sink against the people whose money it actually was.
+// The escalator's stake sits inside c.Paid, so charging the whole rake to the
+// buyer would credit them with tax they never paid — and credit the escalator,
+// who funded most of a boss contract, with none.
+func trackMischiefSink(c *mischiefContract, amount int) {
+	buyerPaid, escPaid := mischiefOutlay(c)
+	total := buyerPaid + escPaid
+	if amount <= 0 || total <= 0 {
+		return
+	}
+	escShare := amount * escPaid / total
+	if escShare > 0 {
+		trackTaxPaid(c.EscalatedBy, escShare)
+	}
+	if buyerShare := amount - escShare; buyerShare > 0 {
+		trackTaxPaid(c.BuyerID, buyerShare)
+	}
+}
+
+// mischiefBlessingFee is what one ward costs against a contract of this fee. It
+// reads the contract's CURRENT basis, so an escalation raises the price of
+// protecting its target too — the room's counterplay tracks the threat.
+func mischiefBlessingFee(contractFee int) int {
+	fee := int(math.Round(float64(contractFee) * mischiefBlessingFeePct))
+	if fee < mischiefBlessingFeeMin {
+		return mischiefBlessingFeeMin
+	}
+	return fee
+}
+
+// mischiefBlessingTempHP is the cushion a contract's blessings are worth to a
+// target of this MaxHP. At least 1 per blessing, so a low-HP character still
+// feels the ward they were bought.
+func mischiefBlessingTempHP(hpMax, blessings int) int {
+	if blessings <= 0 || hpMax <= 0 {
+		return 0
+	}
+	if blessings > mischiefBlessingCap {
+		blessings = mischiefBlessingCap
+	}
+	per := int(float64(hpMax) * mischiefBlessingPct)
+	if per < 1 {
+		per = 1
+	}
+	return per * blessings
+}
+
 // mischiefSignedFee is what a buyer pays to put their name on the contract up
 // front. The extra is a sink — mischiefPurse never sees it.
 func mischiefSignedFee(fee int) int {
@@ -229,21 +346,24 @@ type mischiefContract struct {
 	Status          string
 	Signed          bool
 	EscalationCount int
+	EscalatedBy     id.UserID // "" unless somebody paid to bump the tier
 	BlessingCount   int
 	Source          string
 	Outcome         string
+	OrderGUID       string // the web order this was opened for; "" for a Matrix buy
 	CreatedAt       time.Time
 	WindowEndsAt    time.Time
 }
 
 const mischiefCols = `contract_id, buyer_id, target_id, tier, fee, paid, status, signed,
-	escalation_count, blessing_count, source, COALESCE(outcome, ''), created_at, window_ends_at`
+	escalation_count, COALESCE(escalated_by, ''), blessing_count, source, COALESCE(outcome, ''),
+	COALESCE(order_guid, ''), created_at, window_ends_at`
 
 func scanMischief(row interface{ Scan(...any) error }) (*mischiefContract, error) {
 	c := &mischiefContract{}
 	err := row.Scan(&c.ID, &c.BuyerID, &c.TargetID, &c.Tier, &c.Fee, &c.Paid, &c.Status,
-		&c.Signed, &c.EscalationCount, &c.BlessingCount, &c.Source, &c.Outcome,
-		&c.CreatedAt, &c.WindowEndsAt)
+		&c.Signed, &c.EscalationCount, &c.EscalatedBy, &c.BlessingCount, &c.Source, &c.Outcome,
+		&c.OrderGUID, &c.CreatedAt, &c.WindowEndsAt)
 	if err != nil {
 		return nil, err
 	}
@@ -263,14 +383,70 @@ func scanMischief(row interface{ Scan(...any) error }) (*mischiefContract, error
 func insertMischiefContract(c *mischiefContract) error {
 	_, err := db.Get().Exec(
 		`INSERT INTO mischief_contracts
-		 (contract_id, buyer_id, target_id, tier, fee, paid, status, signed, source,
+		 (contract_id, buyer_id, target_id, tier, fee, paid, status, signed, source, order_guid,
 		  created_at, window_ends_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		c.ID, string(c.BuyerID), string(c.TargetID), c.Tier, c.Fee, c.Paid,
-		c.Status, c.Signed, c.Source, c.CreatedAt, c.WindowEndsAt)
+		c.Status, c.Signed, c.Source, c.OrderGUID, c.CreatedAt, c.WindowEndsAt)
 	return err
 }
 
+// mischiefContractByOrderGUID finds the contract opened for a web order, if one
+// exists. It is the idempotency backstop for the storefront's retrying claim
+// loop: a placement that already created a contract must not create a second, so
+// the loop checks here before it debits or inserts. Returns nil when no contract
+// carries this order (the normal first-attempt case).
+func mischiefContractByOrderGUID(orderGUID string) *mischiefContract {
+	if orderGUID == "" {
+		return nil
+	}
+	row := db.Get().QueryRow(
+		`SELECT `+mischiefCols+` FROM mischief_contracts WHERE order_guid = ?`, orderGUID)
+	c, err := scanMischief(row)
+	if err != nil {
+		return nil // sql.ErrNoRows (the common case) or a scan miss — treat as absent
+	}
+	return c
+}
+
+// blessMischiefContract adds one ward to an open contract and reports whether it
+// took. The cap and the still-open check are in the WHERE clause, not in the
+// caller: the window is a scramble, and a room that piles four blessings in the
+// same second must still land exactly three. A caller that loses this race has
+// already been debited and must refund.
+func blessMischiefContract(contractID string) bool {
+	res := db.ExecResult("mischief: bless contract",
+		`UPDATE mischief_contracts SET blessing_count = blessing_count + 1
+		  WHERE contract_id = ? AND status = ? AND blessing_count < ?`,
+		contractID, mischiefStatusOpen, mischiefBlessingCap)
+	if res == nil {
+		return false
+	}
+	n, _ := res.RowsAffected()
+	return n == 1
+}
+
+// escalateMischiefContract bumps an open contract one rung: the tier, the payout
+// basis (fee) and the buyer-side outlay (paid) all move together, so the purse
+// stays a percentage of what was actually spent and the 75% cap survives an
+// escalation untouched.
+//
+// The escalation_count = 0 and tier = <from> guards are what make it one step,
+// once, even if two people hit `!mischief escalate` on the same contract at the
+// same moment. The loser is refunded.
+func escalateMischiefContract(contractID, fromTier string, next mischiefTier, delta int, by id.UserID) bool {
+	res := db.ExecResult("mischief: escalate contract",
+		`UPDATE mischief_contracts
+		    SET tier = ?, fee = ?, paid = paid + ?, escalation_count = 1, escalated_by = ?
+		  WHERE contract_id = ? AND status = ? AND tier = ? AND escalation_count = 0`,
+		next.Key, next.Fee, delta, string(by), contractID, mischiefStatusOpen, fromTier)
+	if res == nil {
+		return false
+	}
+	n, _ := res.RowsAffected()
+	return n == 1
+}
+
 // claimMischiefForDelivery moves open → delivering and reports whether THIS
 // caller won the race. Exactly one delivery per contract, whatever the ticker
 // does across a restart.
@@ -480,9 +656,14 @@ func (p *AdventurePlugin) handleMischiefCmd(ctx MessageContext, args string) err
 		return p.mischiefStatusCmd(ctx)
 	case "send":
 		return p.mischiefSendCmd(ctx, fields[1:])
+	case "bless":
+		return p.mischiefBlessCmd(ctx, fields[1:])
+	case "escalate":
+		return p.mischiefEscalateCmd(ctx, fields[1:])
 	default:
 		return p.SendReply(ctx.RoomID, ctx.EventID,
-			"Unknown option. `!mischief` for the board · `!mischief send <tier> @user` · `!mischief status`")
+			"Unknown option. `!mischief` for the board · `!mischief send <tier> @user` · "+
+				"`!mischief bless @user` · `!mischief escalate @user` · `!mischief status`")
 	}
 }
 
@@ -492,11 +673,18 @@ func (p *AdventurePlugin) mischiefBoard() string {
 	b.WriteString("The monster comes from their own bracket, so it's always a fight worth watching. ")
 	b.WriteString("If they survive it, they keep a cut of your money — and the town finds out it was you.\n\n")
 	for _, t := range mischiefTiers {
-		b.WriteString(fmt.Sprintf("· **%s** — %s (signed: %s) — survivor keeps %s\n   _%s_\n",
+		b.WriteString(fmt.Sprintf("· **%s** — %s (signed: %s) — survivor keeps %s · ward %s\n   _%s_\n",
 			t.Display, fmtEuro(t.Fee), fmtEuro(mischiefSignedFee(t.Fee)),
-			fmtEuro(mischiefPurse(t.Fee, t.PayoutPct)), t.Blurb))
+			fmtEuro(mischiefPurse(t.Fee, t.PayoutPct)), fmtEuro(mischiefBlessingFee(t.Fee)), t.Blurb))
 	}
 	b.WriteString("\n`!mischief send <tier> @user` — anonymous · add `signed` to put your name on it up front.\n")
+	b.WriteString(fmt.Sprintf(
+		"While a contract is open, the rest of us get a say:\n"+
+			"· `!mischief bless @user` — a ward for the fight, up to %d of them. Help them. "+
+			"The worse the thing coming, the more a ward costs.\n"+
+			"· `!mischief escalate @user` — pay the difference, send something worse. \"Help\" them. "+
+			"It raises their purse too, if they live.\n",
+		mischiefBlessingCap))
 	b.WriteString(fmt.Sprintf("_They have to be out on an expedition, level %d+. It lands about %s later._",
 		mischiefMinLevel, formatDuration(mischiefWindow)))
 	return b.String()
@@ -509,10 +697,14 @@ func (p *AdventurePlugin) mischiefStatusCmd(ctx MessageContext) error {
 		if c.Signed {
 			who = "**" + p.DisplayName(c.BuyerID) + "**"
 		}
+		wards := ""
+		if c.BlessingCount > 0 {
+			wards = fmt.Sprintf("\n🕯️ %d of the town's wards are on you.", c.BlessingCount)
+		}
 		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
-			"😈 %s has paid for a **%s** to find you. It arrives %s. Survive it and you keep %s.",
+			"😈 %s has paid for a **%s** to find you. It arrives %s. Survive it and you keep %s.%s",
 			who, strings.ToLower(t.Display), formatDuration(time.Until(c.WindowEndsAt)),
-			fmtEuro(mischiefPurse(c.Fee, t.PayoutPct))))
+			fmtEuro(mischiefPurse(c.Fee, t.PayoutPct)), wards))
 	}
 	rows, err := db.Get().Query(
 		`SELECT `+mischiefCols+` FROM mischief_contracts
@@ -617,6 +809,7 @@ func (p *AdventurePlugin) mischiefSendCmd(ctx MessageContext, fields []string) e
 	}
 
 	p.announceMischiefContract(c, tier)
+	p.dmMischiefVictim(c, tier)
 	emitMischiefContractNews(c, tier)
 
 	return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
@@ -625,6 +818,333 @@ func (p *AdventurePlugin) mischiefSendCmd(ctx MessageContext, fields []string) e
 		mischiefBuyerNote(signed)))
 }
 
+// Web-order verdicts. These strings are the storefront order statuses Pete files,
+// so they are part of the wire contract — see internal/storage/mischief.go.
+const (
+	mischiefWebPlaced            = "placed"
+	mischiefWebBouncedFunds      = "bounced_funds"
+	mischiefWebBouncedIneligible = "bounced_ineligible"
+)
+
+// mischiefWebResult is the outcome of a web placement. Retry means "leave the
+// order pending" — a transient failure (DB hiccup, half-done state) the poll loop
+// should try again — and is never itself a verdict Pete files.
+type mischiefWebResult struct {
+	Status string
+	Detail string
+	Retry  bool
+}
+
+// placeWebMischief opens a contract for a web storefront order. It is the poll
+// loop's fulfilment path, and differs from the Matrix mischiefSendCmd in exactly
+// the ways a retrying wire demands:
+//
+//   - The order guid is the idempotency key. The euro debit goes through
+//     DebitIdem keyed on it, and the contract is stamped with it, so a claim
+//     whose ack was lost can re-run the whole thing without charging twice or
+//     opening a second contract.
+//   - It debits *before* checking eligibility, then refunds if the target turns
+//     out ineligible. Doing it in that order keeps the money state a pure
+//     function of the guid: on any retry the debit is a settled fact, not a
+//     coin-flip on where we crashed. The Matrix path can afford the friendlier
+//     check-first flow because it never retries.
+//   - It returns a verdict for Pete to render instead of replying in a room.
+//
+// The buyer is DM'd the same way a Matrix buyer is told, and the victim and news
+// feed see exactly what a Matrix contract produces — a web hit is indistinguishable
+// downstream from one placed in chat.
+func (p *AdventurePlugin) placeWebMischief(order peteclient.MischiefOrder) mischiefWebResult {
+	// Already fulfilled on a prior attempt — the surest idempotency check there
+	// is. Report placed without touching money again.
+	if existing := mischiefContractByOrderGUID(order.GUID); existing != nil {
+		return mischiefWebResult{Status: mischiefWebPlaced, Detail: "already placed"}
+	}
+
+	tier, ok := mischiefTierByKey(order.Tier)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "unknown tier"}
+	}
+
+	buyerID, ok := p.mischiefBuyerMXID(order.BuyerUsername)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "unknown buyer"}
+	}
+	targetID, ok := resolveRosterToken(order.TargetToken)
+	if !ok {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "that adventurer is no longer on the board"}
+	}
+	if targetID == buyerID {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "you can't put a price on your own head"}
+	}
+
+	// Serialise this buyer's placements, same discipline as the Matrix path: two
+	// orders in one poll batch can't both slip past the daily cap.
+	lock := p.advUserLock(buyerID)
+	lock.Lock()
+	defer lock.Unlock()
+
+	now := time.Now().UTC()
+	if n := mischiefBuyerCountSince(buyerID, now.Add(-24*time.Hour)); n >= mischiefBuyerDailyCap {
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: fmt.Sprintf("daily limit reached (%d today)", n)}
+	}
+
+	price := tier.Fee
+	if order.Signed {
+		price = mischiefSignedFee(tier.Fee)
+	}
+
+	// Affordability gate, matching the Matrix path: a mischief buy takes no credit,
+	// so a buyer short of the fee is bounced before any money moves. The gate is
+	// skipped on a retry of an order already debited — re-reading the now-lower
+	// balance would wrongly bounce a hit that was already paid for.
+	if !p.euro.HasExternalTx(order.GUID) && int(p.euro.GetBalance(buyerID)) < price {
+		return mischiefWebResult{Status: mischiefWebBouncedFunds, Detail: fmt.Sprintf("a %s runs %s", strings.ToLower(tier.Display), fmtEuro(price))}
+	}
+
+	// Debit, keyed on the order guid so a replay is a no-op. ok=false means the
+	// buyer is already past the debt floor, which the gate above all but rules out.
+	debited, _, err := p.euro.DebitIdem(buyerID, float64(price), "mischief_contract_web", order.GUID)
+	if err != nil {
+		slog.Warn("mischief: web debit errored, will retry", "order", order.GUID, "err", err)
+		return mischiefWebResult{Retry: true}
+	}
+	if !debited {
+		return mischiefWebResult{Status: mischiefWebBouncedFunds, Detail: fmt.Sprintf("a %s runs %s", strings.ToLower(tier.Display), fmtEuro(price))}
+	}
+
+	// From here the buyer is debited; every failure path must refund. The refund
+	// keys on a distinct external id so it can't be swallowed as a replay of the
+	// debit itself.
+	refund := func() {
+		if _, _, err := p.euro.CreditIdem(buyerID, float64(price), "mischief_refund_web", order.GUID+":refund"); err != nil {
+			slog.Error("mischief: web refund failed — buyer is short", "order", order.GUID, "buyer", buyerID, "err", err)
+		}
+	}
+
+	if reason := p.mischiefTargetable(targetID, tier, now); reason != "" {
+		refund()
+		return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: reason}
+	}
+
+	c := &mischiefContract{
+		ID:           uuid.NewString(),
+		BuyerID:      buyerID,
+		TargetID:     targetID,
+		Tier:         tier.Key,
+		Fee:          tier.Fee,
+		Paid:         price,
+		Status:       mischiefStatusOpen,
+		Signed:       order.Signed,
+		Source:       "web",
+		OrderGUID:    order.GUID,
+		CreatedAt:    now,
+		WindowEndsAt: now.Add(mischiefWindow),
+	}
+	if err := insertMischiefContract(c); err != nil {
+		// Distinguish the one legitimate rejection from a transient write failure,
+		// the same way the Matrix path does — the two want opposite handling.
+		if liveMischiefForTarget(targetID) != nil {
+			// A rival contract is already on this target (ours isn't: we checked
+			// order_guid up top). Refund and terminally bounce; the buyer lost a
+			// race, not money.
+			refund()
+			slog.Warn("mischief: web contract lost the race", "order", order.GUID, "target", targetID)
+			return mischiefWebResult{Status: mischiefWebBouncedIneligible, Detail: "someone already sent a monster their way"}
+		}
+		// A real write failure with no rival to blame. Leave the debit in place
+		// and the order pending — the guid makes the next poll's re-run a no-op on
+		// the money and a clean retry on the insert, which is the whole point of
+		// keying on it. Refunding here would both drop a placeable hit and, worse,
+		// hand out a free contract if the retry then succeeded against the credit.
+		slog.Warn("mischief: web contract insert failed, will retry", "order", order.GUID, "target", targetID, "err", err)
+		return mischiefWebResult{Retry: true}
+	}
+
+	p.announceMischiefContract(c, tier)
+	p.dmMischiefVictim(c, tier)
+	emitMischiefContractNews(c, tier)
+	p.dmMischiefWebBuyer(buyerID, c, tier)
+
+	return mischiefWebResult{Status: mischiefWebPlaced, Detail: fmt.Sprintf("a %s is on the way", strings.ToLower(tier.Display))}
+}
+
+// mischiefBuyerMXID reconstructs the buyer's Matrix id from the username Pete
+// sent. Authentik's preferred_username is the Matrix localpart by construction
+// (verified on the MAS box), so the buyer is @<username>:<our homeserver>. We
+// lowercase because Matrix localparts are lowercase and an Authentik display of
+// the name may not be. Fails closed if the client isn't up (tests) or the name
+// is empty.
+func (p *AdventurePlugin) mischiefBuyerMXID(username string) (id.UserID, bool) {
+	lp := strings.ToLower(strings.TrimSpace(username))
+	if lp == "" || p.Client == nil {
+		return "", false
+	}
+	server := p.Client.UserID.Homeserver()
+	if server == "" {
+		return "", false
+	}
+	return id.NewUserID(lp, server), true
+}
+
+// dmMischiefWebBuyer tells a web buyer their hit is out, the same courtesy a
+// Matrix buyer gets in-thread. Best-effort: a buyer with no DM room open just
+// watches the storefront status instead.
+func (p *AdventurePlugin) dmMischiefWebBuyer(buyerID id.UserID, c *mischiefContract, tier mischiefTier) {
+	msg := fmt.Sprintf("😈 The word's out. A **%s** is on its way to **%s** — it finds them in about %s.\n%s",
+		strings.ToLower(tier.Display), p.DisplayName(c.TargetID), formatDuration(mischiefWindow),
+		mischiefBuyerNote(c.Signed))
+	if err := p.SendDM(buyerID, msg); err != nil {
+		slog.Debug("mischief: web buyer DM failed", "buyer", buyerID, "err", err)
+	}
+}
+
+// mischiefOpenContractFor resolves "@user" to the contract currently open against
+// them, or explains why the room can't act on it. A contract already claimed for
+// delivery is deliberately out of reach: the monster is in the room with them and
+// a ward bought now would have to reach back into a fight that has started.
+func (p *AdventurePlugin) mischiefOpenContractFor(ctx MessageContext, fields []string, verb string) (*mischiefContract, id.UserID, string) {
+	if len(fields) < 1 {
+		return nil, "", fmt.Sprintf("Usage: `!mischief %s @user`", verb)
+	}
+	targetID, ok := p.ResolveUser(fields[0], ctx.RoomID)
+	if !ok {
+		return nil, "", fmt.Sprintf("Could not resolve that user. Usage: `!mischief %s @user`", verb)
+	}
+	c := liveMischiefForTarget(targetID)
+	if c == nil {
+		return nil, targetID, fmt.Sprintf("Nobody has coin on **%s** right now.", p.DisplayName(targetID))
+	}
+	if c.Status != mischiefStatusOpen {
+		return nil, targetID, fmt.Sprintf(
+			"Too late — the thing has already found **%s**.", p.DisplayName(targetID))
+	}
+	return c, targetID, ""
+}
+
+// mischiefBlessCmd — the helping half of the window. The fee is a pure sink (it
+// goes to the community pot, never to the purse), so a blessing can't be used to
+// route money to the target: it buys them HP, not euros.
+func (p *AdventurePlugin) mischiefBlessCmd(ctx MessageContext, fields []string) error {
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	c, targetID, reason := p.mischiefOpenContractFor(ctx, fields, "bless")
+	if c == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, reason)
+	}
+	if c.BlessingCount >= mischiefBlessingCap {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"**%s** is already carrying every ward the town has to give (%d). The rest is up to them.",
+			p.DisplayName(targetID), mischiefBlessingCap))
+	}
+	// Priced off the contract's current basis: warding someone against a boss costs
+	// what a boss is worth, and an escalation raises the price of saving them.
+	fee := mischiefBlessingFee(c.Fee)
+	if bal := p.euro.GetBalance(ctx.Sender); int(bal) < fee {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"A ward against a %s costs %s — you have %s.",
+			strings.ToLower(c.Tier), fmtEuro(fee), fmtEuro(int(bal))))
+	}
+	if !p.euro.Debit(ctx.Sender, float64(fee), "mischief_blessing") {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't take your money. Try again.")
+	}
+	// The cap is enforced by the UPDATE, not by the read above — two people can
+	// buy the third ward in the same second, and only one of them may have it.
+	if !blessMischiefContract(c.ID) {
+		p.euro.Credit(ctx.Sender, float64(fee), "mischief_blessing_refund")
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"Somebody got there first — the ward wasn't needed. You've been refunded.")
+	}
+	communityPotAdd(fee)
+	trackTaxPaid(ctx.Sender, fee)
+
+	// Read the tally back rather than deriving it from the pre-UPDATE snapshot: two
+	// blessers landing together would both compute BlessingCount+1 off a count of 0
+	// and both announce "1 of 3" for a contract that is now carrying 2.
+	count := c.BlessingCount + 1
+	if fresh, err := mischiefContractByID(c.ID); err == nil && fresh != nil {
+		count = fresh.BlessingCount
+	}
+
+	p.announceMischiefBlessing(c, ctx.Sender, count)
+	p.SendDM(targetID, fmt.Sprintf(
+		"🕯️ **%s** has paid for a ward on you. Whatever's coming, I've made you harder to put down.",
+		p.DisplayName(ctx.Sender)))
+	return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+		"🕯️ Done — **%s** goes into that fight tougher than they would have. (%d/%d wards)",
+		p.DisplayName(targetID), count, mischiefBlessingCap))
+}
+
+// mischiefEscalateCmd — the "helping" half. Anyone but the target can pay the
+// difference to send something worse. The money joins the payout basis, so piling
+// on raises the jackpot the target walks away with if they live: the room's cruelty
+// is also its generosity, which is the joke.
+func (p *AdventurePlugin) mischiefEscalateCmd(ctx MessageContext, fields []string) error {
+	lock := p.advUserLock(ctx.Sender)
+	lock.Lock()
+	defer lock.Unlock()
+
+	c, targetID, reason := p.mischiefOpenContractFor(ctx, fields, "escalate")
+	if c == nil {
+		return p.SendReply(ctx.RoomID, ctx.EventID, reason)
+	}
+	if targetID == ctx.Sender {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"You don't get to raise the price on your own head. Have some dignity.")
+	}
+	cur, _ := mischiefTierByKey(c.Tier)
+	next, ok := mischiefNextTier(c.Tier)
+	if !ok {
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"It's already the worst thing in their bracket. There is nothing bigger to send.")
+	}
+	if c.EscalationCount > 0 {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"Somebody has already made it worse — it's a **%s** now. Once is the limit.",
+			strings.ToLower(cur.Display)))
+	}
+	// An escalation into boss tier is still a boss landing on this person, so it
+	// answers to the same weekly limit a bought boss does. (This contract is not a
+	// boss yet, so it cannot count itself.)
+	now := time.Now().UTC()
+	if next.Key == "boss" && mischiefBossCountSince(targetID, now.Add(-mischiefBossPerTargetWindow)) > 0 {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"**%s** has already had a boss sent after them this week. Let them keep this one.",
+			p.DisplayName(targetID)))
+	}
+	delta := next.Fee - cur.Fee
+	if bal := p.euro.GetBalance(ctx.Sender); int(bal) < delta {
+		return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+			"Bumping a %s up to a %s costs the difference: %s. You have %s.",
+			strings.ToLower(cur.Display), strings.ToLower(next.Display), fmtEuro(delta), fmtEuro(int(bal))))
+	}
+	if !p.euro.Debit(ctx.Sender, float64(delta), "mischief_escalation") {
+		return p.SendReply(ctx.RoomID, ctx.EventID, "Couldn't take your money. Try again.")
+	}
+	if !escalateMischiefContract(c.ID, cur.Key, next, delta, ctx.Sender) {
+		p.euro.Credit(ctx.Sender, float64(delta), "mischief_escalation_refund")
+		return p.SendReply(ctx.RoomID, ctx.EventID,
+			"Somebody beat you to it, or the thing already left. You've been refunded.")
+	}
+
+	purse := mischiefPurse(next.Fee, next.PayoutPct)
+	p.announceMischiefEscalation(c, next, purse)
+	p.SendDM(targetID, fmt.Sprintf(
+		"😈 It got worse. What's coming for you is a **%s** now — somebody in town paid to upgrade it.\n"+
+			"Their money's in the pot with the rest: walk away from it and you keep %s.",
+		strings.ToLower(next.Display), fmtEuro(purse)))
+	if c.BuyerID != ctx.Sender {
+		p.SendDM(c.BuyerID, fmt.Sprintf(
+			"😈 Somebody liked your idea and paid to make it worse: **%s** is getting a **%s** now.",
+			p.DisplayName(targetID), strings.ToLower(next.Display)))
+	}
+	return p.SendReply(ctx.RoomID, ctx.EventID, fmt.Sprintf(
+		"😈 Paid. It's a **%s** now. If **%s** walks away from it they keep %s — you helped with that too.\n"+
+			"_Nobody knows it was you — unless they survive._",
+		strings.ToLower(next.Display), p.DisplayName(targetID), fmtEuro(purse)))
+}
+
 func mischiefBuyerNote(signed bool) string {
 	if signed {
 		return "_Your name is on it. Everyone already knows._"
@@ -653,18 +1173,77 @@ func (p *AdventurePlugin) announceMischiefContract(c *mischiefContract, tier mis
 		formatDuration(time.Until(c.WindowEndsAt)), fmtEuro(mischiefPurse(c.Fee, tier.PayoutPct))))
 }
 
+// dmMischiefVictim is TwinBee telling the target that somebody wants them dead.
+// Pure flavor — the expedition is autonomous and they cannot act on it directly —
+// but it is what lets them ask the room for wards, which is the whole window.
+func (p *AdventurePlugin) dmMischiefVictim(c *mischiefContract, tier mischiefTier) {
+	who := "Somebody in town"
+	if c.Signed {
+		who = "**" + p.DisplayName(c.BuyerID) + "**"
+	}
+	p.SendDM(c.TargetID, fmt.Sprintf(
+		"😈 **Word's reached me, and you're not going to like it.**\n"+
+			"%s has paid to have a **%s** find you out there. It's already looking. I make it about %s.\n\n"+
+			"I can't call it off, and I can't come out there. What the town *can* do is ward you — "+
+			"anyone who likes you can `!mischief bless %s` (%s each, up to %d).\n"+
+			"Walk away from it and their money is yours: **%s**. And we all find out who paid.",
+		who, strings.ToLower(tier.Display), formatDuration(time.Until(c.WindowEndsAt)),
+		// The full MXID, not the display name: handleMischiefCmd splits on whitespace,
+		// so a copy-pasted `bless @Misty Blue` would resolve on "@Misty" — or on
+		// somebody else entirely. ResolveUser takes an "@user:server" verbatim.
+		c.TargetID, fmtEuro(mischiefBlessingFee(c.Fee)), mischiefBlessingCap,
+		fmtEuro(mischiefPurse(c.Fee, tier.PayoutPct))))
+}
+
+// announceMischiefBlessing — helping is public and immediate. The blesser is
+// named on the spot: there is no reason to hide having done someone a kindness,
+// and the room seeing wards go up is what pulls the next one out of somebody.
+func (p *AdventurePlugin) announceMischiefBlessing(c *mischiefContract, blesser id.UserID, count int) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	p.SendMessage(gr, fmt.Sprintf(
+		"🕯️ **%s** puts a ward on **%s** — %d of %d. Whatever's coming for them will have to work harder.",
+		p.DisplayName(blesser), p.DisplayName(c.TargetID), count, mischiefBlessingCap))
+}
+
+// announceMischiefEscalation — "helping" is anonymous, exactly like the purchase
+// it piles onto, and unsealed by the same survival.
+func (p *AdventurePlugin) announceMischiefEscalation(c *mischiefContract, next mischiefTier, purse int) {
+	gr := gamesRoom()
+	if gr == "" {
+		return
+	}
+	p.SendMessage(gr, fmt.Sprintf(
+		"😈 **Somebody has made it worse.** What's hunting **%s** out there is a **%s** now.\n"+
+			"They put their money in the pot to do it — so if **%s** walks away, the purse is up to %s.",
+		p.DisplayName(c.TargetID), strings.ToLower(next.Display),
+		p.DisplayName(c.TargetID), fmtEuro(purse)))
+}
+
 func (p *AdventurePlugin) announceMischiefSurvived(c *mischiefContract, monsterName string, purse int) {
 	gr := gamesRoom()
 	if gr == "" {
 		return
 	}
 	// The unseal. Anonymity is the buyer's to lose, and losing it is what makes
-	// a survival worth announcing.
+	// a survival worth announcing. Whoever paid to make it worse loses theirs on
+	// the same terms — piling on is a purchase, and it carries the same exposure.
 	p.SendMessage(gr, fmt.Sprintf(
 		"🛡️ **%s walked away from it.** The **%s** that came for them is dead, and %s is %s richer for the trouble.\n"+
-			"The coin came from **%s**.",
+			"The coin came from **%s**.%s",
 		p.DisplayName(c.TargetID), monsterName, p.DisplayName(c.TargetID), fmtEuro(purse),
-		p.DisplayName(c.BuyerID)))
+		p.DisplayName(c.BuyerID), p.mischiefEscalatorNote(c)))
+}
+
+// mischiefEscalatorNote names whoever paid to upgrade the contract, for the
+// unseal. Empty when nobody did.
+func (p *AdventurePlugin) mischiefEscalatorNote(c *mischiefContract) string {
+	if c.EscalatedBy == "" {
+		return ""
+	}
+	return fmt.Sprintf(" **%s** paid to make it worse.", p.DisplayName(c.EscalatedBy))
 }
 
 func (p *AdventurePlugin) announceMischiefDowned(c *mischiefContract, monsterName string) {
@@ -686,6 +1265,13 @@ func (p *AdventurePlugin) announceMischiefDowned(c *mischiefContract, monsterNam
 //
 // Deploy Pete BEFORE gogobee whenever these types change: Pete 400s an unknown
 // event_type, gogobee retries, and the bulletin parks forever.
+//
+// BULLETIN, never priority. Priority tier is the one thing that makes Pete post a
+// live Matrix beat, and TwinBee already announces every one of these in the games
+// room as it happens (announceMischiefContract / Survived / Downed) — a priority
+// fact would just read Pete's version back to the people who watched it. Bulletin
+// still carries the story to the site and the daily digest, where a roundup is
+// what it is. Same call 1cbd68a made for death and zone_first.
 
 func emitMischiefContractNews(c *mischiefContract, tier mischiefTier) {
 	target := charName(c.TargetID)
@@ -702,7 +1288,7 @@ func emitMischiefContractNews(c *mischiefContract, tier mischiefTier) {
 	emitFact(peteclient.Fact{
 		GUID:       fmt.Sprintf("mischief_contract:%s:%d", eventToken(c.TargetID, "mischief:"+c.ID), ts),
 		EventType:  "mischief_contract",
-		Tier:       "priority",
+		Tier:       "bulletin",
 		Subject:    target,
 		Opponent:   buyer,
 		Boss:       tier.Display,
@@ -733,7 +1319,7 @@ func emitMischiefResolvedNews(c *mischiefContract, monsterName, outcome string,
 	emitFact(peteclient.Fact{
 		GUID:       fmt.Sprintf("%s:%s:%d", eventType, eventToken(c.TargetID, "mischief:"+c.ID), ts),
 		EventType:  eventType,
-		Tier:       "priority",
+		Tier:       "bulletin",
 		Subject:    target,
 		Opponent:   buyer,
 		Boss:       monsterName,

internal/plugin/adventure_mischief_deliver.go

@@ -121,6 +121,15 @@ func (p *AdventurePlugin) fireOneMischiefDelivery(contract *mischiefContract) {
 	if !claimMischiefForDelivery(contract.ID) {
 		return // another tick (or another process) already has it
 	}
+	// Re-read AFTER the claim, never before it. The row we were handed came from
+	// the due-sweep, and the window's commands (bless, escalate) keep writing to an
+	// open contract right up to the moment the claim closes it. A ward bought in
+	// that gap would be paid for and never applied; an escalation would be paid for
+	// and deliver the *old* tier's monster. The claim is the fence — everything the
+	// fight is built from has to be read on this side of it.
+	if fresh, err := mischiefContractByID(contract.ID); err == nil && fresh != nil {
+		contract = fresh
+	}
 	if err := p.deliverMischief(contract, exp); err != nil {
 		slog.Error("mischief: delivery failed",
 			"contract", contract.ID, "target", target, "err", err)
@@ -132,46 +141,110 @@ func (p *AdventurePlugin) fireOneMischiefDelivery(contract *mischiefContract) {
 // row would otherwise be immortal: the target can never be targeted again, and
 // the buyer's money never comes back.
 //
-// The buyer is made whole in full rather than rake-charged. A stranded delivery
-// is our crash, not a bet they lost.
+// Everyone who paid is made whole in full rather than rake-charged. A stranded
+// delivery is our crash, not a bet they lost — and the escalator paid too, so the
+// refund splits on mischiefOutlay.
+//
+// The ward comes back off the sheet here as well. The crash is exactly the case
+// runMischiefInterrupt's `defer clearMischiefBlessings` cannot cover, and a ward
+// left behind is a permanent free cushion on the target until something else
+// happens to reset TempHP.
 func (p *AdventurePlugin) sweepStaleMischief(now time.Time) {
 	for _, c := range loadStaleMischiefDeliveries(now.Add(-mischiefDeliveryGrace)) {
 		contract := c
 		if !abandonStaleMischief(contract.ID) {
 			continue
 		}
-		p.euro.Credit(contract.BuyerID, float64(contract.Paid), "mischief_refund_stranded")
+		p.clearStrandedMischiefWard(&contract)
+
+		buyerPaid, escPaid := mischiefOutlay(&contract)
+		p.euro.Credit(contract.BuyerID, float64(buyerPaid), "mischief_refund_stranded")
 		p.SendDM(contract.BuyerID, fmt.Sprintf(
 			"😾 Your **%s** never reached **%s** — something went wrong on our end. Fully refunded: %s.",
-			contract.Tier, p.DisplayName(contract.TargetID), fmtEuro(contract.Paid)))
+			contract.Tier, p.DisplayName(contract.TargetID), fmtEuro(buyerPaid)))
+		if escPaid > 0 {
+			p.euro.Credit(contract.EscalatedBy, float64(escPaid), "mischief_refund_stranded")
+			p.SendDM(contract.EscalatedBy, fmt.Sprintf(
+				"😾 The **%s** you paid to upgrade never reached **%s** — something went wrong on our end. "+
+					"Fully refunded: %s.",
+				contract.Tier, p.DisplayName(contract.TargetID), fmtEuro(escPaid)))
+		}
 		slog.Warn("mischief: swept stranded delivery",
 			"contract", contract.ID, "target", contract.TargetID)
 	}
 }
 
-// fizzleMischief refunds the buyer (minus the rake) when the monster arrives to
-// an empty dungeon. The CAS is what makes the refund safe: a contract that was
-// simultaneously claimed for delivery cannot also be refunded here.
+// clearStrandedMischiefWard takes back a ward whose delivery died before it could
+// clear its own. The amount is re-derived exactly as applyMischiefBlessings
+// derived it, off the target's current MaxHP.
+//
+// If the crash landed BEFORE the ward was ever applied, this over-subtracts into
+// a well-rested cushion the target had of their own. That window is a handful of
+// DB reads wide against a whole fight, clearMischiefBlessings floors at 0, and the
+// alternative — leaving a stranded ward on the sheet forever — is the strictly
+// worse failure.
+func (p *AdventurePlugin) clearStrandedMischiefWard(c *mischiefContract) {
+	if c.BlessingCount <= 0 {
+		return
+	}
+	dc, err := LoadDnDCharacter(c.TargetID)
+	if err != nil || dc == nil {
+		return
+	}
+	if ward := mischiefBlessingTempHP(dc.HPMax, c.BlessingCount); ward > 0 {
+		p.clearMischiefBlessings(c.TargetID, ward)
+	}
+}
+
+// fizzleMischief refunds everyone who put money on the contract (minus the rake)
+// when the monster arrives to an empty dungeon. The CAS is what makes the refund
+// safe: a contract that was simultaneously claimed for delivery cannot also be
+// refunded here.
+//
+// The buyer and the escalator are refunded SEPARATELY, off mischiefOutlay. They
+// are two people who each parted with their own money, and c.Paid is the sum.
 func (p *AdventurePlugin) fizzleMischief(c *mischiefContract) {
 	if !fizzleMischiefContract(c.ID) {
 		return
 	}
-	refund := int(float64(c.Paid) * mischiefFizzleRefund)
-	rake := c.Paid - refund
-	if refund > 0 {
-		p.euro.Credit(c.BuyerID, float64(refund), "mischief_fizzle_refund")
-	}
-	if rake > 0 {
-		communityPotAdd(rake)
-		trackTaxPaid(c.BuyerID, rake)
-	}
+	buyerPaid, escPaid := mischiefOutlay(c)
+
+	refund, rake := p.rakedMischiefRefund(c.BuyerID, buyerPaid, "mischief_fizzle_refund")
 	p.SendDM(c.BuyerID, fmt.Sprintf(
 		"😾 Your **%s** got to the dungeon and found nobody home — **%s** was already out of there.\n"+
 			"You're refunded %s. The other %s stays with the town, for its trouble.",
 		c.Tier, p.DisplayName(c.TargetID), fmtEuro(refund), fmtEuro(rake)))
+
+	if escPaid > 0 {
+		escRefund, escRake := p.rakedMischiefRefund(c.EscalatedBy, escPaid, "mischief_fizzle_refund")
+		p.SendDM(c.EscalatedBy, fmt.Sprintf(
+			"😾 The **%s** you paid to upgrade found nobody home — **%s** was already out of there.\n"+
+				"You're refunded %s. The other %s stays with the town, for its trouble.",
+			c.Tier, p.DisplayName(c.TargetID), fmtEuro(escRefund), fmtEuro(escRake)))
+		refund += escRefund
+	}
 	emitMischiefFizzledNews(c, refund)
 }
 
+// rakedMischiefRefund gives one stakeholder their stake back minus the fizzle
+// rake, and sinks the rake against THEIR name. Returns what they got back and
+// what the town kept.
+func (p *AdventurePlugin) rakedMischiefRefund(who id.UserID, paid int, reason string) (refund, rake int) {
+	if paid <= 0 {
+		return 0, 0
+	}
+	refund = int(float64(paid) * mischiefFizzleRefund)
+	rake = paid - refund
+	if refund > 0 {
+		p.euro.Credit(who, float64(refund), reason)
+	}
+	if rake > 0 {
+		communityPotAdd(rake)
+		trackTaxPaid(who, rake)
+	}
+	return refund, rake
+}
+
 // deliverMischief runs the purchased fight and closes it out. By the time this
 // is called the contract is claimed, so it resolves exactly once.
 func (p *AdventurePlugin) deliverMischief(c *mischiefContract, exp *Expedition) error {
@@ -208,7 +281,8 @@ func (p *AdventurePlugin) deliverMischief(c *mischiefContract, exp *Expedition)
 		}
 	}
 
-	narration, monsterName, survived := p.runMischiefInterrupt(target, exp, bracket, chain, ambush)
+	narration, monsterName, survived := p.runMischiefInterrupt(
+		target, exp, bracket, chain, ambush, c.BlessingCount)
 
 	if survived {
 		p.resolveMischiefSurvived(c, tier, exp, bracket, monsterName, narration)
@@ -219,13 +293,21 @@ func (p *AdventurePlugin) deliverMischief(c *mischiefContract, exp *Expedition)
 }
 
 // refundClaimedMischief unwinds a contract that was already claimed for delivery
-// but couldn't be staged. The buyer gets everything back — this is our fault,
-// not a fizzle they gambled on.
+// but couldn't be staged. Everyone who paid gets everything back — this is our
+// fault, not a fizzle they gambled on. The escalator is a payer too; see
+// mischiefOutlay.
 func (p *AdventurePlugin) refundClaimedMischief(c *mischiefContract, reason string) {
 	resolveMischiefContract(c.ID, mischiefStatusFizzled, mischiefStatusFizzled)
-	p.euro.Credit(c.BuyerID, float64(c.Paid), "mischief_refund_unstageable")
+	buyerPaid, escPaid := mischiefOutlay(c)
+	p.euro.Credit(c.BuyerID, float64(buyerPaid), "mischief_refund_unstageable")
 	p.SendDM(c.BuyerID, fmt.Sprintf(
-		"😾 Your **%s** never made it out of the gate. Fully refunded: %s.", c.Tier, fmtEuro(c.Paid)))
+		"😾 Your **%s** never made it out of the gate. Fully refunded: %s.", c.Tier, fmtEuro(buyerPaid)))
+	if escPaid > 0 {
+		p.euro.Credit(c.EscalatedBy, float64(escPaid), "mischief_refund_unstageable")
+		p.SendDM(c.EscalatedBy, fmt.Sprintf(
+			"😾 The **%s** you paid to upgrade never made it out of the gate. Fully refunded: %s.",
+			c.Tier, fmtEuro(escPaid)))
+	}
 	slog.Warn("mischief: contract unstageable", "contract", c.ID, "reason", reason)
 }
 
@@ -243,10 +325,17 @@ func (p *AdventurePlugin) runMischiefInterrupt(
 	bracket ZoneDefinition,
 	chain []DnDMonsterTemplate,
 	ambush bool,
+	blessings int,
 ) (narration, monsterName string, survived bool) {
 	var b strings.Builder
 	last := chain[len(chain)-1].Name
 
+	if ward := p.applyMischiefBlessings(target, blessings); ward > 0 {
+		b.WriteString(fmt.Sprintf(
+			"_The town's wards hold — %d of them, worth %d HP of cushion._\n", blessings, ward))
+		defer p.clearMischiefBlessings(target, ward)
+	}
+
 	for i, monster := range chain {
 		// The ambush is the attacker's privilege — it was lying in wait, and the
 		// target had no reason to expect it. Same one-free-swing approximation the
@@ -300,6 +389,57 @@ func (p *AdventurePlugin) runMischiefInterrupt(
 	return b.String(), last, true
 }
 
+// applyMischiefBlessings turns the room's wards into temp HP on the target's
+// sheet for the duration of the delivery, and returns the cushion granted.
+//
+// TempHP is the well-rested mechanism (applyDnDHPScaling layers it above MaxHP
+// for the fight, and persistDnDHPAfterCombat clamps back down to MaxHP after), so
+// a ward is a damage sponge and nothing more — it can't leave the target at more
+// HP than they started with.
+//
+// It ADDS to whatever TempHP is already there rather than overwriting: a target
+// who long-rested at a T3 home before setting out is carrying a cushion of their
+// own, and a ward bought to help them must not silently delete it. clearMischiefBlessings
+// subtracts exactly what we added, which is why this returns the amount.
+//
+// The cushion refreshes for each link of a chain, because TempHP is a sheet field
+// and applyDnDHPScaling re-reads it per fight. That only ever matters for the mob
+// tier (the sole multi-fight chain), which the M0 sweep priced at 98-100% survival
+// as pure theatre anyway. The tiers where a ward decides anything — elite and boss —
+// are single fights, so what the room buys there is exactly one sponge.
+func (p *AdventurePlugin) applyMischiefBlessings(target id.UserID, blessings int) int {
+	if blessings <= 0 {
+		return 0
+	}
+	c, err := LoadDnDCharacter(target)
+	if err != nil || c == nil {
+		return 0
+	}
+	ward := mischiefBlessingTempHP(c.HPMax, blessings)
+	if ward <= 0 {
+		return 0
+	}
+	c.TempHP += ward
+	if err := SaveDnDCharacter(c); err != nil {
+		return 0
+	}
+	return ward
+}
+
+// clearMischiefBlessings takes the ward back off the sheet once the delivery is
+// over — the blessing was bought for THIS fight, not for the rest of the run.
+// Subtracts what we added, so a pre-existing well-rested cushion survives intact.
+func (p *AdventurePlugin) clearMischiefBlessings(target id.UserID, ward int) {
+	c, err := LoadDnDCharacter(target)
+	if err != nil || c == nil {
+		return
+	}
+	if c.TempHP -= ward; c.TempHP < 0 {
+		c.TempHP = 0
+	}
+	_ = SaveDnDCharacter(c)
+}
+
 // floorMischiefRoster raises every seat the delivery put on the floor back to
 // 1 HP. It runs on BOTH outcomes, and that is not belt-and-braces: the leader
 // can win a fight their friend went down in, and a mischief delivery
@@ -331,11 +471,13 @@ func (p *AdventurePlugin) resolveMischiefSurvived(
 	purse := mischiefPurse(c.Fee, tier.PayoutPct)
 	p.euro.Credit(c.TargetID, float64(purse), "mischief_survived")
 
-	// Everything the buyer spent that isn't the purse — the rake, plus the whole
-	// sign surcharge — is a sink. That is what makes the payout cap bite.
+	// Everything spent on the contract that isn't the purse — the rake, plus the
+	// whole sign surcharge — is a sink. That is what makes the payout cap bite. It
+	// is booked against the buyer AND the escalator in proportion to what each of
+	// them actually put in; c.Paid is the sum of the two.
 	if rake := c.Paid - purse; rake > 0 {
 		communityPotAdd(rake)
-		trackTaxPaid(c.BuyerID, rake)
+		trackMischiefSink(c, rake)
 	}
 
 	// Extras by tier. Treasure rolls against the zone they're actually in — the
@@ -370,8 +512,8 @@ func (p *AdventurePlugin) resolveMischiefSurvived(
 	dm.WriteString(fmt.Sprintf(
 		"\n🛡️ You're still standing, and the coin was never really theirs. **%s** is yours.\n",
 		fmtEuro(purse)))
-	dm.WriteString(fmt.Sprintf("It was **%s** who paid to have you killed. Do with that what you like.",
-		p.DisplayName(c.BuyerID)))
+	dm.WriteString(fmt.Sprintf("It was **%s** who paid to have you killed. Do with that what you like.%s",
+		p.DisplayName(c.BuyerID), p.mischiefEscalatorNote(c)))
 	for _, e := range extras {
 		dm.WriteString("\n_" + e + "_")
 	}
@@ -380,6 +522,12 @@ func (p *AdventurePlugin) resolveMischiefSurvived(
 	p.SendDM(c.BuyerID, fmt.Sprintf(
 		"🛡️ **%s walked away from your %s.** They keep %s of your money, and the town knows your name now.",
 		p.DisplayName(c.TargetID), c.Tier, fmtEuro(purse)))
+	if c.EscalatedBy != "" && c.EscalatedBy != c.BuyerID {
+		p.SendDM(c.EscalatedBy, fmt.Sprintf(
+			"🛡️ **%s** walked away from the **%s** you paid to upgrade — and your money went into their purse.\n"+
+				"_The town knows you piled on. That was the deal._",
+			p.DisplayName(c.TargetID), c.Tier))
+	}
 
 	p.announceMischiefSurvived(c, monsterName, purse)
 	emitMischiefResolvedNews(c, monsterName, mischiefOutcomeSurvived, purse)
@@ -414,7 +562,7 @@ func (p *AdventurePlugin) resolveMischiefDowned(
 	}
 
 	communityPotAdd(c.Paid)
-	trackTaxPaid(c.BuyerID, c.Paid)
+	trackMischiefSink(c, c.Paid)
 
 	resolveMischiefContract(c.ID, mischiefStatusDelivered, mischiefOutcomeDowned)
 
@@ -439,6 +587,13 @@ func (p *AdventurePlugin) resolveMischiefDowned(
 		"💀 Your **%s** found **%s** and put them on the floor. Their expedition is over.\n"+
 			"_You get nothing back — %s went to the community pot. You did this for the story._",
 		c.Tier, p.DisplayName(c.TargetID), fmtEuro(c.Paid)))
+	if c.EscalatedBy != "" && c.EscalatedBy != c.BuyerID {
+		// They stay anonymous: only a survival unseals. Their money is gone either
+		// way — that is what makes the survival unseal a real risk to have taken.
+		p.SendDM(c.EscalatedBy, fmt.Sprintf(
+			"💀 The **%s** you paid to upgrade found **%s** and put them down. Nobody knows it was you.",
+			c.Tier, p.DisplayName(c.TargetID)))
+	}
 
 	p.announceMischiefDowned(c, monsterName)
 	emitMischiefResolvedNews(c, monsterName, mischiefOutcomeDowned, 0)

internal/plugin/adventure_mischief_test.go

@@ -377,7 +377,7 @@ func TestMischiefDelivery_GruntIsSurvivable(t *testing.T) {
 	bracket := mischiefBracketZone(5)
 	chain, ambush := mischiefMonsters("grunt", bracket, rand.New(rand.NewPCG(1, 2)))
 
-	_, monster, survived := p.runMischiefInterrupt(uid, exp, bracket, chain, ambush)
+	_, monster, survived := p.runMischiefInterrupt(uid, exp, bracket, chain, ambush, 0)
 	if !survived {
 		t.Fatalf("a level-5 fighter at full HP died to a grunt (%s) — the tier is mispriced", monster)
 	}
@@ -492,7 +492,12 @@ func TestMischiefDelivery_FizzlesWhenTargetWentHome(t *testing.T) {
 		t.Fatalf("forcedExtractExpedition: %v", err)
 	}
 
-	p.fireMischiefDeliveries(time.Now().UTC().Add(mischiefWindow + time.Minute))
+	// Tomorrow at noon UTC: past the contract's window, and deliberately nowhere
+	// near the 06:00 briefing or the 21:00 recap. fireMischiefDeliveries refuses to
+	// run inside those quiet windows, so a wall-clock `now` here makes this test
+	// fail for two hours of every real day.
+	due := time.Now().UTC().AddDate(0, 0, 1).Truncate(24 * time.Hour).Add(12 * time.Hour)
+	p.fireMischiefDeliveries(due)
 
 	got, _ := mischiefContractByID(c.ID)
 	if got.Status != mischiefStatusFizzled {
@@ -562,3 +567,363 @@ func TestMischiefDelivery_SurvivalFloorsADroppedPartyMember(t *testing.T) {
 		t.Error("a bought monster killed a party member — mischief maims, it never murders")
 	}
 }
+
+// ── M2: the window (bless / escalate) ────────────────────────────────────────
+
+// mischiefWindowPlugin is a plugin wired for command-level tests: a euro ledger
+// and a sink, so `!mischief bless/escalate` can be driven the way a player drives
+// them (the CAS races these commands lose are the whole point of M2, and they only
+// exist on the command path).
+func mischiefWindowPlugin(t *testing.T) (*AdventurePlugin, *captureSink) {
+	t.Helper()
+	sink := &captureSink{}
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	p.Sink = sink
+	return p, sink
+}
+
+func mischiefCtx(sender id.UserID) MessageContext {
+	return MessageContext{Sender: sender, RoomID: id.RoomID("!room:x"), EventID: id.EventID("$e")}
+}
+
+// A ward is priced against the thing it defends against. The M1-close-out sweep
+// measured three wards buying ~+40pp of survival, which at a flat fee let the room
+// halve a €1,200 boss contract for €75 — the tier the whole economy rests on,
+// bought off for pocket change. Cheap at the impulse tiers, real money at the top.
+func TestMischiefBlessingFee_ScalesWithTheContract(t *testing.T) {
+	want := map[string]int{"grunt": 25, "mob": 25, "elite": 35, "boss": 120}
+	for _, tier := range mischiefTiers {
+		if got := mischiefBlessingFee(tier.Fee); got != want[tier.Key] {
+			t.Errorf("%s ward = %d, want %d", tier.Key, got, want[tier.Key])
+		}
+		// Where a ward is a rational purchase — the tiers the sweep says can
+		// actually put someone on the floor — covering a target must cost less than
+		// the contract does. Otherwise the room's counterplay is priced out and the
+		// window is dead.
+		//
+		// Grunt and mob are deliberately exempt: the €25 floor is above-market
+		// there (3 wards cost more than a €40 grunt), and that is fine, because
+		// nothing in the sweep needs warding against theatre — those tiers sit at
+		// 100% survival unwounded. The floor is there to keep a ward an impulse
+		// buy, not to make it a sensible one against a goblin.
+		if tier.Key != "elite" && tier.Key != "boss" {
+			continue
+		}
+		if full := mischiefBlessingFee(tier.Fee) * mischiefBlessingCap; full >= tier.Fee {
+			t.Errorf("%s: %d wards cost %d, which is more than the %d contract — "+
+				"the room can't afford to save anyone", tier.Key, mischiefBlessingCap, full, tier.Fee)
+		}
+	}
+}
+
+// The cap lives in the UPDATE, not in the read that precedes it. A room that
+// piles four wards on in the same second must still land exactly three — and the
+// player who lost that race must get their money back rather than pay for
+// nothing.
+func TestMischiefBlessing_CapIsEnforcedByTheUpdate(t *testing.T) {
+	newMischiefTestDB(t)
+	c := seedContract(t, "@buyer:x", "@target:x", "elite", false)
+
+	for i := 1; i <= mischiefBlessingCap; i++ {
+		if !blessMischiefContract(c.ID) {
+			t.Fatalf("blessing %d/%d was rejected", i, mischiefBlessingCap)
+		}
+	}
+	if blessMischiefContract(c.ID) {
+		t.Errorf("a %dth blessing landed — the cap is not enforced", mischiefBlessingCap+1)
+	}
+	got, _ := mischiefContractByID(c.ID)
+	if got.BlessingCount != mischiefBlessingCap {
+		t.Errorf("blessing_count = %d, want %d", got.BlessingCount, mischiefBlessingCap)
+	}
+	// And nobody may ward a contract that has already been claimed for delivery:
+	// the monster is in the room with them.
+	c2 := seedContract(t, "@buyer:x", "@other:x", "grunt", false)
+	if !claimMischiefForDelivery(c2.ID) {
+		t.Fatal("claim should win")
+	}
+	if blessMischiefContract(c2.ID) {
+		t.Error("warded a contract mid-delivery — the fight had already started")
+	}
+}
+
+// A blessing buys HP, never euros: the fee is a sink (community pot), and the
+// purse is untouched by it. Otherwise a target's friend could ward them as a way
+// of routing money into their pocket on the way out.
+func TestMischiefBlessing_FeeIsASinkNotAPurseTopUp(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	target := id.UserID("@warded:x")
+	friend := id.UserID("@friend:x")
+	p.euro.Credit(friend, 500, "test")
+
+	c := seedContract(t, "@buyer:x", target, "elite", false)
+	feeBefore := c.Fee
+	ward := mischiefBlessingFee(c.Fee) // 10% of the €350 elite fee
+
+	if err := p.mischiefBlessCmd(mischiefCtx(friend), []string{string(target)}); err != nil {
+		t.Fatalf("bless: %v", err)
+	}
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.BlessingCount != 1 {
+		t.Fatalf("blessing_count = %d, want 1", got.BlessingCount)
+	}
+	if got.Fee != feeBefore {
+		t.Errorf("a blessing moved the payout basis to %d (was %d) — wards must not pay the target",
+			got.Fee, feeBefore)
+	}
+	if bal := p.euro.GetBalance(friend); bal != float64(500-ward) {
+		t.Errorf("blesser balance %.0f, want %d", bal, 500-ward)
+	}
+	if pot := communityPotBalance(); pot != ward {
+		t.Errorf("pot holds %d, want the %d ward fee", pot, ward)
+	}
+	// Broke, so the second ward can't be bought — and must cost nothing.
+	pauper := id.UserID("@pauper:x")
+	if err := p.mischiefBlessCmd(mischiefCtx(pauper), []string{string(target)}); err != nil {
+		t.Fatalf("bless: %v", err)
+	}
+	if bal := p.euro.GetBalance(pauper); bal != 0 {
+		t.Errorf("a failed blessing moved the pauper's balance to %.0f", bal)
+	}
+	if got, _ := mischiefContractByID(c.ID); got.BlessingCount != 1 {
+		t.Errorf("a blessing nobody could pay for still landed (count %d)", got.BlessingCount)
+	}
+}
+
+// Escalation moves the tier, the payout basis and the outlay together — which is
+// what keeps the anti-collusion invariant (purse < what was spent) true after the
+// room has piled on. It also happens exactly once.
+func TestMischiefEscalation_RaisesBasisAndOutlayTogether(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	target := id.UserID("@hunted:x")
+	piler := id.UserID("@piler:x")
+	rival := id.UserID("@rival:x")
+	p.euro.Credit(piler, 5000, "test")
+	p.euro.Credit(rival, 5000, "test")
+
+	c := seedContract(t, "@buyer:x", target, "elite", true) // signed: paid > fee
+	elite, _ := mischiefTierByKey("elite")
+	boss, _ := mischiefTierByKey("boss")
+	delta := boss.Fee - elite.Fee
+
+	if err := p.mischiefEscalateCmd(mischiefCtx(piler), []string{string(target)}); err != nil {
+		t.Fatalf("escalate: %v", err)
+	}
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.Tier != "boss" || got.Fee != boss.Fee {
+		t.Fatalf("contract is %s/fee %d, want boss/%d", got.Tier, got.Fee, boss.Fee)
+	}
+	if got.Paid != c.Paid+delta {
+		t.Errorf("paid = %d, want %d (%d + the %d delta)", got.Paid, c.Paid+delta, c.Paid, delta)
+	}
+	if got.EscalatedBy != piler {
+		t.Errorf("escalated_by = %q, want %s — the unseal has nobody to name", got.EscalatedBy, piler)
+	}
+	if bal := p.euro.GetBalance(piler); bal != float64(5000-delta) {
+		t.Errorf("escalator paid %.0f, want the %d delta", 5000-bal, delta)
+	}
+	// The invariant, after the escalation: the purse is still strictly less than
+	// the money that went in.
+	if purse := mischiefPurse(got.Fee, boss.PayoutPct); purse >= got.Paid {
+		t.Errorf("escalated purse %d >= outlay %d — collusion now beats !baltransfer", purse, got.Paid)
+	}
+
+	// One step, once — whoever else was reaching for it is refunded.
+	if err := p.mischiefEscalateCmd(mischiefCtx(rival), []string{string(target)}); err != nil {
+		t.Fatalf("second escalate: %v", err)
+	}
+	if bal := p.euro.GetBalance(rival); bal != 5000 {
+		t.Errorf("the losing escalator is out %.0f — a rejected escalation must cost nothing", 5000-bal)
+	}
+	after, _ := mischiefContractByID(c.ID)
+	if after.EscalationCount != 1 || after.Paid != got.Paid {
+		t.Errorf("contract escalated twice (count %d, paid %d)", after.EscalationCount, after.Paid)
+	}
+}
+
+// A fizzle refunds `paid`, and after an escalation `paid` is TWO people's money.
+// Refunding all of it to the buyer is a money pump: buy an elite for €350, have
+// somebody bump it to a boss (+€850), let the target walk out of the dungeon, and
+// the 90% refund hands the buyer €1080 — a €730 profit funded entirely by the
+// escalator, who gets nothing and is never told.
+func TestMischiefFizzle_RefundsTheEscalatorTheirOwnMoney(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	target := id.UserID("@hunted:x")
+	buyer := id.UserID("@buyer:x")
+	piler := id.UserID("@piler:x")
+	p.euro.Credit(piler, 5000, "test")
+	exp := seedMischiefTarget(t, target, 5, 60)
+
+	c := seedContract(t, buyer, target, "elite", false)
+	elite, _ := mischiefTierByKey("elite")
+	boss, _ := mischiefTierByKey("boss")
+	delta := boss.Fee - elite.Fee
+
+	if err := p.mischiefEscalateCmd(mischiefCtx(piler), []string{string(target)}); err != nil {
+		t.Fatalf("escalate: %v", err)
+	}
+	// They extract before the boss arrives. Nobody's monster ever lands.
+	if _, _, err := forcedExtractExpedition(exp.ID, "went home"); err != nil {
+		t.Fatalf("forcedExtractExpedition: %v", err)
+	}
+	due := time.Now().UTC().AddDate(0, 0, 1).Truncate(24 * time.Hour).Add(12 * time.Hour)
+	p.fireMischiefDeliveries(due)
+
+	if got, _ := mischiefContractByID(c.ID); got.Status != mischiefStatusFizzled {
+		t.Fatalf("contract status %s, want fizzled", got.Status)
+	}
+
+	// Each stakeholder is refunded 90% of THEIR OWN stake — not 90% of the pooled
+	// `paid`, which is what the buyer would otherwise pocket.
+	wantBuyer := int(float64(c.Paid) * mischiefFizzleRefund)
+	wantPiler := int(float64(delta) * mischiefFizzleRefund)
+	if bal := int(p.euro.GetBalance(buyer)); bal != wantBuyer {
+		t.Errorf("buyer refunded %d, want %d — they were handed the escalator's stake", bal, wantBuyer)
+	}
+	if spent := 5000 - int(p.euro.GetBalance(piler)); spent != delta-wantPiler {
+		t.Errorf("escalator is out %d, want %d (their 10%% rake) — their refund went elsewhere",
+			spent, delta-wantPiler)
+	}
+	if pot, want := communityPotBalance(), (c.Paid-wantBuyer)+(delta-wantPiler); pot != want {
+		t.Errorf("pot raked %d, want %d", pot, want)
+	}
+}
+
+// Boss tier is the "end their expedition" button, and the weekly cap on it is the
+// target's protection. An escalation into boss is still a boss landing on them, so
+// it answers to the same cap — otherwise the cap is bought around for the price of
+// an elite plus the delta.
+func TestMischiefEscalation_IntoBossRespectsTheWeeklyCap(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	target := id.UserID("@bossed:x")
+	piler := id.UserID("@piler:x")
+	p.euro.Credit(piler, 5000, "test")
+
+	// They already took a boss this week (delivered, so it counts).
+	spent := seedContract(t, "@buyer:x", target, "boss", false)
+	resolveMischiefContract(spent.ID, mischiefStatusDelivered, mischiefOutcomeSurvived)
+
+	c := seedContract(t, "@buyer2:x", target, "elite", false)
+	if err := p.mischiefEscalateCmd(mischiefCtx(piler), []string{string(target)}); err != nil {
+		t.Fatalf("escalate: %v", err)
+	}
+	got, _ := mischiefContractByID(c.ID)
+	if got.Tier != "elite" {
+		t.Errorf("escalated to %s — the weekly boss cap was bought around", got.Tier)
+	}
+	if bal := p.euro.GetBalance(piler); bal != 5000 {
+		t.Errorf("a refused escalation charged %.0f", 5000-bal)
+	}
+}
+
+// Boss is the top of the ladder, and a target may not raise the price on their
+// own head.
+func TestMischiefEscalation_RefusesBossAndSelfService(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	target := id.UserID("@top:x")
+	piler := id.UserID("@piler:x")
+	p.euro.Credit(piler, 5000, "test")
+	p.euro.Credit(target, 5000, "test")
+
+	c := seedContract(t, "@buyer:x", target, "boss", false)
+	if err := p.mischiefEscalateCmd(mischiefCtx(piler), []string{string(target)}); err != nil {
+		t.Fatalf("escalate: %v", err)
+	}
+	if got, _ := mischiefContractByID(c.ID); got.EscalationCount != 0 {
+		t.Error("something got escalated past boss tier")
+	}
+	if bal := p.euro.GetBalance(piler); bal != 5000 {
+		t.Errorf("charged %.0f for an impossible escalation", 5000-bal)
+	}
+
+	newMischiefTestDB(t)
+	c2 := seedContract(t, "@buyer:x", target, "grunt", false)
+	if err := p.mischiefEscalateCmd(mischiefCtx(target), []string{string(target)}); err != nil {
+		t.Fatalf("escalate: %v", err)
+	}
+	if got, _ := mischiefContractByID(c2.ID); got.EscalationCount != 0 {
+		t.Error("the target escalated their own contract")
+	}
+}
+
+// The window keeps writing to an open contract right up to the claim, so the
+// delivery must build the fight from the row as it stands AFTER the claim — not
+// from the copy the due-sweep handed it. A tier bought at the last second (an
+// escalation) is the visible half of this: read stale, the buyer pays for a boss
+// and the target fights a grunt.
+func TestMischiefDelivery_ReadsTheContractAfterTheClaim(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	uid := id.UserID("@lastsecond:x")
+	seedMischiefTarget(t, uid, 12, 400)
+
+	c := seedContract(t, "@buyer:x", uid, "grunt", false)
+	// Somebody escalates in the gap between the due-sweep and the claim. `c` is now
+	// the stale copy the ticker is still holding.
+	elite, _ := mischiefTierByKey("elite")
+	if !escalateMischiefContract(c.ID, "grunt", elite, elite.Fee-c.Fee, "@piler:x") {
+		t.Fatal("escalation should have taken")
+	}
+
+	before := p.euro.GetBalance(uid)
+	p.fireOneMischiefDelivery(c)
+
+	got, _ := mischiefContractByID(c.ID)
+	if got.Outcome != mischiefOutcomeSurvived {
+		t.Fatalf("target lost; this test needs a survival to read the purse (outcome %s)", got.Outcome)
+	}
+	want := mischiefPurse(elite.Fee, elite.PayoutPct)
+	if gained := int(p.euro.GetBalance(uid) - before); gained != want {
+		t.Errorf("survivor was paid %d, want the escalated %d purse — "+
+			"the delivery ran off the pre-claim copy of the contract", gained, want)
+	}
+}
+
+// The ward is a cushion for THIS fight and nothing else: it goes on the sheet as
+// temp HP for the delivery and comes off after — without eating the well-rested
+// cushion the target may already have been carrying out of the door.
+func TestMischiefBlessing_CushionsTheFightThenClearsItself(t *testing.T) {
+	newMischiefTestDB(t)
+	p, _ := mischiefWindowPlugin(t)
+	uid := id.UserID("@blessed:x")
+	exp := seedMischiefTarget(t, uid, 12, 400)
+
+	// They long-rested at home before setting out.
+	dc, _ := LoadDnDCharacter(uid)
+	dc.TempHP = 32
+	if err := SaveDnDCharacter(dc); err != nil {
+		t.Fatal(err)
+	}
+
+	c := seedContract(t, "@buyer:x", uid, "grunt", false)
+	for i := 0; i < mischiefBlessingCap; i++ {
+		if !blessMischiefContract(c.ID) {
+			t.Fatal("seed blessing rejected")
+		}
+	}
+	c.BlessingCount = mischiefBlessingCap
+
+	want := mischiefBlessingTempHP(400, mischiefBlessingCap) // 3 × 10% of 400
+	if want != 120 {
+		t.Fatalf("ward is %d HP, want 120 — the fight is being cushioned by something else", want)
+	}
+	if !claimMischiefForDelivery(c.ID) {
+		t.Fatal("claim should win")
+	}
+	if err := p.deliverMischief(c, exp); err != nil {
+		t.Fatalf("deliverMischief: %v", err)
+	}
+
+	after, _ := LoadDnDCharacter(uid)
+	if after.TempHP != 32 {
+		t.Errorf("temp HP is %d after the delivery, want the 32 they rested for — "+
+			"the ward must not linger, and must not eat their own cushion", after.TempHP)
+	}
+}

internal/plugin/adventure_pet_combat_xp_test.go

@@ -0,0 +1,118 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newPetXPTestDB(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+}
+
+// TestGrantPetCombatXPPersists is the regression guard for the bug this fixes:
+// petGrantXP existed but nothing called it, so an un-babysat pet sat at its
+// adoption level forever. A win must move XP on disk.
+func TestGrantPetCombatXPPersists(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp:test")
+
+	pet := PetState{Type: "dog", Name: "Rex", Arrived: true, Level: 1, XP: 0}
+	if err := upsertPlayerMetaPetState(uid, pet); err != nil {
+		t.Fatal(err)
+	}
+
+	if leveled := grantPetCombatXP(uid); len(leveled) != 0 {
+		t.Errorf("one win should not level a fresh pet, got %v", leveled)
+	}
+
+	got, err := loadPetState(uid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.XP != int(petXPPerAction*100) {
+		t.Errorf("XP = %d, want %d", got.XP, int(petXPPerAction*100))
+	}
+	if got.Level != 1 {
+		t.Errorf("Level = %d, want 1", got.Level)
+	}
+}
+
+// TestGrantPetCombatXPLevelsBothSlots checks the second pet earns off the same
+// win, matching the babysit trickle — combat only reads the two pets' averaged
+// procs, so leveling both is not a power spike.
+func TestGrantPetCombatXPLevelsBothSlots(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp2:test")
+
+	// Both one grant short of level 2 (needs 10 XP = 1000 centi-XP).
+	short := 1000 - int(petXPPerAction*100)
+	if err := upsertPlayerMetaPetState(uid,
+		PetState{Type: "dog", Name: "Rex", Arrived: true, Level: 1, XP: short}); err != nil {
+		t.Fatal(err)
+	}
+	if err := upsertPlayerMetaPet2State(uid,
+		PetState{Type: "cat", Name: "Whiskers", Arrived: true, Level: 1, XP: short}); err != nil {
+		t.Fatal(err)
+	}
+
+	leveled := grantPetCombatXP(uid)
+	if len(leveled) != 2 {
+		t.Fatalf("expected both pets to level, got %v", leveled)
+	}
+
+	p1, _ := loadPetState(uid)
+	p2, _ := loadPet2State(uid)
+	if p1.Level != 2 || p2.Level != 2 {
+		t.Errorf("levels = %d/%d, want 2/2", p1.Level, p2.Level)
+	}
+}
+
+// TestGrantPetCombatXPIgnoresChasedAway — a pet that isn't with you doesn't
+// fight, so it doesn't earn.
+func TestGrantPetCombatXPIgnoresChasedAway(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp3:test")
+
+	if err := upsertPlayerMetaPetState(uid, PetState{
+		Type: "dog", Name: "Rex", Arrived: true, ChasedAway: true, Level: 3, XP: 100,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	grantPetCombatXP(uid)
+
+	got, _ := loadPetState(uid)
+	if got.XP != 100 {
+		t.Errorf("chased-away pet gained XP: %d, want 100", got.XP)
+	}
+}
+
+// TestGrantPetCombatXPCapsAtTen — a maxed pet stops earning rather than
+// accumulating dead XP.
+func TestGrantPetCombatXPCapsAtTen(t *testing.T) {
+	newPetXPTestDB(t)
+	uid := id.UserID("@petxp4:test")
+
+	if err := upsertPlayerMetaPetState(uid, PetState{
+		Type: "dog", Name: "Rex", Arrived: true, Level: 10, XP: 0,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if leveled := grantPetCombatXP(uid); len(leveled) != 0 {
+		t.Errorf("L10 pet should not level, got %v", leveled)
+	}
+	got, _ := loadPetState(uid)
+	if got.XP != 0 || got.Level != 10 {
+		t.Errorf("L10 pet moved: level %d xp %d", got.Level, got.XP)
+	}
+}

internal/plugin/adventure_pets.go

@@ -15,6 +15,11 @@ import (
 
 const petXPPerAction = 1.5
 
+// petMaxLevel is where the curve stops. Named because two things read it for
+// different reasons: the level-up loop stops here, and the web push reports "no
+// more to earn" from it.
+const petMaxLevel = 10
+
 var petNameValid = regexp.MustCompile(`^[a-zA-Z0-9 '\-]+$`)
 
 // petXPToNextLevel returns XP needed for a given pet level.
@@ -31,6 +36,19 @@ func petXPToNextLevel(level int) int {
 	}
 }
 
+// petXPNeededCenti is petXPToNextLevel in the unit the stored ledger actually
+// uses — centi-XP — and 0 once the pet is capped, so a caller can tell "nothing
+// left to earn" from "needs another 10 points". Every comparison against a
+// stored PetXP multiplies by 100 (see advancePetLevelsFromXP); anything reading
+// the curve for display has to do the same, and doing it in one place is how the
+// web push avoids getting it wrong.
+func petXPNeededCenti(level int) int {
+	if level >= petMaxLevel {
+		return 0
+	}
+	return petXPToNextLevel(level) * 100
+}
+
 // petGrantXP adds a per-action XP grant to the pet and handles level-ups.
 // Returns true if leveled up. Shares the level-up loop with the babysit trickle
 // via advancePetLevelsFromXP.
@@ -41,17 +59,62 @@ func petGrantXP(pet *PetState) bool {
 	return advancePetLevelsFromXP(&pet.XP, &pet.Level, &pet.Level10Date, int(petXPPerAction*100))
 }
 
+// grantPetCombatXP pays both pet slots their per-action XP for a fight the
+// player won, and returns the names of any pet that leveled so the caller can
+// narrate it.
+//
+// This is the pet's only *earned* XP source. It used to ride the legacy daily
+// activity loop, which R1 deleted — and for the whole life of Adventure 2.0
+// nothing replaced it, leaving petGrantXP orphaned and every un-babysat pet
+// frozen at the level it was adopted with. Pet level is not cosmetic
+// (DerivePlayerStats scales PetAttackProc / PetDeflectProc / PetAttackDmg off
+// it), so a frozen pet is a permanently dead combat slot.
+//
+// Both slots earn on the same win, matching the babysit trickle: combat only
+// ever reads the two pets' *averaged* procs, so leveling both is not a spike.
+//
+// Writes go through the narrow per-slot pet upserts rather than
+// saveAdvCharacter: this runs on the combat close-out path, which does not
+// hold the per-user lock, and a full-row write from here could clobber a
+// concurrent character save.
+func grantPetCombatXP(userID id.UserID) []string {
+	var leveled []string
+	slots := []struct {
+		n      int
+		load   func(id.UserID) (PetState, error)
+		upsert func(id.UserID, PetState) error
+	}{
+		{1, loadPetState, upsertPlayerMetaPetState},
+		{2, loadPet2State, upsertPlayerMetaPet2State},
+	}
+	for _, s := range slots {
+		pet, err := s.load(userID)
+		if err != nil || !pet.HasPet() {
+			continue
+		}
+		didLevel := petGrantXP(&pet)
+		if uerr := s.upsert(userID, pet); uerr != nil {
+			slog.Error("adventure: pet xp persist", "user", userID, "slot", s.n, "err", uerr)
+			continue
+		}
+		if didLevel {
+			leveled = append(leveled, fmt.Sprintf("%s reached level %d", pet.Name, pet.Level))
+		}
+	}
+	return leveled
+}
+
 // advancePetLevelsFromXP adds centi-XP to a pet and applies any level-ups, up
 // to the level-10 cap, stamping the level-10 date on first reaching it. Shared
 // by both pet slots (the babysit trickle). Returns true if the pet leveled.
 func advancePetLevelsFromXP(xp, level *int, level10Date *string, addCentiXP int) bool {
-	if *level >= 10 {
+	if *level >= petMaxLevel {
 		return false
 	}
 	*xp += addCentiXP
 	leveled := false
-	for *level < 10 {
-		needed := petXPToNextLevel(*level) * 100
+	for *level < petMaxLevel {
+		needed := petXPNeededCenti(*level)
 		if *xp < needed {
 			break
 		}
@@ -59,7 +122,7 @@ func advancePetLevelsFromXP(xp, level *int, level10Date *string, addCentiXP int)
 		*level++
 		leveled = true
 	}
-	if *level >= 10 && *level10Date == "" {
+	if *level >= petMaxLevel && *level10Date == "" {
 		*level10Date = time.Now().UTC().Format("2006-01-02")
 	}
 	return leveled

internal/plugin/adventure_robbie.go

@@ -164,20 +164,18 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 		gaveCard = true
 	}
 
-	// Update visit count, and every 10th visit leave a small consumable
-	// "for the trouble" (D2 NPC arc).
-	var leftGift *AdvItem
+	// Update visit count and work out what he leaves behind.
+	var leftGifts []AdvItem
 	char, err := loadAdvCharacter(userID)
 	if err == nil {
 		char.RobbieVisitCount++
-		if char.RobbieVisitCount%robbieGiftEveryNVisits == 0 {
-			// Use the canonical DnD level (like the arena's tier gate), not the
-			// frozen legacy CombatLevel — that snapshots at 1–3 once D&D setup
-			// completes, so reading it here would peg every gift at tier 1.
-			if gifts := consumableCache(robbieGiftTier(arenaDnDLevelOrZero(userID)), 1); len(gifts) > 0 {
-				if err := addAdvInventoryItem(userID, gifts[0]); err == nil {
-					leftGift = &gifts[0]
-				}
+		// Use the canonical DnD level (like the arena's tier gate), not the
+		// frozen legacy CombatLevel — that snapshots at 1–3 once D&D setup
+		// completes, so reading it here would peg every gift at tier 1.
+		tier := robbieGiftTier(arenaDnDLevelOrZero(userID))
+		for _, gift := range consumableCache(tier, robbieGiftCount(char.RobbieVisitCount, len(takenItems))) {
+			if err := addAdvInventoryItem(userID, gift); err == nil {
+				leftGifts = append(leftGifts, gift)
 			}
 		}
 		_ = saveAdvCharacter(char)
@@ -185,7 +183,7 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 	}
 
 	// Send DM
-	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard, leftGift)
+	dm := renderRobbieDM(userID, takenItems, totalPayout, masterworkTaken, gaveCard, leftGifts)
 	if err := p.SendDM(userID, dm); err != nil {
 		slog.Error("adventure: robbie: failed to send DM", "user", userID, "err", err)
 	}
@@ -213,12 +211,17 @@ func (p *AdventurePlugin) robbieVisitPlayer(userID id.UserID, displayName string
 func robbieQualifyingItems(inv []AdvItem, equip map[EquipmentSlot]*AdvEquipment) []AdvItem {
 	var result []AdvItem
 	for _, item := range inv {
-		// Never touch Arena gear, cards, consumables, or keys. Consumables are
-		// a player-curated stockpile (crafted or dropped); selling them is an
-		// explicit decision the player must make themselves. Keys are cross-zone
-		// unlock tokens (N5/D4) that must persist in inventory to open their
-		// vault later — sweeping one permanently breaks that unlock.
-		if item.Type == "ArenaGear" || item.Type == "card" || item.Type == "consumable" || item.Type == "key" {
+		// Never touch Arena gear, cards, consumables, keys, or tools.
+		// Consumables are a player-curated stockpile (crafted or dropped);
+		// selling them is an explicit decision the player must make themselves.
+		// Keys are cross-zone unlock tokens (N5/D4) that must persist in
+		// inventory to open their vault later — sweeping one permanently breaks
+		// that unlock. Tools are the same shape of promise: thieves' tools are
+		// bought precisely so a locked fork can be opened *later*, and a bandit
+		// who pockets them between the purchase and the door has taken the
+		// thing the player paid to still have.
+		switch item.Type {
+		case "ArenaGear", "card", "consumable", "key", thievesToolsItemType:
 			continue
 		}
 
@@ -267,9 +270,49 @@ func robbiePlayerHasCard(userID id.UserID) bool {
 
 // ── DM Rendering ─────────────────────────────────────────────────────────────
 
-// robbieGiftEveryNVisits is how often Robbie leaves a consumable behind.
+// robbieGiftEveryNVisits is how often Robbie leaves a consumable behind on the
+// loyalty track alone, independent of how much he hauled off.
 const robbieGiftEveryNVisits = 10
 
+// robbieHaulPerGift is how many items one visit has to be worth before Robbie
+// leaves something for the trouble, and robbieMaxHaulGifts caps how generous a
+// single monster haul can get.
+//
+// The loyalty track on its own was far too thin to read as a reward: a visit is
+// a 40% daily roll, so every-10-visits works out to one consumable per ~25 real
+// days — and it paid exactly the same for a stockpile of sixty items as it did
+// for one rock. Volume is the thing the player actually controls, so volume is
+// what the haul track pays on.
+const (
+	robbieHaulPerGift  = 15
+	robbieMaxHaulGifts = 3
+)
+
+// robbieGiftCount returns how many consumables Robbie leaves this visit: the
+// every-Nth-visit loyalty gift plus one per robbieHaulPerGift items carried
+// off, capped. Pure so the curve is testable without a DB or a Matrix stub.
+func robbieGiftCount(visitCount, itemsTaken int) int {
+	n := 0
+	if visitCount > 0 && visitCount%robbieGiftEveryNVisits == 0 {
+		n++
+	}
+	if haul := itemsTaken / robbieHaulPerGift; haul > 0 {
+		n += min(haul, robbieMaxHaulGifts)
+	}
+	return n
+}
+
+// joinAnd renders a list as "a", "a and b", or "a, b and c".
+func joinAnd(xs []string) string {
+	switch len(xs) {
+	case 0:
+		return ""
+	case 1:
+		return xs[0]
+	}
+	return strings.Join(xs[:len(xs)-1], ", ") + " and " + xs[len(xs)-1]
+}
+
 // robbieGiftTier maps a player's combat level to a consumable tier, matching
 // the arena tier bands (1–3 / 4–7 / 8–12 / 13–17 / 18+).
 func robbieGiftTier(level int) int {
@@ -287,7 +330,7 @@ func robbieGiftTier(level int) int {
 	}
 }
 
-func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool, leftGift *AdvItem) string {
+func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gaveCard bool, leftGifts []AdvItem) string {
 	var sb strings.Builder
 
 	// Opening
@@ -334,9 +377,19 @@ func renderRobbieDM(userID id.UserID, items []AdvItem, total int64, mwTaken, gav
 	}
 	sb.WriteString("\n\n")
 
-	// Every-10th-visit consumable (D2).
-	if leftGift != nil {
-		sb.WriteString(fmt.Sprintf(robbieLeftConsumable, leftGift.Name))
+	// What he left behind: the every-10th-visit loyalty consumable (D2), the
+	// big-haul thank-you, or both rolled into one line. A single gift keeps the
+	// original loyalty phrasing; anything more is the haul talking.
+	if len(leftGifts) > 0 {
+		names := make([]string, 0, len(leftGifts))
+		for _, g := range leftGifts {
+			names = append(names, g.Name)
+		}
+		if len(names) == 1 {
+			sb.WriteString(fmt.Sprintf(robbieLeftConsumable, names[0]))
+		} else {
+			sb.WriteString(fmt.Sprintf(robbieLeftForTheHaul, joinAnd(names)))
+		}
 		sb.WriteString("\n\n")
 	}
 

internal/plugin/adventure_robbie_gift_test.go

@@ -0,0 +1,47 @@
+package plugin
+
+import "testing"
+
+// TestRobbieGiftCount pins the two tracks: the every-10th-visit loyalty gift
+// and the volume track that pays for a big haul, capped so one monster
+// stockpile can't mint an unbounded pile of consumables.
+func TestRobbieGiftCount(t *testing.T) {
+	cases := []struct {
+		name          string
+		visits, taken int
+		want          int
+	}{
+		{"small haul, off-loyalty visit", 7, 3, 0},
+		{"loyalty visit only", 10, 3, 1},
+		{"haul only", 7, 15, 1},
+		{"haul and loyalty stack", 20, 15, 2},
+		{"haul scales", 7, 45, 3},
+		{"haul capped", 7, 500, robbieMaxHaulGifts},
+		{"cap plus loyalty", 30, 500, robbieMaxHaulGifts + 1},
+		{"one under the haul threshold", 7, robbieHaulPerGift - 1, 0},
+		{"zeroth visit is not a loyalty visit", 0, 0, 0},
+	}
+	for _, c := range cases {
+		if got := robbieGiftCount(c.visits, c.taken); got != c.want {
+			t.Errorf("%s: robbieGiftCount(%d, %d) = %d, want %d",
+				c.name, c.visits, c.taken, got, c.want)
+		}
+	}
+}
+
+func TestJoinAnd(t *testing.T) {
+	cases := []struct {
+		in   []string
+		want string
+	}{
+		{nil, ""},
+		{[]string{"a"}, "a"},
+		{[]string{"a", "b"}, "a and b"},
+		{[]string{"a", "b", "c"}, "a, b and c"},
+	}
+	for _, c := range cases {
+		if got := joinAnd(c.in); got != c.want {
+			t.Errorf("joinAnd(%v) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}

internal/plugin/adventure_shop.go

@@ -845,7 +845,13 @@ func (p *AdventurePlugin) advSellAll(userID id.UserID) string {
 	var keptConsumable int
 	var keptMagic int
 	for _, item := range items {
-		if item.Type == "MasterworkGear" || item.Type == "ArenaGear" || item.Type == "card" {
+		// Keys and tools ride along with the special gear here for the same
+		// reason Robbie won't take them: both are bought or found precisely so a
+		// door can be opened *later*, and `sell all` is a bulk-loot verb the
+		// player fires after every haul without reading the list. Turning one
+		// into €300 silently deletes the unlock it was carried for.
+		switch item.Type {
+		case "MasterworkGear", "ArenaGear", "card", "key", thievesToolsItemType:
 			keptSpecial++
 			continue
 		}
@@ -1019,6 +1025,9 @@ func luigiSuppliesView(_ id.UserID, balance float64) string {
 		}
 	}
 
+	sb.WriteString(fmt.Sprintf("**%s** — €%d\n  Opens one dungeon path a failed check closed (`!zone unlock <n>`). Not used in combat.\n\n",
+		thievesToolsName, thievesToolsPrice))
+
 	sb.WriteString("Reply with an item name to buy, or `back` to return.\n")
 	sb.WriteString("Stronger consumables drop from foraging, mining, fishing, and dungeons at T2+.")
 	return sb.String()
@@ -1073,6 +1082,13 @@ func (p *AdventurePlugin) resolveShopSupplyChoice(ctx MessageContext, interactio
 		return p.SendDM(ctx.Sender, "*Luigi nods and gestures toward the main counter.*")
 	}
 
+	// Thieves' tools sit on the supplies shelf but are not a ConsumableDef:
+	// the combat engine scans inventory against that table and would happily
+	// spend them mid-fight. They get their own branch and their own item type.
+	if isThievesToolsReply(reply) {
+		return p.buyThievesTools(ctx, interaction)
+	}
+
 	// Find matching consumable
 	var match *ConsumableDef
 	for i := range consumableDefs {
@@ -1115,6 +1131,34 @@ func (p *AdventurePlugin) resolveShopSupplyChoice(ctx MessageContext, interactio
 		match.Name, consumablePrice, newBalance))
 }
 
+// buyThievesTools sells one set off the supplies shelf. Mirrors the consumable
+// purchase beside it — same session price factor, same 5% pot cut — and leaves
+// the player in the supplies view so they can buy a second.
+func (p *AdventurePlugin) buyThievesTools(ctx MessageContext, interaction *advPendingInteraction) error {
+	price := float64(thievesToolsPrice) * p.shopSessionPriceFactor(ctx.Sender)
+	balance := p.euro.GetBalance(ctx.Sender)
+	if balance < price {
+		p.pending.Store(string(ctx.Sender), interaction)
+		return p.SendDM(ctx.Sender, fmt.Sprintf("You need €%.0f for %s but only have €%.0f.",
+			price, thievesToolsName, balance))
+	}
+	p.euro.Debit(ctx.Sender, price, "shop_thieves_tools")
+	if potCut := int(math.Round(price * 0.05)); potCut > 0 {
+		communityPotAdd(potCut)
+		trackTaxPaid(ctx.Sender, potCut)
+	}
+	_ = addAdvInventoryItem(ctx.Sender, AdvItem{
+		Name:  thievesToolsName,
+		Type:  thievesToolsItemType,
+		Tier:  1,
+		Value: thievesToolsPrice / 2,
+	})
+	p.pending.Store(string(ctx.Sender), interaction)
+	return p.SendDM(ctx.Sender, fmt.Sprintf(
+		"Purchased **%s** for €%.0f. You carry %d.\n💰 Balance: €%.0f\n\nReply with another item name or `back` to return.",
+		thievesToolsName, price, countThievesTools(ctx.Sender), p.euro.GetBalance(ctx.Sender)))
+}
+
 // ── Curios (Magic Items) ────────────────────────────────────────────────────
 
 // curiosStockSize — how many registry magic items Luigi stocks per day.

internal/plugin/adventure_worldboss.go

@@ -2,6 +2,7 @@ package plugin
 
 import (
 	"database/sql"
+	"errors"
 	"fmt"
 	"hash/fnv"
 	"log/slog"
@@ -394,14 +395,15 @@ func (p *AdventurePlugin) spawnWorldBoss(eventKey string) (*worldBossState, erro
 		return nil, err
 	}
 	p.announceWorldBossSpawn(boss, activeN)
+	emitSiegeStart(boss)
 	slog.Info("worldboss: spawned", "id", bossID, "name", name, "tier", tier, "hp", hpMax, "activeN", activeN)
 	return boss, nil
 }
 
-// worldBossTick rides the 1-minute event ticker. It auto-spawns a boss on the
-// first of each UTC month and resolves a live boss whose window has lapsed. The
-// defeat path is not here — a bout crossing the pool to zero resolves inline
-// (W2), because the ticker never sees the pool between two 60s reads.
+// worldBossTick rides the 1-minute event ticker. It auto-spawns the month's
+// boss and resolves a live boss whose window has lapsed. The defeat path is not
+// here — a bout crossing the pool to zero resolves inline (W2), because the
+// ticker never sees the pool between two 60s reads.
 func (p *AdventurePlugin) worldBossTick() {
 	boss, err := loadActiveWorldBoss()
 	if err != nil {
@@ -423,10 +425,17 @@ func (p *AdventurePlugin) worldBossTick() {
 		}
 		return
 	}
-	// No boss camped — auto-spawn on the 1st of the month, once.
-	if now.Day() != 1 {
-		return
-	}
+	// No boss camped — spawn this month's Siege, once.
+	//
+	// The month key below is the whole dedup, so the rule is simply "one Siege
+	// per calendar month, as early as the process is up to run it." It used to
+	// additionally require now.Day() == 1, which deadlocked the entire feature:
+	// the world boss shipped mid-July 2026 and prod never once ran a first-of-
+	// the-month tick with the code in it, so `select count(*) from world_boss`
+	// was still 0 weeks later. The day gate also silently skipped any month
+	// where the bot happened to be down or redeploying across the 1st, with no
+	// catch-up. Dropping it makes a missed 1st self-heal on the next tick
+	// instead of costing the town a month.
 	monthKey := now.Format("2006-01")
 	if db.JobCompleted("worldboss_spawn", monthKey) {
 		return
@@ -489,6 +498,7 @@ func (p *AdventurePlugin) resolveWorldBossDefeated(boss *worldBossState) {
 		}
 	}
 	p.announceWorldBossDefeated(boss, payouts)
+	emitSiegeWin(boss, len(payouts))
 	slog.Info("worldboss: defeated", "id", boss.ID, "contributors", len(payouts))
 }
 
@@ -509,6 +519,7 @@ func (p *AdventurePlugin) resolveWorldBossSurvived(boss *worldBossState) {
 		paid = tribute
 	}
 	p.announceWorldBossSurvived(boss, paid)
+	emitSiegeLoss(boss)
 	slog.Info("worldboss: survived", "id", boss.ID, "tribute", paid)
 }
 
@@ -597,42 +608,58 @@ func (p *AdventurePlugin) worldBossOperatorSpawn(ctx MessageContext) error {
 		boss.Name, boss.Tier, groupInt(boss.HPMax)))
 }
 
-// fightWorldBoss runs one player's daily bout against the Siege: an arena-style
+// Sentinels for the four ways a bout can be refused, so a headless caller (the
+// web action queue, pete_orders.go) can turn each into its own verdict instead of
+// parsing a DM. `!adventure worldboss fight` maps them back to the prose it
+// always sent.
+var (
+	errSiegeNoBoss        = errors.New("siege: nothing camped outside town")
+	errSiegeNoCharacter   = errors.New("siege: no adventurer")
+	errSiegeDead          = errors.New("siege: adventurer is dead")
+	errSiegeAlreadyFought = errors.New("siege: today's bout already spent")
+)
+
+// takeSiegeBout runs one player's daily bout against the Siege: an arena-style
 // solo fight whose damage is subtracted from the shared pool win or lose. Real
 // HP cost, no death — a loss leaves the fighter battered (floored at 1 HP) but
 // standing. The per-user lock serialises a player's own repeat submits, so the
-// once-per-day gate can't be raced by a double-tap.
-func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
-	userMu := p.advUserLock(ctx.Sender)
+// once-per-day gate can't be raced by a double-tap — and that same lock is what
+// makes it safe for the web queue and a Matrix command to reach for the bout at
+// the same moment.
+//
+// The combat narration is DM'd from here whichever door the bout came through: a
+// fight is thirty lines of blow-by-blow and belongs in Matrix, not in a one-line
+// verdict on a web page. The caller gets the boss and the result to describe.
+func (p *AdventurePlugin) takeSiegeBout(uid id.UserID) (worldBossBoutResult, *worldBossState, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()
 
 	boss, err := loadActiveWorldBoss()
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+		return worldBossBoutResult{}, nil, fmt.Errorf("reaching the Siege: %w", err)
 	}
 	if boss == nil {
-		return p.SendDM(ctx.Sender, "No Siege is camped outside town right now.")
+		return worldBossBoutResult{}, nil, errSiegeNoBoss
 	}
 
-	char, err := loadAdvCharacter(ctx.Sender)
+	char, err := loadAdvCharacter(uid)
 	if err != nil || char == nil {
-		return p.SendDM(ctx.Sender, "You need an adventurer first — type `!adventure` to begin.")
+		return worldBossBoutResult{}, boss, errSiegeNoCharacter
 	}
 	if !char.Alive {
-		return p.SendDM(ctx.Sender, "You're dead. The Siege will have to wait until you're back on your feet.")
+		return worldBossBoutResult{}, boss, errSiegeDead
 	}
 
 	today := time.Now().UTC().Format("2006-01-02")
-	if worldBossBoutUsedToday(boss.ID, ctx.Sender, today) {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You've already taken your bout against **%s** today. Come back tomorrow — one fight per day.", boss.Name))
+	if worldBossBoutUsedToday(boss.ID, uid, today) {
+		return worldBossBoutResult{}, boss, errSiegeAlreadyFought
 	}
 
-	bout, err := p.resolveWorldBossBout(ctx.Sender, boss, today)
+	bout, err := p.resolveWorldBossBout(uid, boss, today)
 	if err != nil {
-		slog.Error("worldboss: bout failed", "user", ctx.Sender, "err", err)
-		return p.SendDM(ctx.Sender, "The Siege combat hit an error. Try again in a moment.")
+		slog.Error("worldboss: bout failed", "user", uid, "err", err)
+		return worldBossBoutResult{}, boss, fmt.Errorf("running the bout: %w", err)
 	}
 
 	// Resolve a defeat BEFORE streaming the (multi-second) narration. The pool is
@@ -643,7 +670,7 @@ func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
 		p.resolveWorldBossDefeated(boss)
 	}
 
-	playerName, _ := loadDisplayName(ctx.Sender)
+	playerName, _ := loadDisplayName(uid)
 	if playerName == "" {
 		playerName = "You"
 	}
@@ -651,18 +678,45 @@ func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
 		fmt.Sprintf("⚔️ **The Siege — %s** (Tier %d)", boss.Name, boss.Tier),
 	}, RenderCombatLog(bout.Combat, playerName, boss.Name)...)
 
+	<-p.sendZoneCombatMessages(uid, phaseMessages, siegeBoutFooter(bout, boss))
+	return bout, boss, nil
+}
+
+// siegeBoutFooter is the one-line result of a bout — the damage dealt and what
+// the pool looks like now. It closes the Matrix narration and doubles as the web
+// verdict, so the two doors can't drift into describing the same fight
+// differently.
+func siegeBoutFooter(bout worldBossBoutResult, boss *worldBossState) string {
 	var footer string
 	if bout.Killed {
-		footer = fmt.Sprintf("💥 You deal **%d** damage — the killing blow! **%s** falls!", bout.Damage, boss.Name)
+		footer = fmt.Sprintf("💥 You deal **%d** damage: the killing blow! **%s** falls!", bout.Damage, boss.Name)
 	} else {
 		footer = fmt.Sprintf("💥 You deal **%d** damage. **%s** has **%s / %s HP** left.",
 			bout.Damage, boss.Name, groupInt(bout.Remaining), groupInt(boss.HPMax))
 	}
 	if bout.Battered {
-		footer += "\nYou stagger out of the fight at 1 HP — rest up before your next outing."
+		footer += "\nYou stagger out of the fight at 1 HP. Rest up before your next outing."
 	}
+	return footer
+}
 
-	<-p.sendZoneCombatMessages(ctx.Sender, phaseMessages, footer)
+// fightWorldBoss is `!adventure worldboss fight`: the command framing around
+// takeSiegeBout, which does the fight and the narration.
+func (p *AdventurePlugin) fightWorldBoss(ctx MessageContext) error {
+	_, boss, err := p.takeSiegeBout(ctx.Sender)
+	switch {
+	case errors.Is(err, errSiegeNoBoss):
+		return p.SendDM(ctx.Sender, "No Siege is camped outside town right now.")
+	case errors.Is(err, errSiegeNoCharacter):
+		return p.SendDM(ctx.Sender, "You need an adventurer first — type `!adventure` to begin.")
+	case errors.Is(err, errSiegeDead):
+		return p.SendDM(ctx.Sender, "You're dead. The Siege will have to wait until you're back on your feet.")
+	case errors.Is(err, errSiegeAlreadyFought):
+		return p.SendDM(ctx.Sender, fmt.Sprintf(
+			"You've already taken your bout against **%s** today. Come back tomorrow — one fight per day.", boss.Name))
+	case err != nil:
+		return p.SendDM(ctx.Sender, "Something went wrong reaching the Siege. Try again in a moment.")
+	}
 	return nil
 }
 

internal/plugin/bootstrap_pete_news.go

@@ -22,6 +22,16 @@ import (
 //  3. Single-holder achievements — rarity-gated to one holder, matching the live
 //     milestone rule so routine unlocks don't flood the backlog.
 //
+// Every fact here is a BULLETIN, like every fact gogobee files (1cbd68a). Priority
+// is the one tier that makes Pete post a live Matrix beat, and TwinBee already
+// narrates these moments in the games room as they happen — a priority fact would
+// have Pete read his version back to the people who watched it. Nothing in the
+// back catalogue is news, least of all a death from three weeks ago.
+//
+// NoPush independently short-circuits Pete's beat today, so this is belt AND
+// braces: the tier is the rule, and it must not depend on NoPush staying in front
+// of it. Rendering keys off event_type, not tier, so nothing on the site moves.
+//
 // Backfilled facts are backdated to when they happened and marked NoPush (no
 // web-push spam on launch). GUIDs are deterministic (keyed on the historical
 // timestamp), so a re-run — or a later live emit of the same event — dedups on
@@ -48,34 +58,119 @@ func (p *AdventurePlugin) bootstrapPeteNewsBackfill() {
 		"zone_firsts", firsts, "deaths", deaths, "achievements", achv)
 }
 
-// backfillZoneFirsts seeds news_realm_firsts from history and emits one PRIORITY
-// realm-first dispatch per zone, attributed to its earliest boss-defeating
-// clearer. SQLite returns the user_id from the same row as MIN(completed_at)
-// (bare-column min/max rule), so the (zone, first clearer, time) triple is
-// consistent. Returns the count emitted.
-func (p *AdventurePlugin) backfillZoneFirsts() int {
+// zoneFirstClear is one zone's earliest boss kill: who did it and when.
+type zoneFirstClear struct {
+	zoneID, userID, completedAt string
+}
+
+// zoneFirstClears reads the earliest boss-defeating run of every zone.
+//
+// The filter is `boss_defeated = 1` and NOTHING else, and that is the whole
+// point. `abandoned` does not mean anybody gave up — abandonZoneRunByID exists
+// to retire a run whose boss is ALREADY DEAD when the expedition travels onward
+// (dnd_zone_run.go), so in prod 30 of 32 boss kills carry abandoned = 1. An
+// `AND abandoned = 0` here drew a realm where 2 zones had ever been beaten
+// instead of 9. It is the same filter loadRealmClearStats documents; do not
+// reintroduce it.
+//
+// SQLite returns the user_id from the same row as MIN(completed_at) (bare-column
+// min/max rule), so the (zone, first clearer, time) triple is internally
+// consistent.
+// ok is false only when the read itself failed. A caller that is about to mark
+// a one-shot job complete has to be able to tell "no zone has ever been cleared"
+// from "the query fell over", or a transient DB fault at boot retires the repair
+// permanently.
+func zoneFirstClears() (firsts []zoneFirstClear, ok bool) {
 	rows, err := db.Get().Query(
 		`SELECT zone_id, user_id, MIN(completed_at)
 		   FROM dnd_zone_run
-		  WHERE boss_defeated = 1 AND completed_at IS NOT NULL AND abandoned = 0
+		  WHERE boss_defeated = 1 AND completed_at IS NOT NULL
 		  GROUP BY zone_id`)
 	if err != nil {
 		slog.Error("backfill: zone-firsts query", "err", err)
-		return 0
+		return nil, false
 	}
-	type first struct {
-		zoneID, userID, completedAt string
-	}
-	var firsts []first
+	defer rows.Close()
+
 	for rows.Next() {
-		var f first
+		var f zoneFirstClear
 		if err := rows.Scan(&f.zoneID, &f.userID, &f.completedAt); err != nil {
 			slog.Error("backfill: zone-firsts scan", "err", err)
 			continue
 		}
 		firsts = append(firsts, f)
 	}
-	rows.Close()
+	if err := rows.Err(); err != nil {
+		slog.Error("backfill: zone-firsts rows", "err", err)
+		return nil, false
+	}
+	return firsts, true
+}
+
+// bootstrapRealmFirstsReseed repairs the zone half of news_realm_firsts.
+//
+// The ledger is what claimRealmFirst tiers live dispatches against, so a zone
+// whose first clear the original one-shot missed is a spurious PRIORITY "realm
+// first" waiting to fire the next time somebody clears it, months after the
+// fact. Two things were wrong with what got seeded:
+//
+//  1. The `abandoned = 0` filter above, which is why prod holds 6 zones where
+//     the run history knows 9.
+//  2. first_at is claimRealmFirst's unixepoch() — when the claim was RECORDED,
+//     not when the clear happened. Every backfilled prod row carries the one
+//     minute the job ran.
+//
+// This is a re-SEED, not a re-run: it writes the ledger and emits nothing at
+// all, so no historical realm-first dispatch reaches the room. It has its own
+// job name because the original one-shot's gate is already marked, and per
+// feedback_loader_rewire_needs_bootstrap it stays in place afterwards — a fresh
+// deploy runs it as an ordinary bootstrap.
+//
+// It runs unconditionally on the news seam's switches, unlike the backfill: a
+// ledger that is correct only when emission happens to be on is a ledger that
+// mis-tiers the first dispatch after somebody flips it.
+//
+// A zone claim with no surviving run behind it is left exactly as it is. The run
+// history is the better record of both who and when, but only where it has one.
+func bootstrapRealmFirstsReseed() {
+	const jobName = "pete_realm_firsts_reseed_v1"
+	if db.JobCompleted(jobName, "once") {
+		return
+	}
+
+	clears, ok := zoneFirstClears()
+	if !ok {
+		// The read failed. Leave the job unmarked so the next boot tries again —
+		// marking it here would retire the repair on the strength of a transient
+		// DB fault and leave the ledger wrong forever.
+		return
+	}
+
+	seeded := 0
+	for _, f := range clears {
+		ts, ok := parseSQLiteTime(f.completedAt)
+		if !ok {
+			slog.Warn("reseed: unparseable clear time", "zone", f.zoneID, "at", f.completedAt)
+			continue
+		}
+		// Upsert, not INSERT OR IGNORE: the six rows that already exist carry the
+		// wrong date and correcting them is half of what this job is for.
+		db.Exec("realm-firsts reseed",
+			`INSERT INTO news_realm_firsts (kind, target, first_at) VALUES ('zone', ?, ?)
+			 ON CONFLICT(kind, target) DO UPDATE SET first_at = excluded.first_at`,
+			f.zoneID, ts.Unix())
+		seeded++
+	}
+
+	db.MarkJobCompleted(jobName, "once")
+	slog.Warn("bootstrap: realm-firsts ledger reseeded", "zones", seeded)
+}
+
+// backfillZoneFirsts seeds news_realm_firsts from history and emits one
+// dispatch per zone, attributed to its earliest boss-defeating clearer.
+// Returns the count emitted.
+func (p *AdventurePlugin) backfillZoneFirsts() int {
+	firsts, _ := zoneFirstClears()
 
 	n := 0
 	for _, f := range firsts {
@@ -97,7 +192,7 @@ func (p *AdventurePlugin) backfillZoneFirsts() int {
 		emitFact(peteclient.Fact{
 			GUID:       fmt.Sprintf("zone_first:%s:%s:%d", eventToken(uid, fmt.Sprintf("%s:%d", f.zoneID, ts.Unix())), f.zoneID, ts.Unix()),
 			EventType:  "zone_first",
-			Tier:       "priority",
+			Tier:       "bulletin",
 			Subject:    name,
 			Zone:       zone.Display,
 			Boss:       zone.Boss.Name,
@@ -151,7 +246,7 @@ func backfillDeaths() int {
 		emitFact(peteclient.Fact{
 			GUID:       fmt.Sprintf("death:%s:%s", eventToken(uid, d.date), d.date),
 			EventType:  "death",
-			Tier:       "priority",
+			Tier:       "bulletin",
 			Subject:    name,
 			Zone:       d.location,
 			Level:      lvl,

internal/plugin/bootstrap_realm_firsts_test.go

@@ -0,0 +1,160 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+)
+
+// ledgerFirstAt reads a zone's recorded claim time, or -1 if the ledger has no
+// row for it at all.
+func ledgerFirstAt(t *testing.T, zoneID string) int64 {
+	t.Helper()
+	var at int64
+	err := db.Get().QueryRow(
+		`SELECT first_at FROM news_realm_firsts WHERE kind = 'zone' AND target = ?`,
+		zoneID).Scan(&at)
+	if err != nil {
+		return -1
+	}
+	return at
+}
+
+func unixOf(t *testing.T, sqliteTime string) int64 {
+	t.Helper()
+	ts, ok := parseSQLiteTime(sqliteTime)
+	if !ok {
+		t.Fatalf("parseSQLiteTime(%q) failed", sqliteTime)
+	}
+	return ts.Unix()
+}
+
+// TestReseedClaimsAZoneWhoseClearsWereAllRetired is the regression for the bug
+// that made this job necessary: every clear of forest_shadows carries
+// abandoned = 1, which is how the game stores a kill the expedition walked on
+// from, and the original one-shot's `abandoned = 0` filter therefore never saw
+// the zone at all. An unclaimed zone is a spurious PRIORITY "realm first"
+// waiting to fire the next time somebody clears it, months after the fact — so
+// the assertion that matters is the claimRealmFirst one at the end.
+func TestReseedClaimsAZoneWhoseClearsWereAllRetired(t *testing.T) {
+	seedRealmFixture(t)
+
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	if got := ledgerFirstAt(t, "forest_shadows"); got != -1 {
+		t.Fatalf("forest_shadows already claimed before the reseed (first_at=%d) — fixture drift", got)
+	}
+
+	bootstrapRealmFirstsReseed()
+
+	if got := ledgerFirstAt(t, "forest_shadows"); got != unixOf(t, "2026-02-14 09:00:00") {
+		t.Errorf("forest_shadows first_at = %d, want %d (the real clear, not the minute the job ran)",
+			got, unixOf(t, "2026-02-14 09:00:00"))
+	}
+	// The point of the whole job. Before the reseed this returns true and the
+	// next clear of a zone beaten in February announces itself as a realm first.
+	if claimRealmFirst("zone", "forest_shadows") {
+		t.Error("forest_shadows was still unclaimed after the reseed — the next clear would fire a spurious realm-first")
+	}
+}
+
+// TestReseedCorrectsTheBackfillsDates pins the second half. claimRealmFirst
+// stamps unixepoch(), so every row the original one-shot wrote carries the one
+// minute that job ran — in prod, all six share the identical timestamp. The
+// reseed has to overwrite an existing row, not INSERT OR IGNORE past it.
+func TestReseedCorrectsTheBackfillsDates(t *testing.T) {
+	seedRealmFixture(t)
+
+	// The fixture claims both zones the way the backfill did: at claim time.
+	before := ledgerFirstAt(t, "goblin_warrens")
+	if before < time.Now().Unix()-300 {
+		t.Fatalf("fixture claim for goblin_warrens is not a now-stamp (%d) — fixture drift", before)
+	}
+
+	bootstrapRealmFirstsReseed()
+
+	// Josie's r1, January, not r2 or r3 and not today.
+	if got, want := ledgerFirstAt(t, "goblin_warrens"), unixOf(t, "2026-01-10 12:00:00"); got != want {
+		t.Errorf("goblin_warrens first_at = %d, want %d (earliest real clear)", got, want)
+	}
+	// crypt_valdris has a clean clear (r4) and a retired-but-won one (r5). The
+	// earliest is r4.
+	if got, want := ledgerFirstAt(t, "crypt_valdris"), unixOf(t, "2026-05-01 12:00:00"); got != want {
+		t.Errorf("crypt_valdris first_at = %d, want %d", got, want)
+	}
+}
+
+// TestReseedEmitsNothing is the reason this is a re-seed and not a re-run of the
+// backfill. The ledger has to be repaired without any historical realm-first
+// dispatch reaching the room; a zone beaten in February is not news in July.
+func TestReseedEmitsNothing(t *testing.T) {
+	seedRealmFixture(t)
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	bootstrapRealmFirstsReseed()
+
+	var queued int
+	if err := db.Get().QueryRow(`SELECT COUNT(*) FROM pete_emit_queue`).Scan(&queued); err != nil {
+		t.Fatalf("count pete_emit_queue: %v", err)
+	}
+	if queued != 0 {
+		t.Errorf("reseed queued %d dispatches, want 0 — the ledger repair must be silent", queued)
+	}
+}
+
+// TestReseedIsAOneShot. It is a bootstrap kept in place for fresh deploys (per
+// feedback_loader_rewire_needs_bootstrap), so it runs on every start and must
+// cost nothing after the first — and, more importantly, must not undo a
+// later live claim by rewriting the ledger from stale history on every boot.
+func TestReseedIsAOneShot(t *testing.T) {
+	seedRealmFixture(t)
+	bootstrapRealmFirstsReseed()
+
+	// A zone cleared after the reseed, claimed live.
+	if !claimRealmFirst("zone", "sunken_temple") {
+		t.Fatal("sunken_temple should have been an unclaimed realm-first")
+	}
+	live := ledgerFirstAt(t, "sunken_temple")
+
+	bootstrapRealmFirstsReseed()
+
+	if got := ledgerFirstAt(t, "sunken_temple"); got != live {
+		t.Errorf("second reseed moved a live claim: %d -> %d", live, got)
+	}
+	if claimRealmFirst("zone", "goblin_warrens") {
+		t.Error("second reseed dropped an existing claim")
+	}
+}
+
+// TestZoneFirstClearsCountsRetiredKills guards the shared query itself, which
+// the kept backfill also uses. `abandoned` means the run row was retired, not
+// that anybody gave up.
+func TestZoneFirstClearsCountsRetiredKills(t *testing.T) {
+	seedRealmFixture(t)
+	db.Exec("seed retired-only zone", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r7', '@josie:x', 'forest_shadows', 6, 1, 1, '2026-02-14 09:00:00')`)
+
+	clears, ok := zoneFirstClears()
+	if !ok {
+		t.Fatal("zoneFirstClears reported a read failure")
+	}
+	byZone := map[string]zoneFirstClear{}
+	for _, f := range clears {
+		byZone[f.zoneID] = f
+	}
+	if len(byZone) != 3 {
+		t.Fatalf("zoneFirstClears returned %d zones, want 3 (a regression to `abandoned = 0` gives 2)", len(byZone))
+	}
+	if got := byZone["forest_shadows"].userID; got != "@josie:x" {
+		t.Errorf("forest_shadows first clearer = %q, want @josie:x", got)
+	}
+	if _, ok := byZone["arena"]; ok {
+		t.Error("an unfinished run counted as a clear")
+	}
+}

internal/plugin/combat_armed_ability_test.go

@@ -97,7 +97,7 @@ func TestBuildFightSeats_ConsumesTheAbilityOnceAndCarriesItOnTheSeat(t *testing.
 	ragingBerserker(t, uid)
 
 	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
-		uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+		uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}
@@ -125,7 +125,7 @@ func TestBuildZoneCombatants_RebuildKeepsTheRageForTheWholeFight(t *testing.T) {
 	ragingBerserker(t, uid)
 	p := &AdventurePlugin{}
 
-	seats, _, _, refusal := p.buildFightSeats(uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0)
+	seats, _, _, refusal := p.buildFightSeats(uid, []id.UserID{uid}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}
@@ -171,7 +171,7 @@ func TestBuildFightSeats_SatOutMemberKeepsTheirArmedAbility(t *testing.T) {
 	}
 
 	seats, _, _, refusal := (&AdventurePlugin{}).buildFightSeats(
-		leader, []id.UserID{leader, downed}, dndBestiary["goblin"], 1, 0)
+		leader, []id.UserID{leader, downed}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("fight refused: %s", refusal)
 	}

internal/plugin/combat_bridge.go

@@ -32,6 +32,20 @@ func (p *AdventurePlugin) postCombatBookkeeping(
 	if err := persistDnDPostCombatSubclass(dndChar, raged, result, mods); err != nil {
 		slog.Error("dnd: post-combat subclass persist", "user", userID, "err", err)
 	}
+	// The pet fought too. A win is its only earned XP — see grantPetCombatXP
+	// for why this seam and not the room-clear one: it is the single place all
+	// four close-outs already meet, so a pet cannot level differently depending
+	// on whether the fight auto-resolved or was played a round at a time.
+	if result.PlayerWon {
+		if leveled := grantPetCombatXP(userID); len(leveled) > 0 {
+			for _, line := range leveled {
+				slog.Info("adventure: pet leveled", "user", userID, "pet", line)
+			}
+			if err := p.SendDM(userID, "🐾 "+strings.Join(leveled, "\n🐾 ")); err != nil {
+				slog.Warn("adventure: pet level-up DM", "user", userID, "err", err)
+			}
+		}
+	}
 }
 
 // grantCombatAchievements checks combat results for achievement-worthy moments.
@@ -371,7 +385,7 @@ type DeathTransitionResult struct {
 func transitionDeath(p DeathTransitionParams) DeathTransitionResult {
 	var r DeathTransitionResult
 
-	if p.AllowPardon && p.ChatLevel >= 20 && p.Char.PardonAvailable() && rand.Float64() < 0.33 {
+	if p.AllowPardon && p.ChatLevel >= 20 && p.Char.PardonAvailable() && simFloat64() < 0.33 {
 		r.Pardoned = true
 		now := time.Now().UTC()
 		p.Char.LastPardonUsed = &now

internal/plugin/combat_cmd.go

@@ -97,7 +97,7 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {
 
 	// Seat the whole party, leader first. A solo player is a one-seat roster and
 	// takes the path they always took: one build, one INSERT, no participant rows.
-	seats, enemy, senderSkip, refusal := p.buildFightSeats(ctx.Sender, roster, monster, int(zone.Tier), run.DMMood)
+	seats, enemy, senderSkip, refusal := p.buildFightSeats(ctx.Sender, roster, monster, int(zone.Tier), run.DMMood, run)
 	if refusal != "" {
 		return p.replyDM(ctx, refusal)
 	}
@@ -119,6 +119,17 @@ func (p *AdventurePlugin) handleFightCmd(ctx MessageContext) error {
 		return p.replyDM(ctx, "Couldn't start the fight: "+err.Error())
 	}
 
+	// Layer-2 boss state that is spent mid-fight (Valdris's Phylactery Verses)
+	// is seeded onto the fresh session ONCE, from the route the player walked to
+	// get here — not on the per-round rebuild, which would resurrect spent
+	// rebirths. enemyHP is the party-scaled pool persisted above. No-op for every
+	// non-hooked enemy.
+	if seedBossRunStatuses(sess, monster.ID, enemyHP, run) {
+		if err := saveCombatSession(sess); err != nil {
+			return p.replyDM(ctx, "Couldn't start the fight: "+err.Error())
+		}
+	}
+
 	var b strings.Builder
 	if isBoss {
 		if line := composeBossEntry(zone.ID, run.RunID, run.CurrentRoom); line != "" {
@@ -696,6 +707,24 @@ func (p *AdventurePlugin) castActionForSeat(ct *combatTurn, seat int, args strin
 			PlayerHeal:  out.PlayerHeal,
 			EnemySkip:   out.EnemySkip,
 		}
+		// Revive the arcane-blaster sustained cantrip floor in the turn engine.
+		// combat_engine.go:590 deals CantripPerRound flat every round, but that
+		// path is the swing-based engine (SimulateCombat). Auto-resolve — the
+		// live path for every expedition — runs the turn engine, where a caster
+		// autocasts and never weapon-swings, so the floor was dead code: casters
+		// fought at bare cantrip dice (~4d10≈22 at L20). Lift LANDED cantrip
+		// damage to the floor, but only when the cast already connected
+		// (eff.EnemyDamage > 0) — a whiffed Fire Bolt still whiffs, so the ~35%
+		// miss variance survives and the floor doesn't become a guaranteed flat
+		// hammer (that overshot to ~99%). Damage cantrips only; slot spells keep
+		// their rolled damage. Only Mage/Sorcerer/Warlock carry a nonzero
+		// CantripPerRound, so this is self-targeting.
+		if spell.Level == 0 && eff.EnemyDamage > 0 &&
+			(spell.Effect == EffectDamageAttack || spell.Effect == EffectDamageSave || spell.Effect == EffectDamageAuto) {
+			if floor := ct.players[seat].Mods.CantripPerRound; floor > eff.EnemyDamage {
+				eff.EnemyDamage = floor
+			}
+		}
 		// §1 — redirect the heal onto the named ally. The roll is the same; only
 		// the body it lands on changes. This is the line that makes a cleric a
 		// cleric: until it existed, every heal in the engine was a self-heal, and

internal/plugin/combat_engine.go

@@ -181,6 +181,20 @@ type CombatModifiers struct {
 	SpellPreDamage      int
 	SpellPreDamageDesc  string
 	SpellEnemySkipFirst bool
+
+	// At-will cantrip channel. Arcane blasters (Mage/Sorcerer/Warlock) throw a
+	// scaling damage cantrip EVERY round — 5e cantrips are the caster's at-will
+	// floor and scale to 4 dice at L17 (Fire Bolt 4d10, Eldritch Blast 4 beams).
+	// The pre-combat one-shot SpellPreDamage modelled a single leveled cast and
+	// left the caster swinging a stick for the rest of the fight; that is the
+	// whole of the caster T5-room wall (one burst can't finish a 65-HP monster
+	// and the quarterstaff floor does nothing). CantripPerRound is dealt as flat
+	// magic damage at the top of resolvePlayerSwings each round — no dice roll,
+	// so the RNG stream is stable and variance stays low. 0 for non-casters, so
+	// martial combat is byte-identical. Halved by enemy spell_resist like any
+	// spell. CantripDesc is the narration hook (spell name).
+	CantripPerRound int
+	CantripDesc     string
 }
 
 type Combatant struct {
@@ -428,6 +442,14 @@ type combatState struct {
 	enemyRegen         int     // regenerate: enemy heals this much each round end
 	enemySurviveArmed  bool    // survive_at_1: enemy cheats death once, dropping to 1 HP
 
+	// Phylactery Verses (T6 Valdris) — stackable rebirth. enemyReviveCharges is
+	// how many times the boss still cheats death; each revives it to
+	// enemyReviveHP. Seeded once at fight start from unfound Verses, round-tripped
+	// through CombatStatuses. Distinct from enemySurviveArmed (a one-shot 1-HP
+	// proc): a rebirth restores a meaningful pool, and there can be several.
+	enemyReviveCharges int
+	enemyReviveHP      int
+
 	// Phase 13 bestiary slice 4 — the former flavor-only placeholders, now
 	// backed by real state.
 	enemySpellResist bool // spell_resist: player spell damage against this enemy is halved
@@ -435,6 +457,25 @@ type combatState struct {
 	enemyFearImmune  bool // fear_immune: player control spells (enemy-skip) fizzle against this enemy
 	enemyAtkBuff     int  // ally_buff: flat, accumulating bonus to the enemy's attack damage
 
+	// Amendment (T6 Custodian) — an in-combat Layer-2 hook resolved at round end
+	// by applyBossInCombatRoundEnd. enemyRewindHP is the boss's round-3 HP
+	// snapshot (0 until captured); enemyRewindUsed gates the once-only rewind
+	// that restores it to that snapshot when the boss crosses into phase 2. The
+	// soft midnight timer past round 20 rides enemyAtkBuff. Round-tripped through
+	// CombatStatuses; zero/false for every non-Custodian fight.
+	enemyRewindHP   int
+	enemyRewindUsed bool
+
+	// Inversion Stitch (T6 Seamstress) — an in-combat Layer-2 hook resolved at
+	// round end by applyBossInCombatRoundEnd, live only in the boss's phase 2.
+	// inversionActive is the number of rounds the room stays sewn inside-out
+	// (heals sting instead of mend, gated in stepPlayerActionEffect); it counts
+	// down one per round end. inversionTelegraph warns the round before a pulse
+	// activates, so a player who watches the tell can hold their heals. Both
+	// round-trip through CombatStatuses; zero/false for every non-Seamstress fight.
+	inversionActive    int
+	inversionTelegraph bool
+
 	round  int
 	events []CombatEvent
 
@@ -541,6 +582,31 @@ func maybeTriggerOrcRage(st *combatState, player *Combatant, phaseName string) {
 // consumes once-per-fight openers (AutoCritFirst, FirstAttackBonus,
 // AssassinateAdvantage) via st flags — extras roll vanilla.
 func resolvePlayerSwings(st *combatState, player, enemy *Combatant, phase *CombatPhase, result *CombatResult) bool {
+	// At-will cantrip: fires once per round before the weapon swing, independent
+	// of whether the swing connects (a caster who whiffs the stick still throws
+	// its Fire Bolt). Flat magic damage, halved by spell_resist. 0 for
+	// non-casters → skipped entirely, so martial combat draws no extra events
+	// and no RNG. See CantripPerRound in CombatModifiers.
+	if player.Mods.CantripPerRound > 0 && st.enemyHP > 0 {
+		dmg := player.Mods.CantripPerRound
+		if enemyResistsSpells(enemy, st) {
+			dmg = max(1, dmg/2)
+		}
+		st.enemyHP = max(0, st.enemyHP-dmg)
+		st.events = append(st.events, CombatEvent{
+			Round: st.round, Phase: phase.Name, Actor: "player", Action: "cantrip",
+			Damage: dmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+			Desc: player.Mods.CantripDesc,
+		})
+		// Route the kill through enemyDown, not a raw HP read: a boss that cheats
+		// death (survive_at_1) or holds a phylactery rebirth (T6 Valdris) must get
+		// that chance even when the lethal blow is the at-will cantrip. enemyDown
+		// restores its HP and returns false, so the weapon swing below resolves
+		// against the revived pool. Mirrors resolvePlayerAttack's own kill routing.
+		if enemyDown(st, phase.Name) {
+			return true
+		}
+	}
 	if resolvePlayerAttack(st, player, enemy, phase, result) {
 		return true
 	}
@@ -1308,6 +1374,19 @@ func enemyDown(st *combatState, phaseName string) bool {
 		})
 		return false
 	}
+	// Phylactery Verses (T6 Valdris): a stackable rebirth. Each unfound Verse
+	// left one of these charges, and each restores a real pool rather than the
+	// 1-HP stay above — a full-clear explorer stripped them all and fights a
+	// mortal, a skip-route fights a god who keeps getting back up.
+	if st.enemyReviveCharges > 0 {
+		st.enemyReviveCharges--
+		st.enemyHP = max(1, st.enemyReviveHP)
+		st.events = append(st.events, CombatEvent{
+			Round: st.round, Phase: phaseName, Actor: "enemy", Action: "phylactery_rebirth",
+			PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+		})
+		return false
+	}
 	return true
 }
 

internal/plugin/combat_narrative.go

@@ -242,6 +242,10 @@ func renderEvent(e CombatEvent, playerName, enemyName string, result CombatResul
 	case "concentration_tick":
 		return fmt.Sprintf(pickRand(narrativeConcentrationTick), e.Damage)
 
+	case "cantrip":
+		// e.Desc is the spell name (Fire Bolt / Eldritch Blast); e.Damage the hit.
+		return fmt.Sprintf(pickRand(narrativeCantrip), e.Desc, e.Damage)
+
 	case "pet_deflect":
 		return pickRand(narrativePetDeflect)
 
@@ -331,6 +335,18 @@ func renderEvent(e CombatEvent, playerName, enemyName string, result CombatResul
 		return pickRand(narrativeSurviveArmed)
 	case "survive_at_1":
 		return pickRand(narrativeSurvive)
+	case "phylactery_rebirth":
+		return pickRand(narrativePhylacteryRebirth)
+	case "amendment_rewind":
+		return pickRand(narrativeAmendmentRewind)
+	case "midnight_toll":
+		return fmt.Sprintf(pickRand(narrativeMidnightToll), e.Damage)
+	case "inversion_telegraph":
+		return pickRand(narrativeInversionTelegraph)
+	case "inversion_stitch":
+		return pickRand(narrativeInversionStitch)
+	case "heal_inverted":
+		return fmt.Sprintf(pickRand(narrativeHealInverted), e.Damage)
 	case "stat_drain":
 		return fmt.Sprintf(pickRand(narrativeStatDrain), e.Damage)
 	case "debuff":
@@ -546,6 +562,15 @@ var narrativeConcentrationTick = []string{
 	"🌀 The enemy steps wrong and the standing magic answers, %d damage. It does not move on.",
 }
 
+// narrativeCantrip fires each round an arcane blaster throws its at-will cantrip
+// (Fire Bolt / Eldritch Blast) before the weapon swing. %s is the spell name,
+// %d the damage — a caster's sustained floor, so it lands every round.
+var narrativeCantrip = []string{
+	"✨ %s streaks out and burns home — %d damage. The at-will floor never stops.",
+	"✨ A bolt of %s answers before the staff even moves, scorching for %d.",
+	"✨ %s lances the enemy for %d. No incantation, no wind-up — just the steady arcane drum.",
+}
+
 var narrativePetDeflect = []string{
 	"🐾 Your pet intercepts the blow. Damage halved. Your pet is now your best piece of equipment.",
 	"🐾 Your pet pushes you aside at the last second. Impact reduced. You did not ask to be pushed. Results speak for themselves.",
@@ -761,6 +786,52 @@ var narrativeSurvive = []string{
 	"🕯️ The enemy by all rights should be down. It is, instead, very barely up.",
 }
 
+// narrativePhylacteryRebirth fires when Valdris burns a Verse the player left
+// un-found: a bound rebirth spends and the lich reassembles. Each line reads as
+// "you skipped one of these" so the mechanic teaches itself over a wipe.
+var narrativePhylacteryRebirth = []string{
+	"💀 The lich comes apart — and a Verse you never found sings him back together. He rises, unhurried.",
+	"💀 Bone-dust swirls up off the floor and re-seats itself. A rebirth you didn't unbind just spent itself. He stands.",
+	"💀 That should have been the end of him. A Verse still hums somewhere in the cathedral, and Valdris simply *begins again*.",
+}
+
+// narrativeAmendmentRewind fires when the Custodian rewinds itself to its round-3
+// HP snapshot — the once-only Amendment. Each line reads as time being undone so
+// the mechanic (front-loaded burst is partly refunded) teaches itself over a run.
+var narrativeAmendmentRewind = []string{
+	"🕰️ The Custodian raises a hand and *edits the last few minutes out of the record.* Wounds close in reverse; the clock-golem stands as it did rounds ago.",
+	"🕰️ \"That entry is amended.\" The damage you dealt simply un-happens — the Custodian rewinds to where it was and resumes, unhurried.",
+	"🕰️ Verdigris rings spin backward. Time you spent hurting it is refunded to the golem; it returns to its round-three self and keeps working.",
+}
+
+// narrativeMidnightToll fires past round 20 — the soft closing-time timer, the
+// Custodian's Attack climbing each round a stalled fight refuses to end.
+var narrativeMidnightToll = []string{
+	"🔔 A bell tolls somewhere above. Closing time — the Custodian's swings come harder. (+%d attack)",
+	"🔔 The hour is nearly spent, and so is its patience; each blow lands with more weight now. (+%d attack)",
+}
+
+// narrativeInversionTelegraph fires one round before an Inversion Stitch pulse —
+// the Seamstress's tell. It reads as a warning so a player learns to hold heals.
+var narrativeInversionTelegraph = []string{
+	"🧵 The Seamstress draws a thread taut and the room *shivers* — walls flexing toward inside-out. Whatever you were about to mend, hold it. (next round, healing turns against you)",
+	"🧵 A seam in the air puckers. The geometry is about to flip; a cure cast into it will run backward. (inversion incoming next round)",
+}
+
+// narrativeInversionStitch fires when a pulse activates — the room is sewn
+// inside-out and healing now wounds for the pulse's duration.
+var narrativeInversionStitch = []string{
+	"🧵 The stitch pulls through. The room is inside-out now — for a moment, to heal is to hurt.",
+	"🧵 Everything turns wrong-way-round. Mending and wounding have swapped ends of the needle.",
+}
+
+// narrativeHealInverted fires each time a heal lands during an active pulse: the
+// cure runs backward and stings instead. Teaches the mechanic on the spot.
+var narrativeHealInverted = []string{
+	"🧵 The heal runs backward through the inverted room — the cure opens the wound it meant to close. (%d damage)",
+	"🧵 Healing turns against its target in the sewn-inside-out air; the mend lands as a sting. (%d damage)",
+}
+
 var narrativeStatDrain = []string{
 	"🩸 The enemy saps your strength — your swings feel heavier, weaker. (-%d hit damage)",
 	"🩸 Something drains out of your limbs. Your hits won't bite as deep now. (-%d damage)",

internal/plugin/combat_party_start.go

@@ -51,7 +51,7 @@ func fightRoster(sender id.UserID) []id.UserID {
 // The enemy is built once. Every seat's build derives the identical stat block
 // from (monster, tier, dmMood); only the player half varies.
 func (p *AdventurePlugin) buildFightSeats(
-	sender id.UserID, roster []id.UserID, monster DnDMonsterTemplate, tier, dmMood int,
+	sender id.UserID, roster []id.UserID, monster DnDMonsterTemplate, tier, dmMood int, run *DungeonRun,
 ) (seats []CombatSeatSetup, enemy *Combatant, senderSkip, refusal string) {
 	skip := func(uid id.UserID, why string) {
 		if uid == sender {
@@ -157,6 +157,13 @@ func (p *AdventurePlugin) buildFightSeats(
 	// actually seated — a member who was skipped (downed, busy elsewhere) never
 	// joined the fight and must not be charged to the enemy.
 	applySeatWeights(seatCombatants(seats), levels, companions)
+
+	// Fold in any Layer-2 pre-combat boss mechanic before this enemy is used to
+	// persist the initial HP pool. partyCombatantsForSession re-applies the same
+	// modifier on every round's rebuild; doing it here keeps the persisted stat
+	// block consistent with the fight the engine will actually run. No-op for
+	// every non-hooked enemy.
+	applyBossRunModifiers(monster.ID, enemy, run)
 	return seats, enemy, senderSkip, ""
 }
 

internal/plugin/combat_party_start_test.go

@@ -109,7 +109,7 @@ func TestBuildFightSeats_SoloSeatsExactlyThePlayer(t *testing.T) {
 	fightTestChar(t, solo, 30)
 
 	seats, enemy, skip, refusal := (&AdventurePlugin{}).buildFightSeats(
-		solo, []id.UserID{solo}, dndBestiary["goblin"], 1, 0)
+		solo, []id.UserID{solo}, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" || skip != "" {
 		t.Fatalf("solo fight refused: %s / %s", refusal, skip)
 	}
@@ -140,7 +140,7 @@ func TestBuildFightSeats_DownedMemberSitsOut(t *testing.T) {
 
 	roster := []id.UserID{leader, downed, standing}
 	seats, _, skip, refusal := (&AdventurePlugin{}).buildFightSeats(
-		leader, roster, dndBestiary["goblin"], 1, 0)
+		leader, roster, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("party refused over a downed member: %s", refusal)
 	}
@@ -156,7 +156,7 @@ func TestBuildFightSeats_DownedMemberSitsOut(t *testing.T) {
 
 	// The one who was left behind typed `!fight` too, and silence is not an answer.
 	_, _, skip, refusal = (&AdventurePlugin{}).buildFightSeats(
-		downed, roster, dndBestiary["goblin"], 1, 0)
+		downed, roster, dndBestiary["goblin"], 1, 0, nil)
 	if refusal != "" {
 		t.Fatalf("a downed member must not refuse the party's fight: %s", refusal)
 	}
@@ -176,7 +176,7 @@ func TestBuildFightSeats_DownedLeaderRefusesTheFightForEveryone(t *testing.T) {
 	roster := []id.UserID{leader, member}
 	p := &AdventurePlugin{}
 
-	seats, _, _, refusal := p.buildFightSeats(leader, roster, dndBestiary["goblin"], 1, 0)
+	seats, _, _, refusal := p.buildFightSeats(leader, roster, dndBestiary["goblin"], 1, 0, nil)
 	if len(seats) != 0 || refusal == "" {
 		t.Fatalf("downed leader seated %d players, refusal %q", len(seats), refusal)
 	}
@@ -184,7 +184,7 @@ func TestBuildFightSeats_DownedLeaderRefusesTheFightForEveryone(t *testing.T) {
 		t.Errorf("the leader should be told to rest, got %q", refusal)
 	}
 
-	_, _, _, refusal = p.buildFightSeats(member, roster, dndBestiary["goblin"], 1, 0)
+	_, _, _, refusal = p.buildFightSeats(member, roster, dndBestiary["goblin"], 1, 0, nil)
 	if !strings.Contains(refusal, "leader") {
 		t.Errorf("the member should be told it is the leader holding things up, got %q", refusal)
 	}

internal/plugin/combat_session.go

@@ -215,12 +215,44 @@ type CombatStatuses struct {
 	EnemyRegen         int     `json:"enemy_regen,omitempty"`
 	EnemySurviveArmed  bool    `json:"enemy_survive_armed,omitempty"`
 
+	// Phylactery Verses (Tier-6 postgame, Valdris Ascendant). Unlike the
+	// proc-armed EnemySurviveArmed one-shot, this is a *count* of rebirths seeded
+	// once at fight start (seedBossRunStatuses) from how many of the zone's secret
+	// Verses the player left un-found. Each consumed rebirth (enemyDown) revives
+	// the boss to EnemyReviveHP. Both fields are frozen at seed time except
+	// EnemyReviveCharges, which decrements as rebirths are spent — so they must
+	// round-trip through combatState to survive a suspend/resume. Zero for every
+	// other enemy, so omitempty keeps them off every non-Valdris row.
+	EnemyReviveCharges int `json:"enemy_revive_charges,omitempty"`
+	EnemyReviveHP      int `json:"enemy_revive_hp,omitempty"`
+
 	// Slice-4 monster-ability effects — the former flavor-only placeholders.
 	// EnemyRevealNext is a one-shot; the other three persist for the fight.
 	EnemySpellResist bool `json:"enemy_spell_resist,omitempty"`
 	EnemyRevealNext  bool `json:"enemy_reveal_next,omitempty"`
 	EnemyFearImmune  bool `json:"enemy_fear_immune,omitempty"`
 	EnemyAtkBuff     int  `json:"enemy_atk_buff,omitempty"`
+
+	// Amendment (Tier-6 postgame, The Custodian of the Last Hour). An in-combat
+	// Layer-2 hook resolved at round end (applyBossInCombatRoundEnd), not proc-
+	// armed: EnemyRewindHP snapshots the boss's HP at the end of round 3 (0 until
+	// captured); when the boss then crosses into phase 2 the hook restores it to
+	// that snapshot exactly once and sets EnemyRewindUsed. Both round-trip through
+	// combatState so the once-only rewind survives a suspend/resume. Zero/false
+	// for every other enemy. The soft midnight timer past round 20 rides the
+	// existing EnemyAtkBuff, so it needs no field of its own.
+	EnemyRewindHP   int  `json:"enemy_rewind_hp,omitempty"`
+	EnemyRewindUsed bool `json:"enemy_rewind_used,omitempty"`
+
+	// Inversion Stitch (Tier-6 postgame, The Seamstress). An in-combat Layer-2
+	// hook resolved at round end (applyBossInCombatRoundEnd), live only in the
+	// boss's phase 2. InversionActive is the rounds-remaining of the inside-out
+	// pulse during which player heals sting instead of mend (gated in
+	// stepPlayerActionEffect); InversionTelegraph is the one-round warning before
+	// a pulse activates. Both round-trip through combatState so a suspend/resume
+	// can't lose or replay a pulse mid-fight. Zero/false for every other enemy.
+	InversionActive    int  `json:"inversion_active,omitempty"`
+	InversionTelegraph bool `json:"inversion_telegraph,omitempty"`
 }
 
 // applyBuffDelta folds one resolved buff (the result of a !cast / !consume
@@ -450,6 +482,9 @@ const combatSessionCols = `
 
 // newCombatSessionID — 16-char hex token. Same scheme as zone runs / expeditions.
 func newCombatSessionID() string {
+	if simSeedOn() {
+		return simHexToken()
+	}
 	var b [8]byte
 	if _, err := cryptorand.Read(b[:]); err != nil {
 		// Vanishingly unlikely; fall through with a zeroed prefix.

internal/plugin/combat_session_build.go

@@ -211,6 +211,13 @@ func (p *AdventurePlugin) partyCombatantsForSession(sess *CombatSession) ([]*Com
 	// until every seat is built.
 	applySeatWeights(players, levels, companions)
 
+	// Layer-2 pre-combat boss mechanics: fold in any run-state-derived
+	// adjustment (e.g. Aurvandryx's Greed Tax) before the party HP scaling. This
+	// is re-derived every round like everything else here; its inputs are frozen
+	// for a terminal boss fight, so the result is stable. No-op for every
+	// non-hooked enemy.
+	applyBossRunModifiers(monster.ID, &enemy, run)
+
 	// Party-only enemy HP bump, re-derived each turn from the template so it never
 	// compounds. Matches the scalar startPartyCombatSession used for the initial
 	// persist; solo (one seat, weight 1) scales by 1.0.

internal/plugin/combat_turn_engine.go

@@ -363,12 +363,20 @@ func resumeTurnEngine(sess *CombatSession, players []*Combatant, enemy *Combatan
 		enemyRetaliateFrac: sess.Statuses.EnemyRetaliateFrac,
 		enemyRegen:         sess.Statuses.EnemyRegen,
 		enemySurviveArmed:  sess.Statuses.EnemySurviveArmed,
+		enemyReviveCharges: sess.Statuses.EnemyReviveCharges,
+		enemyReviveHP:      sess.Statuses.EnemyReviveHP,
 		// Slice-4 monster-ability effects — the former flavor-only placeholders.
 		enemySpellResist: sess.Statuses.EnemySpellResist,
 		enemyRevealNext:  sess.Statuses.EnemyRevealNext,
 		enemyFearImmune:  sess.Statuses.EnemyFearImmune,
 		enemyAtkBuff:     sess.Statuses.EnemyAtkBuff,
-		rng:              rng,
+		// Amendment (T6 Custodian) — round-3 snapshot + once-only rewind.
+		enemyRewindHP:   sess.Statuses.EnemyRewindHP,
+		enemyRewindUsed: sess.Statuses.EnemyRewindUsed,
+		// Inversion Stitch (T6 Seamstress) — phase-2 heal-inverting pulses.
+		inversionActive:    sess.Statuses.InversionActive,
+		inversionTelegraph: sess.Statuses.InversionTelegraph,
+		rng:                rng,
 	}
 	order := turnOrder(sess, sess.Round, players, enemy)
 	sess.Statuses.TurnIdx = turnIdxForPhase(order, sess.Statuses.TurnIdx, sess.Phase)
@@ -568,10 +576,22 @@ func (te *turnEngine) stepPlayerActionEffect(eff *turnActionEffect) {
 		st.enemyHP = max(0, st.enemyHP-enemyDmg)
 	}
 	if eff.PlayerHeal > 0 {
-		// Respect any max_hp_drain monster ability — a drained player can't be
-		// healed back past the lowered ceiling.
-		hpCap := max(1, st.hpMax-st.maxHPDrain)
-		st.playerHP = min(hpCap, st.playerHP+eff.PlayerHeal)
+		if st.inversionActive > 0 {
+			// Inversion Stitch (T6 Seamstress phase 2): the room is sewn inside-out,
+			// so the cure lands as a wound. Floored at 1 so a player is never killed
+			// by their own heal — the Seamstress's own blows do the finishing; the
+			// sting just denies the sustain and softens the seat for them.
+			st.playerHP = max(1, st.playerHP-eff.PlayerHeal)
+			st.events = append(st.events, CombatEvent{
+				Round: st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "heal_inverted",
+				Damage: eff.PlayerHeal, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
+			})
+		} else {
+			// Respect any max_hp_drain monster ability — a drained player can't be
+			// healed back past the lowered ceiling.
+			hpCap := max(1, st.hpMax-st.maxHPDrain)
+			st.playerHP = min(hpCap, st.playerHP+eff.PlayerHeal)
+		}
 	}
 	// §1 — heal somebody else. The caster's cursor stays where it is; only the
 	// target's HP moves.
@@ -582,14 +602,27 @@ func (te *turnEngine) stepPlayerActionEffect(eff *turnActionEffect) {
 	// path depends on. Healing keeps people up; it does not bring them back.
 	if eff.AllyHeal > 0 && eff.AllySeat >= 0 && eff.AllySeat < len(st.actors) {
 		if tgt := st.actors[eff.AllySeat]; tgt.playerHP > 0 {
-			cap := max(1, tgt.hpMax-tgt.maxHPDrain)
-			before := tgt.playerHP
-			tgt.playerHP = min(cap, tgt.playerHP+eff.AllyHeal)
-			st.events = append(st.events, CombatEvent{
-				Round: st.round, Phase: turnCombatPhase.Name, Actor: "player", Action: "ally_heal",
-				Damage: tgt.playerHP - before, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
-				Seat: eff.AllySeat, Desc: eff.Label,
-			})
+			if st.inversionActive > 0 {
+				// Inversion Stitch: the ally-heal wounds the friend it was meant to
+				// mend. Floored at 1 like the self-heal sting above — the sting denies
+				// the sustain, it does not kill.
+				before := tgt.playerHP
+				tgt.playerHP = max(1, tgt.playerHP-eff.AllyHeal)
+				st.events = append(st.events, CombatEvent{
+					Round: st.round, Phase: turnCombatPhase.Name, Actor: "enemy", Action: "heal_inverted",
+					Damage: before - tgt.playerHP, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
+					Seat: eff.AllySeat, Desc: eff.Label,
+				})
+			} else {
+				cap := max(1, tgt.hpMax-tgt.maxHPDrain)
+				before := tgt.playerHP
+				tgt.playerHP = min(cap, tgt.playerHP+eff.AllyHeal)
+				st.events = append(st.events, CombatEvent{
+					Round: st.round, Phase: turnCombatPhase.Name, Actor: "player", Action: "ally_heal",
+					Damage: tgt.playerHP - before, PlayerHP: tgt.playerHP, EnemyHP: st.enemyHP,
+					Seat: eff.AllySeat, Desc: eff.Label,
+				})
+			}
 		}
 	}
 	// Arm / replace the concentration aura. A new concentration cast overwrites
@@ -840,7 +873,12 @@ func (te *turnEngine) stepRoundEnd() {
 			Round: st.round, Phase: CombatPhaseRoundEnd, Actor: "player", Action: "concentration_tick",
 			Damage: st.concentrationDmg, PlayerHP: st.playerHP, EnemyHP: st.enemyHP, Seat: i,
 		})
-		if st.enemyHP <= 0 {
+		// Route the kill through enemyDown, not a raw HP read: a boss that cheats
+		// death (survive_at_1) or holds a phylactery rebirth (T6 Valdris) must get
+		// that chance even when the lethal blow is a lingering concentration pulse.
+		// enemyDown restores its HP and returns false, so the next seat's pulse (or
+		// the following round) resolves against the revived pool.
+		if enemyDown(st, CombatPhaseRoundEnd) {
 			te.finish(CombatStatusWon)
 			return
 		}
@@ -872,6 +910,14 @@ func (te *turnEngine) stepRoundEnd() {
 			Damage: st.enemyRegen, PlayerHP: st.playerHP, EnemyHP: st.enemyHP,
 		})
 	}
+	// Tier-6 in-combat Layer-2 boss hooks (Amendment): round-3 HP snapshot +
+	// once-only phase-2 rewind + soft midnight timer, resolved on the round that
+	// just finished. A no-op for every enemy but the hooked bosses, and only
+	// while the enemy still stands, so it is safe to call unconditionally here
+	// after the round's damage has settled.
+	if st.enemyHP > 0 {
+		applyBossInCombatRoundEnd(st, te.sess.EnemyID, te.enemy.Stats.MaxHP)
+	}
 	st.round++
 	// Initiative is re-rolled each round, so the next round's order is derived
 	// here — off st.round, since commit has not yet pushed it onto the session.
@@ -926,10 +972,16 @@ func (te *turnEngine) commit() {
 	s.EnemyRetaliateFrac = st.enemyRetaliateFrac
 	s.EnemyRegen = st.enemyRegen
 	s.EnemySurviveArmed = st.enemySurviveArmed
+	s.EnemyReviveCharges = st.enemyReviveCharges
+	s.EnemyReviveHP = st.enemyReviveHP
 	s.EnemySpellResist = st.enemySpellResist
 	s.EnemyRevealNext = st.enemyRevealNext
 	s.EnemyFearImmune = st.enemyFearImmune
 	s.EnemyAtkBuff = st.enemyAtkBuff
+	s.EnemyRewindHP = st.enemyRewindHP
+	s.EnemyRewindUsed = st.enemyRewindUsed
+	s.InversionActive = st.inversionActive
+	s.InversionTelegraph = st.inversionTelegraph
 
 	te.sess.TurnLog = append(te.sess.TurnLog, st.events...)
 }

internal/plugin/combat_turn_party_test.go

@@ -275,3 +275,57 @@ func TestTurnEngine_CommitPersistsSeatZeroNotTheCursor(t *testing.T) {
 		t.Error("seat 1's consumed Lucky reroll leaked onto the session row")
 	}
 }
+
+// A lingering concentration pulse that lands the killing blow must still give a
+// revive-armed boss (survive_at_1 / T6 Valdris's phylactery rebirth) its chance
+// to stand back up — the round-end tick routes the kill through enemyDown, not a
+// raw enemyHP<=0 read. Regression for the concentration-bypass gap found in the
+// P8 Layer-2 review.
+func TestTurnEngine_ConcentrationKillHonorsRebirth(t *testing.T) {
+	// A charged rebirth: the pulse drops the enemy, a charge spends, it revives.
+	sess := turnSession(CombatPhaseRoundEnd, 500, 30)
+	p := basePlayer()
+	e := baseEnemy()
+	te := resumeTurnEngine(sess, []*Combatant{&p}, &e, combatSessionStepRNG(sess, enemySeat))
+	te.st.concentrationDmg = 100 // lethal against 30 HP
+	te.st.enemyReviveCharges = 1
+	te.st.enemyReviveHP = 40
+	if _, err := te.step(PlayerAction{}); err != nil {
+		t.Fatal(err)
+	}
+	te.commit()
+
+	if !sess.IsActive() {
+		t.Fatalf("a concentration kill ended the fight (%q) while a rebirth charge was armed", sess.Status)
+	}
+	if sess.EnemyHP != 40 {
+		t.Errorf("revived EnemyHP = %d, want the 40-HP revive pool", sess.EnemyHP)
+	}
+	if sess.Statuses.EnemyReviveCharges != 0 {
+		t.Errorf("post-revive charges = %d, want 0 (one spent)", sess.Statuses.EnemyReviveCharges)
+	}
+	rebirths := 0
+	for _, ev := range sess.TurnLog {
+		if ev.Action == "phylactery_rebirth" {
+			rebirths++
+		}
+	}
+	if rebirths != 1 {
+		t.Errorf("phylactery_rebirth events = %d, want 1", rebirths)
+	}
+
+	// With no charge left, the same pulse ends the fight cleanly (the win path
+	// is not broken by the enemyDown routing).
+	mortal := turnSession(CombatPhaseRoundEnd, 500, 30)
+	p2 := basePlayer()
+	e2 := baseEnemy()
+	te2 := resumeTurnEngine(mortal, []*Combatant{&p2}, &e2, combatSessionStepRNG(mortal, enemySeat))
+	te2.st.concentrationDmg = 100
+	if _, err := te2.step(PlayerAction{}); err != nil {
+		t.Fatal(err)
+	}
+	te2.commit()
+	if mortal.Status != CombatStatusWon {
+		t.Errorf("charge-less concentration kill status = %q, want %q", mortal.Status, CombatStatusWon)
+	}
+}

internal/plugin/dnd_combat.go

@@ -607,6 +607,7 @@ func emitDeathNews(userID id.UserID, location string) {
 		Zone:       location,
 		Level:      lvl,
 		Outcome:    "lost",
+		RunID:      latestRunIDForNews(userID),
 		OccurredAt: ts,
 	}, userID, "")
 }
@@ -655,6 +656,7 @@ func emitRetreatNews(userID id.UserID, reason string, zoneID ZoneID, day int) {
 		Level:      charLevel(userID),
 		Count:      day, // the day they got to before it fell apart
 		Outcome:    "retreated",
+		RunID:      latestRunIDForNews(userID),
 		OccurredAt: ts,
 	}, userID, "")
 }

internal/plugin/dnd_economy.go

@@ -37,11 +37,21 @@ type ThomCraftRecipe struct {
 	// inventory items consumed (§8.2 Drow Poison Blade). 0 = none.
 	BladeWeaponCount int
 	OutputName       string
-	OutputType       string // material | item | weapon | armor | accessory | consumable
+	OutputType       string // material | item | weapon | armor | accessory | consumable | magic_item
 	OutputTier       int
 	OutputValue      int64
-	Description      string
-	DiscoveryHint    string // shown when newly discovered via !lore
+	// OutputSkillSource, when set, is stamped on the crafted AdvItem's
+	// SkillSource — used for OutputType "magic_item" so the result equips and
+	// resolves against the registry exactly like a looted magic item
+	// ("magic_item:<id>").
+	OutputSkillSource string
+	Description       string
+	DiscoveryHint     string // shown when newly discovered via !lore
+	// AlwaysKnown recipes are never gated behind !lore discovery — they're the
+	// T6 signature-item pity path, craftable the moment a player holds enough
+	// of the zone's crafting anchor. They stay hidden from the recipe book
+	// until the player actually has an anchor in hand (see renderRecipeBook).
+	AlwaysKnown bool
 }
 
 var thomCraftRecipes = []ThomCraftRecipe{
@@ -115,6 +125,83 @@ var thomCraftRecipes = []ThomCraftRecipe{
 		Description:      "Coated blade — sleep-on-crit (DC 14 CON save) for 3 combats. (Effect wired in R6 polish.)",
 		DiscoveryHint:    "Thom turns a glass vial in the lamplight. \"Drow brew, drawn down to a thin coat. Bring me any blade you trust — sword, dagger, scimitar, makes no odds. The poison picks the edge.\"",
 	},
+
+	// ── T6 signature-item pity path ────────────────────────────────────────
+	// AlwaysKnown: no !lore gate. Each consumes 5 of the zone's crafting anchor
+	// (one guaranteed per clear) so a bad-luck run of the 4–6% signature drops
+	// still converts ~5 clears into a guaranteed best-in-slot. Output is a real
+	// magic_item — same SkillSource shape the loot path stamps — so it equips
+	// and carries its postgameSignatureEffects delta.
+	{
+		ID:   "anchor_crown_of_the_patient_king",
+		Name: "Crown of the Patient King",
+		Ingredients: map[string]int{
+			"Verse Bound Folio": 5,
+		},
+		OutputName:        "Crown of the Patient King",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:crown_of_the_patient_king",
+		AlwaysKnown:       true,
+		Description:       "Legendary crown of Valdris — the patient plan, worn on the head. (Pity craft: 5 Ossuary clears.)",
+	},
+	{
+		ID:   "anchor_aegis_of_the_first_scale",
+		Name: "Aegis of the First Scale",
+		Ingredients: map[string]int{
+			"Cooling Ember Of Aurvandryx": 5,
+		},
+		OutputName:        "Aegis of the First Scale",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       9000,
+		OutputSkillSource: "magic_item:aegis_of_the_first_scale",
+		AlwaysKnown:       true,
+		Description:       "Legendary breastplate of the Ember Before Fire — best armor in the game. (Pity craft: 5 First Hoard clears.)",
+	},
+	{
+		ID:   "anchor_needle_of_the_seam",
+		Name: "Needle of the Seam",
+		Ingredients: map[string]int{
+			"Spool Of Undone Geometry": 5,
+		},
+		OutputName:        "Needle of the Seam",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:needle_of_the_seam",
+		AlwaysKnown:       true,
+		Description:       "Legendary needle-dagger of the Seamstress — best caster weapon. (Pity craft: 5 Unplace clears.)",
+	},
+	{
+		ID:   "anchor_halo_of_the_sunken_dawn",
+		Name: "Halo of the Sunken Dawn",
+		Ingredients: map[string]int{
+			"Ember Of The Drowned Star": 5,
+		},
+		OutputName:        "Halo of the Sunken Dawn",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:halo_of_the_sunken_dawn",
+		AlwaysKnown:       true,
+		Description:       "Legendary halo of Seraphel — the first true healer's crown. (Pity craft: 5 Drowned Star clears.)",
+	},
+	{
+		ID:   "anchor_the_second_hand",
+		Name: "The Second Hand",
+		Ingredients: map[string]int{
+			"Unspent Hour": 5,
+		},
+		OutputName:        "The Second Hand",
+		OutputType:        "magic_item",
+		OutputTier:        5,
+		OutputValue:       8000,
+		OutputSkillSource: "magic_item:the_second_hand",
+		AlwaysKnown:       true,
+		Description:       "Legendary sidearm of the Last Meridian — best martial sidearm. (Pity craft: 5 Last Meridian clears.)",
+	},
 }
 
 // bladeWeaponKeywords are the name-substrings that qualify an AdvItem
@@ -140,6 +227,13 @@ func isBladeWeapon(it AdvItem) bool {
 	return false
 }
 
+// recipeCraftable reports whether a player may craft a recipe: either they've
+// discovered it via !lore, or it's an AlwaysKnown pity recipe (which skips
+// discovery entirely — the crafting anchor it needs is the real gate).
+func recipeCraftable(known map[string]bool, r ThomCraftRecipe) bool {
+	return r.AlwaysKnown || known[r.ID]
+}
+
 // findRecipeByID returns the recipe with the given ID.
 func findRecipeByID(id string) (ThomCraftRecipe, bool) {
 	for _, r := range thomCraftRecipes {
@@ -410,7 +504,7 @@ func (p *AdventurePlugin) handleCraftCmd(ctx MessageContext, args string) error
 		return p.SendDM(ctx.Sender, fmt.Sprintf(
 			"No recipe matches '%s'. Try `!craft list` to see what you've discovered.", args))
 	}
-	if !known[recipe.ID] {
+	if !recipeCraftable(known, recipe) {
 		return p.SendDM(ctx.Sender,
 			"_Thom: \"Doesn't ring a bell. If you don't know the recipe, I don't either.\"_\n\nDiscover it via `!lore` first.")
 	}
@@ -427,12 +521,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 	items, _ := loadAdvInventory(userID)
 	have := inventoryByName(items)
 
-	knownCount := 0
+	shownCount := 0
 	for _, r := range thomCraftRecipes {
-		if !known[r.ID] {
+		// AlwaysKnown pity recipes only surface once the player actually holds
+		// one of the crafting anchor — no need to spoil T6 chase items to a
+		// level-3 player. Discovered recipes always show.
+		switch {
+		case known[r.ID]:
+		case r.AlwaysKnown && recipeHasAnyIngredient(have, r):
+		default:
 			continue
 		}
-		knownCount++
+		shownCount++
 		sb.WriteString(fmt.Sprintf("**%s**\n", r.Name))
 		var parts []string
 		ready := true
@@ -463,11 +563,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 		sb.WriteString("\n")
 	}
 
-	if knownCount == 0 {
+	if shownCount == 0 {
 		sb.WriteString("_You don't know any recipes yet. Try `!lore` at Thom Krooke's._\n\n")
 	}
 
-	hidden := len(thomCraftRecipes) - knownCount
+	// Only discoverable (non-AlwaysKnown) recipes count toward the !lore hint;
+	// pity recipes are never "discovered", so they'd make the count never zero.
+	hidden := 0
+	for _, r := range thomCraftRecipes {
+		if !r.AlwaysKnown && !known[r.ID] {
+			hidden++
+		}
+	}
 	if hidden > 0 {
 		sb.WriteString(fmt.Sprintf("_%d undiscovered recipe(s). Use `!lore` to dig._", hidden))
 	} else {
@@ -476,6 +583,18 @@ func renderRecipeBook(userID id.UserID, known map[string]bool) string {
 	return sb.String()
 }
 
+// recipeHasAnyIngredient reports whether the player holds at least one unit of
+// any of a recipe's named ingredients — the gate for surfacing an AlwaysKnown
+// pity recipe in the book.
+func recipeHasAnyIngredient(have map[string]int, r ThomCraftRecipe) bool {
+	for ing := range r.Ingredients {
+		if have[ing] > 0 {
+			return true
+		}
+	}
+	return false
+}
+
 // inventoryByName counts items grouped by name.
 func inventoryByName(items []AdvItem) map[string]int {
 	out := map[string]int{}
@@ -517,10 +636,11 @@ func (p *AdventurePlugin) executeCraft(userID id.UserID, r ThomCraftRecipe) erro
 	}
 
 	out := AdvItem{
-		Name:  r.OutputName,
-		Type:  r.OutputType,
-		Tier:  r.OutputTier,
-		Value: r.OutputValue,
+		Name:        r.OutputName,
+		Type:        r.OutputType,
+		Tier:        r.OutputTier,
+		Value:       r.OutputValue,
+		SkillSource: r.OutputSkillSource,
 	}
 	if err := addAdvInventoryItem(userID, out); err != nil {
 		return p.SendDM(userID, "Crafted item couldn't be deposited. Tell an admin.")
@@ -600,6 +720,11 @@ func (p *AdventurePlugin) handleLoreCmd(ctx MessageContext) error {
 
 	var undiscovered []ThomCraftRecipe
 	for _, r := range thomCraftRecipes {
+		// AlwaysKnown recipes are never in the discovery pool — they can't be
+		// "found" and shouldn't dilute the odds of finding the real ones.
+		if r.AlwaysKnown {
+			continue
+		}
 		if !known[r.ID] {
 			undiscovered = append(undiscovered, r)
 		}

internal/plugin/dnd_economy_test.go

@@ -18,6 +18,11 @@ func TestRecipeRegistry_IngredientsExistInResources(t *testing.T) {
 		}
 	}
 	for _, r := range thomCraftRecipes {
+		// AlwaysKnown pity recipes consume zone-loot crafting anchors, not
+		// gather-resource materials — validated separately below.
+		if r.AlwaysKnown {
+			continue
+		}
 		for ing := range r.Ingredients {
 			if !known[ing] {
 				t.Errorf("recipe %s references unknown ingredient %q", r.ID, ing)
@@ -26,12 +31,59 @@ func TestRecipeRegistry_IngredientsExistInResources(t *testing.T) {
 	}
 }
 
+// TestPityRecipes_AnchorsAndOutputsResolve — the T6 signature-item pity
+// recipes consume a zone-loot UniqueAlways crafting anchor and emit a real
+// registry magic item. Validate both ends: every ingredient name matches a
+// UniqueAlways zone-loot drop's inventory name, and every OutputSkillSource
+// points at a magicItemRegistry ID.
+func TestPityRecipes_AnchorsAndOutputsResolve(t *testing.T) {
+	anchorNames := map[string]bool{}
+	for _, z := range allZones() {
+		for _, e := range z.Loot {
+			if e.UniqueAlways {
+				anchorNames[titleCaseUnderscored(e.ItemID)] = true
+			}
+		}
+	}
+	pity := 0
+	for _, r := range thomCraftRecipes {
+		if !r.AlwaysKnown {
+			continue
+		}
+		pity++
+		for ing := range r.Ingredients {
+			if !anchorNames[ing] {
+				t.Errorf("pity recipe %s ingredient %q is not a zone-loot anchor name", r.ID, ing)
+			}
+		}
+		if r.OutputType != "magic_item" {
+			t.Errorf("pity recipe %s OutputType = %q, want magic_item", r.ID, r.OutputType)
+		}
+		id, ok := strings.CutPrefix(r.OutputSkillSource, "magic_item:")
+		if !ok {
+			t.Errorf("pity recipe %s OutputSkillSource %q missing magic_item: prefix", r.ID, r.OutputSkillSource)
+			continue
+		}
+		if _, ok := magicItemRegistry[id]; !ok {
+			t.Errorf("pity recipe %s output %q not in magicItemRegistry", r.ID, id)
+		}
+	}
+	if pity != 5 {
+		t.Errorf("expected 5 T6 pity recipes, found %d", pity)
+	}
+}
+
 // TestRecipeRegistry_OutputValuesMatchTier — outputs should land in §8.1
 // rarity brackets given their tier (rare 100–300, very rare 500–1200,
 // epic 500–1200 in §8.1 — recipes here lean tier 3–4, so 200..1200 is the
 // reasonable band).
 func TestRecipeRegistry_OutputValuesInBand(t *testing.T) {
 	for _, r := range thomCraftRecipes {
+		// Pity recipes emit Legendary magic items priced well above the §8.1
+		// crafting band by design — excluded from this invariant.
+		if r.AlwaysKnown {
+			continue
+		}
 		if r.OutputValue < 200 || r.OutputValue > 1200 {
 			t.Errorf("recipe %s output value %d outside band [200,1200] (tier %d)",
 				r.ID, r.OutputValue, r.OutputTier)

internal/plugin/dnd_expedition_cmd.go

@@ -1,9 +1,11 @@
 package plugin
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"math"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -31,6 +33,23 @@ import (
 // in E1e. !advance / !search / !rest / !extract are out-of-scope for E1.
 
 func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string) error {
+	args = strings.TrimSpace(args)
+	sub, rest := splitFirstWord(args)
+
+	// Two subcommands are aliases for top-level commands that take the per-user
+	// lock themselves. Dispatch them BEFORE we take it: advUserLock is a plain
+	// sync.Mutex, so grabbing it here and again in there does not merely block —
+	// it wedges the lock forever, because the deferred Unlock below never runs.
+	// Every later `!adventure` / `!expedition` / `!zone` command from that player
+	// then hangs too. Both aliases load their own character, so nothing below is
+	// being skipped.
+	switch strings.ToLower(sub) {
+	case "extract":
+		return p.handleExtractCmd(ctx, "")
+	case "resume":
+		return p.handleResumeCmd(ctx, rest)
+	}
+
 	userMu := p.advUserLock(ctx.Sender)
 	userMu.Lock()
 	defer userMu.Unlock()
@@ -44,8 +63,6 @@ func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string
 			"No Adv 2.0 character yet — run `!setup` (or just enter combat and we'll auto-build one).")
 	}
 
-	args = strings.TrimSpace(args)
-	sub, rest := splitFirstWord(args)
 	switch strings.ToLower(sub) {
 	case "":
 		// If active, show status; otherwise help. A party member is on an
@@ -99,10 +116,6 @@ func (p *AdventurePlugin) handleDnDExpeditionCmd(ctx MessageContext, args string
 		return p.expeditionCmdHire(ctx, rest)
 	case "dismiss":
 		return p.expeditionCmdDismiss(ctx)
-	case "extract":
-		return p.handleExtractCmd(ctx, "")
-	case "resume":
-		return p.handleResumeCmd(ctx, rest)
 	case "map", "m":
 		return p.handleExpeditionMapCmd(ctx, "")
 	case "run", "explore", "advance":
@@ -160,6 +173,23 @@ func (p *AdventurePlugin) expeditionCmdList(ctx MessageContext, c *DnDCharacter)
 			i+1, z.Display, int(z.Tier), z.LevelMin, z.LevelMax, z.ID, suffix))
 		b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
 	}
+	// Post-game zones under the "Beyond the Map" divider (see zoneCmdList).
+	if pg := postgameZones(); len(pg) > 0 {
+		unlocked, reason := postgameUnlocked(ctx.Sender, c.Level)
+		b.WriteString("\n— Beyond the Map —\n")
+		if !unlocked {
+			b.WriteString(fmt.Sprintf("_%s_\n", reason))
+		}
+		for j, z := range pg {
+			if unlocked {
+				b.WriteString(fmt.Sprintf("**%d.** %s — _T%d, L%d+_  `!expedition start %s`\n",
+					len(zones)+j+1, z.Display, int(z.Tier), z.LevelMin, z.ID))
+			} else {
+				b.WriteString(fmt.Sprintf("🔒 %s — _T%d, L%d+_\n", z.Display, int(z.Tier), z.LevelMin))
+			}
+			b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
+		}
+	}
 	if exp, isLeader, _ := activeExpeditionFor(ctx.Sender); exp != nil {
 		zone := zoneOrFallback(exp.ZoneID)
 		tail := "Use `!expedition status` or `!expedition abandon`."
@@ -295,9 +325,12 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	if strings.EqualFold(zoneTok, "epilogue") {
 		return p.handleEpilogueEncounter(ctx)
 	}
-	available := zonesForLevel(c.Level)
+	available := availableZonesFor(ctx.Sender, c.Level)
 	zoneID, ok := resolveZoneInput(zoneTok, available)
 	if !ok {
+		if reason := postgameLockReason(zoneTok, ctx.Sender, c.Level); reason != "" {
+			return p.SendDM(ctx.Sender, reason)
+		}
 		return p.SendDM(ctx.Sender,
 			"Unknown zone for your level. Try `!expedition list`.")
 	}
@@ -311,83 +344,14 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Couldn't parse supply packs: "+err.Error())
 	}
-	if err := purchase.Validate(zoneForCaps.Tier); err != nil {
-		return p.SendDM(ctx.Sender, "Invalid pack selection: "+err.Error())
-	}
-	// Reject if any expedition or zone run already active. This runs before the
-	// price quote: a player who cannot leave doesn't need to hear what leaving
-	// would have cost.
-	//
-	// The seat check spans `extracting` as well as `active` — a member of an
-	// extracting party is still seated for the seven-day resume window, and
-	// letting them outfit a rival expedition double-books them the moment their
-	// leader types `!resume`.
-	if seated, _ := seatedExpeditionFor(ctx.Sender); seated != nil {
-		zone, _ := getZone(seated.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You're riding a party expedition in **%s** (Day %d). `!expedition leave` before starting your own.",
-			zone.Display, seated.CurrentDay))
-	}
-	if existing, _ := getActiveExpedition(ctx.Sender); existing != nil {
-		zone, _ := getZone(existing.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You're already on expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
-			zone.Display, existing.CurrentDay))
-	}
-	// A leader who extracted still holds their roster for the resume window, and
-	// `!resume` only ever reaches the *newest* extracted row. Starting fresh on
-	// top of one would orphan it: unreachable, un-reapable until the sweeper
-	// catches it, with every member still seated and refused a run of their own.
-	//
-	// Only a row with a roster blocks. A solo extraction strands nobody, so
-	// walking away from it stays a normal thing to do.
-	if pending, _ := getResumableExpedition(ctx.Sender); pending != nil {
-		switch {
-		case extractionLapsed(pending, time.Now().UTC()):
-			// Past the window — reap it here rather than make them wait an hour
-			// for the sweeper, and let the new expedition proceed. Route through
-			// the shared reap so the freed members hear about it, same as the
-			// sweeper and `!expedition abandon` do.
-			if err := p.reapLapsedExtraction(pending); err != nil {
-				slog.Warn("expedition: reap lapsed on start", "expedition", pending.ID, "err", err)
-			}
-		default:
-			// A roster still holds; block. On a roster-read error, assume it is
-			// occupied and refuse — proceeding would orphan a party we could not
-			// confirm was empty, the one outcome this guard exists to prevent. A
-			// solo extraction (n == 1) strands nobody, so walking away is fine.
-			n, err := partySize(pending.ID)
-			if err != nil || n > 1 {
-				zone, _ := getZone(pending.ZoneID)
-				return p.SendDM(ctx.Sender, fmt.Sprintf(
-					"You extracted from **%s** on Day %d and your party is still waiting on you. `!resume` to lead them back in, or `!expedition abandon` to let it go — until you do one or the other, none of them can start a run of their own.",
-					zone.Display, pending.CurrentDay))
-			}
-		}
-	}
 
-	cost := float64(purchase.Cost())
-	if p.euro == nil {
-		return p.SendDM(ctx.Sender, "Coin system unavailable — try again later.")
-	}
-	if balance := p.euro.GetBalance(ctx.Sender); balance < cost {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
-			int(cost), balance))
-	}
-	if existing, _ := getActiveZoneRun(ctx.Sender); existing != nil {
-		zone, _ := getZone(existing.ZoneID)
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"You have an active single-session zone run in **%s**. Finish or `!zone abandon` before starting an expedition.",
-			zone.Display))
-	}
-
-	zone := zoneForCaps
-	_, supplies, startLine, err := p.beginExpedition(ctx.Sender, c.Level, zone, purchase, "expedition outfitting")
+	out, err := p.performExpeditionStart(ctx.Sender, c, zoneForCaps, purchase, "")
 	if err != nil {
+		// Every refusal below carries its own finished sentence — see the sentinel
+		// block on performExpeditionStart — so the command only has to say it.
 		return p.SendDM(ctx.Sender, err.Error())
 	}
-	markActedToday(ctx.Sender)
+	zone, supplies, startLine := out.Zone, out.Supplies, out.StartLine
 
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🗺 **Expedition begins — %s** _(T%d)_\n\n", zone.Display, int(zone.Tier)))
@@ -408,6 +372,182 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 	return p.SendDM(ctx.Sender, b.String())
 }
 
+// ── the headless twin of `!expedition start` ────────────────────────────────
+
+// Sentinels for the ways outfitting can be refused, so the web action queue
+// (pete_orders.go) can pick a verdict without parsing prose. Every refusal is
+// returned as an advRefusal, which wraps one of these AND carries the
+// finished player-facing sentence — that is how `!expedition start` keeps the
+// exact copy it always sent while the web gets a machine-readable answer.
+var (
+	errExpStartResting    = errors.New("expedition start: still resting")
+	errExpStartZoneLocked = errors.New("expedition start: zone not available at this level")
+	errExpStartBadPacks   = errors.New("expedition start: invalid pack selection")
+	errExpStartBusy       = errors.New("expedition start: already adventuring")
+	errExpStartBroke      = errors.New("expedition start: cannot cover outfitting")
+	errExpStartFailed     = errors.New("expedition start: could not outfit")
+)
+
+// advRefusal is a refusal that is both classifiable and quotable: errors.Is
+// picks the verdict, Error() is the sentence the command has always sent. Shared
+// by every headless twin in the web action family (start, resume, babysit).
+type advRefusal struct {
+	kind error
+	msg  string
+}
+
+func (e advRefusal) Error() string { return e.msg }
+func (e advRefusal) Unwrap() error { return e.kind }
+
+func refuseAdv(kind error, format string, args ...any) error {
+	return advRefusal{kind: kind, msg: fmt.Sprintf(format, args...)}
+}
+
+// expStartOutcome is what outfitting did, for a caller describing it somewhere
+// other than a DM.
+type expStartOutcome struct {
+	Zone      ZoneDefinition
+	Supplies  ExpeditionSupplies
+	Cost      int
+	Days      int
+	StartLine string
+}
+
+// performExpeditionStart is `!expedition start` minus the command framing: the
+// eligibility guards, the price gate, the debit, and the expedition row. It is
+// shared with the web action queue so that leaving town from a phone is the
+// *same* departure — same guards, same supplies, same opening log line.
+//
+// idemKey, when set, is the web order's guid: the debit then goes through
+// DebitIdem so a re-offered order that already paid cannot pay twice. The Matrix
+// command passes "" and keeps the plain debit, which is right — a Matrix message
+// arrives exactly once.
+//
+// LOCKING, and this is the one asymmetry in the headless-twin family: this
+// function does NOT take the per-user lock. performExtraction, takeSiegeBout and
+// performBabysitPurchase all take it themselves, because their command framings
+// do not hold it — but handleDnDExpeditionCmd holds it across its whole switch,
+// so taking it here would wedge advUserLock permanently (it is a plain
+// sync.Mutex, and the deferred unlock up there would never run). The web caller
+// takes it explicitly instead; see applyAdvOrder.
+func (p *AdventurePlugin) performExpeditionStart(uid id.UserID, c *DnDCharacter, zone ZoneDefinition, purchase SupplyPurchase, idemKey string) (expStartOutcome, error) {
+	if remaining := restingLockoutRemaining(c); remaining > 0 {
+		return expStartOutcome{}, refuseAdv(errExpStartResting,
+			"🛌 You're still resting — %s remaining. Pack up after.",
+			formatRespecDuration(remaining))
+	}
+	// Re-resolve availability against the game's own tables rather than trusting
+	// the caller. The web resolves a zone from an offer list gogobee itself
+	// pushed, but that snapshot can be minutes old and is not a permission.
+	if _, ok := resolveZoneInput(string(zone.ID), availableZonesFor(uid, c.Level)); !ok {
+		if reason := postgameLockReason(string(zone.ID), uid, c.Level); reason != "" {
+			return expStartOutcome{}, refuseAdv(errExpStartZoneLocked, "%s", reason)
+		}
+		return expStartOutcome{}, refuseAdv(errExpStartZoneLocked,
+			"Unknown zone for your level. Try `!expedition list`.")
+	}
+	if err := purchase.Validate(zone.Tier); err != nil {
+		return expStartOutcome{}, refuseAdv(errExpStartBadPacks,
+			"Invalid pack selection: %s", err.Error())
+	}
+	// Reject if any expedition or zone run already active. This runs before the
+	// price quote: a player who cannot leave doesn't need to hear what leaving
+	// would have cost.
+	//
+	// The seat check spans `extracting` as well as `active` — a member of an
+	// extracting party is still seated for the seven-day resume window, and
+	// letting them outfit a rival expedition double-books them the moment their
+	// leader types `!resume`.
+	if seated, _ := seatedExpeditionFor(uid); seated != nil {
+		z, _ := getZone(seated.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You're riding a party expedition in **%s** (Day %d). `!expedition leave` before starting your own.",
+			z.Display, seated.CurrentDay)
+	}
+	if existing, _ := getActiveExpedition(uid); existing != nil {
+		// A web order that already paid and already started this expedition on an
+		// earlier tick lands here on the re-offer. Saying "you're already on
+		// expedition" would be a rejection for the thing the order in fact did, so
+		// the settled debit is what tells the two apart.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) && existing.ZoneID == zone.ID {
+			z, _ := getZone(existing.ZoneID)
+			return expStartOutcome{Zone: z, Supplies: existing.Supplies,
+				Cost: purchase.Cost(),
+				Days: estimateDays(existing.Supplies.Max, existing.Supplies.DailyBurn)}, nil
+		}
+		z, _ := getZone(existing.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You're already on expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
+			z.Display, existing.CurrentDay)
+	}
+	// A leader who extracted still holds their roster for the resume window, and
+	// `!resume` only ever reaches the *newest* extracted row. Starting fresh on
+	// top of one would orphan it: unreachable, un-reapable until the sweeper
+	// catches it, with every member still seated and refused a run of their own.
+	//
+	// Only a row with a roster blocks. A solo extraction strands nobody, so
+	// walking away from it stays a normal thing to do.
+	if pending, _ := getResumableExpedition(uid); pending != nil {
+		switch {
+		case extractionLapsed(pending, time.Now().UTC()):
+			// Past the window — reap it here rather than make them wait an hour
+			// for the sweeper, and let the new expedition proceed. Route through
+			// the shared reap so the freed members hear about it, same as the
+			// sweeper and `!expedition abandon` do.
+			if err := p.reapLapsedExtraction(pending); err != nil {
+				slog.Warn("expedition: reap lapsed on start", "expedition", pending.ID, "err", err)
+			}
+		default:
+			// A roster still holds; block. On a roster-read error, assume it is
+			// occupied and refuse — proceeding would orphan a party we could not
+			// confirm was empty, the one outcome this guard exists to prevent. A
+			// solo extraction (n == 1) strands nobody, so walking away is fine.
+			n, err := partySize(pending.ID)
+			if err != nil || n > 1 {
+				z, _ := getZone(pending.ZoneID)
+				return expStartOutcome{}, refuseAdv(errExpStartBusy,
+					"You extracted from **%s** on Day %d and your party is still waiting on you. `!resume` to lead them back in, or `!expedition abandon` to let it go — until you do one or the other, none of them can start a run of their own.",
+					z.Display, pending.CurrentDay)
+			}
+		}
+	}
+
+	cost := float64(purchase.Cost())
+	if p.euro == nil {
+		return expStartOutcome{}, refuseAdv(errExpStartFailed, "Coin system unavailable — try again later.")
+	}
+	// Skip the affordability gate on a re-offer that already paid: the debit is a
+	// settled fact and re-reading the now-lower balance would bounce a departure
+	// the player has bought. Same reasoning as purchaseEquipmentTier's.
+	if !(idemKey != "" && p.euro.HasExternalTx(idemKey)) {
+		if balance := p.euro.GetBalance(uid); balance < cost {
+			return expStartOutcome{}, refuseAdv(errExpStartBroke,
+				"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
+				int(cost), balance)
+		}
+	}
+	if existing, _ := getActiveZoneRun(uid); existing != nil {
+		z, _ := getZone(existing.ZoneID)
+		return expStartOutcome{}, refuseAdv(errExpStartBusy,
+			"You have an active single-session zone run in **%s**. Finish or `!zone abandon` before starting an expedition.",
+			z.Display)
+	}
+
+	_, supplies, startLine, err := p.beginExpeditionIdem(uid, c.Level, zone, purchase, "expedition outfitting", idemKey)
+	if err != nil {
+		// beginExpedition refunds and tears down on every failure path, so the
+		// player owes nothing and this is permanent rather than retryable — a retry
+		// after a refund would find the guid-keyed debit already settled and hand
+		// them the expedition for free.
+		return expStartOutcome{}, refuseAdv(errExpStartFailed, "%s", err.Error())
+	}
+	markActedToday(uid)
+	return expStartOutcome{
+		Zone: zone, Supplies: supplies, Cost: purchase.Cost(),
+		Days: estimateDays(supplies.Max, supplies.DailyBurn), StartLine: startLine,
+	}, nil
+}
+
 // beginExpedition performs the non-interactive half of starting an expedition:
 // supply freebies, the coin debit, persistence, the starting region's run, and
 // the opening log entry. It refunds and tears down on every failure path, so a
@@ -421,10 +561,38 @@ func (p *AdventurePlugin) expeditionCmdStart(ctx MessageContext, c *DnDCharacter
 // It deliberately does NOT call markActedToday — an expedition the player did
 // not ask for must not spend their daily action or count as them showing up.
 func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone ZoneDefinition, purchase SupplyPurchase, reason string) (*Expedition, ExpeditionSupplies, string, error) {
+	return p.beginExpeditionIdem(uid, charLevel, zone, purchase, reason, "")
+}
+
+// beginExpeditionIdem is beginExpedition with the money keyed to an idempotency
+// id. idemKey empty keeps the plain Debit/Credit pair, which is correct for the
+// two callers that arrive exactly once (a Matrix command, the boredom ticker).
+//
+// A non-empty key comes from the web action queue, whose wire retries: the debit
+// then lands at most once however many times the order is re-offered, and the
+// refunds are keyed too so a torn-down start cannot refund on every tick. Note
+// what this means for the caller — once a refund has happened, retrying is
+// *unsafe*, because the guid-keyed debit will not charge again and the player
+// would get the expedition for free. performExpeditionStart therefore treats
+// every error from here as permanent.
+func (p *AdventurePlugin) beginExpeditionIdem(uid id.UserID, charLevel int, zone ZoneDefinition, purchase SupplyPurchase, reason, idemKey string) (*Expedition, ExpeditionSupplies, string, error) {
 	if p.euro == nil {
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Coin system unavailable — try again later.")
 	}
 	cost := float64(purchase.Cost())
+	debit := func(why string) bool { return p.euro.Debit(uid, cost, why) }
+	refund := func(why, suffix string) { p.euro.Credit(uid, cost, why) }
+	if idemKey != "" {
+		debit = func(why string) bool {
+			ok, _, err := p.euro.DebitIdem(uid, cost, why, idemKey)
+			return err == nil && ok
+		}
+		refund = func(why, suffix string) {
+			if _, _, err := p.euro.CreditIdem(uid, cost, why, idemKey+":refund"+suffix); err != nil {
+				slog.Error("expedition: outfitting refund failed", "user", uid, "order", idemKey, "err", err)
+			}
+		}
+	}
 
 	// Holiday perk: a complimentary standard pack is added to the supplies
 	// snapshot without inflating the coin cost. Bypasses the per-tier cap
@@ -439,14 +607,14 @@ func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone Zon
 	supplies := makeSupplies(zone.Tier, suppliesPurchase)
 
 	// Debit coins; bail on debit failure (race / cap).
-	if !p.euro.Debit(uid, cost, reason+": "+string(zone.ID)) {
+	if !debit(reason + ": " + string(zone.ID)) {
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't debit outfitting cost (try again).")
 	}
 
 	exp, err := startExpedition(uid, zone.ID, "", supplies)
 	if err != nil {
 		// Refund on persistence failure.
-		p.euro.Credit(uid, cost, "expedition outfitting refund")
+		refund("expedition outfitting refund", "")
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't start expedition: %s", err)
 	}
 
@@ -457,7 +625,7 @@ func (p *AdventurePlugin) beginExpedition(uid id.UserID, charLevel int, zone Zon
 		// Refund and tear the expedition row back down — without a
 		// linked run, harvest and rooms can't function.
 		_ = abandonExpedition(uid)
-		p.euro.Credit(uid, cost, "expedition outfitting refund (run-spawn failed)")
+		refund("expedition outfitting refund (run-spawn failed)", ":region")
 		return nil, ExpeditionSupplies{}, "", fmt.Errorf("Couldn't outfit the first region: %s", err)
 	}
 
@@ -676,65 +844,102 @@ func formatLogTimestamp(t time.Time) string {
 
 // ── abandon ─────────────────────────────────────────────────────────────────
 
-func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+// Sentinels for the two ways abandoning can be refused, so the web action queue
+// can pick a verdict without reading prose. Same contract as the start/resume
+// family above: errors.Is classifies, Error() is the sentence Matrix has always
+// sent.
+var (
+	errAbandonNothing   = errors.New("expedition abandon: nothing to abandon")
+	errAbandonNotLeader = errors.New("expedition abandon: only the leader may call it")
+)
+
+// abandonOutcome is what closing the expedition did, for a caller describing it
+// somewhere other than a DM.
+type abandonOutcome struct {
+	Zone      ZoneDefinition
+	Day       int
+	Extracted bool // it was already out and standing in town: loot and XP are kept
+}
+
+// performExpeditionAbandon is `!expedition abandon` minus the command framing.
+// Shared with the web action queue so closing a run from a phone disbands the
+// same roster, retires the same region runs, writes the same log line and tells
+// the same party — the members hear it from their leader either way, because
+// that is a fact about the expedition and not about which door was used.
+//
+// Like performExpeditionStart this does NOT take the per-user lock: its Matrix
+// caller already holds it across the whole `!expedition` switch. applyWebAbandon
+// takes it instead. Getting that backwards does not fail loudly — it wedges the
+// player's lock forever and every later adventure command from them hangs.
+func (p *AdventurePlugin) performExpeditionAbandon(uid id.UserID) (abandonOutcome, error) {
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return abandonOutcome{}, err
 	}
 	if exp == nil {
 		// An extracted expedition is still the owner's to close — it holds the
 		// roster until the resume window lapses. Without this, a leader who
 		// wanted out had to pay to `!resume` first just to abandon.
-		if exp, err = getResumableExpedition(ctx.Sender); err != nil {
-			return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		if exp, err = getResumableExpedition(uid); err != nil {
+			return abandonOutcome{}, err
 		}
 		isLeader = exp != nil
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition to abandon.")
+		return abandonOutcome{}, refuseAdv(errAbandonNothing, "No active expedition to abandon.")
 	}
 	if !isLeader {
 		// Abandoning throws away everyone's day. A member leaves alone.
-		return p.SendDM(ctx.Sender,
+		return abandonOutcome{}, refuseAdv(errAbandonNotLeader,
 			"Only your party leader can abandon the expedition. `!expedition leave` to walk out alone.")
 	}
 	zone, _ := getZone(exp.ZoneID)
-	extracted := exp.Status == ExpeditionStatusExtracting
+	out := abandonOutcome{Zone: zone, Day: exp.CurrentDay, Extracted: exp.Status == ExpeditionStatusExtracting}
 	audience := expeditionAudience(exp) // read before abandonExpedition disbands the roster
-	if err := abandonExpedition(ctx.Sender); err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't abandon: "+err.Error())
+	if err := abandonExpedition(uid); err != nil {
+		return abandonOutcome{}, err
 	}
-	markActedToday(ctx.Sender)
+	markActedToday(uid)
 	_ = retireAllRegionRuns(exp)
 	_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative", "expedition abandoned", "")
+	// The roster is being disbanded out from under the members; they hear it from
+	// their leader rather than discovering it the next time a command works again.
+	for _, member := range audience {
+		if member == uid {
+			continue
+		}
+		if err := p.SendDM(member, fmt.Sprintf(
+			"Your leader called off the expedition in **%s** on Day %d. You're free to start a run of your own.",
+			zone.Display, exp.CurrentDay)); err != nil {
+			slog.Warn("expedition: abandon DM failed", "user", member, "expedition", exp.ID, "err", err)
+		}
+	}
+	// Emergence seam: see maybeRollPetArrivalOnEmerge. Inside the twin because
+	// walking out of a dungeon is what rolls it, not saying so in a room.
+	p.maybeRollPetArrivalOnEmerge(uid)
+	return out, nil
+}
+
+func (p *AdventurePlugin) expeditionCmdAbandon(ctx MessageContext) error {
+	out, err := p.performExpeditionAbandon(ctx.Sender)
+	if err != nil {
+		var refusal advRefusal
+		if errors.As(err, &refusal) {
+			return p.SendDM(ctx.Sender, refusal.Error())
+		}
+		return p.SendDM(ctx.Sender, "Couldn't abandon: "+err.Error())
+	}
 	// An extracted party is standing in town, not in the dungeon: their supplies
 	// are already spent and their loot is already banked. Say the true thing.
 	body := fmt.Sprintf(
 		"Expedition in **%s** abandoned on Day %d. Supplies are forfeit. The dungeon remembers.",
-		zone.Display, exp.CurrentDay)
-	if extracted {
+		out.Zone.Display, out.Day)
+	if out.Extracted {
 		body = fmt.Sprintf(
 			"You let the expedition in **%s** go. Day %d is where it ends — loot, XP, and coins are kept. The dungeon remembers.",
-			zone.Display, exp.CurrentDay)
+			out.Zone.Display, out.Day)
 	}
-	// The roster is being disbanded out from under the members; they hear it from
-	// their leader rather than discovering it the next time a command works again.
-	for _, uid := range audience {
-		if uid == ctx.Sender {
-			continue
-		}
-		if err := p.SendDM(uid, fmt.Sprintf(
-			"Your leader called off the expedition in **%s** on Day %d. You're free to start a run of your own.",
-			zone.Display, exp.CurrentDay)); err != nil {
-			slog.Warn("expedition: abandon DM failed", "user", uid, "expedition", exp.ID, "err", err)
-		}
-	}
-	if err := p.SendDM(ctx.Sender, body); err != nil {
-		return err
-	}
-	// Emergence seam: see maybeRollPetArrivalOnEmerge.
-	p.maybeRollPetArrivalOnEmerge(ctx.Sender)
-	return nil
+	return p.SendDM(ctx.Sender, body)
 }
 
 // helper: ensure we don't shadow id.UserID import in test harness.
@@ -823,45 +1028,197 @@ func (p *AdventurePlugin) expeditionCmdRun(ctx MessageContext) error {
 // run graph / harvest tally / supplies / threat — same as before, just
 // no streamFlow here. compact==true switches the underlying combat
 // narration into terse mode and auto-resolves elite (not boss) rooms.
-// forkAutoPickTimeout — how long a background fork may sit unanswered
-// before the autopilot picks an available route itself. Short enough that
-// the expedition keeps moving rather than idling out to the 24h stale-run
-// reaper; long enough that a player away for the evening still gets first
-// say on a genuine fork.
-const forkAutoPickTimeout = 8 * time.Hour
+// forkAutoPickTimeout — how long a background fork may sit unanswered before
+// the autopilot picks a route itself.
+//
+// This was 8h, which reads as "the player gets first say" and behaves as "the
+// expedition stops for a third of a day, every fork." A multi-day expedition
+// crosses a lot of forks; at 8h apiece the autopilot spends more of its life
+// parked than walking, and a player who is simply asleep loses a night per
+// branch. 30m keeps a genuine first say for anyone actually at the keyboard and
+// costs an absent player almost nothing.
+const forkAutoPickTimeout = 30 * time.Minute
 
-// autoPickStaleFork commits the first unlocked option of a stale background
-// fork, advancing the run to that node exactly as `!zone go <n>` would
-// (advanceZoneRunNode + region-transition hook). Returns false — no pick —
-// when every option is locked, so the caller re-emits the prompt and the
-// run idles on toward the reaper. The choice is logged as a narrative entry
-// so the end-of-day digest can surface the decision the player missed.
-func (p *AdventurePlugin) autoPickStaleFork(exp *Expedition, run *DungeonRun, pf *pendingFork) bool {
-	var chosen *pendingChoice
-	for i := range pf.Options {
-		if pf.Options[i].Unlocked {
-			chosen = &pf.Options[i]
-			break
+// rankForkOptions orders a fork's options by how much walking them is worth:
+// somewhere new first, then the fatter edge (Weight is the author's own "this
+// is the main line" signal), then menu order as the tiebreak so the pick is
+// deterministic. Only unlocked options are returned.
+//
+// The old rule was "first unlocked option in the menu", which is edge-authoring
+// order — meaningful to whoever wrote the graph, arbitrary to the player. It
+// walked past unvisited branches to loop through cleared ones often enough to
+// look broken.
+func rankForkOptions(g ZoneGraph, run *DungeonRun, pf *pendingFork) []pendingChoice {
+	weights := map[string]int{}
+	for _, e := range g.outgoingEdges(run.CurrentNode) {
+		weights[e.To] = e.Weight
+	}
+	visited := map[string]bool{}
+	for _, n := range run.VisitedNodes {
+		visited[n] = true
+	}
+
+	open := make([]pendingChoice, 0, len(pf.Options))
+	for _, o := range pf.Options {
+		if o.Unlocked {
+			open = append(open, o)
 		}
 	}
-	if chosen == nil {
-		return false // nothing unlocked — leave it for the player / reaper
+	sort.SliceStable(open, func(i, j int) bool {
+		vi, vj := visited[open[i].To], visited[open[j].To]
+		if vi != vj {
+			return !vi // unvisited first
+		}
+		if wi, wj := weights[open[i].To], weights[open[j].To]; wi != wj {
+			return wi > wj
+		}
+		return open[i].Index < open[j].Index
+	})
+	return open
+}
+
+// autoPickStaleFork commits a stale background fork, advancing the run exactly
+// as `!zone go <n>` would (advanceZoneRunNode + region-transition hook). The
+// choice is logged as a narrative entry so the end-of-day digest can surface
+// the decision the player missed.
+//
+// When every route is locked it does not give up: it spends a set of thieves'
+// tools if the party is carrying any and one of the locks is the pickable kind.
+// Returns false only when there is genuinely nothing it can do — the caller
+// then backtracks rather than idling the expedition into the 24h reaper.
+func (p *AdventurePlugin) autoPickStaleFork(exp *Expedition, run *DungeonRun, pf *pendingFork) bool {
+	g, _ := loadZoneGraph(run.ZoneID)
+
+	ranked := rankForkOptions(g, run, pf)
+	note := "autopilot took the most promising path"
+	var spendTool int64
+	if len(ranked) == 0 {
+		picked, toolID, ok := p.autoPickWithTools(run, pf)
+		if !ok {
+			return false
+		}
+		ranked = []pendingChoice{picked}
+		spendTool = toolID
+		note = "autopilot spent " + thievesToolsName + " on the only way forward"
 	}
+	chosen := ranked[0]
+
 	if _, err := advanceZoneRunNode(run.RunID, chosen.To); err != nil {
 		slog.Warn("expedition: auto-pick stale fork",
 			"user", run.UserID, "run", run.RunID, "err", err)
 		return false
 	}
-	g, _ := loadZoneGraph(run.ZoneID)
+	// The door is behind us, so now the set is actually used up. Billing before
+	// the advance would charge the player for a move that failed — and the
+	// caller's backtrack would then clear the fork the tools just paid for.
+	if spendTool != 0 {
+		if err := removeAdvInventoryItem(spendTool); err != nil {
+			slog.Warn("expedition: autopilot tools spend", "user", run.UserID, "err", err)
+		}
+		beatLock(run, chosen.Label, "picked")
+	}
 	fireGraphRegionTransition(run.UserID, g.Nodes[run.CurrentNode], g.Nodes[chosen.To])
 	if exp != nil {
 		_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
-			fmt.Sprintf("autopilot took an available path after %dh idle at the fork: %s",
-				int(forkAutoPickTimeout.Hours()), chosen.Label), "")
+			fmt.Sprintf("%s: %s", note, chosen.Label), "")
 	}
 	return true
 }
 
+// autoPickWithTools finds a route a set of thieves' tools could open when every
+// option on the fork is locked, so a bad Perception roll can't quietly end an
+// expedition the player paid days into. It only ever fires when there is no free
+// route left — the player's tools are their own, and the autopilot does not get
+// to burn them for convenience.
+//
+// It reports the route and the inventory row to spend, but does not spend it:
+// the caller charges the player only once the move has actually committed.
+func (p *AdventurePlugin) autoPickWithTools(run *DungeonRun, pf *pendingFork) (pendingChoice, int64, bool) {
+	toolID, ok := findThievesTools(id.UserID(run.UserID))
+	if !ok {
+		return pendingChoice{}, 0, false
+	}
+	for i := range pf.Options {
+		if pf.Options[i].Unlocked || !pickableLock(pf.Options[i].Lock) {
+			continue
+		}
+		// Local copy only — advanceZoneRunNode clears node_choices on success,
+		// and on failure the fork must stay as locked as the player left it
+		// rather than reading "open" for a set nobody paid for.
+		chosen := pf.Options[i]
+		chosen.Unlocked = true
+		chosen.Reason = "opened with " + thievesToolsName
+		return chosen, toolID, true
+	}
+	return pendingChoice{}, 0, false
+}
+
+// backtrackFromDeadFork walks the run back one room when a fork has no route
+// the autopilot can take and no tools to buy one with. Without this the run
+// simply sits there until the 24h stale reaper ends the expedition — a player
+// losing days of progress to a die roll they never saw and could not answer.
+// Backtracking at least returns them to a room with other exits.
+//
+// Returns false at the entry node, where there is nowhere behind to go, and
+// wherever no fallback room would actually help — see backtrackTarget.
+func (p *AdventurePlugin) backtrackFromDeadFork(exp *Expedition, run *DungeonRun) bool {
+	g, ok := loadZoneGraph(run.ZoneID)
+	if !ok {
+		return false
+	}
+	target, ok := backtrackTarget(g, run)
+	if !ok {
+		return false
+	}
+
+	// Clear the fork first: it belongs to the node being left, and both
+	// `!zone advance` and `!zone go` would otherwise resolve a prompt pointing
+	// at a room the party is no longer standing in.
+	if err := clearPendingFork(run.RunID); err != nil {
+		slog.Warn("expedition: backtrack clear fork", "run", run.RunID, "err", err)
+		return false
+	}
+	beatLock(run, "", "sealed")
+	if _, err := revisitZoneRun(run.RunID, target, run.VisitedNodes); err != nil {
+		slog.Warn("expedition: backtrack from dead fork", "run", run.RunID, "err", err)
+		return false
+	}
+	if exp != nil {
+		_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
+			"every way on was sealed — the party doubled back", "")
+	}
+	return true
+}
+
+// backtrackTarget picks the room a dead fork falls back to: the most recently
+// entered visited node that is genuinely joined to the current one by an edge
+// and that still offers a way on other than the sealed room.
+//
+// Both halves are load-bearing. VisitedNodes is a first-entry ordered *set*, not
+// a path stack (see appendVisited) — after any earlier backtrack the entry
+// before CurrentNode can sit on a completely different branch, so stepping to it
+// blind teleports the party across the map. `!revisit` refuses exactly that move
+// via adjacentNodes, and the autopilot has no business doing what the player is
+// forbidden from doing. The second half stops the other failure: falling back
+// into a corridor whose only exit is the fork we just fled from just walks
+// straight back in — and the lock rolls are seeded per (run, edge), so the
+// result is identical every time. That is an infinite loop, not a recovery.
+func backtrackTarget(g ZoneGraph, run *DungeonRun) (string, bool) {
+	adj := adjacentNodes(g, run.CurrentNode)
+	for i := pathIndexOf(run.VisitedNodes, run.CurrentNode) - 1; i >= 0; i-- {
+		n := run.VisitedNodes[i]
+		if !adj[n] {
+			continue
+		}
+		for _, e := range g.outgoingEdges(n) {
+			if e.To != run.CurrentNode {
+				return n, true
+			}
+		}
+	}
+	return "", false
+}
+
 func (p *AdventurePlugin) runAutopilotWalk(ctx MessageContext, maxRooms int, compact, inlineBossCombat bool) autopilotWalkResult {
 	exp, err := getActiveExpedition(ctx.Sender)
 	if err != nil {
@@ -883,9 +1240,19 @@ func (p *AdventurePlugin) runAutopilotWalk(ctx MessageContext, maxRooms int, com
 	// (unlocked) route and keep walking instead of stalling out.
 	if run, rerr := getActiveZoneRun(ctx.Sender); rerr == nil && run != nil {
 		if pf, derr := decodePendingFork(run.NodeChoices); derr == nil && pf != nil {
-			picked := compact &&
-				time.Since(run.LastActionAt) > forkAutoPickTimeout &&
-				p.autoPickStaleFork(exp, run, pf)
+			stale := compact && time.Since(run.LastActionAt) > forkAutoPickTimeout
+			picked := stale && p.autoPickStaleFork(exp, run, pf)
+			// Stale and nothing takeable: every route locked, no tools. Back out
+			// one room rather than sitting here until the 24h reaper ends an
+			// expedition the player may be days into. The backtrack clears the
+			// fork, so the next tick walks from the previous room normally.
+			if stale && !picked && p.backtrackFromDeadFork(exp, run) {
+				return autopilotWalkResult{
+					finalMsg: "🔒 Every way on was sealed. The party doubled back to look for another line.",
+					rooms:    0,
+					reason:   stopFork,
+				}
+			}
 			if !picked {
 				zone := zoneOrFallback(run.ZoneID)
 				return autopilotWalkResult{

internal/plugin/dnd_expedition_combat.go

@@ -23,7 +23,6 @@ package plugin
 import (
 	"encoding/json"
 	"fmt"
-	"math/rand/v2"
 	"strings"
 
 	"gogobee/internal/flavor"
@@ -75,7 +74,7 @@ func resolveCombatInterrupt(
 	rollFn func() int,
 ) (CombatInterruptKind, int) {
 	if rollFn == nil {
-		rollFn = func() int { return rand.IntN(20) + 1 }
+		rollFn = func() int { return simIntN(20) + 1 }
 	}
 	r := rollFn()
 	mod := tier
@@ -249,7 +248,7 @@ func surpriseRoundNickF(m DnDMonsterTemplate, tier, floorOverride int) int {
 	if tier < 1 {
 		tier = 1
 	}
-	dmg := 1 + rand.IntN(4) + m.AttackBonus/2
+	dmg := 1 + simIntN(4) + m.AttackBonus/2
 	floor := tier
 	if floorOverride >= 0 {
 		floor = floorOverride
@@ -484,7 +483,7 @@ func (p *AdventurePlugin) tryPatrolEncounter(
 		return
 	}
 	chance := rollPatrolChance(exp.ThreatLevel)
-	if chance <= 0 || rand.Float64() > chance {
+	if chance <= 0 || simFloat64() > chance {
 		return
 	}
 	monster, ok := pickZoneEnemy(zone, run.RunID, run.CurrentRoom, false)

internal/plugin/dnd_expedition_extract.go

@@ -352,32 +352,54 @@ func resumeExpedition(expID string, supplies ExpeditionSupplies) error {
 
 // ── !extract command ────────────────────────────────────────────────────────
 
-func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the two ways an extraction can be refused. They exist so the
+// headless caller (the web action queue, pete_orders.go) can turn a refusal into
+// its own verdict without parsing a DM. `!extract` maps them straight back to the
+// prose it always sent.
+var (
+	errExtractNoRun     = errors.New("extract: no active expedition")
+	errExtractNotLeader = errors.New("extract: not the party leader")
+)
+
+// extractOutcome is what an extraction did, for a caller that has to describe it
+// somewhere other than a DM.
+type extractOutcome struct {
+	Zone string // display name
+	Day  int
+}
+
+// performExtraction is the whole of `!extract` minus the command framing: the
+// per-user lock, the leader check, the state flip, the log line, the party
+// fan-out and the emergence pet roll. It is shared with the web action queue so
+// that pulling out from a phone is the *same* extraction, not a second
+// implementation of one — the party still gets DM'd, the log still gets its
+// line, and the resume window is the same window.
+func (p *AdventurePlugin) performExtraction(uid id.UserID) (extractOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()
 
-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return extractOutcome{}, fmt.Errorf("reading expedition state: %w", err)
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition to extract from.")
+		return extractOutcome{}, errExtractNoRun
 	}
 	if !isLeader {
 		// Extraction ends the expedition for the whole roster, so it is the
 		// leader's call — the same reasoning that makes `!flee` leader-only.
-		return p.SendDM(ctx.Sender, "Only your party leader can call the extraction. Ask them to `!extract`, or `!expedition leave` to walk out alone.")
+		return extractOutcome{}, errExtractNotLeader
 	}
 	zone, _ := getZone(exp.ZoneID)
-	updated, err := voluntaryExtractExpedition(ctx.Sender)
+	updated, err := voluntaryExtractExpedition(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't extract: "+err.Error())
+		return extractOutcome{}, err
 	}
 	line := flavor.Pick(flavor.ExtractionVoluntary)
 	_ = appendExpeditionLog(updated.ID, updated.CurrentDay, "narrative",
 		"voluntary extraction", line)
-	markActedToday(ctx.Sender)
+	markActedToday(uid)
 
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🚪 **Extraction — %s, Day %d**\n\n",
@@ -401,84 +423,167 @@ func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {
 
 	// Emergence seam: surfacing from a run is when an animal may have moved
 	// into the empty house. Every member surfaced, so every member rolls.
-	for _, uid := range expeditionAudience(updated) {
-		p.maybeRollPetArrivalOnEmerge(uid)
+	for _, member := range expeditionAudience(updated) {
+		p.maybeRollPetArrivalOnEmerge(member)
+	}
+	return extractOutcome{Zone: zone.Display, Day: updated.CurrentDay}, nil
+}
+
+// handleExtractCmd is `!extract`: the command framing around performExtraction.
+// The extraction itself, including the DM everyone in the party gets, happens in
+// there — so this only has to turn a refusal back into the prose it always sent.
+func (p *AdventurePlugin) handleExtractCmd(ctx MessageContext, _ string) error {
+	_, err := p.performExtraction(ctx.Sender)
+	switch {
+	case errors.Is(err, errExtractNoRun):
+		return p.SendDM(ctx.Sender, "No active expedition to extract from.")
+	case errors.Is(err, errExtractNotLeader):
+		return p.SendDM(ctx.Sender, "Only your party leader can call the extraction. Ask them to `!extract`, or `!expedition leave` to walk out alone.")
+	case err != nil:
+		return p.SendDM(ctx.Sender, "Couldn't extract: "+err.Error())
 	}
 	return nil
 }
 
 // ── !resume command ─────────────────────────────────────────────────────────
 
-func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error {
-	userMu := p.advUserLock(ctx.Sender)
+// Sentinels for the ways going back in can be refused. Same contract as
+// performExpeditionStart's: each one comes back inside an advRefusal that also
+// carries the finished sentence, so `!resume` keeps its copy verbatim.
+//
+// errResumeNeedLoadout is the odd one out and deliberately so: it is not a
+// refusal at all but the loadout prompt, returned as one so the whole decision
+// stays inside the lock. The web never triggers it — it always names a loadout.
+var (
+	errResumeNeedLoadout = errors.New("resume: no loadout named")
+	errResumeBusy        = errors.New("resume: already on an expedition")
+	errResumeNothing     = errors.New("resume: no extracted expedition")
+	errResumeLapsed      = errors.New("resume: past the 7-day window")
+	errResumeBadPacks    = errors.New("resume: invalid pack selection")
+	errResumeBroke       = errors.New("resume: cannot cover outfitting")
+	errResumeFailed      = errors.New("resume: could not resume")
+)
+
+// resumeOutcome is what going back in did, for a caller describing it somewhere
+// other than a DM.
+type resumeOutcome struct {
+	Zone     ZoneDefinition
+	Day      int
+	Supplies ExpeditionSupplies
+	Purchase SupplyPurchase
+	Threat   int
+	Stack    int
+	Line     string
+}
+
+// performResume is `!resume` minus the command framing: the leader check, the
+// lapse check, the re-outfitting purchase and the fresh region run. Shared with
+// the web action queue so that walking back in from a phone is the same walk.
+//
+// loadoutTok is the raw `Ns Md` / preset token; empty asks for the prompt.
+// idemKey, when set, is the web order's guid and moves the money onto the
+// idempotent variants — see beginExpeditionIdem for why a refund then makes a
+// retry unsafe, which is why every error here is permanent for the web caller.
+func (p *AdventurePlugin) performResume(uid id.UserID, loadoutTok, idemKey string) (resumeOutcome, error) {
+	userMu := p.advUserLock(uid)
 	userMu.Lock()
 	defer userMu.Unlock()
 
-	c, err := LoadDnDCharacter(ctx.Sender)
+	c, err := LoadDnDCharacter(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't load your character: "+err.Error())
+		return resumeOutcome{}, fmt.Errorf("Couldn't load your character: %s", err)
 	}
 	if c == nil || c.PendingSetup {
-		return p.SendDM(ctx.Sender, "No Adv 2.0 character yet — run `!setup` first.")
+		return resumeOutcome{}, refuseAdv(errResumeNothing, "No Adv 2.0 character yet — run `!setup` first.")
 	}
 
-	if existing, isLeader, _ := activeExpeditionFor(ctx.Sender); existing != nil {
+	if existing, isLeader, _ := activeExpeditionFor(uid); existing != nil {
 		zone, _ := getZone(existing.ZoneID)
 		if !isLeader {
-			return p.SendDM(ctx.Sender, fmt.Sprintf(
+			return resumeOutcome{}, refuseAdv(errResumeBusy,
 				"You're riding a party expedition in **%s** (Day %d). Only its leader can `!resume`.",
-				zone.Display, existing.CurrentDay))
+				zone.Display, existing.CurrentDay)
 		}
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
+		// A web order that already paid and already resumed lands here on the
+		// re-offer; the settled debit is what tells that apart from a player who
+		// really is already out. Same tell as performExpeditionStart's.
+		if idemKey != "" && p.euro != nil && p.euro.HasExternalTx(idemKey) {
+			out := resumeOutcome{Zone: zone, Day: existing.CurrentDay,
+				Supplies: existing.Supplies, Threat: existing.ThreatLevel}
+			// Re-price the same loadout at the same tier so the verdict this feeds
+			// can still say what it cost. Leaving Purchase zero would file a
+			// "re-outfitted for 0 coins" receipt for a trip that was paid for.
+			if pp, perr := resolveLoadoutOrParse(strings.TrimSpace(loadoutTok), zone.Tier); perr == nil {
+				out.Purchase = pp
+			}
+			return out, nil
+		}
+		return resumeOutcome{}, refuseAdv(errResumeBusy,
 			"You already have an active expedition in **%s** (Day %d). Finish it or `!expedition abandon` first.",
-			zone.Display, existing.CurrentDay))
+			zone.Display, existing.CurrentDay)
 	}
 
-	exp, err := getResumableExpedition(ctx.Sender)
+	exp, err := getResumableExpedition(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return resumeOutcome{}, fmt.Errorf("Couldn't read expedition state: %s", err)
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No extracted expedition to resume. Use `!expedition start <zone>` to begin a new one.")
+		return resumeOutcome{}, refuseAdv(errResumeNothing,
+			"No extracted expedition to resume. Use `!expedition start <zone>` to begin a new one.")
 	}
 	if extractionLapsed(exp, time.Now().UTC()) {
 		// Expire it so it doesn't keep resurfacing. The hourly sweeper would get
 		// here on its own; this keeps the refusal and the reap in one breath.
 		_ = completeExpedition(exp.ID, ExpeditionStatusFailed)
-		return p.SendDM(ctx.Sender,
+		return resumeOutcome{}, refuseAdv(errResumeLapsed,
 			"That extraction is past its 7-day resume window — the dungeon has reshaped without you. Start a new expedition.")
 	}
 
-	resumeZone, _ := getZone(exp.ZoneID)
+	zone, _ := getZone(exp.ZoneID)
 	// D5-b: prompt for a preset loadout on empty args.
-	if strings.TrimSpace(args) == "" {
-		return p.SendDM(ctx.Sender, renderLoadoutPrompt(resumeZone, "resume"))
+	if strings.TrimSpace(loadoutTok) == "" {
+		return resumeOutcome{}, refuseAdv(errResumeNeedLoadout, "%s", renderLoadoutPrompt(zone, "resume"))
 	}
-	purchase, err := resolveLoadoutOrParse(strings.TrimSpace(args), resumeZone.Tier)
+	purchase, err := resolveLoadoutOrParse(strings.TrimSpace(loadoutTok), zone.Tier)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't parse supply packs: "+err.Error())
+		return resumeOutcome{}, refuseAdv(errResumeBadPacks, "Couldn't parse supply packs: %s", err.Error())
 	}
-	if err := purchase.Validate(resumeZone.Tier); err != nil {
-		return p.SendDM(ctx.Sender, "Invalid pack selection: "+err.Error())
+	if err := purchase.Validate(zone.Tier); err != nil {
+		return resumeOutcome{}, refuseAdv(errResumeBadPacks, "Invalid pack selection: %s", err.Error())
 	}
 	cost := float64(purchase.Cost())
 	if p.euro == nil {
-		return p.SendDM(ctx.Sender, "Coin system unavailable — try again later.")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Coin system unavailable — try again later.")
 	}
-	if balance := p.euro.GetBalance(ctx.Sender); balance < cost {
-		return p.SendDM(ctx.Sender, fmt.Sprintf(
-			"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
-			int(cost), balance))
+	paid := idemKey != "" && p.euro.HasExternalTx(idemKey)
+	if !paid {
+		if balance := p.euro.GetBalance(uid); balance < cost {
+			return resumeOutcome{}, refuseAdv(errResumeBroke,
+				"Not enough coins. Outfitting costs **%d** but you have **%.0f**.",
+				int(cost), balance)
+		}
 	}
-	if !p.euro.Debit(ctx.Sender, cost, "expedition resume outfitting: "+string(exp.ZoneID)) {
-		return p.SendDM(ctx.Sender, "Couldn't debit outfitting cost (try again).")
+	debit := func(why string) bool { return p.euro.Debit(uid, cost, why) }
+	refund := func(why, suffix string) { p.euro.Credit(uid, cost, why) }
+	if idemKey != "" {
+		debit = func(why string) bool {
+			ok, _, err := p.euro.DebitIdem(uid, cost, why, idemKey)
+			return err == nil && ok
+		}
+		refund = func(why, suffix string) {
+			if _, _, err := p.euro.CreditIdem(uid, cost, why, idemKey+":refund"+suffix); err != nil {
+				slog.Error("expedition: resume refund failed", "user", uid, "order", idemKey, "err", err)
+			}
+		}
+	}
+	if !debit("expedition resume outfitting: " + string(exp.ZoneID)) {
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't debit outfitting cost (try again).")
 	}
 
-	zone, _ := getZone(exp.ZoneID)
 	supplies := makeSupplies(zone.Tier, purchase)
 	if err := resumeExpedition(exp.ID, supplies); err != nil {
-		p.euro.Credit(ctx.Sender, cost, "expedition resume refund")
-		return p.SendDM(ctx.Sender, "Couldn't resume: "+err.Error())
+		refund("expedition resume refund", "")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't resume: %s", err.Error())
 	}
 	exp.Status = ExpeditionStatusActive
 	exp.Supplies = supplies
@@ -489,25 +594,40 @@ func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error
 	exp.RegionState[regionStateRegionRuns] = map[string]string{}
 	_ = persistRegionState(exp)
 	if _, err := ensureRegionRun(exp, c.Level); err != nil {
-		p.euro.Credit(ctx.Sender, cost, "expedition resume refund (run-spawn failed)")
-		return p.SendDM(ctx.Sender, "Couldn't outfit the resumed region: "+err.Error())
+		refund("expedition resume refund (run-spawn failed)", ":region")
+		return resumeOutcome{}, refuseAdv(errResumeFailed, "Couldn't outfit the resumed region: %s", err.Error())
 	}
 	line := flavor.Pick(flavor.ExpeditionResume)
 	_ = appendExpeditionLog(exp.ID, exp.CurrentDay, "narrative",
 		"expedition resumed", line)
 
+	return resumeOutcome{
+		Zone: zone, Day: exp.CurrentDay, Supplies: supplies, Purchase: purchase,
+		Threat: exp.ThreatLevel, Stack: exp.TemporalStack, Line: line,
+	}, nil
+}
+
+// handleResumeCmd is `!resume`: the command framing around performResume.
+func (p *AdventurePlugin) handleResumeCmd(ctx MessageContext, args string) error {
+	out, err := p.performResume(ctx.Sender, args, "")
+	if err != nil {
+		// Every refusal — and the loadout prompt, which travels as one — arrives
+		// as a finished sentence, so this only has to say it.
+		return p.SendDM(ctx.Sender, err.Error())
+	}
+
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("🚪 **Expedition resumed — %s, Day %d**\n\n",
-		zone.Display, exp.CurrentDay))
-	if line != "" {
-		b.WriteString(line)
+		out.Zone.Display, out.Day))
+	if out.Line != "" {
+		b.WriteString(out.Line)
 		b.WriteString("\n\n")
 	}
 	b.WriteString(fmt.Sprintf("**Re-outfitted:** %.0f SU (%d standard, %d deluxe) — %d coins\n",
-		supplies.Max, purchase.StandardPacks, purchase.DeluxePacks, purchase.Cost()))
-	b.WriteString(fmt.Sprintf("**Threat:** %d / 100 (resumed at extraction value)\n", exp.ThreatLevel))
-	if exp.TemporalStack != 0 {
-		b.WriteString(fmt.Sprintf("**Zone stack:** %d (resumed)\n", exp.TemporalStack))
+		out.Supplies.Max, out.Purchase.StandardPacks, out.Purchase.DeluxePacks, out.Purchase.Cost()))
+	b.WriteString(fmt.Sprintf("**Threat:** %d / 100 (resumed at extraction value)\n", out.Threat))
+	if out.Stack != 0 {
+		b.WriteString(fmt.Sprintf("**Zone stack:** %d (resumed)\n", out.Stack))
 	}
 	b.WriteString("\nUse `!expedition status` for the daily briefing.")
 	return p.SendDM(ctx.Sender, b.String())

internal/plugin/dnd_expedition_extract_test.go

@@ -175,3 +175,28 @@ func TestResume_WindowExpired(t *testing.T) {
 			time.Since(*got.CompletedAt), extractResumeWindow)
 	}
 }
+
+// `!expedition extract` and `!expedition resume` are aliases for two top-level
+// commands that take the per-user lock themselves. If the alias dispatcher takes
+// that lock first the handler blocks on it forever and, because the deferred
+// unlock never runs, every later adventure command from that player wedges too.
+// This does not fail on regression — it hangs — so the timeout is the assertion.
+func TestExpeditionAliasesDoNotWedgeTheUserLock(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@exp-alias-lock:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+
+	for _, sub := range []string{"extract", "resume"} {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			p := &AdventurePlugin{euro: &EuroPlugin{}}
+			_ = p.handleDnDExpeditionCmd(MessageContext{Sender: uid}, sub)
+		}()
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("!expedition %s never returned: the alias re-took advUserLock", sub)
+		}
+	}
+}

internal/plugin/dnd_expedition_region_cmd.go

@@ -170,6 +170,13 @@ func (p *AdventurePlugin) advanceToNextRegion(userID id.UserID, exp *Expedition,
 	tc := resolveTransitWanderingCheck(exp, charClass, nil)
 	_ = processTransitWanderingCheck(exp, tc)
 
+	// The liveblog beat goes on the *outgoing* run, and it has to be filed before
+	// the run is retired — a region crossing is the last thing that happens in
+	// the region being left, and it is what explains why that run's log stops.
+	if outgoing, _ := getZoneRun(exp.RunID); outgoing != nil {
+		beatRegion(outgoing, cur.Name, next.Name)
+	}
+
 	// R2 — retire the outgoing region's DungeonRun before mutating
 	// CurrentRegion so retireRegionRun keys the right region.
 	if err := retireRegionRun(exp, cur.ID); err != nil {

internal/plugin/dnd_passives.go

@@ -112,6 +112,56 @@ func applyRacePassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharacte
 //     AutoCritFirst is already a one-shot bool.
 //   - A Cleric carrying a healing potion stacks: passive 5 + potion 8 = 13.
 //     The passive heal triggers first since both use the same threshold.
+// cantripDice is the 5e at-will cantrip die progression (Fire Bolt / Eldritch
+// Blast): 1 die L1–4, 2 at L5, 3 at L11, 4 at L17. Drives the per-round arcane
+// blaster damage (CantripPerRound) that models a caster's sustained at-will
+// floor — see CombatModifiers.CantripPerRound.
+func cantripDice(level int) int {
+	switch {
+	case level >= 17:
+		return 4
+	case level >= 11:
+		return 3
+	case level >= 5:
+		return 2
+	default:
+		return 1
+	}
+}
+
+// casterBlasterFloor gives the arcane blasters (Mage/Sorcerer/Warlock) their
+// shared sustained-DPS floor at T5. Two knobs, both LEVEL-SCALED so the L20
+// floor lift stays negligible at low tiers — a flat +40 HP doubled a L1 mage
+// and facerolled T5, which the class-balance guardrail (dnd_class_balance_test)
+// correctly rejected.
+//
+//   - Cantrip: kill-speed is the T5 currency (fights are truncation-bound), so
+//     the primary lever is damage. Multiplicative form — the spell modifier
+//     (INT for Mage, CHA for Sorcerer/Warlock) rides EVERY die, matching 5e
+//     Agonizing Blast. cantripDice scales 1→4 across levels.
+//   - Survival: just enough Defense (scaled by level) that the caster lives long
+//     enough for the cantrip to connect the kill — NOT a tank rider. This adds
+//     Defense only (no HP add); calcDamage's diminishing returns keep the L20
+//     +20 Def from becoming a wall.
+//
+// casterCantripBase / casterDefPerLevel are the caster tuning dials; see the
+// rebaseline plan for the sweep that set them. The cantrip floor only becomes a
+// live lever once combat_cmd.go bridges CantripPerRound into the turn engine
+// (the swing engine, combat_engine.go:590, is not the auto-resolve path). Mage
+// and Sorcerer take casterCantripBase; Warlock passes 0 — its bare-dice cantrip
+// plus its structural edge already lands it mid-band, so an added floor would
+// overshoot the 45 ceiling.
+const (
+	casterCantripBase = 3 // per-die base before the ability modifier rides in
+	casterDefPerLevel = 1 // ~+20 Def at L20, +1 at L1
+)
+
+func casterBlasterFloor(stats *CombatStats, mods *CombatModifiers, level, abilityMod, base int, cantrip string) {
+	mods.CantripPerRound = cantripDice(level) * (base + clampNonNeg(abilityMod))
+	mods.CantripDesc = cantrip
+	stats.Defense += casterDefPerLevel * level
+}
+
 func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharacter) {
 	switch c.Class {
 	case ClassFighter:
@@ -127,18 +177,23 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// re-tune in a follow-up if their win curves drift after this.
 		switch {
 		case c.Level >= 20:
-			mods.ExtraAttacks += 3
+			mods.ExtraAttacks += 2 // rebaseline: ceiling nerf — 3 swings at L20, was 4 (the engine-ceiling faceroll)
 		case c.Level >= 11:
 			mods.ExtraAttacks += 2
 		case c.Level >= 5:
 			mods.ExtraAttacks += 1
 		}
+		stats.AttackBonus -= 2 // rebaseline: sub-swing to-hit trim — 3 swings lands the Fighter in the ~60 band
 	case ClassRogue:
 		mods.AutoCritFirst = true
+		if c.Level >= 5 { // rebaseline: 2nd swing (was 1) fixes the 1-swing action-economy floor at T5
+			mods.ExtraAttacks += 1
+		}
+		stats.AttackBonus -= 3 // rebaseline: to-hit trim so the 2nd swing lands the Rogue in band, not the +75pp nuke
 		// Phase 2 class-balance: rogue's once-per-fight auto-crit goes stale
 		// at high tiers (T5 mean trails leaders by ~10pp pre-tune). Add a
 		// modest steady-DPS rider so post-opener rounds aren't pure attrition.
-		mods.DamageBonus += 0.05
+		mods.DamageBonus += -0.10 // rebaseline: fine-trim the 2-swing Rogue down into the ~60 band
 		// Class-identity audit (2026-05-16) — actual Sneak Attack as Nd6
 		// per hit, scaling with level per 5e (1d6 L1-2 ... 10d6 L19-20).
 		// AutoCritFirst + DamageBonus alone left the rogue's defining
@@ -154,6 +209,8 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		mods.SneakAttackDie += sneakDice
 	case ClassMage:
 		stats.AttackBonus++
+		// At-will Fire Bolt + level-scaled survival — the sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.INT), casterCantripBase, "Fire Bolt")
 		// Phase 2 class-balance: +1 attack alone left Mage mid-pack on damage
 		// per round. A modest damage rider lifts weapon hits (DamageBonus does
 		// not multiply queued SpellPreDamage — that path is its own field).
@@ -190,10 +247,19 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 			mods.ExtraAttacks += 1
 		}
 	case ClassDruid:
-		// Wild Resilience — multiplicative, so it stacks cleanly with the
-		// subclass DamageReduct riders. DamageReduct is initialized to 1.0
-		// by DerivePlayerStats before passives run.
+		// Multiplicative, so it stacks cleanly with the subclass DamageReduct
+		// riders (DamageReduct is initialized to 1.0 by DerivePlayerStats before
+		// passives run). NOTE the player-defender direction: DamageReduct feeds
+		// calcDamage as a defense multiplier, so <1 = MORE damage taken. This
+		// line is therefore a mild survival trim in the same direction as the
+		// rebaseline *0.2 below — not the damage cut the "Wild Resilience" name
+		// suggests. Left as-is because the rebaseline sweep is tuned to it.
 		mods.DamageReduct *= 0.95
+		// rebaseline: the Druid wins T5 rooms on the survival tiebreak, immune to
+		// every damage lever. DamageReduct is a defense multiplier (calcDamage) —
+		// <1 = take MORE damage. Combined with a damage trim to pull it to band.
+		mods.DamageReduct *= 0.2
+		mods.DamageBonus += -0.20
 		// Phase 3 class-balance: druid was the only caster chassis with a
 		// purely defensive passive, and the off-tier numbers showed it —
 		// L1/T2 mean 0.04 vs Mage 0.27. Mirror the other caster bursts so
@@ -219,6 +285,7 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		stats.AttackBonus++
 		mods.DamageBonus += 0.05
 		mods.FlatDmgStart += c.Level + clampNonNeg(abilityModifier(c.CHA))
+		mods.DamageReduct *= 0.4 // rebaseline: Bard also wins T5 on the survival tiebreak — take more damage to reach band
 	case ClassSorcerer:
 		// Innate Sorcery — pre-combat burst, CHA-scaled like the Sorcerer's
 		// spellcasting stat. Floors at the flat base for low-CHA builds.
@@ -231,6 +298,9 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// touching the +0.05 rider that already saturates at high tier.
 		mods.FlatDmgStart += 5 + c.Level + clampNonNeg(abilityModifier(c.CHA))
 		mods.DamageBonus += 0.05
+		stats.AttackBonus++ // rebaseline: Sorcerer lagged the other blasters — match their +1 to-hit
+		// At-will Fire Bolt + level-scaled survival — sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.CHA), casterCantripBase, "Fire Bolt")
 	case ClassWarlock:
 		// Phase 2 class-balance: bumped from 10% to 12% damage + 1 attack —
 		// the Warlock chassis read mid-pack at T5 (0.52) pre-tune. Eldritch
@@ -240,6 +310,8 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		mods.DamageBonus += 0.12
 		stats.AttackBonus++
 		mods.FlatDmgStart += c.Level + clampNonNeg(abilityModifier(c.CHA))
+		// At-will Eldritch Blast + level-scaled survival — sustained arcane floor.
+		casterBlasterFloor(stats, mods, c.Level, abilityModifier(c.CHA), 0, "Eldritch Blast")
 	case ClassPaladin:
 		// Class-identity audit (2026-05-16) — Divine Smite as actual
 		// per-hit radiant bonus + L5 Extra Attack. 5e: smite consumes a
@@ -249,8 +321,9 @@ func applyClassPassives(stats *CombatStats, mods *CombatModifiers, c *DnDCharact
 		// down so an extra-attack paladin doesn't trivialize every fight.
 		// Rides DivineStrikePerHit (already in the weapon-hit damage path).
 		// Previous FlatDmgStart opener felt like Lay on Hands, not Smite.
-		smite := 3 + c.Level/3
+		smite := 4 + c.Level/2 // rebaseline: bigger Divine Smite lifts the Paladin from floor into band
 		mods.DivineStrikePerHit += smite
+		mods.DamageReduct *= 0.9 // rebaseline: small survival trim between the two integer smite steps for a ~60 landing
 		if c.Level >= 5 {
 			mods.ExtraAttacks += 1
 		}

internal/plugin/dnd_rest.go

@@ -2,7 +2,6 @@ package plugin
 
 import (
 	"fmt"
-	"math/rand/v2"
 	"sort"
 	"strings"
 	"time"
@@ -117,7 +116,7 @@ func (p *AdventurePlugin) handleDnDShortRest(ctx MessageContext) error {
 	before := c.HPCurrent
 	if !hpFull {
 		conMod := abilityModifier(c.CON)
-		healDie := 1 + rand.IntN(6) // 1d6
+		healDie := 1 + simIntN(6) // 1d6
 		heal := healDie + conMod
 		if heal < 1 {
 			heal = 1

internal/plugin/dnd_spell_combat.go

@@ -3,7 +3,6 @@ package plugin
 import (
 	"fmt"
 	"log/slog"
-	"math/rand/v2"
 
 	"maunium.net/go/mautrix/id"
 )
@@ -128,7 +127,7 @@ func applyMageSubclassSpellHooks(c *DnDCharacter, spell SpellDefinition, slotLev
 // applySpellDamageAttack — Fire Bolt, Inflict Wounds, Chill Touch, etc.
 // Roll d20 + spell attack vs enemy AC; nat 20 doubles dice damage.
 func applySpellDamageAttack(spell SpellDefinition, atk int, mods *CombatModifiers, enemy *CombatStats, slot, charLevel int) {
-	roll := 1 + rand.IntN(20)
+	roll := 1 + simIntN(20)
 	isCrit := roll == 20
 	isFumble := roll == 1
 	if isFumble || (!isCrit && roll+atk < enemy.AC) {
@@ -158,7 +157,7 @@ func applySpellDamageAttack(spell SpellDefinition, atk int, mods *CombatModifier
 // future multi-enemy combat (Phase 11+) but is not consulted here.
 func applySpellDamageSave(spell SpellDefinition, dc int, c *DnDCharacter, mods *CombatModifiers, enemy *CombatStats, slot int) {
 	saveMod := enemySpellSaveMod(enemy)
-	saveRoll := 1 + rand.IntN(20)
+	saveRoll := 1 + simIntN(20)
 	saved := saveRoll+saveMod >= dc
 	dmg := rollSpellDamageDice(spell, slot, c.Level)
 	if saved {
@@ -182,7 +181,7 @@ func applySpellDamageAuto(spell SpellDefinition, mods *CombatModifiers, slot, ch
 		}
 		total := 0
 		for i := 0; i < darts; i++ {
-			total += 1 + rand.IntN(4) + 1
+			total += 1 + simIntN(4) + 1
 		}
 		mods.SpellPreDamage += total
 		mods.SpellPreDamageDesc = fmt.Sprintf("Magic Missile (%d darts, %d dmg)", darts, total)
@@ -223,7 +222,7 @@ func enemySpellSaveMod(enemy *CombatStats) int {
 // double damage (5e: paralyzed creatures auto-crit on melee hits).
 func applySpellControl(spell SpellDefinition, dc int, mods *CombatModifiers, enemy *CombatStats, slot int) {
 	saveMod := enemySpellSaveMod(enemy)
-	saveRoll := 1 + rand.IntN(20)
+	saveRoll := 1 + simIntN(20)
 	if saveRoll+saveMod >= dc {
 		mods.SpellPreDamageDesc = spell.Name + " — resisted"
 		return
@@ -382,7 +381,7 @@ func rollTurnSpellHeal(c *DnDCharacter, spell SpellDefinition, slotLevel int) in
 		if supreme {
 			heal += faces
 		} else {
-			heal += 1 + rand.IntN(faces)
+			heal += 1 + simIntN(faces)
 		}
 	}
 	heal += abilityModifier(c.WIS)
@@ -418,7 +417,7 @@ func rollSpellDamageDice(spell SpellDefinition, slot, charLevel int) int {
 	}
 	total := flat
 	for i := 0; i < dice; i++ {
-		total += 1 + rand.IntN(faces)
+		total += 1 + simIntN(faces)
 	}
 	if total < 1 {
 		total = 1

internal/plugin/dnd_xp_test.go

@@ -224,7 +224,14 @@ func TestApplyClassPassives(t *testing.T) {
 		wantFlatStart   int
 		wantInitBias    float64
 	}{
-		{ClassFighter, 0.05, 0, false, 0, 1.0, 0, 0},
+		// Fighter-ceiling rebaseline (2026-07-16): Fighter picked up a -2 to-hit
+		// sub-swing trim; Rogue's steady rider flipped +0.05→-0.10 and it took a
+		// -3 to-hit trim (both offset a new 2nd swing gated at L5, not seen here);
+		// Druid took a survival trim (DR 0.95→0.19) + -0.20 damage; Bard a DR 0.4
+		// survival trim; Sorcerer a +1 to-hit to match the blasters; Paladin a
+		// 0.9 DR survival trim. Caster CantripPerRound / Defense adds are
+		// not asserted here.
+		{ClassFighter, 0.05, -2, false, 0, 1.0, 0, 0},
 		// Phase 2 class-balance rebalance: rogue picked up +5% damage,
 		// Mage/Bard/Warlock gained a level-scaled FlatDmgStart burst, Sorcerer's
 		// burst now also scales with level, and Warlock picked up +1 attack.
@@ -233,7 +240,7 @@ func TestApplyClassPassives(t *testing.T) {
 		// Phase 3 class-balance: Druid picked up a WIS-scaled FlatDmgStart burst
 		// (lvl 1 + clamp(mod(WIS=0)) = 1), and Sorcerer's burst base went 3→5
 		// (5 + 1 + clamp(mod(CHA=10)=0) = 6).
-		{ClassRogue, 0.05, 0, true, 0, 1.0, 0, 0},
+		{ClassRogue, -0.10, -3, true, 0, 1.0, 0, 0},
 		{ClassMage, 0.05, 1, false, 0, 1.0, 1, 0},
 		{ClassCleric, 0, 0, false, 5, 1.0, 0, 0},
 		// Class-identity audit (2026-05-16): Ranger Hunter's Mark is now
@@ -243,11 +250,11 @@ func TestApplyClassPassives(t *testing.T) {
 		// FlatDmgStart compensation riders are gone; +1 to-hit stays on
 		// Ranger as the "read prey tells" half.
 		{ClassRanger, 0, 1, false, 0, 1.0, 0, 0},
-		{ClassDruid, 0, 0, false, 0, 0.95, 1, 0},
-		{ClassBard, 0.05, 1, false, 0, 1.0, 1, 1},
-		{ClassSorcerer, 0.05, 0, false, 0, 1.0, 6, 0},
+		{ClassDruid, -0.20, 0, false, 0, 0.95 * 0.2, 1, 0},
+		{ClassBard, 0.05, 1, false, 0, 0.4, 1, 1},
+		{ClassSorcerer, 0.05, 1, false, 0, 1.0, 6, 0},
 		{ClassWarlock, 0.12, 1, false, 0, 1.0, 1, 0},
-		{ClassPaladin, 0, 0, false, 0, 1.0, 0, 0},
+		{ClassPaladin, 0, 0, false, 0, 0.9, 0, 0},
 	}
 	for _, tc := range cases {
 		stats := CombatStats{AttackBonus: 5}

internal/plugin/dnd_zone.go

@@ -32,6 +32,15 @@ const (
 	ZoneDragonsLair     ZoneID = "dragons_lair"
 	ZoneAbyssPortal     ZoneID = "abyss_portal"
 
+	// Tier 6 "Mythic" post-game zones. Gated behind postgameUnlocked (both
+	// T5 bosses beaten + level ≥ 18), never surfaced by zonesForLevel. See
+	// postgame_zones.go and gogobee_postgame_zones_plan.md.
+	ZoneOssuaryAscendant ZoneID = "ossuary_ascendant"
+	ZoneFirstHoard       ZoneID = "first_hoard"
+	ZoneUnplace          ZoneID = "unplace"
+	ZoneDrownedStar      ZoneID = "drowned_star"
+	ZoneLastMeridian     ZoneID = "last_meridian"
+
 	// ZoneArena is a synthetic ID — never registered via registerZone, so
 	// !zone enter can't reach it. It exists to route renderBossOutcome's
 	// twinBeeLine calls when an arena fight (resolveArenaBoss, post-L2)
@@ -51,6 +60,10 @@ const (
 	ZoneTierJourneyman ZoneTier = 3
 	ZoneTierVeteran    ZoneTier = 4
 	ZoneTierLegendary  ZoneTier = 5
+	// ZoneTierMythic — Tier 6 post-game. Earned, not leveled: unlocked by
+	// postgameUnlocked (both T5 bosses beaten + level ≥ 18), excluded from
+	// zonesForLevel unconditionally.
+	ZoneTierMythic ZoneTier = 6
 )
 
 // ZoneEnemy is a roster entry. BestiaryID must resolve via dndBestiary
@@ -83,6 +96,7 @@ type ZoneLootEntry struct {
 	ItemID       string
 	DropChance   float64 // 0..1; ignored if UniqueAlways
 	UniqueAlways bool    // always drops; used for quest items
+	BossOnly     bool    // only rolls on the zone-boss kill (signature items)
 	Note         string  // free-text descriptor (unique-item flavor)
 }
 
@@ -172,6 +186,13 @@ func zonesForLevel(dndLevel int) []ZoneDefinition {
 	var out []ZoneDefinition
 	for _, id := range zoneOrder {
 		z := dndZoneRegistry[id]
+		// Tier 6 (Mythic post-game) is never level-gated in. It has its own
+		// unlock (postgameUnlocked) and surfaces only via postgameZones().
+		// Note: maxTier = playerTier+2 has no hard clamp, so a high-level
+		// player would otherwise reach a T6 zone here — exclude explicitly.
+		if z.Tier >= ZoneTierMythic {
+			continue
+		}
 		if int(z.Tier) <= maxTier {
 			out = append(out, z)
 		}

internal/plugin/dnd_zone_cmd.go

@@ -53,6 +53,9 @@ func (p *AdventurePlugin) handleDnDZoneCmd(ctx MessageContext, args string) erro
 		// fork pending) the handler short-circuits with a friendly
 		// message — see zoneCmdGo for the full surface.
 		return p.zoneCmdGo(ctx, rest)
+	case "unlock", "pick", "force":
+		// Spend thieves' tools on a fork option a failed check closed.
+		return p.zoneCmdUnlock(ctx, rest)
 	case "status", "info":
 		return p.zoneCmdStatus(ctx)
 	case "map", "m":
@@ -83,6 +86,7 @@ func zoneHelpText() string {
 	b.WriteString("`!zone map` — show the room layout\n")
 	b.WriteString("`!zone advance` — resolve the current room and move on\n")
 	b.WriteString("`!zone go <n>` — at a fork, take path #n\n")
+	b.WriteString("`!zone unlock <n>` — spend thieves' tools to open a path you couldn't\n")
 	b.WriteString("`!revisit <n>` — walk back to a room you've already cleared\n")
 	b.WriteString("`!zone abandon` — end the active run (no rewards)\n")
 	b.WriteString("`!zone taunt` — poke TwinBee (they'll remember)\n")
@@ -118,6 +122,25 @@ func (p *AdventurePlugin) zoneCmdList(ctx MessageContext, c *DnDCharacter) error
 			i+1, z.Display, int(z.Tier), z.LevelMin, z.LevelMax, z.ID))
 		b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
 	}
+	// Post-game zones render under a divider once any exist. Unlocked players
+	// see enterable entries (indexed continuing from the list above, matching
+	// availableZonesFor); locked players see aspiration + the unlock hint.
+	if pg := postgameZones(); len(pg) > 0 {
+		unlocked, reason := postgameUnlocked(ctx.Sender, c.Level)
+		b.WriteString("\n— Beyond the Map —\n")
+		if !unlocked {
+			b.WriteString(fmt.Sprintf("_%s_\n", reason))
+		}
+		for j, z := range pg {
+			if unlocked {
+				b.WriteString(fmt.Sprintf("**%d.** %s — _T%d, L%d+_  `!zone enter %s`\n",
+					len(zones)+j+1, z.Display, int(z.Tier), z.LevelMin, z.ID))
+			} else {
+				b.WriteString(fmt.Sprintf("🔒 %s — _T%d, L%d+_\n", z.Display, int(z.Tier), z.LevelMin))
+			}
+			b.WriteString(fmt.Sprintf("    %s\n", z.Atmosphere))
+		}
+	}
 	if active, isLeader, _ := activeZoneRunFor(ctx.Sender); active != nil {
 		zone := zoneOrFallback(active.ZoneID)
 		tail := "Use `!zone status` or `!zone abandon`."
@@ -200,9 +223,12 @@ func (p *AdventurePlugin) zoneCmdEnter(ctx MessageContext, c *DnDCharacter, rest
 			"🛌 You're still resting — %s remaining. The dungeon won't go anywhere.",
 			formatRespecDuration(remaining)))
 	}
-	available := zonesForLevel(c.Level)
+	available := availableZonesFor(ctx.Sender, c.Level)
 	id, ok := resolveZoneInput(rest, available)
 	if !ok {
+		if reason := postgameLockReason(rest, ctx.Sender, c.Level); reason != "" {
+			return p.SendDM(ctx.Sender, reason)
+		}
 		return p.SendDM(ctx.Sender,
 			"Unknown zone for your level. Try `!zone list` to see what's available.")
 	}
@@ -762,7 +788,7 @@ func (p *AdventurePlugin) advanceOnceWithOpts(ctx MessageContext, compact, inlin
 			b.WriteString(line)
 			b.WriteString("\n\n")
 		}
-		if granted := p.rollZoneLoot(ctx.Sender, run, zone); len(granted) > 0 {
+		if granted := p.rollZoneLoot(ctx.Sender, run, zone, !midZone); len(granted) > 0 {
 			b.WriteString("**Loot:**\n")
 			for _, id := range granted {
 				b.WriteString("• " + id + "\n")
@@ -867,6 +893,7 @@ func (p *AdventurePlugin) runHarvestForAdvance(
 	if herr != nil {
 		return autoHarvestResult{}, ""
 	}
+	beatHaul(fresh, hr.Summary)
 	return hr, renderAutoHarvestFooter(hr.Summary)
 }
 
@@ -1035,7 +1062,8 @@ func (p *AdventurePlugin) resolveRoom(userID id.UserID, run *DungeonRun, zone Zo
 	case RoomEntry:
 		return
 	case RoomTrap:
-		_, narration := p.resolveTrapRoom(userID, run, zone)
+		damage, narration := p.resolveTrapRoom(userID, run, zone)
+		beatTrap(userID, run, damage)
 		outcome = narration
 		return
 	case RoomExploration:
@@ -1099,6 +1127,12 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 	result := pres.Seats[0]
 	postHP, maxHP := dndHPSnapshot(userID)
 	nat20s, nat1s := scanMoodEventsFromEvents(run.RunID, pres.Events)
+	// One beat for the fight, filed here rather than on each of the three
+	// outcome branches below — every one of them passes through this point with
+	// the result already decided, and a single site can't drift out of step with
+	// the others.
+	beatCombat(run, monster.Name, elite, isBoss, result.PlayerWon, result.TimedOut,
+		preHP, postHP, maxHP, nat20s, nat1s)
 
 	// Compact mode: skip TwinBee banter, skip the multi-beat play-by-play.
 	// Render a single outcome line. Still records kills, threat, and drops.
@@ -1200,6 +1234,14 @@ func (p *AdventurePlugin) resolveCombatRoom(userID id.UserID, run *DungeonRun, z
 		// tryPatrolEncounter); see retreatThreatBump in
 		// dnd_expedition_combat.go.
 		_, _ = applyMoodEvent(run.RunID, MoodEventPlayerDeath)
+		// Ahead of abandonZoneRun, which would close the story as "abandoned" —
+		// the difference between being killed and running out of clock is the
+		// most interesting fact in the whole log.
+		if result.TimedOut {
+			beatRunEnd(run, "retreated")
+		} else {
+			beatRunEnd(run, "died")
+		}
 		_ = abandonZoneRun(userID)
 		// Timeout loss = retreat; the fighters took wounds but nobody actually
 		// died. Don't fire markAdventureDead — that would trigger the 6h respawn

internal/plugin/dnd_zone_cmd_graph.go

@@ -188,6 +188,17 @@ func (p *AdventurePlugin) zoneCmdGo(ctx MessageContext, rest string) error {
 	if cerr != nil {
 		return p.SendDM(ctx.Sender, cerr.Error())
 	}
+	return p.commitForkChoice(ctx, run, chosen, "")
+}
+
+// commitForkChoice advances the run onto an already-validated fork option and
+// emits the arrival teaser. Split out of zoneCmdGo so `!zone unlock` — which
+// reaches the same place by paying for it — cannot drift from the plain
+// `!zone go` arrival: same region-transition hook, same camp strike, same
+// boss/elite prompt. header, if set, is printed above the move.
+func (p *AdventurePlugin) commitForkChoice(
+	ctx MessageContext, run *DungeonRun, chosen pendingChoice, header string,
+) error {
 	nextIdx, aerr := advanceZoneRunNode(run.RunID, chosen.To)
 	if aerr != nil {
 		return p.SendDM(ctx.Sender, "Couldn't advance: "+aerr.Error())
@@ -200,6 +211,7 @@ func (p *AdventurePlugin) zoneCmdGo(ctx MessageContext, rest string) error {
 	fireGraphRegionTransition(run.UserID, fromNode, nextNode)
 	nextRoom := nodeKindToRoomType(nextNode.Kind)
 	var b strings.Builder
+	b.WriteString(header)
 	if kind := autoBreakCampOnMove(ctx.Sender); kind != "" {
 		b.WriteString(fmt.Sprintf("⛺ Camp struck (**%s**) — the party moved on.\n\n", kind))
 	}

internal/plugin/dnd_zone_combat.go

@@ -238,6 +238,7 @@ func (p *AdventurePlugin) resolveSecretRoom(userID id.UserID, run *DungeonRun, z
 		it := item
 		if line := p.grantZoneItem(userID, &it, "🧪"); line != "" {
 			rewards = append(rewards, line)
+			beatTreasure(run, it.Name, "cache")
 		}
 	}
 
@@ -357,7 +358,7 @@ func (p *AdventurePlugin) resolveTrapRoomLegacy(userID id.UserID, run *DungeonRu
 // to a single "coins" item with rolled value; everything else becomes a
 // treasure-tier inventory item with a tier-derived placeholder value
 // (zone equipment registry wiring is a later content phase).
-func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone ZoneDefinition) []string {
+func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone ZoneDefinition, bossCleared bool) []string {
 	rng := rand.New(rand.NewPCG(uint64(zoneSelectorHash(run.RunID, run.CurrentRoom)), 0x100712))
 	// DM mood tilts probabilistic drop chances. UniqueAlways entries are
 	// untouched — those are story drops, not flavor for the DM to gate.
@@ -367,6 +368,13 @@ func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone Z
 	}
 	var granted []string
 	for _, entry := range zone.Loot {
+		// BossOnly (signature) drops only roll on the true zone-boss / whole-zone
+		// clear. rollZoneLoot fires on every region completion of a multi-region
+		// zone; without this gate a T6 signature item would get four roll chances
+		// per run instead of one at the boss.
+		if entry.BossOnly && !bossCleared {
+			continue
+		}
 		if !entry.UniqueAlways {
 			chance := entry.DropChance * moodMult
 			if rng.Float64() > chance {
@@ -385,6 +393,11 @@ func (p *AdventurePlugin) rollZoneLoot(userID id.UserID, run *DungeonRun, zone Z
 			slog.Error("zone: addLoot audit", "user", userID, "item", entry.ItemID, "err", err)
 		}
 		granted = append(granted, entry.ItemID)
+		source := "zone"
+		if bossCleared {
+			source = "boss"
+		}
+		beatTreasure(run, item.Name, source)
 	}
 	return granted
 }
@@ -404,6 +417,15 @@ func zoneLootToInventory(entry ZoneLootEntry, zone ZoneDefinition, rng *rand.Ran
 			Value: int64(val),
 		}, true
 	}
+	// Registry-backed loot (T6 signature items and any future magic-item drops)
+	// materializes as a real equippable magic_item — the SkillSource tag is what
+	// the equip path and magicItemEffectFor key off. Plain named entries (legacy
+	// zone signature items not in the registry) fall through to treasure below.
+	if mi, ok := magicItemRegistry[entry.ItemID]; ok {
+		item := magicItemSell(mi)
+		item.SkillSource = "magic_item:" + mi.ID
+		return item, true
+	}
 	tier := int(zone.Tier)
 	displayName := titleCaseUnderscored(entry.ItemID)
 	value := int64(50 * tier * tier) // T1=50, T2=200, T3=450, T4=800, T5=1250

internal/plugin/dnd_zone_combat_test.go

@@ -507,6 +507,33 @@ func TestZoneTrapRoom_AntimagicFieldNoHPLoss(t *testing.T) {
 	}
 }
 
+// TestZoneLootToInventory_RegistryItemBecomesMagicItem — a signature drop whose
+// ItemID is in the magic-item registry materializes as an equippable magic_item
+// carrying the "magic_item:<id>" SkillSource, not generic treasure.
+func TestZoneLootToInventory_RegistryItemBecomesMagicItem(t *testing.T) {
+	zone, ok := getZone(ZoneFirstHoard)
+	if !ok {
+		t.Fatal("first_hoard zone not registered")
+	}
+	rng := newDeterministicRNG(t, "sig-loot")
+	entry := ZoneLootEntry{ItemID: "aegis_of_the_first_scale", DropChance: 1.0, BossOnly: true}
+	item, ok := zoneLootToInventory(entry, zone, rng)
+	if !ok {
+		t.Fatal("zoneLootToInventory returned ok=false for a registry item")
+	}
+	if item.Type != "magic_item" {
+		t.Errorf("Type = %q, want magic_item", item.Type)
+	}
+	if item.SkillSource != "magic_item:aegis_of_the_first_scale" {
+		t.Errorf("SkillSource = %q, want magic_item:aegis_of_the_first_scale", item.SkillSource)
+	}
+	// A plain non-registry entry still falls through to treasure.
+	plain, _ := zoneLootToInventory(ZoneLootEntry{ItemID: "cooling_ember_of_aurvandryx", UniqueAlways: true}, zone, rng)
+	if plain.Type != "treasure" {
+		t.Errorf("crafting anchor Type = %q, want treasure", plain.Type)
+	}
+}
+
 func TestRollZoneLoot_BossLootDrops(t *testing.T) {
 	setupAuditTestDB(t)
 	uid := id.UserID("@zone-loot:example")
@@ -517,7 +544,7 @@ func TestRollZoneLoot_BossLootDrops(t *testing.T) {
 	zone, _ := getZone(ZoneCryptValdris)
 
 	p := &AdventurePlugin{}
-	granted := p.rollZoneLoot(uid, run, zone)
+	granted := p.rollZoneLoot(uid, run, zone, true)
 	// Crypt of Valdris has UniqueAlways "valdris_phylactery_shard" + always-drop coins.
 	foundShard := false
 	foundCoins := false

internal/plugin/dnd_zone_loot.go

@@ -358,7 +358,10 @@ func pickLootEntry(zone map[LootTier][]ZoneLootDrop, tier LootTier, rng *rand.Ra
 // while production paths use the package-global generator.
 func rngFloat(rng *rand.Rand) float64 {
 	if rng == nil {
-		return rand.Float64()
+		// Auto-resolve rooms pass nil. simFloat64 routes to the seeded combat
+		// stream when the sim is seeding, else the package global — so prod
+		// (never seeded) stays byte-identical while sim room combat pairs.
+		return simFloat64()
 	}
 	return rng.Float64()
 }
@@ -368,7 +371,7 @@ func rngIntN(rng *rand.Rand, n int) int {
 		return 0
 	}
 	if rng == nil {
-		return rand.IntN(n)
+		return simIntN(n)
 	}
 	return rng.IntN(n)
 }

internal/plugin/dnd_zone_narration.go

@@ -92,6 +92,16 @@ func zoneRoomEntryPool(zoneID ZoneID) []string {
 		return append(append([]string{}, flavor.RoomEntryDragonsLair...), flavor.RoomEntryGeneric...)
 	case ZoneAbyssPortal:
 		return append(append([]string{}, flavor.RoomEntryAbyssPortal...), flavor.RoomEntryGeneric...)
+	case ZoneOssuaryAscendant:
+		return append(append([]string{}, flavor.RoomEntryOssuaryAscendant...), flavor.RoomEntryGeneric...)
+	case ZoneFirstHoard:
+		return append(append([]string{}, flavor.RoomEntryFirstHoard...), flavor.RoomEntryGeneric...)
+	case ZoneUnplace:
+		return append(append([]string{}, flavor.RoomEntryUnplace...), flavor.RoomEntryGeneric...)
+	case ZoneDrownedStar:
+		return append(append([]string{}, flavor.RoomEntryDrownedStar...), flavor.RoomEntryGeneric...)
+	case ZoneLastMeridian:
+		return append(append([]string{}, flavor.RoomEntryLastMeridian...), flavor.RoomEntryGeneric...)
 	}
 	return flavor.RoomEntryGeneric
 }
@@ -120,6 +130,16 @@ func bossEntryPool(zoneID ZoneID) []string {
 		return flavor.BossEntryInfernax
 	case ZoneAbyssPortal:
 		return flavor.BossEntryBelaxath
+	case ZoneOssuaryAscendant:
+		return flavor.BossEntryValdrisAscendant
+	case ZoneFirstHoard:
+		return flavor.BossEntryAurvandryx
+	case ZoneUnplace:
+		return flavor.BossEntrySeamstress
+	case ZoneDrownedStar:
+		return flavor.BossEntrySeraphel
+	case ZoneLastMeridian:
+		return flavor.BossEntryCustodian
 	}
 	return flavor.BossEntryGeneric
 }
@@ -182,6 +202,16 @@ func zoneLorePool(zoneID ZoneID) []string {
 		return append(append([]string{}, flavor.LoreLinesDragonsLair...), flavor.LoreLines...)
 	case ZoneAbyssPortal:
 		return append(append([]string{}, flavor.LoreLinesAbyssPortal...), flavor.LoreLines...)
+	case ZoneOssuaryAscendant:
+		return append(append([]string{}, flavor.LoreLinesOssuaryAscendant...), flavor.LoreLines...)
+	case ZoneFirstHoard:
+		return append(append([]string{}, flavor.LoreLinesFirstHoard...), flavor.LoreLines...)
+	case ZoneUnplace:
+		return append(append([]string{}, flavor.LoreLinesUnplace...), flavor.LoreLines...)
+	case ZoneDrownedStar:
+		return append(append([]string{}, flavor.LoreLinesDrownedStar...), flavor.LoreLines...)
+	case ZoneLastMeridian:
+		return append(append([]string{}, flavor.LoreLinesLastMeridian...), flavor.LoreLines...)
 	}
 	return flavor.LoreLines
 }
@@ -211,6 +241,16 @@ func bossSignaturePool(zoneID ZoneID) []string {
 		return flavor.InfernaxSignatureCallouts
 	case ZoneAbyssPortal:
 		return flavor.BelaxathSignatureCallouts
+	case ZoneOssuaryAscendant:
+		return flavor.ValdrisAscendantSignatureCallouts
+	case ZoneFirstHoard:
+		return flavor.AurvandryxSignatureCallouts
+	case ZoneUnplace:
+		return flavor.SeamstressSignatureCallouts
+	case ZoneDrownedStar:
+		return flavor.SeraphelSignatureCallouts
+	case ZoneLastMeridian:
+		return flavor.CustodianSignatureCallouts
 	}
 	return nil
 }
@@ -236,6 +276,16 @@ func bossPhaseTwoPool(zoneID ZoneID) []string {
 		return flavor.InfernaxPhaseTwoLines
 	case ZoneAbyssPortal:
 		return flavor.BelaxathPhaseTwoLines
+	case ZoneOssuaryAscendant:
+		return flavor.ValdrisAscendantPhaseTwoLines
+	case ZoneFirstHoard:
+		return flavor.AurvandryxPhaseTwoLines
+	case ZoneUnplace:
+		return flavor.SeamstressPhaseTwoLines
+	case ZoneDrownedStar:
+		return flavor.SeraphelPhaseTwoLines
+	case ZoneLastMeridian:
+		return flavor.CustodianPhaseTwoLines
 	}
 	return nil
 }

internal/plugin/dnd_zone_run.go

@@ -175,6 +175,9 @@ func generateRoomSequence(zone ZoneDefinition, rng *rand.Rand) []RoomType {
 
 // newRunID — 16-char hex token. Crypto-random; collision-resistant.
 func newRunID() string {
+	if simSeedOn() {
+		return simHexToken()
+	}
 	var b [8]byte
 	if _, err := cryptorand.Read(b[:]); err != nil {
 		// Fall back to math/rand if /dev/urandom is unavailable.
@@ -219,6 +222,15 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 			break
 		}
 	}
+	// Tier 6 zones are excluded from zonesForLevel by design; they're
+	// admitted here only through the post-game unlock (both T5 bosses beaten
+	// + level ≥ floor). This is the shared engine safety net — command sites
+	// give the friendly reason before reaching here.
+	if isPostgameZone(zoneID) {
+		if ok, _ := postgameUnlocked(userID, dndLevel); ok {
+			allowed = true
+		}
+	}
 	if !allowed {
 		return nil, ErrZoneTierLocked
 	}
@@ -231,7 +243,11 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 	}
 
 	if rng == nil {
-		rng = rand.New(rand.NewPCG(uint64(time.Now().UnixNano()), uint64(time.Now().UnixMicro())))
+		if simSeedOn() {
+			rng = simZoneRNG()
+		} else {
+			rng = rand.New(rand.NewPCG(uint64(time.Now().UnixNano()), uint64(time.Now().UnixMicro())))
+		}
 	}
 	seq := generateRoomSequence(zone, rng)
 
@@ -279,6 +295,7 @@ func startZoneRun(userID id.UserID, zoneID ZoneID, dndLevel int, rng *rand.Rand)
 	); err != nil {
 		return nil, fmt.Errorf("insert zone run: %w", err)
 	}
+	beatRunStart(userID, run, zone)
 	return run, nil
 }
 
@@ -565,6 +582,7 @@ func abandonZoneRun(userID id.UserID) error {
 	if r == nil {
 		return ErrNoActiveRun
 	}
+	beatRunEnd(r, "abandoned")
 	_, err = db.Get().Exec(`
 		UPDATE dnd_zone_run
 		   SET abandoned = 1,
@@ -583,6 +601,12 @@ func abandonZoneRunByID(runID string) error {
 	if runID == "" {
 		return nil
 	}
+	// The generic funnel: it fires for an idle reap, a region retirement, and a
+	// completed run being tidied up alike. beatRunEnd is first-writer-wins, so
+	// this only ever supplies the outcome nothing more specific already did.
+	if r, _ := getZoneRun(runID); r != nil {
+		beatRunEnd(r, "abandoned")
+	}
 	_, err := db.Get().Exec(`
 		UPDATE dnd_zone_run
 		   SET abandoned = 1,

internal/plugin/dnd_zone_test.go

@@ -128,10 +128,10 @@ func TestZoneRegistry_LootDropChances(t *testing.T) {
 func TestZoneRegistry_RoomCountSane(t *testing.T) {
 	// Long-expedition plan §2 widens the bands per tier: T1 12–14 up to
 	// T5 ~36–44. The guard floor stays at 5 (no zone should ever drop
-	// below that) and the ceiling tracks the T5 target.
+	// below that) and the ceiling tracks the T6 post-game target of 44–52.
 	for _, z := range allZones() {
-		if z.MinRooms < 5 || z.MaxRooms > 44 || z.MinRooms > z.MaxRooms {
-			t.Errorf("zone %s rooms %d-%d outside design (5-44, min<=max)",
+		if z.MinRooms < 5 || z.MaxRooms > 52 || z.MinRooms > z.MaxRooms {
+			t.Errorf("zone %s rooms %d-%d outside design (5-52, min<=max)",
 				z.ID, z.MinRooms, z.MaxRooms)
 		}
 	}
@@ -162,6 +162,7 @@ func TestZoneRegistry_LevelRangeMatchesTier(t *testing.T) {
 		ZoneTierJourneyman: {5, 8},
 		ZoneTierVeteran:    {8, 12},
 		ZoneTierLegendary:  {12, 20},
+		ZoneTierMythic:     {18, 20}, // post-game: gated by unlock, not level band
 	}
 	for _, z := range allZones() {
 		want, ok := expected[z.Tier]

internal/plugin/euro.go

@@ -1,8 +1,11 @@
 package plugin
 
 import (
+	"database/sql"
+	"errors"
 	"fmt"
 	"log/slog"
+	"math"
 	"os"
 	"regexp"
 	"strings"
@@ -413,6 +416,146 @@ func (p *EuroPlugin) GetBalance(userID id.UserID) float64 {
 	return balance
 }
 
+// HasExternalTx reports whether a money move with this externalID has already
+// been applied. It lets a retrying web caller tell a first attempt from a replay:
+// on a first attempt the affordability gate must run, but on a retry of an order
+// already debited the gate must be skipped — the debit is a settled fact, and
+// re-reading the now-lower balance would wrongly bounce a hit the buyer paid for.
+func (p *EuroPlugin) HasExternalTx(externalID string) bool {
+	if externalID == "" {
+		return false
+	}
+	var one int
+	err := db.Get().QueryRow(
+		`SELECT 1 FROM euro_transactions WHERE external_id = ? LIMIT 1`, externalID).Scan(&one)
+	return err == nil
+}
+
+// ---------------------------------------------------------------------------
+// Idempotent money moves
+//
+// Every caller of Credit/Debit above is a Matrix message, which arrives exactly
+// once. Money that moves over a retrying wire — the Pete games escrow poll loop
+// — has no such guarantee: a claim that succeeds but whose ack is lost gets
+// retried, and the player pays twice. CreditIdem/DebitIdem take an externalID
+// (the escrow GUID), do the balance mutation and the transaction log in one
+// tx, and lean on idx_euro_tx_external so a replay is a no-op rather than a
+// second debit.
+//
+// Anything web-initiated goes through these. Nothing else should.
+// ---------------------------------------------------------------------------
+
+// DebitIdem subtracts euros exactly once for a given externalID. Returns ok=false
+// only when the debit would breach the debt limit; a replay of an already-applied
+// externalID returns ok=true without moving money again. balanceAfter is the
+// balance as of the decision, and is meaningless when ok is false.
+func (p *EuroPlugin) DebitIdem(userID id.UserID, amount float64, reason, externalID string) (ok bool, balanceAfter float64, err error) {
+	if amount <= 0 {
+		return false, 0, fmt.Errorf("euro: DebitIdem non-positive amount %v", amount)
+	}
+	if externalID == "" {
+		return false, 0, fmt.Errorf("euro: DebitIdem requires an external id")
+	}
+	debtLimit := envFloat("BLACKJACK_DEBT_LIMIT", 1000)
+	return p.applyIdem(userID, -amount, reason, externalID, -debtLimit)
+}
+
+// CreditIdem adds euros exactly once for a given externalID. A replay is a no-op
+// that still reports ok.
+func (p *EuroPlugin) CreditIdem(userID id.UserID, amount float64, reason, externalID string) (ok bool, balanceAfter float64, err error) {
+	if amount <= 0 {
+		return false, 0, fmt.Errorf("euro: CreditIdem non-positive amount %v", amount)
+	}
+	if externalID == "" {
+		return false, 0, fmt.Errorf("euro: CreditIdem requires an external id")
+	}
+	// A credit has no floor to breach — math.Inf would do, but the balance can
+	// never land below the current one, so any sentinel below it works.
+	return p.applyIdem(userID, amount, reason, externalID, math.Inf(-1))
+}
+
+// applyIdem is the shared body: signed delta, applied once, never letting the
+// balance fall below floor. Balance mutation and transaction log commit together
+// or not at all.
+func (p *EuroPlugin) applyIdem(userID id.UserID, delta float64, reason, externalID string, floor float64) (bool, float64, error) {
+	// Outside the tx: db is capped at a single connection, so a nested Exec on
+	// the pool would deadlock against our own open transaction.
+	p.ensureBalance(userID)
+
+	d := db.Get()
+	tx, err := d.Begin()
+	if err != nil {
+		return false, 0, fmt.Errorf("euro: begin: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op after a successful Commit
+
+	// Already applied? Report the current balance and move on.
+	var prior int
+	switch err := tx.QueryRow(
+		`SELECT 1 FROM euro_transactions WHERE external_id = ?`, externalID,
+	).Scan(&prior); {
+	case err == nil:
+		bal, err := txBalance(tx, userID)
+		if err != nil {
+			return false, 0, err
+		}
+		slog.Info("euro: idempotent replay ignored", "user", userID, "external_id", externalID, "reason", reason)
+		return true, bal, nil
+	case errors.Is(err, sql.ErrNoRows):
+		// Not applied yet — carry on.
+	default:
+		return false, 0, fmt.Errorf("euro: idem lookup: %w", err)
+	}
+
+	res, err := tx.Exec(
+		`UPDATE euro_balances SET balance = balance + ?, updated_at = CURRENT_TIMESTAMP
+		 WHERE user_id = ? AND (balance + ?) >= ?`,
+		delta, string(userID), delta, floor,
+	)
+	if err != nil {
+		return false, 0, fmt.Errorf("euro: idem balance update: %w", err)
+	}
+	if affected, _ := res.RowsAffected(); affected == 0 {
+		return false, 0, nil // would breach the floor
+	}
+
+	if _, err := tx.Exec(
+		`INSERT INTO euro_transactions (user_id, amount, reason, external_id) VALUES (?, ?, ?, ?)`,
+		string(userID), delta, reason, externalID,
+	); err != nil {
+		// A racing caller won with the same externalID. The unique index is the
+		// backstop the SELECT above can't be: roll back our half-applied delta
+		// and report theirs.
+		if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+			if rbErr := tx.Rollback(); rbErr != nil {
+				return false, 0, fmt.Errorf("euro: rollback after idem race: %w", rbErr)
+			}
+			slog.Info("euro: idempotent race lost, delta rolled back", "user", userID, "external_id", externalID)
+			return true, p.GetBalance(userID), nil
+		}
+		return false, 0, fmt.Errorf("euro: idem tx log: %w", err)
+	}
+
+	bal, err := txBalance(tx, userID)
+	if err != nil {
+		return false, 0, err
+	}
+	if err := tx.Commit(); err != nil {
+		return false, 0, fmt.Errorf("euro: commit: %w", err)
+	}
+	return true, bal, nil
+}
+
+func txBalance(tx *sql.Tx, userID id.UserID) (float64, error) {
+	var bal float64
+	if err := tx.QueryRow(
+		`SELECT balance FROM euro_balances WHERE user_id = ?`, string(userID),
+	).Scan(&bal); err != nil {
+		return 0, fmt.Errorf("euro: read balance: %w", err)
+	}
+	return bal, nil
+}
+
 func (p *EuroPlugin) logTransaction(userID id.UserID, amount float64, reason string) {
 	db.Exec("euro: log transaction",
 		"INSERT INTO euro_transactions (user_id, amount, reason) VALUES (?, ?, ?)",

internal/plugin/euro_idem_test.go

@@ -0,0 +1,174 @@
+package plugin
+
+import (
+	"sync"
+	"testing"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+func newEuroTestDB(t *testing.T) *EuroPlugin {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+	return NewEuroPlugin(nil)
+}
+
+func seedBalance(t *testing.T, p *EuroPlugin, user id.UserID, amount float64) {
+	t.Helper()
+	p.ensureBalance(user)
+	if _, err := db.Get().Exec(
+		`UPDATE euro_balances SET balance = ? WHERE user_id = ?`, amount, string(user),
+	); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDebitIdem_ReplaySameGUIDDebitsOnce(t *testing.T) {
+	p := newEuroTestDB(t)
+	user := id.UserID("@replay:test.invalid")
+	seedBalance(t, p, user, 500)
+
+	for i := 0; i < 3; i++ {
+		ok, bal, err := p.DebitIdem(user, 100, "games_buyin", "guid-abc")
+		if err != nil {
+			t.Fatalf("attempt %d: %v", i, err)
+		}
+		if !ok {
+			t.Fatalf("attempt %d: debit rejected", i)
+		}
+		if bal != 400 {
+			t.Fatalf("attempt %d: balance after = %v, want 400", i, bal)
+		}
+	}
+
+	if got := p.GetBalance(user); got != 400 {
+		t.Fatalf("final balance = %v, want 400 (replay debited more than once)", got)
+	}
+
+	var n int
+	if err := db.Get().QueryRow(
+		`SELECT COUNT(*) FROM euro_transactions WHERE external_id = 'guid-abc'`,
+	).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 1 {
+		t.Fatalf("logged %d transactions for one guid, want 1", n)
+	}
+}
+
+func TestCreditIdem_ReplaySameGUIDCreditsOnce(t *testing.T) {
+	p := newEuroTestDB(t)
+	user := id.UserID("@cashout:test.invalid")
+	seedBalance(t, p, user, 0)
+
+	for i := 0; i < 3; i++ {
+		ok, bal, err := p.CreditIdem(user, 250, "games_cashout", "guid-xyz")
+		if err != nil {
+			t.Fatalf("attempt %d: %v", i, err)
+		}
+		if !ok || bal != 250 {
+			t.Fatalf("attempt %d: ok=%v balance=%v, want true/250", i, ok, bal)
+		}
+	}
+
+	if got := p.GetBalance(user); got != 250 {
+		t.Fatalf("final balance = %v, want 250", got)
+	}
+}
+
+func TestDebitIdem_DistinctGUIDsBothApply(t *testing.T) {
+	p := newEuroTestDB(t)
+	user := id.UserID("@distinct:test.invalid")
+	seedBalance(t, p, user, 500)
+
+	for _, guid := range []string{"guid-1", "guid-2"} {
+		if ok, _, err := p.DebitIdem(user, 100, "games_buyin", guid); err != nil || !ok {
+			t.Fatalf("%s: ok=%v err=%v", guid, ok, err)
+		}
+	}
+	if got := p.GetBalance(user); got != 300 {
+		t.Fatalf("balance = %v, want 300", got)
+	}
+}
+
+func TestDebitIdem_RespectsDebtLimitAndLogsNothing(t *testing.T) {
+	t.Setenv("BLACKJACK_DEBT_LIMIT", "1000")
+	p := newEuroTestDB(t)
+	user := id.UserID("@broke:test.invalid")
+	seedBalance(t, p, user, 0)
+
+	ok, _, err := p.DebitIdem(user, 1500, "games_buyin", "guid-broke")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok {
+		t.Fatal("debit past the debt limit was accepted")
+	}
+	if got := p.GetBalance(user); got != 0 {
+		t.Fatalf("balance = %v, want 0 — a rejected debit moved money", got)
+	}
+
+	// A rejection must leave no trace, so the same guid can be retried later
+	// (e.g. once the player has earned their way back above the limit).
+	var n int
+	if err := db.Get().QueryRow(
+		`SELECT COUNT(*) FROM euro_transactions WHERE external_id = 'guid-broke'`,
+	).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("rejected debit logged %d transactions, want 0", n)
+	}
+}
+
+// The SELECT-then-UPDATE in applyIdem is not by itself a guard against two
+// concurrent claims of the same guid; the unique index is. Hammer it.
+func TestDebitIdem_ConcurrentSameGUIDDebitsOnce(t *testing.T) {
+	p := newEuroTestDB(t)
+	user := id.UserID("@race:test.invalid")
+	seedBalance(t, p, user, 1000)
+
+	const racers = 8
+	var wg sync.WaitGroup
+	errs := make([]error, racers)
+	for i := 0; i < racers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			_, _, errs[i] = p.DebitIdem(user, 100, "games_buyin", "guid-race")
+		}(i)
+	}
+	wg.Wait()
+
+	for i, err := range errs {
+		if err != nil {
+			t.Fatalf("racer %d: %v", i, err)
+		}
+	}
+	if got := p.GetBalance(user); got != 900 {
+		t.Fatalf("balance = %v, want 900 — %d concurrent claims of one guid double-debited", got, racers)
+	}
+}
+
+func TestIdem_RejectsEmptyExternalID(t *testing.T) {
+	p := newEuroTestDB(t)
+	user := id.UserID("@noguid:test.invalid")
+	seedBalance(t, p, user, 500)
+
+	if _, _, err := p.DebitIdem(user, 10, "games_buyin", ""); err == nil {
+		t.Fatal("DebitIdem accepted an empty external id")
+	}
+	if _, _, err := p.CreditIdem(user, 10, "games_cashout", ""); err == nil {
+		t.Fatal("CreditIdem accepted an empty external id")
+	}
+	if got := p.GetBalance(user); got != 500 {
+		t.Fatalf("balance = %v, want 500", got)
+	}
+}

internal/plugin/expedition_balance_test.go

@@ -123,6 +123,11 @@ var phase1TierCenterline = map[ZoneTier]int{
 	ZoneTierJourneyman: 9,
 	ZoneTierVeteran:    13,
 	ZoneTierLegendary:  17,
+	// Tier 6 post-game runs at the cap. These in-process matrices tune the
+	// T1–T5 global levers; T6 rows are simmed and logged for reference but
+	// carry no band assertion here — T6 balance is owned by the remote P7
+	// sweep (n=750, control arm) per gogobee_postgame_zones_plan.md §4.
+	ZoneTierMythic: 20,
 }
 
 // TestExpeditionBalance_Phase1_FullMatrix is the Phase 1 baseline-

internal/plugin/expedition_boredom.go

@@ -375,6 +375,12 @@ func isBoredomDriven(userID id.UserID, now time.Time) bool {
 func pickBoredomZone(uid id.UserID, level int) (ZoneDefinition, bool) {
 	var inBand, nonRaid []ZoneDefinition
 	for _, z := range allZones() {
+		// Tier 6 post-game zones are opt-in endgame — a bored character never
+		// wanders into one on autopilot, even once unlocked. This picker walks
+		// allZones() directly (not zonesForLevel), so exclude T6 explicitly.
+		if z.Tier >= ZoneTierMythic {
+			continue
+		}
 		if level < z.LevelMin || level > z.LevelMax {
 			continue
 		}

internal/plugin/expedition_party_cmd.go

@@ -137,7 +137,16 @@ func (p *AdventurePlugin) expeditionCmdAccept(ctx MessageContext, c *DnDCharacte
 	}
 
 	zone := zoneOrFallback(exp.ZoneID)
-	if !zoneOpenToLevel(exp.ZoneID, c.Level) {
+	// Tier 6 zones are excluded from zonesForLevel by design, so zoneOpenToLevel
+	// would refuse every seat; they carry their own post-game unlock instead.
+	// Non-postgame zones keep the plain level gate.
+	if isPostgameZone(exp.ZoneID) {
+		// A party can't smuggle an ungated member into a Tier 6 zone: every seat
+		// must have cleared the post-game unlock on their own.
+		if ok, reason := postgameUnlocked(ctx.Sender, c.Level); !ok {
+			return p.SendDM(ctx.Sender, reason)
+		}
+	} else if !zoneOpenToLevel(exp.ZoneID, c.Level) {
 		return p.SendDM(ctx.Sender, fmt.Sprintf(
 			"**%s** is beyond you for now — come back at a higher level.", zone.Display))
 	}
@@ -271,47 +280,77 @@ func (p *AdventurePlugin) expeditionCmdParty(ctx MessageContext) error {
 	return p.SendDM(ctx.Sender, b.String())
 }
 
-// expeditionCmdLeave walks a member out. The leader cannot leave — their row is
-// the expedition — so they are pointed at `!extract`, which ends it for all.
-func (p *AdventurePlugin) expeditionCmdLeave(ctx MessageContext) error {
+// Sentinels for the two ways walking out can be refused, so the web action queue
+// can pick a verdict without reading prose. errLeaveIsLeader is deliberately not
+// errAbandonNotLeader inverted-and-reused: they are opposite facts about the same
+// person and a verdict that conflated them would tell a leader they weren't one.
+var (
+	errLeaveNothing  = errors.New("expedition leave: no expedition to leave")
+	errLeaveIsLeader = errors.New("expedition leave: the leader's row is the expedition")
+)
+
+// performExpeditionLeave is `!expedition leave` minus the command framing.
+// Shared with the web action queue, so a member walking out from a phone unseats
+// the same way and the leader is told either way.
+//
+// Like performExpeditionAbandon this does NOT take the per-user lock — its
+// Matrix caller holds it across the whole `!expedition` switch, and applyWebLeave
+// takes it instead. See the comment on performExpeditionAbandon for what getting
+// that backwards costs.
+func (p *AdventurePlugin) performExpeditionLeave(uid id.UserID) error {
 	// Resolve the seat the way the guards that trap them do. seatedExpeditionFor
 	// spans `extracting`, which activeExpeditionFor does not: a leader who
 	// extracts and never resumes would otherwise leave their members seated —
 	// refused a new adventure by the guard, and told "no active expedition" by
 	// the very command the guard points them at. The exit has to see every state
 	// the gate sees. It already excludes leaders, so they fall through below.
-	seated, err := seatedExpeditionFor(ctx.Sender)
+	seated, err := seatedExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return err
 	}
 	if seated != nil {
-		return p.leaveSeatedParty(ctx, seated)
+		return p.leaveSeatedParty(uid, seated)
 	}
 
-	exp, isLeader, err := activeExpeditionFor(ctx.Sender)
+	exp, isLeader, err := activeExpeditionFor(uid)
 	if err != nil {
-		return p.SendDM(ctx.Sender, "Couldn't read expedition state: "+err.Error())
+		return err
 	}
 	if exp == nil {
-		return p.SendDM(ctx.Sender, "No active expedition.")
+		return refuseAdv(errLeaveNothing, "No active expedition.")
 	}
 	if isLeader {
-		return p.SendDM(ctx.Sender,
+		return refuseAdv(errLeaveIsLeader,
 			"You're leading this one — `!extract` ends it for everyone, or `!expedition abandon` to walk away from it.")
 	}
-	return p.leaveSeatedParty(ctx, exp)
+	return p.leaveSeatedParty(uid, exp)
 }
 
-// leaveSeatedParty unseats a member and tells both ends. Shared by the two ways
-// a member's seat resolves: the `extracting` limbo and the plain active party.
-func (p *AdventurePlugin) leaveSeatedParty(ctx MessageContext, exp *Expedition) error {
-	if err := leaveParty(exp.ID, ctx.Sender); err != nil {
+// expeditionCmdLeave walks a member out. The leader cannot leave — their row is
+// the expedition — so they are pointed at `!extract`, which ends it for all.
+func (p *AdventurePlugin) expeditionCmdLeave(ctx MessageContext) error {
+	if err := p.performExpeditionLeave(ctx.Sender); err != nil {
+		var refusal advRefusal
+		if errors.As(err, &refusal) {
+			return p.SendDM(ctx.Sender, refusal.Error())
+		}
 		return p.SendDM(ctx.Sender, "Couldn't leave: "+err.Error())
 	}
+	return p.SendDM(ctx.Sender, "You turn back for town. Your supplies stay with the party.")
+}
+
+// leaveSeatedParty unseats a member and tells the leader. Shared by the two ways
+// a member's seat resolves: the `extracting` limbo and the plain active party.
+// The *member's* own confirmation is the caller's, because that is the one line
+// that differs between a DM and a web verdict.
+func (p *AdventurePlugin) leaveSeatedParty(uid id.UserID, exp *Expedition) error {
+	if err := leaveParty(exp.ID, uid); err != nil {
+		return err
+	}
 	// Supplies stay in the pool. They were spent on the expedition, not lent to
 	// it, and clawing them back would let a member starve the party on their way
 	// out of the door.
 	_ = p.SendDM(id.UserID(exp.UserID), fmt.Sprintf(
-		"**%s** turned back. Their supplies stay with the party.", p.DisplayName(ctx.Sender)))
-	return p.SendDM(ctx.Sender, "You turn back for town. Your supplies stay with the party.")
+		"**%s** turned back. Their supplies stay with the party.", p.DisplayName(uid)))
+	return nil
 }

internal/plugin/expedition_sim.go

@@ -136,6 +136,30 @@ func (s *SimRunner) BuildCharacter(uid id.UserID, class DnDClass, level int) (*D
 	return c, nil
 }
 
+// SeedPostgameUnlock makes the synthetic user satisfy postgameUnlocked's
+// T5-clear gate by writing two completed, boss-defeated dnd_expedition rows
+// (dragons_lair + abyss_portal) into the sim's throwaway DB. Without this the
+// P1 gate in startZoneRun rejects every T6 zone ("did not persist after start")
+// and the sim can't reach post-game content. Sim/test-only — the live gate is
+// unchanged. Idempotent enough for a fresh per-run DB; call once after
+// BuildCharacter/PrepareRealCharacter when the target zone IsPostgameZone.
+func (s *SimRunner) SeedPostgameUnlock(uid id.UserID) error {
+	for i, z := range []ZoneID{ZoneDragonsLair, ZoneAbyssPortal} {
+		if _, err := db.Get().Exec(
+			`INSERT INTO dnd_expedition (expedition_id, user_id, zone_id, status, boss_defeated)
+			 VALUES (?, ?, ?, ?, 1)`,
+			fmt.Sprintf("sim-unlock-%s-%d", uid, i), string(uid), string(z), ExpeditionStatusComplete,
+		); err != nil {
+			return fmt.Errorf("seed T5 clear %s: %w", z, err)
+		}
+	}
+	return nil
+}
+
+// IsPostgameZone exports the T6 predicate so the sim binary (a separate
+// package) can decide whether to call SeedPostgameUnlock before a run.
+func IsPostgameZone(id ZoneID) bool { return isPostgameZone(id) }
+
 // PrepareRealCharacter readies an already-persisted character (loaded from a
 // copy of the prod DB) for a headless run. Unlike BuildCharacter it fabricates
 // nothing: the character keeps its real race/class/subclass/level, ability
@@ -294,8 +318,16 @@ func applyClassBaselineStats(c *DnDCharacter) {
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 16, 13, 15, 8, 12, 10
 	case ClassRogue, ClassRanger:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 10, 16, 14, 12, 13, 8
-	case ClassMage, ClassSorcerer:
+	case ClassMage:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 8, 14, 13, 16, 12, 10
+	case ClassSorcerer:
+		// Sorcerer is a CHA caster (spellcastingMod → CHA), so its 16 goes in
+		// CHA, not INT. Previously it shared the Mage's INT-heavy array, which
+		// left the synthetic sorcerer casting at CHA mod 0 — every CHA-scaled
+		// ability (cantrip, Innate Sorcery, spell DCs) ran crippled and sorc
+		// trailed the field in every sweep. Prod players always placed 16 in
+		// CHA; this makes the sim's sorcerer match a real one.
+		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 8, 14, 13, 10, 12, 16
 	case ClassCleric, ClassDruid:
 		c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA = 12, 10, 14, 8, 16, 13
 	case ClassBard, ClassWarlock:

internal/plugin/expedition_sim_party_test.go

@@ -98,6 +98,75 @@ func TestSeatParty_RefusedFollowerHaltsTheRun(t *testing.T) {
 	}
 }
 
+// Regression: a party could never seat a follower into a Tier 6 post-game
+// zone. expeditionCmdAccept ran the plain zoneOpenToLevel level gate first, and
+// T6 zones are excluded from zonesForLevel by design, so every unlocked member
+// was refused ("beyond you for now") before the post-game check could admit
+// them. The intended party-only endgame was unreachable. The fix routes T6
+// zones through postgameUnlocked instead of the level gate.
+func TestSeatParty_PostgameZoneSeatsUnlockedMembers(t *testing.T) {
+	setupZoneRunTestDB(t)
+	s := newPartySimRunner()
+
+	leader := id.UserID("@sim-pg-ok:example")
+	member := id.UserID("@sim-pg-ok-m1:example")
+	for _, u := range []id.UserID{leader, member} {
+		if _, err := s.BuildCharacter(u, ClassFighter, postgameLevelFloor+2); err != nil {
+			t.Fatalf("build %s: %v", u, err)
+		}
+		s.Euro.Credit(u, 50000, "test")
+		if err := s.SeedPostgameUnlock(u); err != nil {
+			t.Fatalf("seed unlock %s: %v", u, err)
+		}
+	}
+	defer cleanupExpeditions(leader)
+
+	ctx := MessageContext{Sender: leader}
+	if err := s.P.handleDnDExpeditionCmd(ctx, "start "+string(ZoneOssuaryAscendant)+" heavy"); err != nil {
+		t.Fatalf("start T6 expedition: %v", err)
+	}
+	if err := s.seatParty(leader, []id.UserID{member}); err != nil {
+		t.Fatalf("seatParty refused an unlocked member into a T6 zone: %v", err)
+	}
+	exp, _ := getActiveExpedition(leader)
+	if exp == nil {
+		t.Fatal("expedition vanished while seating")
+	}
+	if size, err := partySize(exp.ID); err != nil || size != 2 {
+		t.Fatalf("roster = %d (%v), want 2 (leader + 1 unlocked member)", size, err)
+	}
+}
+
+// The post-game gate must still refuse a member who has NOT beaten both T5
+// bosses, even in a party: no smuggling an ungated seat into a T6 zone. The
+// leader is unlocked (so the expedition starts); the member is not.
+func TestSeatParty_PostgameZoneRefusesUngatedMember(t *testing.T) {
+	setupZoneRunTestDB(t)
+	s := newPartySimRunner()
+
+	leader := id.UserID("@sim-pg-gate:example")
+	member := id.UserID("@sim-pg-gate-m1:example")
+	for _, u := range []id.UserID{leader, member} {
+		if _, err := s.BuildCharacter(u, ClassFighter, postgameLevelFloor+2); err != nil {
+			t.Fatalf("build %s: %v", u, err)
+		}
+		s.Euro.Credit(u, 50000, "test")
+	}
+	// Only the leader clears the T5 gate; the member stays ungated.
+	if err := s.SeedPostgameUnlock(leader); err != nil {
+		t.Fatalf("seed leader unlock: %v", err)
+	}
+	defer cleanupExpeditions(leader)
+
+	ctx := MessageContext{Sender: leader}
+	if err := s.P.handleDnDExpeditionCmd(ctx, "start "+string(ZoneOssuaryAscendant)+" heavy"); err != nil {
+		t.Fatalf("start T6 expedition: %v", err)
+	}
+	if err := s.seatParty(leader, []id.UserID{member}); err == nil {
+		t.Fatal("seatParty admitted an ungated member into a T6 zone")
+	}
+}
+
 // A misspelled -class / -party-classes token used to build a character at the
 // unknown-class fallback — 1 HP — and the run reported a perfectly normal
 // outcome for it. Nothing downstream treats an unknown class as an error, so

internal/plugin/magic_items.go

@@ -46,10 +46,11 @@ type MagicItem struct {
 }
 
 // magicItemOverlay — hand-authored magic items that win on ID collision with
-// the generated SRD dump. Empty for now: the classifier output is the starting
-// point, and corrections (or wholly new items) land here rather than being
-// edited into the generated file.
-var magicItemOverlay []MagicItem
+// the generated SRD dump. Corrections (or wholly new items) land here rather
+// than being edited into the generated file. Today it carries the T6 signature
+// items (postgame_magic_items.go); this is a plain var reference, not an init()
+// append, so it resolves before buildMagicItemRegistry() reads it.
+var magicItemOverlay = postgameSignatureMagicItems
 
 // magicItemRegistry is the merged lookup table: the generated SRD dump with the
 // hand-authored overlay layered on top.

internal/plugin/magic_items_gameplay.go

@@ -1,6 +1,7 @@
 package plugin
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"math/rand/v2"
@@ -184,9 +185,10 @@ type magicItemEffect struct {
 }
 
 // magicItemEffectOverlay — hand-authored per-item effects that win over the
-// codified formula. Empty for now; corrections land here rather than being
-// folded into the formula, mirroring magicItemOverlay in magic_items.go.
-var magicItemEffectOverlay = map[string]magicItemEffect{}
+// codified formula. Corrections land here rather than being folded into the
+// formula, mirroring magicItemOverlay in magic_items.go. Today it carries the
+// T6 signature items' bespoke combat numbers (postgame_magic_items.go).
+var magicItemEffectOverlay = postgameSignatureEffects
 
 // rarityPowerScalar is the codified power axis: rarer item, bigger delta.
 func rarityPowerScalar(r DnDRarity) float64 {
@@ -328,6 +330,42 @@ func countAttunedMagicItems(equipped map[DnDSlot]EquippedMagicItem) int {
 	return n
 }
 
+// reconcileMagicAttunements bonds any worn attunement item that is sitting
+// inert while a bond slot is free. Bonding is strictly beneficial (there are no
+// cursed items), so the only legitimate reason for a worn attunement item to be
+// unbonded is the hard cap — the moment a slot frees, every straggler should
+// light up. Without this, an item equipped while at cap stays permanently inert:
+// the equip picker only lists inventory, so a slotted item can never be reached
+// to re-attempt bonding. Idempotent; returns the names of items it newly bonded.
+func reconcileMagicAttunements(userID id.UserID) ([]string, error) {
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return nil, err
+	}
+	used := countAttunedMagicItems(equipped)
+	if used >= dndMagicItemAttuneLimit {
+		return nil, nil
+	}
+	var bonded []string
+	for _, ds := range dndSlotOrder { // deterministic order when slots are scarce
+		if used >= dndMagicItemAttuneLimit {
+			break
+		}
+		e, ok := equipped[ds]
+		if !ok || e.Item.ID == "" || !e.Item.Attunement || e.Attuned {
+			continue
+		}
+		if _, err := db.Get().Exec(
+			`UPDATE magic_item_equipped SET attuned = 1 WHERE user_id = ? AND slot = ?`,
+			string(userID), string(ds)); err != nil {
+			return bonded, err
+		}
+		bonded = append(bonded, e.Item.Name)
+		used++
+	}
+	return bonded, nil
+}
+
 // ── Combat hook ─────────────────────────────────────────────────────────────
 
 // applyMagicItemEffects layers the player's equipped magic items onto their
@@ -522,7 +560,140 @@ func magicItemEffectSummary(mi MagicItem) string {
 	return strings.Join(parts, ", ")
 }
 
+// The equip mutation, message-free, shared by the DM resolver above and the web
+// equip queue (pete_equip.go). Splitting it out is deliberate: the ordering below
+// — evict occupant, then remove-from-inventory *before* equip, with a rollback if
+// equip fails — is the whole defence against item duplication, and a second copy
+// of it living in the web path is exactly where that defence would silently rot.
+// One implementation, two callers.
+
+// errItemNotEquippable is a *permanent* refusal (not a magic item, or a slotless
+// curio) — the caller should reject the request, not retry it. Every other error
+// from applyMagicEquip is a transient DB fault the caller may retry.
+var errItemNotEquippable = errors.New("magic-item: not equippable")
+
+// errSlotEmpty is applyMagicUnequip's permanent refusal: nothing is in that slot.
+var errSlotEmpty = errors.New("magic-item: slot empty")
+
+// magicEquipOutcome is what an equip did, for the caller to narrate. BondsBefore
+// is the attunement count *after* any swap-eviction and *before* this item, so a
+// caller reporting "bonded (N/3)" adds one.
+type magicEquipOutcome struct {
+	Effective   MagicItem // the item as worn, tempering folded in
+	SwappedBack string    // name of the occupant sent back to inventory, or ""
+	Bonded      bool      // this item took a bond just now
+	AtCap       bool      // worn but inert: it wants a bond and all 3 are used
+	BondsBefore int       // bonds in use before this item was worn
+	Healed      []string  // stragglers a freed slot let bond, post-equip
+}
+
+// applyMagicEquip wears one inventory item, preserving the anti-duplication
+// ordering. It mutates the equipment tables and sends nothing.
+func applyMagicEquip(userID id.UserID, it AdvItem) (magicEquipOutcome, error) {
+	mi, ok := magicItemFromAdvItem(it)
+	if !ok || mi.Slot == "" {
+		return magicEquipOutcome{}, errItemNotEquippable
+	}
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return magicEquipOutcome{}, err
+	}
+
+	// Return whatever occupies that slot to inventory at full value, and drop it
+	// from the local map so the bond count below reflects the post-swap state.
+	var swappedBack string
+	if prev, exists := equipped[mi.Slot]; exists && prev.Item.ID != "" {
+		back := magicItemSellAt(prev.Item, prev.Temper)
+		back.SkillSource = "magic_item:" + prev.Item.ID
+		if err := addAdvInventoryItem(userID, back); err != nil {
+			return magicEquipOutcome{}, err
+		}
+		swappedBack = prev.Item.Name
+		delete(equipped, mi.Slot)
+	}
+
+	bondsBefore := countAttunedMagicItems(equipped)
+	bonded, atCap := false, false
+	if mi.Attunement {
+		if bondsBefore >= dndMagicItemAttuneLimit {
+			atCap = true
+		} else {
+			bonded = true
+		}
+	}
+
+	// Remove the inventory row FIRST, then equip; if equip fails, restore the row.
+	// The reverse order left a transient failure with the item both worn and in the
+	// pack — a free duplicate.
+	if err := removeAdvInventoryItem(it.ID); err != nil {
+		slog.Error("magic-item: failed to remove from inventory before equip",
+			"user", userID, "item", mi.ID, "err", err)
+		return magicEquipOutcome{}, err
+	}
+	if err := equipMagicItem(userID, mi.Slot, mi.ID, bonded, it.Temper); err != nil {
+		restored := magicItemSellAt(mi, it.Temper)
+		restored.Value = it.Value
+		restored.SkillSource = "magic_item:" + mi.ID
+		if rbErr := addAdvInventoryItem(userID, restored); rbErr != nil {
+			slog.Error("magic-item: equip failed AND inventory rollback failed",
+				"user", userID, "item", mi.ID, "equip_err", err, "rollback_err", rbErr)
+		}
+		return magicEquipOutcome{}, err
+	}
+
+	// Swapping the occupant out may have freed a bond slot — light up any straggler.
+	healed, _ := reconcileMagicAttunements(userID)
+	return magicEquipOutcome{
+		Effective:   temperedItem(mi, it.Temper),
+		SwappedBack: swappedBack,
+		Bonded:      bonded,
+		AtCap:       atCap,
+		BondsBefore: bondsBefore,
+		Healed:      healed,
+	}, nil
+}
+
+// magicUnequipOutcome is what an unequip did, for the caller to narrate.
+type magicUnequipOutcome struct {
+	Item   MagicItem // the item taken off, as it was worn
+	Healed []string  // stragglers the freed bond slot let bond
+}
+
+// applyMagicUnequip takes the item off a slot and returns it to inventory,
+// mirroring the equip ordering (destructive op first, restore on failure). Sends
+// nothing.
+func applyMagicUnequip(userID id.UserID, slot DnDSlot) (magicUnequipOutcome, error) {
+	equipped, err := loadEquippedMagicItems(userID)
+	if err != nil {
+		return magicUnequipOutcome{}, err
+	}
+	e, ok := equipped[slot]
+	if !ok || e.Item.ID == "" {
+		return magicUnequipOutcome{}, errSlotEmpty
+	}
+	if err := unequipMagicItem(userID, slot); err != nil {
+		return magicUnequipOutcome{}, err
+	}
+	back := magicItemSellAt(e.Item, e.Temper)
+	back.SkillSource = "magic_item:" + e.Item.ID
+	if err := addAdvInventoryItem(userID, back); err != nil {
+		if rbErr := equipMagicItem(userID, slot, e.Item.ID, e.Attuned, e.Temper); rbErr != nil {
+			slog.Error("magic-item: unequip failed AND re-equip rollback failed",
+				"user", userID, "item", e.Item.ID, "inv_err", err, "rollback_err", rbErr)
+		}
+		return magicUnequipOutcome{}, err
+	}
+	healed, _ := reconcileMagicAttunements(userID)
+	return magicUnequipOutcome{Item: e.Effective(), Healed: healed}, nil
+}
+
 func (p *AdventurePlugin) handleEquipMagicCmd(ctx MessageContext) error {
+	// Self-heal first: bond any worn item stranded inert while a slot is free
+	// (e.g. equipped at cap, then a bond slot opened). This is the only path a
+	// slotted-but-inert item can be reached from, since the picker below lists
+	// inventory only.
+	healed, _ := reconcileMagicAttunements(ctx.Sender)
+
 	items, err := loadAdvInventory(ctx.Sender)
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to access your inventory.")
@@ -538,13 +709,23 @@ func (p *AdventurePlugin) handleEquipMagicCmd(ctx MessageContext) error {
 		}
 		magic = append(magic, it)
 	}
+	healNote := ""
+	if len(healed) > 0 {
+		healNote = fmt.Sprintf("🔗 A bond slot freed up — **%s** bonded and is now active.\n\n",
+			strings.Join(healed, "**, **"))
+	}
+
 	if len(magic) == 0 {
-		return p.SendDM(ctx.Sender,
-			"No curios to equip yet — they drop from zones or Luigi's 🔮 shelf.")
+		msg := "No curios to equip yet — they drop from zones or Luigi's 🔮 shelf."
+		if healNote != "" {
+			msg = strings.TrimSpace(healNote)
+		}
+		return p.SendDM(ctx.Sender, msg)
 	}
 
 	equipped, _ := loadEquippedMagicItems(ctx.Sender)
 	var sb strings.Builder
+	sb.WriteString(healNote)
 	sb.WriteString("🔮 **Equippable magic items:**\n\n")
 	for i, it := range magic {
 		base, _ := magicItemFromAdvItem(it)
@@ -586,78 +767,108 @@ func (p *AdventurePlugin) resolveMagicEquipReply(ctx MessageContext, interaction
 	}
 
 	it := data.Items[idx]
-	mi, ok := magicItemFromAdvItem(it)
-	if !ok || mi.Slot == "" {
+	out, err := applyMagicEquip(ctx.Sender, it)
+	if errors.Is(err, errItemNotEquippable) {
 		return p.SendDM(ctx.Sender, "That item can't be equipped anymore.")
 	}
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Failed to equip that item.")
+	}
 
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("✨ **%s** equipped in your %s slot — %s.",
+		out.Effective.Name, out.Effective.Slot, magicItemEffectSummary(out.Effective)))
+	if out.SwappedBack != "" {
+		sb.WriteString(fmt.Sprintf("\n📦 **%s** moved back to inventory.", out.SwappedBack))
+	}
+	switch {
+	case out.Bonded:
+		sb.WriteString(fmt.Sprintf("\nBonded (%d/%d bond slots used).",
+			out.BondsBefore+1, dndMagicItemAttuneLimit))
+	case out.AtCap:
+		sb.WriteString(fmt.Sprintf("\n⚠️ All %d bond slots are full — it's worn but **inert** until you free one (`!adventure unequip-magic` to take a bonded item off; this one bonds automatically once a slot opens).",
+			dndMagicItemAttuneLimit))
+	}
+	if len(out.Healed) > 0 {
+		sb.WriteString(fmt.Sprintf("\n🔗 A freed bond slot also activated **%s**.",
+			strings.Join(out.Healed, "**, **")))
+	}
+	return p.SendDM(ctx.Sender, sb.String())
+}
+
+// ── Unequip command (`!adventure unequip-magic`) ─────────────────────────────
+
+// advPendingMagicUnequip is the pending-interaction payload for the numbered
+// unequip picker. It lists slots (not inventory rows) because the item lives in
+// magic_item_equipped, not adventure_inventory.
+type advPendingMagicUnequip struct {
+	Slots []DnDSlot
+}
+
+func (p *AdventurePlugin) handleUnequipMagicCmd(ctx MessageContext) error {
 	equipped, err := loadEquippedMagicItems(ctx.Sender)
 	if err != nil {
 		return p.SendDM(ctx.Sender, "Failed to load your equipped magic items.")
 	}
-
-	// Return whatever currently occupies that slot to inventory at full
-	// value — swapping a curio shouldn't tax it. Evict from the local map
-	// too, so the attunement count below reflects the post-swap state and
-	// can re-open a slot the prior occupant was holding.
-	var swappedBackName string
-	if prev, exists := equipped[mi.Slot]; exists && prev.Item.ID != "" {
-		back := magicItemSellAt(prev.Item, prev.Temper)
-		back.SkillSource = "magic_item:" + prev.Item.ID
-		if err := addAdvInventoryItem(ctx.Sender, back); err != nil {
-			return p.SendDM(ctx.Sender, "Failed to return your currently-equipped item to inventory.")
-		}
-		swappedBackName = prev.Item.Name
-		delete(equipped, mi.Slot)
-	}
-
-	// Auto-attune when the item needs it and an attunement slot is free.
-	// Otherwise it equips inert until the player frees a slot.
-	attune := false
-	atCap := false
-	if mi.Attunement {
-		if countAttunedMagicItems(equipped) >= dndMagicItemAttuneLimit {
-			atCap = true
-		} else {
-			attune = true
-		}
-	}
-	// Remove the inventory row FIRST, then equip. If equip fails after the
-	// remove succeeded, restore inventory. Doing it in the other order
-	// meant a transient DB error on remove left the item both equipped
-	// *and* still in inventory — a free duplication.
-	if err := removeAdvInventoryItem(it.ID); err != nil {
-		slog.Error("magic-item: failed to remove from inventory before equip",
-			"user", ctx.Sender, "item", mi.ID, "err", err)
-		return p.SendDM(ctx.Sender, "Failed to equip that item.")
-	}
-	if err := equipMagicItem(ctx.Sender, mi.Slot, mi.ID, attune, it.Temper); err != nil {
-		// Roll back: try to put the item back in inventory so the player
-		// doesn't lose it. Best-effort; log if the rollback also fails.
-		restored := magicItemSellAt(mi, it.Temper)
-		restored.Value = it.Value
-		restored.SkillSource = "magic_item:" + mi.ID
-		if rbErr := addAdvInventoryItem(ctx.Sender, restored); rbErr != nil {
-			slog.Error("magic-item: equip failed AND inventory rollback failed",
-				"user", ctx.Sender, "item", mi.ID, "equip_err", err, "rollback_err", rbErr)
-		}
-		return p.SendDM(ctx.Sender, "Failed to equip that item.")
-	}
-
-	eqMI := temperedItem(mi, it.Temper)
 	var sb strings.Builder
-	sb.WriteString(fmt.Sprintf("✨ **%s** equipped in your %s slot — %s.",
-		eqMI.Name, eqMI.Slot, magicItemEffectSummary(eqMI)))
-	if swappedBackName != "" {
-		sb.WriteString(fmt.Sprintf("\n📦 **%s** moved back to inventory.", swappedBackName))
+	sb.WriteString("🔮 **Worn magic items** — reply with a number to take one off (it returns to your inventory), or \"cancel\".\n\n")
+	var slots []DnDSlot
+	for _, ds := range dndSlotOrder { // stable numbering across repeated calls
+		e, ok := equipped[ds]
+		if !ok || e.Item.ID == "" {
+			continue
+		}
+		slots = append(slots, ds)
+		mi := e.Effective()
+		status := ""
+		if mi.Attunement {
+			if e.Attuned {
+				status = " — bonded"
+			} else {
+				status = " — _(inert)_"
+			}
+		}
+		sb.WriteString(fmt.Sprintf("%d. **%s** _(%s)_ → %s slot%s\n",
+			len(slots), mi.Name, mi.Rarity, ds, status))
 	}
-	switch {
-	case mi.Attunement && attune:
-		sb.WriteString(fmt.Sprintf("\nBonded (%d/%d bond slots used).",
-			countAttunedMagicItems(equipped)+1, dndMagicItemAttuneLimit))
-	case mi.Attunement && atCap:
-		sb.WriteString(fmt.Sprintf("\n⚠️ All %d bond slots are full — it's worn but **inert** until you free one (`!adventure equip-magic` to swap).",
-			dndMagicItemAttuneLimit))
+	if len(slots) == 0 {
+		return p.SendDM(ctx.Sender, "You aren't wearing any magic items. `!adventure equip-magic` to put one on.")
 	}
+
+	p.pending.Store(string(ctx.Sender), &advPendingInteraction{
+		Type:      "magic_unequip",
+		Data:      &advPendingMagicUnequip{Slots: slots},
+		ExpiresAt: time.Now().Add(advDMResponseWindow),
+	})
 	return p.SendDM(ctx.Sender, sb.String())
 }
+
+func (p *AdventurePlugin) resolveMagicUnequipReply(ctx MessageContext, interaction *advPendingInteraction) error {
+	data := interaction.Data.(*advPendingMagicUnequip)
+	reply := strings.TrimSpace(ctx.Body)
+	if strings.EqualFold(reply, "cancel") {
+		return p.SendDM(ctx.Sender, "Unequip cancelled.")
+	}
+	idx, ok := parseMenuIndex(reply, len(data.Slots))
+	if !ok {
+		p.pending.Store(string(ctx.Sender), interaction)
+		return p.SendDM(ctx.Sender, "Invalid selection. Reply with a number from the list, or \"cancel\".")
+	}
+
+	slot := data.Slots[idx]
+	out, err := applyMagicUnequip(ctx.Sender, slot)
+	if errors.Is(err, errSlotEmpty) {
+		return p.SendDM(ctx.Sender, "That slot is already empty.")
+	}
+	if err != nil {
+		return p.SendDM(ctx.Sender, "Failed to take that item off.")
+	}
+
+	msg := fmt.Sprintf("📦 **%s** taken off your %s slot and returned to inventory.", out.Item.Name, slot)
+	// Freeing a bonded slot may let a worn-but-inert item finally bond.
+	if len(out.Healed) > 0 {
+		msg += fmt.Sprintf("\n🔗 That freed a bond slot — **%s** is now active.",
+			strings.Join(out.Healed, "**, **"))
+	}
+	return p.SendDM(ctx.Sender, msg)
+}

internal/plugin/magic_items_gameplay_test.go

@@ -252,6 +252,152 @@ func TestSwapBackReturnsFullValue(t *testing.T) {
 	}
 }
 
+// TestReconcileBondsStrandedItem reproduces the player report: an attunement
+// item equipped while at the bond cap sits inert, then a bond slot frees up.
+// The item is worn (not in inventory) so the equip picker can never reach it —
+// reconcile must be what lights it up.
+func TestReconcileBondsStrandedItem(t *testing.T) {
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+
+	user := id.UserID("@stranded:test.invalid")
+
+	// Gather attunement items in distinct slots — need cap+1 of them.
+	seen := map[DnDSlot]bool{}
+	var att []MagicItem
+	for _, ds := range dndSlotOrder {
+		for _, mi := range magicItemRegistry {
+			if mi.Attunement && mi.Slot == ds && !seen[ds] {
+				att = append(att, mi)
+				seen[ds] = true
+			}
+		}
+	}
+	if len(att) < dndMagicItemAttuneLimit+1 {
+		t.Skipf("registry has only %d attunement slots, need %d", len(att), dndMagicItemAttuneLimit+1)
+	}
+
+	// Bond the first `limit` items, then wear one more inert (attuned=false).
+	for i := 0; i < dndMagicItemAttuneLimit; i++ {
+		if err := equipMagicItem(user, att[i].Slot, att[i].ID, true, 0); err != nil {
+			t.Fatalf("bond seed %d: %v", i, err)
+		}
+	}
+	stranded := att[dndMagicItemAttuneLimit]
+	if err := equipMagicItem(user, stranded.Slot, stranded.ID, false, 0); err != nil {
+		t.Fatalf("equip stranded: %v", err)
+	}
+
+	// At cap, reconcile must be a no-op — the stranded item stays inert.
+	if healed, err := reconcileMagicAttunements(user); err != nil || len(healed) != 0 {
+		t.Fatalf("reconcile at cap = %v (err %v), want no change", healed, err)
+	}
+
+	// Free a slot (the player swaps out a bonded item), then reconcile.
+	if err := unequipMagicItem(user, att[0].Slot); err != nil {
+		t.Fatalf("free slot: %v", err)
+	}
+	healed, err := reconcileMagicAttunements(user)
+	if err != nil {
+		t.Fatalf("reconcile after free: %v", err)
+	}
+	if len(healed) != 1 || healed[0] != stranded.Name {
+		t.Fatalf("reconcile healed %v, want [%s]", healed, stranded.Name)
+	}
+
+	equipped, _ := loadEquippedMagicItems(user)
+	if !equipped[stranded.Slot].Attuned {
+		t.Errorf("stranded item still inert after reconcile")
+	}
+	if got := countAttunedMagicItems(equipped); got != dndMagicItemAttuneLimit {
+		t.Errorf("bonded count = %d, want %d", got, dndMagicItemAttuneLimit)
+	}
+
+	// Idempotent: a second pass changes nothing.
+	if healed, _ := reconcileMagicAttunements(user); len(healed) != 0 {
+		t.Errorf("second reconcile healed %v, want none", healed)
+	}
+}
+
+// TestUnequipMagicReturnsToInventoryAndHeals drives the unequip resolver end to
+// end: taking a bonded item off must return it to inventory AND free its bond
+// slot so a worn-but-inert item lights up.
+func TestUnequipMagicReturnsToInventoryAndHeals(t *testing.T) {
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(db.Close)
+
+	user := id.UserID("@unequip:test.invalid")
+
+	seen := map[DnDSlot]bool{}
+	var att []MagicItem
+	for _, ds := range dndSlotOrder {
+		for _, mi := range magicItemRegistry {
+			if mi.Attunement && mi.Slot == ds && !seen[ds] {
+				att = append(att, mi)
+				seen[ds] = true
+			}
+		}
+	}
+	if len(att) < dndMagicItemAttuneLimit+1 {
+		t.Skipf("registry has only %d attunement slots, need %d", len(att), dndMagicItemAttuneLimit+1)
+	}
+
+	// Bond the cap, then wear one more inert.
+	for i := 0; i < dndMagicItemAttuneLimit; i++ {
+		if err := equipMagicItem(user, att[i].Slot, att[i].ID, true, 0); err != nil {
+			t.Fatalf("bond seed %d: %v", i, err)
+		}
+	}
+	stranded := att[dndMagicItemAttuneLimit]
+	if err := equipMagicItem(user, stranded.Slot, stranded.ID, false, 0); err != nil {
+		t.Fatalf("equip stranded: %v", err)
+	}
+
+	p := &AdventurePlugin{} // nil Sink/Client → SendDM is a no-op
+	interaction := &advPendingInteraction{
+		Type: "magic_unequip",
+		Data: &advPendingMagicUnequip{Slots: []DnDSlot{att[0].Slot}},
+	}
+	if err := p.resolveMagicUnequipReply(MessageContext{Sender: user, Body: "1"}, interaction); err != nil {
+		t.Fatalf("resolve unequip: %v", err)
+	}
+
+	// The unequipped item is back in inventory as a curio.
+	inv, err := loadAdvInventory(user)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, it := range inv {
+		if it.SkillSource == "magic_item:"+att[0].ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("unequipped item %q not returned to inventory", att[0].ID)
+	}
+
+	// Its slot is empty, and the freed bond slot bonded the stranded item.
+	equipped, _ := loadEquippedMagicItems(user)
+	if _, still := equipped[att[0].Slot]; still {
+		t.Errorf("slot %s still occupied after unequip", att[0].Slot)
+	}
+	if !equipped[stranded.Slot].Attuned {
+		t.Errorf("stranded item did not bond after a slot freed")
+	}
+	if got := countAttunedMagicItems(equipped); got != dndMagicItemAttuneLimit {
+		t.Errorf("bonded count = %d, want %d", got, dndMagicItemAttuneLimit)
+	}
+}
+
 // TestEquippedMagicItemRoundTrip exercises the DB persistence layer: equip,
 // load, attunement counting, unequip.
 func TestEquippedMagicItemRoundTrip(t *testing.T) {

internal/plugin/mischief_delivery_sweep_test.go

@@ -0,0 +1,148 @@
+package plugin
+
+// M1 close-out sweep for gogobee_mischief_plan.md — survival per tier through the
+// REAL delivery path (runMischiefInterrupt → runZoneCombatRoster), not through
+// SimulateCombat.
+//
+// The M0 sweep that priced the fee table measured a full-HP build in a single
+// chain. Two things it could not see, and both of them are why this exists:
+//
+//   - A real target is WOUNDED. The monster arrives mid-run, after the dungeon has
+//     already taken a bite out of them. The entryHP arm is the control-vs-treatment
+//     axis: 100% reproduces M0 through the new path (so a divergence there is a
+//     path bug, not a difficulty finding), 70% and 40% are what a live delivery
+//     actually lands on.
+//   - The M2 ward. `blessings` drives the same temp-HP cushion the room buys, so
+//     we can price what €75 of charity is actually worth against an elite.
+//
+// Run (heavy — see the plan's sim rules, n≥750 per cell for a real signal):
+//
+//	MISCHIEF_SWEEP=1 go test ./internal/plugin -run TestMischiefDeliverySweep -v -timeout 4h
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// mischiefDeliveryTrial seeds a real adventurer on a real expedition at the given
+// fraction of their max HP, sends them the tier's monster through the production
+// delivery path, and reports whether they were still standing.
+//
+// Survival is read the way the delivery reads it (HP > 0), not as "won every
+// fight" — an engine timeout with HP left is a target who held the thing off.
+func mischiefDeliveryTrial(
+	t *testing.T, p *AdventurePlugin, prof classBalanceProfile,
+	tierKey string, entryHPPct float64, blessings int, seq int, rng *rand.Rand,
+) (survived bool, endHPPct float64) {
+	t.Helper()
+	uid := id.UserID(fmt.Sprintf("@sweep%d:sim", seq))
+
+	c := buildHarnessCharacter(prof)
+	c.UserID = uid
+	c.HPCurrent = int(float64(c.HPMax) * entryHPPct)
+	if c.HPCurrent < 1 {
+		c.HPCurrent = 1
+	}
+	if err := createAdvCharacter(uid, "sweep"+strconv.Itoa(seq)); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatalf("SaveDnDCharacter: %v", err)
+	}
+
+	run, err := startZoneRun(uid, ZoneGoblinWarrens, prof.Level, rng)
+	if err != nil {
+		t.Fatalf("startZoneRun: %v", err)
+	}
+	expID := "exp-sweep-" + strconv.Itoa(seq)
+	if _, err := db.Get().Exec(`
+		INSERT INTO dnd_expedition (expedition_id, user_id, zone_id, run_id, status, start_date, coins_earned)
+		VALUES (?, ?, 'goblin_warrens', ?, 'active', ?, 0)`,
+		expID, string(uid), run.RunID, time.Now().UTC()); err != nil {
+		t.Fatalf("seed expedition: %v", err)
+	}
+	exp, err := getActiveExpedition(uid)
+	if err != nil || exp == nil {
+		t.Fatalf("getActiveExpedition: %v", err)
+	}
+
+	bracket := mischiefBracketZone(prof.Level)
+	chain, ambush := mischiefMonsters(tierKey, bracket, rng)
+
+	_, _, survived = p.runMischiefInterrupt(uid, exp, bracket, chain, ambush, blessings)
+	hp, max := dndHPSnapshot(uid)
+	if max <= 0 {
+		max = 1
+	}
+	return survived, float64(hp) / float64(max)
+}
+
+func TestMischiefDeliverySweep(t *testing.T) {
+	if os.Getenv("MISCHIEF_SWEEP") == "" {
+		t.Skip("set MISCHIEF_SWEEP=1 to run")
+	}
+	trials := 250
+	if n := os.Getenv("MISCHIEF_TRIALS"); n != "" {
+		if v, err := strconv.Atoi(n); err == nil && v > 0 {
+			trials = v
+		}
+	}
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	p.Sink = &captureSink{}
+
+	rng := rand.New(rand.NewPCG(20260713, 0x64656C6976657279))
+	profiles := []classBalanceProfile{
+		{Class: ClassPaladin, Level: 3},
+		{Class: ClassMage, Level: 4},
+		{Class: ClassMage, Level: 8, Subclass: SubclassEvocation},
+		{Class: ClassFighter, Level: 12, Subclass: SubclassChampion},
+		{Class: ClassRogue, Level: 20, Subclass: SubclassArcaneTrickster},
+		{Class: ClassCleric, Level: 20, Subclass: SubclassLifeDomain},
+	}
+	// entryHP 1.0 is the control arm: it should reproduce the M0 table through the
+	// real path. The wounded arms are the finding.
+	entryHPs := []float64{1.0, 0.7, 0.4}
+
+	seq := 0
+	fmt.Printf("\n%-26s %-6s %-7s %-6s %8s %10s\n",
+		"profile", "tier", "entryHP", "wards", "survive%", "avgEndHP%")
+	for _, prof := range profiles {
+		for _, tier := range mischiefTiers {
+			for _, entry := range entryHPs {
+				// The ward arm only where a ward could decide anything: the tiers the
+				// M0 sweep did not already call theatre.
+				wardArms := []int{0}
+				if tier.Key == "elite" || tier.Key == "boss" {
+					wardArms = []int{0, mischiefBlessingCap}
+				}
+				for _, wards := range wardArms {
+					wins, hpSum := 0, 0.0
+					for i := 0; i < trials; i++ {
+						seq++
+						ok, hpPct := mischiefDeliveryTrial(t, p, prof, tier.Key, entry, wards, seq, rng)
+						if ok {
+							wins++
+							hpSum += hpPct
+						}
+					}
+					avgHP := 0.0
+					if wins > 0 {
+						avgHP = hpSum / float64(wins) * 100
+					}
+					fmt.Printf("%-26s %-6s %6.0f%% %6d %7.1f%% %9.1f%%\n",
+						fmt.Sprintf("%s L%d %s", prof.Class, prof.Level, prof.Subclass),
+						tier.Key, entry*100, wards, float64(wins)/float64(trials)*100, avgHP)
+				}
+			}
+		}
+	}
+}

internal/plugin/pete.go

@@ -183,6 +183,12 @@ func emitFact(f peteclient.Fact, subjectUser, opponentUser id.UserID) {
 		}
 	}
 	f.Actors = actors
+	// Author the prose in Pete's voice from the FINAL fact, so the names in the
+	// dispatch match the Actors allow-list Pete guards against. Best-effort: an
+	// empty pair (LLM off or authoring failed) just means Pete templates the
+	// fact. Synchronous, like the holdem tip rewrite — news facts are infrequent
+	// and the call is tightly bounded (dispatchLLMTimeout).
+	f.Headline, f.Lede = authorDispatch(f)
 	peteclient.Emit(f)
 }
 
@@ -273,8 +279,12 @@ func claimRealmFirst(kind, target string) bool {
 // *started* — every dispatch was an outcome — which is why the two live boredom
 // runs produced no news at all.
 //
-// The event_type must be one Pete already knows: an unknown type is a 400, which
-// retries and then parks the bulletin forever. Deploy Pete first.
+// The event_type no longer has to be one Pete already knows. It used to: an
+// unknown type was a 400, which retried to the cap and then parked the bulletin
+// forever, so shipping a new event type meant remembering to deploy Pete first.
+// Pete now publishes an untemplated type on a neutral fallback and counts it for
+// the operator, so the ordering rule is a property of the system rather than
+// something a human has to hold.
 func emitBoredomDeparture(userID id.UserID, zone ZoneDefinition, level int) {
 	if !peteclient.Enabled() || !newsEmissionOn() {
 		return
@@ -333,6 +343,68 @@ func emitZoneClearNews(userID id.UserID, exp *Expedition) {
 		Boss:       zone.Boss.Name,
 		Level:      lvl,
 		Outcome:    "cleared",
+		RunID:      latestRunIDForNews(userID),
+		OccurredAt: ts,
+	}, userID, "")
+}
+
+// treasureRarityWord maps a treasure def's tier to the rarity adjective Pete
+// weaves into a find's dispatch. Story-grade treasures are typically tier 5, so
+// "legendary" is the common case; the lower tiers are here for completeness.
+func treasureRarityWord(tier int) string {
+	switch {
+	case tier >= 5:
+		return "legendary"
+	case tier == 4:
+		return "epic"
+	case tier == 3:
+		return "rare"
+	case tier == 2:
+		return "uncommon"
+	default:
+		return "common"
+	}
+}
+
+// emitTreasureFound files a story-grade treasure find. Only treasures carrying a
+// RoomAnnounce string reach here — the same gate that earns them a public moment
+// — so a copper-piece pickup never becomes news. The realm's first finder of a
+// given treasure is a PRIORITY hoard; a later finder of the same item is a
+// BULLETIN, the first/repeat split zone_first already uses. Character name only;
+// no-op unless the seam is enabled.
+//
+// treasure_found is an event_type Pete's ingest must already know: an unknown
+// type 400s, retries to the cap, then parks the bulletin forever. Deploy Pete
+// first.
+func emitTreasureFound(userID id.UserID, def *AdvTreasureDef, loc *AdvLocation) {
+	if !peteclient.Enabled() || !newsEmissionOn() {
+		return
+	}
+	if def == nil || loc == nil {
+		return
+	}
+	// Claim the realm-first BEFORE the name guard, so an unnamed straggler's
+	// genuine first find still seeds the ledger and the next finder isn't
+	// mis-billed as the first-ever. Mirrors emitZoneClearNews.
+	tier := "bulletin"
+	if claimRealmFirst("treasure", def.Key) {
+		tier = "priority"
+	}
+	name := charName(userID)
+	if name == "" {
+		return
+	}
+	ts := nowUnix()
+	disc := fmt.Sprintf("%s:%d", def.Key, ts)
+	emitFact(peteclient.Fact{
+		GUID:       fmt.Sprintf("treasure_found:%s:%s:%d", eventToken(userID, disc), def.Key, ts),
+		EventType:  "treasure_found",
+		Tier:       tier,
+		Subject:    name,
+		Zone:       loc.Name,
+		Level:      charLevel(userID),
+		Stakes:     def.Name,
+		Outcome:    treasureRarityWord(def.Tier),
 		OccurredAt: ts,
 	}, userID, "")
 }

internal/plugin/pete_compare_test.go

@@ -0,0 +1,169 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/peteclient"
+)
+
+// weapon/ring/wondrous helpers build a MagicItem the codified effect formula
+// (magicItemEffectFor) can score without touching the DB.
+func mkItem(kind MagicItemKind, rarity DnDRarity, slot DnDSlot) MagicItem {
+	return MagicItem{ID: string(kind) + "_" + string(rarity), Kind: kind, Rarity: rarity, Slot: slot}
+}
+
+// TestMagicItemDeltasDirection pins the "which way is better" call for each stat,
+// including DamageReductMult where LOWER is the improvement.
+func TestMagicItemDeltasDirection(t *testing.T) {
+	neutral := magicItemEffect{DamageReductMult: 1.0}
+
+	t.Run("more damage is better", func(t *testing.T) {
+		d := magicItemDeltas(magicItemEffect{DamageBonus: 0.15, DamageReductMult: 1.0}, magicItemEffect{DamageBonus: 0.10, DamageReductMult: 1.0})
+		if len(d) != 1 || d[0].Label != "damage" || !d[0].Better || d[0].Text != "+5% damage" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("less damage taken is better", func(t *testing.T) {
+		// cand mult 0.90 (blocks 10%) vs worn neutral 1.0 (blocks nothing).
+		d := magicItemDeltas(magicItemEffect{DamageReductMult: 0.90}, neutral)
+		if len(d) != 1 || d[0].Label != "defense" || !d[0].Better || d[0].Text != "-10% damage taken" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("weaker armor reads as worse", func(t *testing.T) {
+		// cand blocks less than worn: mult rises, damage taken goes up.
+		d := magicItemDeltas(magicItemEffect{DamageReductMult: 0.96}, magicItemEffect{DamageReductMult: 0.90})
+		if len(d) != 1 || d[0].Better || d[0].Text != "+6% damage taken" {
+			t.Fatalf("got %+v", d)
+		}
+	})
+
+	t.Run("hp and opening damage", func(t *testing.T) {
+		d := magicItemDeltas(
+			magicItemEffect{DamageReductMult: 1.0, MaxHP: 10, FlatDmgStart: 3},
+			magicItemEffect{DamageReductMult: 1.0, MaxHP: 6, FlatDmgStart: 5},
+		)
+		byLabel := map[string]itemDelta{}
+		for _, x := range d {
+			byLabel[x.Label] = itemDelta{x.Better, x.Text}
+		}
+		if v := byLabel["hp"]; v.text != "+4 HP" || !v.better {
+			t.Errorf("hp: %+v", v)
+		}
+		if v := byLabel["opening"]; v.text != "-2 opening damage" || v.better {
+			t.Errorf("opening: %+v", v)
+		}
+	})
+
+	t.Run("sub-percent change is dropped", func(t *testing.T) {
+		// 0.004 fraction = 0.4% → rounds to 0% → not a visible delta.
+		if d := magicItemDeltas(
+			magicItemEffect{DamageBonus: 0.104, DamageReductMult: 1.0},
+			magicItemEffect{DamageBonus: 0.100, DamageReductMult: 1.0},
+		); len(d) != 0 {
+			t.Fatalf("expected no visible delta, got %+v", d)
+		}
+	})
+}
+
+type itemDelta struct {
+	better bool
+	text   string
+}
+
+// TestCompareVerdict pins strict-dominance classification and the overrides.
+func TestCompareVerdict(t *testing.T) {
+	gain := []peteclient.ItemDelta{{Better: true}}
+	loss := []peteclient.ItemDelta{{Better: false}}
+	mixed := []peteclient.ItemDelta{{Better: true}, {Better: false}}
+
+	cases := []struct {
+		name        string
+		deltas      []peteclient.ItemDelta
+		empty, inrt bool
+		want        string
+	}{
+		{"all gains", gain, false, false, "upgrade"},
+		{"all losses", loss, false, false, "downgrade"},
+		{"mixed", mixed, false, false, "sidegrade"},
+		{"no change", nil, false, false, "same"},
+		{"empty slot", gain, true, false, "new"},
+		{"inert overrides upgrade", gain, false, true, "inert"},
+		{"inert overrides new", gain, true, true, "inert"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := compareVerdict(c.deltas, c.empty, c.inrt); got != c.want {
+				t.Errorf("compareVerdict(%s) = %q, want %q", c.name, got, c.want)
+			}
+		})
+	}
+}
+
+// TestMagicItemCompareIntegration drives the whole builder against equipped maps.
+func TestMagicItemCompareIntegration(t *testing.T) {
+	rareWpn := mkItem(MagicItemWeapon, RarityRare, DnDSlotMainHand)    // +15% damage
+	uncWpn := mkItem(MagicItemWeapon, RarityUncommon, DnDSlotMainHand) // +10% damage
+
+	t.Run("upgrade over a weaker worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: uncWpn}}
+		c := magicItemCompare(rareWpn, 0, eq)
+		if c.Verdict != "upgrade" || c.VsName != uncWpn.Name || c.VsSlot != "main_hand" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("downgrade under a stronger worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: rareWpn}}
+		if c := magicItemCompare(uncWpn, 0, eq); c.Verdict != "downgrade" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("same as an identical worn weapon", func(t *testing.T) {
+		eq := map[DnDSlot]EquippedMagicItem{DnDSlotMainHand: {Slot: DnDSlotMainHand, Item: rareWpn}}
+		c := magicItemCompare(rareWpn, 0, eq)
+		if c.Verdict != "same" || len(c.Deltas) != 0 {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("new into an empty slot names no worn item", func(t *testing.T) {
+		c := magicItemCompare(rareWpn, 0, map[DnDSlot]EquippedMagicItem{})
+		if c.Verdict != "new" || c.VsName != "" || len(c.Deltas) == 0 {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("attunement item with no free bond is inert", func(t *testing.T) {
+		ring := mkItem(MagicItemRing, RarityRare, DnDSlotRing1)
+		ring.Attunement = true
+		// Three bonds spent elsewhere; the ring slot is empty. Wearing it does nothing.
+		eq := map[DnDSlot]EquippedMagicItem{
+			DnDSlotChest:  {Slot: DnDSlotChest, Item: mkItem(MagicItemArmor, RarityRare, DnDSlotChest), Attuned: true},
+			DnDSlotAmulet: {Slot: DnDSlotAmulet, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotAmulet), Attuned: true},
+			DnDSlotCloak:  {Slot: DnDSlotCloak, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotCloak), Attuned: true},
+		}
+		if c := magicItemCompare(ring, 0, eq); c.Verdict != "inert" {
+			t.Fatalf("got %+v", c)
+		}
+	})
+
+	t.Run("evicting the worn occupant frees its bond, so not inert", func(t *testing.T) {
+		ring := mkItem(MagicItemRing, RarityRare, DnDSlotRing1)
+		ring.Attunement = true
+		wornRing := mkItem(MagicItemRing, RarityUncommon, DnDSlotRing1)
+		wornRing.Attunement = true
+		// Three bonds spent — but one of them is the ring the candidate would replace.
+		eq := map[DnDSlot]EquippedMagicItem{
+			DnDSlotRing1:  {Slot: DnDSlotRing1, Item: wornRing, Attuned: true},
+			DnDSlotChest:  {Slot: DnDSlotChest, Item: mkItem(MagicItemArmor, RarityRare, DnDSlotChest), Attuned: true},
+			DnDSlotAmulet: {Slot: DnDSlotAmulet, Item: mkItem(MagicItemWondrous, RarityRare, DnDSlotAmulet), Attuned: true},
+		}
+		if c := magicItemCompare(ring, 0, eq); c.Verdict == "inert" {
+			t.Fatalf("bond freed by eviction, should not be inert: %+v", c)
+		}
+	})
+}

internal/plugin/pete_detail_test.go

@@ -0,0 +1,280 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The adventurer detail-page push has two halves, matched to two sensitivities:
+// the public sheet (stats + gear) rides the roster snapshot keyed by the
+// anonymous token, and the private self-view (inventory/vault/house/pets) rides
+// its own push keyed by localpart. These tests pin both halves at the gogobee
+// end — that the public detail carries no handle, and that the private detail is
+// keyed so Pete can only ever hand it back to its owner.
+
+// seedDetailPlayer builds a real, playable adventurer: player_meta + tier-0
+// equipment (via createAdvCharacter) plus a confirmed combat sheet. Real rows on
+// purpose — the same modernc scan hazard the roster snapshot dances around.
+func seedDetailPlayer(t *testing.T, uid id.UserID, name string, level int) {
+	t.Helper()
+	if err := createAdvCharacter(uid, name); err != nil {
+		t.Fatalf("createAdvCharacter(%s): %v", uid, err)
+	}
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: level,
+		STR: 16, DEX: 14, CON: 15, INT: 10, WIS: 12, CHA: 8,
+		HPMax: 42, HPCurrent: 30, TempHP: 5, ArmorClass: 17,
+		PendingSetup: false,
+	}); err != nil {
+		t.Fatalf("SaveDnDCharacter(%s): %v", uid, err)
+	}
+}
+
+// TestRosterDetailPublicSheet: buildRosterSnapshot hangs the public sheet on
+// each board entry — HP/AC/abilities/mods and equipped gear — and nothing that
+// could name the player. This is the click-through page's whole payload.
+func TestRosterDetailPublicSheet(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@josie:test")
+	seedDetailPlayer(t, uid, "Josie", 5)
+
+	snap, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(snap.Adventurers) != 1 {
+		t.Fatalf("board has %d adventurers, want 1", len(snap.Adventurers))
+	}
+	e := snap.Adventurers[0]
+	if e.Detail == nil {
+		t.Fatal("board entry carries no detail sheet — the detail page would fall back to the bare row")
+	}
+	d := e.Detail
+	if d.HPMax != 42 || d.HPCurrent != 30 || d.TempHP != 5 || d.ArmorClass != 17 {
+		t.Errorf("detail sheet = %+v, want HP 30/42 (+5 temp), AC 17", d)
+	}
+	if d.Abilities != [6]int{16, 14, 15, 10, 12, 8} {
+		t.Errorf("abilities = %v, want STR..CHA 16,14,15,10,12,8", d.Abilities)
+	}
+	// CON 15 → +2; a mismatched mods slice would misprint the whole sheet.
+	if d.Modifiers[2] != 2 {
+		t.Errorf("CON modifier = %d, want +2", d.Modifiers[2])
+	}
+	// createAdvCharacter seeds tier-0 gear in every slot, so the panel is full.
+	if len(d.Gear) != len(allSlots) {
+		t.Errorf("gear panel has %d pieces, want %d (one per slot)", len(d.Gear), len(allSlots))
+	}
+	for _, g := range d.Gear {
+		if g.Slot == "" || g.Name == "" {
+			t.Errorf("gear piece is unlabelled: %+v", g)
+		}
+	}
+}
+
+// TestRosterDetailExpeditionContext: a player who is out on a run gets the live
+// expedition fields layered onto their sheet — supplies, threat, and the room
+// counter — so the detail page shows where they are, not just who they are.
+func TestRosterDetailExpeditionContext(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@onrun:test")
+	exp := seedMischiefTarget(t, uid, 5, 60) // createAdvCharacter + sheet + live run
+	_ = exp
+
+	snap, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(snap.Adventurers) != 1 {
+		t.Fatalf("board has %d adventurers, want 1", len(snap.Adventurers))
+	}
+	e := snap.Adventurers[0]
+	if e.Status != "expedition" {
+		t.Fatalf("status = %q, want expedition", e.Status)
+	}
+	if e.Detail == nil {
+		t.Fatal("on-run entry carries no detail")
+	}
+	if e.Detail.Room == "" {
+		t.Error("expedition detail has no room counter — the run context didn't layer on")
+	}
+}
+
+// TestDetailSnapshotKeyedByLocalpart is the ownership contract at the source.
+// The private set is keyed by localpart and carries the player's current board
+// token, so Pete can answer "is this signed-in viewer the owner of this page?"
+// by a join — never by reversing the one-way token. And it carries the actual
+// private goods: inventory, vault, house, pets.
+func TestDetailSnapshotKeyedByLocalpart(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@quack:test")
+	seedDetailPlayer(t, uid, "Quack", 7)
+
+	// Backpack + vault: two distinct stashes that must not blur together.
+	if err := addAdvInventoryItem(uid, AdvItem{Name: "Iron Ore", Type: "ore", Tier: 1, Value: 10}); err != nil {
+		t.Fatal(err)
+	}
+	if err := addAdvInventoryItem(uid, AdvItem{Name: "Jeweled Crown", Type: "treasure", Tier: 4, Value: 5000}); err != nil {
+		t.Fatal(err)
+	}
+	if got := vaultStoreItem(uid, "crown"); got == "" {
+		t.Fatal("failed to vault the crown")
+	}
+
+	// House + a pet, through the canonical save path.
+	adv, err := loadAdvCharacter(uid)
+	if err != nil {
+		t.Fatalf("loadAdvCharacter: %v", err)
+	}
+	adv.HouseTier = 2
+	adv.HouseLoanBalance = 1500
+	adv.PetType = "cat"
+	adv.PetName = "Mittens"
+	adv.PetLevel = 3
+	if err := saveAdvCharacter(adv); err != nil {
+		t.Fatalf("saveAdvCharacter: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(snap.Players) != 1 {
+		t.Fatalf("detail set has %d players, want 1", len(snap.Players))
+	}
+	pd := snap.Players[0]
+	if pd.Localpart != "quack" {
+		t.Errorf("localpart = %q, want the lowercase mxid localpart 'quack'", pd.Localpart)
+	}
+	if pd.Token != eventToken(uid, "roster") {
+		t.Error("detail token is not the board token — the ownership join on Pete would never match the page")
+	}
+	// Inventory holds the ore (crown was vaulted out of it); vault holds the crown.
+	if len(pd.Inventory) != 1 || pd.Inventory[0].Name != "Iron Ore" {
+		t.Errorf("inventory = %+v, want just the ore", pd.Inventory)
+	}
+	if len(pd.Vault) != 1 || pd.Vault[0].Name != "Jeweled Crown" {
+		t.Errorf("vault = %+v, want just the crown", pd.Vault)
+	}
+	if pd.House.Tier != 2 || pd.House.LoanBalance != 1500 {
+		t.Errorf("house = %+v, want tier 2 / loan 1500", pd.House)
+	}
+	if len(pd.Pets) != 1 || pd.Pets[0].Name != "Mittens" || pd.Pets[0].Level != 3 {
+		t.Errorf("pets = %+v, want the cat Mittens L3", pd.Pets)
+	}
+}
+
+// TestDetailSnapshotIgnoresOptOut: the news opt-out governs the *public* board,
+// not the private self-view. A player who opted out must still receive their own
+// sheet — Pete only ever serves this back to them — so buildDetailSnapshot must
+// NOT filter on it, unlike buildRosterSnapshot.
+func TestDetailSnapshotIgnoresOptOut(t *testing.T) {
+	newMischiefTestDB(t)
+	shown := id.UserID("@shown:test")
+	hidden := id.UserID("@hidden:test")
+	seedDetailPlayer(t, shown, "Shown", 4)
+	seedDetailPlayer(t, hidden, "Hidden", 4)
+	setNewsOptout(hidden, true)
+
+	// The public board drops the opted-out player...
+	roster, err := buildRosterSnapshot(time.Now().UTC(), nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	if len(roster.Adventurers) != 1 || roster.Adventurers[0].Name != "Shown" {
+		t.Fatalf("public board = %d entries, want just Shown", len(roster.Adventurers))
+	}
+
+	// ...but the private detail set keeps them both.
+	detail, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(detail.Players) != 2 {
+		t.Fatalf("private detail set = %d players, want 2 — opt-out must not deny a player their own self-view", len(detail.Players))
+	}
+	byLP := map[string]bool{}
+	for _, p := range detail.Players {
+		byLP[p.Localpart] = true
+	}
+	if !byLP["hidden"] {
+		t.Error("opted-out player is missing from the private self-view set")
+	}
+}
+
+// TestDetailSnapshotSkipsDeadPlayers: the set is drawn from alive players only.
+// A dead character has no live board page to own, and pushing their stale
+// inventory would leave it standing on Pete after they're gone.
+func TestDetailSnapshotSkipsDeadPlayers(t *testing.T) {
+	newMischiefTestDB(t)
+	alive := id.UserID("@alive:test")
+	dead := id.UserID("@dead:test")
+	seedDetailPlayer(t, alive, "Alive", 4)
+	seedDetailPlayer(t, dead, "Dead", 4)
+	if _, err := db.Get().Exec(`UPDATE player_meta SET alive = 0 WHERE user_id = ?`, string(dead)); err != nil {
+		t.Fatalf("kill player: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	if len(snap.Players) != 1 || snap.Players[0].Localpart != "alive" {
+		t.Fatalf("detail set = %+v, want just the living player", snap.Players)
+	}
+}
+
+// TestPetXPRidesTheCurveNotACopyOfIt pins the unit and the cap, which are the two
+// ways this can go quietly wrong on the web. XP is stored in centi-XP — a pet
+// earns 1.5 points an action and the ledger is an int — so a page that read XP
+// against a whole-number threshold would draw a bar 100x too full. And a capped
+// pet must report 0 needed rather than the next band's number, or its bar sits
+// forever short of a level it can never gain.
+func TestPetXPRidesTheCurveNotACopyOfIt(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@quack:test")
+	seedDetailPlayer(t, uid, "Quack", 7)
+
+	adv, err := loadAdvCharacter(uid)
+	if err != nil {
+		t.Fatalf("loadAdvCharacter: %v", err)
+	}
+	adv.PetType = "cat"
+	adv.PetName = "Mittens"
+	adv.PetLevel = 4
+	adv.PetXP = 750 // 7.5 of the 20 points level 4 wants
+	adv.Pet2Type = "dog"
+	adv.Pet2Name = "Rex"
+	adv.Pet2Level = petMaxLevel
+	adv.Pet2XP = 0
+	if err := saveAdvCharacter(adv); err != nil {
+		t.Fatalf("saveAdvCharacter: %v", err)
+	}
+
+	snap, err := (&AdventurePlugin{}).buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildDetailSnapshot: %v", err)
+	}
+	pets := snap.Players[0].Pets
+	if len(pets) != 2 {
+		t.Fatalf("pets = %+v, want both slots", pets)
+	}
+	byName := map[string]int{}
+	for i, p := range pets {
+		byName[p.Name] = i
+	}
+	mittens := pets[byName["Mittens"]]
+	if mittens.XP != 750 {
+		t.Errorf("Mittens XP = %d, want the stored centi-XP 750", mittens.XP)
+	}
+	if want := petXPToNextLevel(4) * 100; mittens.XPNeeded != want {
+		t.Errorf("Mittens XPNeeded = %d, want %d — the curve is in centi-XP too",
+			mittens.XPNeeded, want)
+	}
+	if rex := pets[byName["Rex"]]; rex.XPNeeded != 0 {
+		t.Errorf("a capped pet needs %d more XP; want 0, meaning nothing left to earn", rex.XPNeeded)
+	}
+}

internal/plugin/pete_dispatch_voice.go

@@ -0,0 +1,203 @@
+package plugin
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"gogobee/internal/peteclient"
+)
+
+// LLM-authored adventure dispatches. gogobee owns the raw model compute; this is
+// where a structured fact becomes warm-reporter prose for Pete to publish. Pete
+// is still the editor and the safety boundary: it runs its own prose-guard over
+// whatever we send and falls back to its templates on anything it does not like,
+// so authoring here is best-effort by design — every failure path returns an
+// empty pair and Pete templates the fact.
+//
+// The voice must live somewhere, and with no route for Pete to call back into
+// this box (see roster.go in the Pete repo) it lives in the prompt below. Keep
+// it faithful to pete_adventure_news_voice.md; Pete's persona, not gogobee's.
+
+// dispatchLLMTimeout bounds the authoring call. emitFact runs on game-event
+// chokepoints (a party wipe fires one per member), so this is deliberately far
+// tighter than the interactive 120s tip budget: if the model cannot turn a
+// handful of facts into two sentences this fast, it is effectively down, and a
+// template dispatch now beats a voiced one late.
+const dispatchLLMTimeout = 15 * time.Second
+
+// Length ceilings, mirrored from Pete's proseGuard so we never ship prose Pete
+// will reject for length alone. Byte counts, matching Pete's len() check.
+const (
+	maxDispatchHeadline = 200
+	maxDispatchLede     = 800
+)
+
+var dispatchHTTP = &http.Client{Timeout: dispatchLLMTimeout}
+
+// authorDispatch turns a fact into a headline+lede in Pete's voice, or returns
+// two empty strings if the model is unconfigured, errors, times out, or produces
+// anything malformed. The fact must already have its FINAL Actors set (post
+// opt-out anonymisation) — that list is the only set of names the prose may use,
+// and it is what Pete's guard checks the output against.
+func authorDispatch(f peteclient.Fact) (headline, lede string) {
+	host := os.Getenv("OLLAMA_HOST")
+	model := os.Getenv("OLLAMA_MODEL")
+	if host == "" || model == "" {
+		return "", ""
+	}
+
+	prompt := buildDispatchPrompt(f)
+	raw, err := callOllamaDispatch(dispatchHTTP, host, model, prompt)
+	if err != nil {
+		slog.Warn("pete dispatch: LLM authoring failed, Pete will template", "guid", f.GUID, "err", err)
+		return "", ""
+	}
+
+	h, l, ok := parseDispatch(raw)
+	if !ok {
+		slog.Warn("pete dispatch: unparseable LLM output, Pete will template", "guid", f.GUID)
+		return "", ""
+	}
+	// Ship only a complete, in-bounds pair. A half-authored dispatch or an
+	// over-long one is exactly what Pete would reject anyway; catch it here so a
+	// bad generation costs nothing on the wire.
+	if h == "" || l == "" || len(h) > maxDispatchHeadline || len(l) > maxDispatchLede {
+		slog.Warn("pete dispatch: LLM output empty or over length, Pete will template",
+			"guid", f.GUID, "headline_len", len(h), "lede_len", len(l))
+		return "", ""
+	}
+	return h, l
+}
+
+// buildDispatchPrompt renders the persona, the strict rules, and this fact's
+// structured facts into a single prompt. The facts block lists only the fields
+// that are set, each labelled, so the model has the who/what/where and no room
+// to invent the rest.
+func buildDispatchPrompt(f peteclient.Fact) string {
+	var facts strings.Builder
+	add := func(label, val string) {
+		if val != "" {
+			fmt.Fprintf(&facts, "- %s: %s\n", label, val)
+		}
+	}
+	addN := func(label string, n int) {
+		if n != 0 {
+			fmt.Fprintf(&facts, "- %s: %d\n", label, n)
+		}
+	}
+	add("event", f.EventType)
+	add("who this is about (the subject)", f.Subject)
+	add("the other person named", f.Opponent)
+	add("monster or boss", f.Boss)
+	add("dungeon or zone", f.Zone)
+	add("region", f.Region)
+	addN("character level", f.Level)
+	addN("count", f.Count)
+	add("outcome", f.Outcome)
+	add("stakes or item", f.Stakes)
+	add("class and race", f.ClassRace)
+	add("milestone", f.Milestone)
+
+	names := "(none — this is a realm-level event with no named adventurer)"
+	if len(f.Actors) > 0 {
+		names = strings.Join(f.Actors, ", ")
+	}
+
+	return fmt.Sprintf(`You are Pete, a warm, friendly local news reporter for a fantasy adventuring town. Think a beloved local newscaster who genuinely knows everyone and is glad to see them. You have journalistic bones — a clear headline and a who/what/where lede that gets the facts right — delivered with personable, first-person warmth. You root for the community, celebrate wins, mourn losses gently, welcome newcomers. Conversational, never snarky, never a caps-lock hype-man. Warmth carries the register, not exclamation marks.
+
+Write a short news dispatch about the event below.
+
+STRICT RULES — do not violate these:
+- Use ONLY these adventurer names, exactly as written: %s. Never invent a name, never use any other person's name, never use an @-handle.
+- Use ONLY the facts listed. Do not invent numbers, outcomes, items, or events that are not below.
+- The monster/boss, zone, region and item names are game names — you may use them as given.
+- Do not address the reader as "you" unless the event is Pete's own duel.
+- No markdown, no emoji, no quotation marks around the whole thing.
+
+Respond with ONLY a JSON object, no other text:
+{"headline": "one short sentence, a real headline", "lede": "one to three warm sentences with the who/what/where"}
+
+The event:
+%s`, names, facts.String())
+}
+
+// callOllamaDispatch posts a single non-streaming generation and returns the raw
+// completion (think-tags stripped). The client is a parameter because the two
+// callers have genuinely different patience: a dispatch is authored on a game
+// chokepoint and must not stall it, while a run summary rides a background
+// ticker and can afford to wait for a bigger model. See runSummaryHTTP.
+func callOllamaDispatch(client *http.Client, host, model, prompt string) (string, error) {
+	payload := map[string]interface{}{
+		"model":  model,
+		"prompt": prompt,
+		"stream": false,
+		"think":  false,
+		"options": map[string]interface{}{
+			"num_ctx": 4096,
+		},
+	}
+	data, err := json.Marshal(payload)
+	if err != nil {
+		return "", fmt.Errorf("marshal payload: %w", err)
+	}
+	apiURL := strings.TrimRight(host, "/") + "/api/generate"
+	resp, err := client.Post(apiURL, "application/json", bytes.NewReader(data))
+	if err != nil {
+		return "", fmt.Errorf("ollama request: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("ollama HTTP %d: %s", resp.StatusCode, string(body))
+	}
+	var result struct {
+		Response string `json:"response"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return "", fmt.Errorf("parse response: %w", err)
+	}
+	return result.Response, nil
+}
+
+// parseDispatch pulls {headline, lede} out of the model's completion, tolerating
+// the usual noise (think blocks, markdown fences, prose around the JSON). ok is
+// false when no JSON object with a headline can be recovered.
+func parseDispatch(raw string) (headline, lede string, ok bool) {
+	s := raw
+	// Drop a Qwen-style reasoning block if present.
+	if i := strings.Index(s, "<think>"); i != -1 {
+		if j := strings.Index(s, "</think>"); j != -1 {
+			s = s[:i] + s[j+len("</think>"):]
+		}
+	}
+	// Isolate the first {...} object so surrounding prose or fences don't break
+	// the decode.
+	start := strings.Index(s, "{")
+	end := strings.LastIndex(s, "}")
+	if start < 0 || end <= start {
+		return "", "", false
+	}
+	var out struct {
+		Headline string `json:"headline"`
+		Lede     string `json:"lede"`
+	}
+	if err := json.Unmarshal([]byte(s[start:end+1]), &out); err != nil {
+		return "", "", false
+	}
+	headline = strings.TrimSpace(out.Headline)
+	lede = strings.TrimSpace(out.Lede)
+	if headline == "" {
+		return "", "", false
+	}
+	return headline, lede, true
+}

internal/plugin/pete_dispatch_voice_test.go

@@ -0,0 +1,81 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+
+	"gogobee/internal/peteclient"
+)
+
+func TestParseDispatch(t *testing.T) {
+	cases := []struct {
+		name        string
+		raw         string
+		wantOK      bool
+		wantHeadPre string
+	}{
+		{
+			name:        "clean json",
+			raw:         `{"headline": "Josie cleared the Ossuary.", "lede": "Alone, no less."}`,
+			wantOK:      true,
+			wantHeadPre: "Josie cleared",
+		},
+		{
+			name:        "wrapped in prose and fences",
+			raw:         "Sure! Here you go:\n```json\n{\"headline\":\"A win.\",\"lede\":\"Nice one.\"}\n```",
+			wantOK:      true,
+			wantHeadPre: "A win.",
+		},
+		{
+			name:        "think block stripped",
+			raw:         "<think>let me consider the tone</think>\n{\"headline\":\"Held the line.\",\"lede\":\"Proud of you all.\"}",
+			wantOK:      true,
+			wantHeadPre: "Held the line.",
+		},
+		{name: "no json", raw: "I could not write that.", wantOK: false},
+		{name: "empty headline", raw: `{"headline":"","lede":"body"}`, wantOK: false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h, l, ok := parseDispatch(c.raw)
+			if ok != c.wantOK {
+				t.Fatalf("ok = %v, want %v (h=%q l=%q)", ok, c.wantOK, h, l)
+			}
+			if ok && !strings.HasPrefix(h, c.wantHeadPre) {
+				t.Errorf("headline = %q, want prefix %q", h, c.wantHeadPre)
+			}
+		})
+	}
+}
+
+// TestBuildDispatchPrompt pins the two properties the prose-guard depends on:
+// the allowed names are stated verbatim, and only the set facts appear (no empty
+// labels for the model to fill in with invention).
+func TestBuildDispatchPrompt(t *testing.T) {
+	f := peteclient.Fact{
+		EventType: "boss_kill", Subject: "Josie", Boss: "the Bone Warden",
+		Zone: "the Ossuary", Level: 14, Actors: []string{"Josie"},
+	}
+	p := buildDispatchPrompt(f)
+
+	if !strings.Contains(p, "ONLY these adventurer names, exactly as written: Josie") {
+		t.Errorf("prompt does not constrain names to Actors:\n%s", p)
+	}
+	if !strings.Contains(p, "the Bone Warden") || !strings.Contains(p, "the Ossuary") {
+		t.Error("prompt dropped a supplied fact")
+	}
+	// Unset fields must not appear as empty labels.
+	if strings.Contains(p, "region:") || strings.Contains(p, "milestone:") {
+		t.Errorf("prompt lists an unset fact:\n%s", p)
+	}
+}
+
+// TestBuildDispatchPromptRealmEvent: a realm-level fact with no named adventurer
+// still produces a usable prompt that tells the model there is no name to use.
+func TestBuildDispatchPromptRealmEvent(t *testing.T) {
+	f := peteclient.Fact{EventType: "siege_start", Boss: "the Horde", Stakes: "the whole town"}
+	p := buildDispatchPrompt(f)
+	if !strings.Contains(p, "no named adventurer") {
+		t.Errorf("realm event prompt missing the no-name note:\n%s", p)
+	}
+}

internal/plugin/pete_equip.go

@@ -0,0 +1,282 @@
+package plugin
+
+// The web equip queue's game-side loop.
+//
+// An owner asks, on their own detail page on Pete, to wear or take off an item.
+// Pete records the intent; we poll for it, run the real equip against our own
+// equipment tables, and file a verdict Pete shows them. Same reverse-pipe shape
+// as mischief — Pete has no route into this box, so we ask for work rather than
+// being told about it.
+//
+// The one thing that is NOT like mischief: the underlying action isn't
+// idempotent. Equipping consumes an inventory row and unequipping mints a fresh
+// one, so simply re-running a re-offered order would double-move the item. So
+// before we touch anything we check the equip_applied_orders ledger: if this
+// order's guid is already there, the mutation happened on an earlier tick and we
+// only lost the verdict-ack — we re-file the stored verdict and mutate nothing.
+// The guid is still the end-to-end key; here it guards a non-idempotent action
+// instead of riding a naturally idempotent one.
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+const (
+	equipPollInterval = 30 * time.Second
+	equipPollTimeout  = 20 * time.Second
+)
+
+// peteEquipTicker polls Pete for equip orders and fulfils them. Started alongside
+// the other adventure tickers; exits on stopCh.
+func (p *AdventurePlugin) peteEquipTicker() {
+	if !peteclient.Enabled() {
+		return // no Pete wire configured; the equip queue is simply off
+	}
+	ticker := time.NewTicker(equipPollInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-ticker.C:
+			p.pollEquipOrders()
+		}
+	}
+}
+
+func (p *AdventurePlugin) pollEquipOrders() {
+	ctx, cancel := context.WithTimeout(context.Background(), equipPollTimeout)
+	defer cancel()
+
+	orders, err := peteclient.PendingEquip(ctx)
+	if err != nil {
+		// A Pete predating the queue answers 404; a wire blip looks the same. Quiet
+		// on purpose — this must not spam while Pete hasn't shipped the endpoint.
+		slog.Debug("equip: poll failed", "err", err)
+		return
+	}
+	for _, order := range orders {
+		p.fulfilEquipOrder(ctx, order)
+	}
+}
+
+// fulfilEquipOrder applies one order and files its verdict. A transient failure is
+// left pending for the next poll (no verdict); a permanent one gets a specific
+// rejection. The guid ledger makes a re-offer after a lost ack a no-op that simply
+// re-files the verdict.
+func (p *AdventurePlugin) fulfilEquipOrder(ctx context.Context, order peteclient.EquipOrder) {
+	// Already applied on an earlier tick? Re-file the stored verdict, mutate nothing.
+	if status, detail, ok := equipOrderAlreadyApplied(order.GUID); ok {
+		if err := peteclient.VerdictEquip(ctx, order.GUID, status, detail); err != nil {
+			slog.Warn("equip: re-file verdict push failed, will retry next poll",
+				"order", order.GUID, "status", status, "err", err)
+		}
+		return
+	}
+
+	owner, ok := p.equipOwnerMXID(order.OwnerLocalpart)
+	if !ok {
+		// The client isn't up (tests) or the localpart is empty. Not our order to
+		// fail permanently — leave it pending and try again once we can name the owner.
+		slog.Debug("equip: cannot resolve owner, leaving pending", "order", order.GUID, "owner", order.OwnerLocalpart)
+		return
+	}
+
+	status, detail, retry := p.applyEquipOrder(owner, order)
+	if retry {
+		return // transient; leave pending for the next tick
+	}
+
+	// Record the verdict BEFORE pushing it, so a crash after the mutation still
+	// short-circuits next tick and re-files rather than re-applying. The mutation
+	// and this insert aren't one transaction, but the window between them is a
+	// single statement — the same practical guarantee the DM equip path lives with.
+	if err := recordEquipApplied(order.GUID, status, detail); err != nil {
+		// If we can't record it, don't push the verdict either: leave the order
+		// pending so the ledger and Pete stay in step. Re-running an equip is the
+		// double-move we're guarding against, so a rare re-apply here is the lesser
+		// evil versus a verdict with no ledger behind it. Transient; retry.
+		slog.Warn("equip: failed to record applied order, leaving pending",
+			"order", order.GUID, "status", status, "err", err)
+		return
+	}
+	if err := peteclient.VerdictEquip(ctx, order.GUID, status, detail); err != nil {
+		slog.Warn("equip: verdict push failed, will re-file next poll",
+			"order", order.GUID, "status", status, "err", err)
+		return
+	}
+	slog.Info("equip: web order fulfilled", "order", order.GUID, "action", order.Action, "status", status)
+}
+
+// applyEquipOrder runs the real equip/unequip. It returns the terminal status and
+// a human note for Pete, or retry=true for a transient fault that should leave the
+// order pending. It records nothing and pushes nothing — the caller does both.
+func (p *AdventurePlugin) applyEquipOrder(owner id.UserID, order peteclient.EquipOrder) (status, detail string, retry bool) {
+	// Serialize against the owner's own Matrix-side mutations (!give, !equip, !sell,
+	// arena, …), all of which hold this same per-user lock. Without it the poll
+	// goroutine's equip could interleave with a concurrent !give of the very item it
+	// resolved — the duplication the DM equip confirm takes this lock to prevent.
+	userMu := p.advUserLock(owner)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	switch order.Action {
+	case "equip":
+		inv, err := loadAdvInventory(owner)
+		if err != nil {
+			return "", "", true // transient
+		}
+		var it AdvItem
+		found := false
+		for _, cand := range inv {
+			if cand.ID == order.ItemID {
+				it, found = cand, true
+				break
+			}
+		}
+		if !found {
+			// The row left the pack before we got here (worn already, sold, a stale
+			// page). The table is AUTOINCREMENT, so the id can't have been reused for
+			// a different item — this is a clean miss, not a wrong hit.
+			return "rejected_not_owned", "That item wasn't in your pack anymore.", false
+		}
+		// Masterwork/arena pieces equip into a standard slot; everything else takes
+		// the magic-item path. Type alone routes it — the id resolved the same row.
+		if it.Type == "MasterworkGear" || it.Type == "ArenaGear" {
+			out, err := applyMasterworkEquip(owner, it)
+			if errors.Is(err, errItemNotEquippable) {
+				return "rejected_not_equippable", "That item can't be worn.", false
+			}
+			if errors.Is(err, errEquipDowngrade) {
+				return "rejected_downgrade", "That isn't an upgrade over what you're wearing.", false
+			}
+			if err != nil {
+				return "", "", true // transient DB fault
+			}
+			return "applied", masterworkEquipDetail(out), false
+		}
+		out, err := applyMagicEquip(owner, it)
+		if errors.Is(err, errItemNotEquippable) {
+			return "rejected_not_equippable", "That item can't be worn.", false
+		}
+		if err != nil {
+			return "", "", true // transient DB fault
+		}
+		return "applied", equipAppliedDetail(out), false
+
+	case "unequip":
+		// A standard slot (weapon/armor/…) takes a masterwork/arena piece off; a DnD
+		// slot takes a magic item off. The vocabularies are disjoint, so the slot
+		// string alone tells the two apart.
+		if isEquipmentSlot(order.Slot) {
+			out, err := applyMasterworkUnequip(owner, EquipmentSlot(order.Slot))
+			if errors.Is(err, errSlotEmpty) {
+				return "rejected_not_worn", "There was nothing to take off there.", false
+			}
+			if err != nil {
+				return "", "", true
+			}
+			return "applied", fmt.Sprintf("Took %s off, back in your pack.", out.Name), false
+		}
+		out, err := applyMagicUnequip(owner, DnDSlot(order.Slot))
+		if errors.Is(err, errSlotEmpty) {
+			return "rejected_not_worn", "That slot was already empty.", false
+		}
+		if err != nil {
+			return "", "", true
+		}
+		note := fmt.Sprintf("Took off %s, back in your pack.", out.Item.Name)
+		if len(out.Healed) > 0 {
+			note += fmt.Sprintf(" That freed a bond, so %s is active now.", strings.Join(out.Healed, ", "))
+		}
+		return "applied", note, false
+
+	case "upgrade":
+		return p.purchaseEquipmentTier(owner, EquipmentSlot(order.Slot), order.Tier, order.GUID)
+
+	case "repair":
+		return p.repairSlot(owner, EquipmentSlot(order.Slot), order.GUID)
+
+	default:
+		// Pete validates the action before it ever queues an order, so this is a
+		// contract breach, not a user mistake. Reject permanently rather than spin.
+		return "rejected_not_equippable", "Unknown action.", false
+	}
+}
+
+// equipAppliedDetail turns an equip outcome into the plain note Pete shows.
+func equipAppliedDetail(out magicEquipOutcome) string {
+	b := fmt.Sprintf("Now worn in your %s slot.", out.Effective.Slot)
+	switch {
+	case out.Bonded:
+		b += fmt.Sprintf(" Bonded (%d of %d).", out.BondsBefore+1, dndMagicItemAttuneLimit)
+	case out.AtCap:
+		b += fmt.Sprintf(" Worn but inert: all %d bonds are in use, so take one off to activate it.", dndMagicItemAttuneLimit)
+	}
+	if out.SwappedBack != "" {
+		b += fmt.Sprintf(" %s went back to your pack.", out.SwappedBack)
+	}
+	if len(out.Healed) > 0 {
+		b += fmt.Sprintf(" A freed bond also activated %s.", strings.Join(out.Healed, ", "))
+	}
+	return b
+}
+
+// equipOwnerMXID reconstructs the owner's Matrix id from the localpart Pete sent,
+// the same construction as the mischief buyer's. Fails closed if the client isn't
+// up (tests) or the name is empty.
+func (p *AdventurePlugin) equipOwnerMXID(localpart string) (id.UserID, bool) {
+	lp := strings.ToLower(strings.TrimSpace(localpart))
+	if lp == "" || p.Client == nil {
+		return "", false
+	}
+	server := p.Client.UserID.Homeserver()
+	if server == "" {
+		return "", false
+	}
+	return id.NewUserID(lp, server), true
+}
+
+// ---- the applied-order ledger --------------------------------------------------
+
+// equipOrderAlreadyApplied reports the verdict we filed for an order, if we have
+// already applied it. This is the short-circuit that keeps a re-offered order from
+// re-running its non-idempotent mutation.
+func equipOrderAlreadyApplied(guid string) (status, detail string, ok bool) {
+	err := db.Get().QueryRow(
+		`SELECT status, detail FROM equip_applied_orders WHERE guid = ?`, guid,
+	).Scan(&status, &detail)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", "", false
+	}
+	if err != nil {
+		// A read failure here would send us down the mutation path and risk a
+		// double-move, so treat it as "don't know" and let the caller leave the
+		// order pending rather than assume it's fresh. We signal that by returning
+		// ok=false but... the caller can't tell the difference. Log loudly; a
+		// persistent read failure is a real problem, but a transient one self-heals
+		// on the next poll because the mutation itself is guarded by this same table.
+		slog.Error("equip: applied-ledger read failed", "order", guid, "err", err)
+		return "", "", false
+	}
+	return status, detail, true
+}
+
+// recordEquipApplied stamps an order as applied with the verdict we're about to
+// file. OR IGNORE so a re-file that somehow reaches here can't error on the guid.
+func recordEquipApplied(guid, status, detail string) error {
+	_, err := db.Get().Exec(
+		`INSERT OR IGNORE INTO equip_applied_orders (guid, status, detail) VALUES (?, ?, ?)`,
+		guid, status, detail)
+	return err
+}

internal/plugin/pete_equip_manage.go

@@ -0,0 +1,340 @@
+package plugin
+
+// Ask 7: full equipment management from the web.
+//
+// The magic-item equip path (magic_items_gameplay.go) only ever touched the DnD
+// slots — off_hand, rings, and the like — which are almost always empty. Almost
+// everything a player actually wears lives in the OTHER two systems: the 5
+// standard EquipmentSlots (weapon/armor/helmet/boots/tool), whose power is the
+// slot's integer Tier, and the masterwork/arena pieces that get equipped INTO a
+// standard slot. This file is the game-side of managing all of that from Pete:
+//
+//   - applyMasterworkEquip / applyMasterworkUnequip — move a masterwork/arena
+//     piece between the pack and a standard slot (no money).
+//   - purchaseEquipmentTier — buy the next standard tier with euros (confirm-gated
+//     on the web), the headless twin of the shop's advBuyEquipment.
+//   - repairSlot — mend a slot's condition with euros, the headless twin of the
+//     blacksmith's executeRepair.
+//   - buildEquipSlotViews — the owner-only snapshot the web panel renders from.
+//
+// The two euro-spending mutators run on the retrying poll wire, so every money
+// move goes through the idempotent euro variants keyed on the order guid: a
+// re-offered order that already debited skips the charge and just re-runs the
+// idempotent slot write. That is why neither refunds on a later DB fault — a
+// refund keyed on a fresh id, followed by a guid-guarded retry that no longer
+// re-debits, would hand the player both the gear and their money back. The casino
+// escrow (pete_games.go) settles the same way: idempotent move, then retry.
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+// errEquipDowngrade is a permanent refusal: the incoming piece is no better than
+// what is worn. Downgrades are blocked by user decision (equip and upgrade both).
+var errEquipDowngrade = errors.New("equip: would be a downgrade")
+
+// mwEquipOutcome is what a masterwork/arena equip did, for the verdict note.
+type mwEquipOutcome struct {
+	Name        string
+	Slot        EquipmentSlot
+	Tier        int
+	Arena       bool
+	SwappedBack string // the special occupant evicted back to the pack, or ""
+}
+
+// applyMasterworkEquip wears one masterwork/arena backpack piece into its standard
+// slot. Ordering is anti-duplication AND safe under the equip poll's 30s retry:
+// remove the incoming row FIRST (restoring it on a save fault), then write the
+// slot, and only THEN evict any displaced special occupant back to the pack. The
+// eviction comes last, once the slot no longer references the occupant, so it can
+// never mint a duplicate; and it is best-effort — a failure there is logged, not
+// aborted on, the same tolerance the DM confirm handler (adventure_masterwork.go)
+// lives with. Aborting after the slot write would strand a completed equip for a
+// retry that re-evicts the occupant on every tick.
+func applyMasterworkEquip(uid id.UserID, it AdvItem) (mwEquipOutcome, error) {
+	if it.Slot == "" || (it.Type != "MasterworkGear" && it.Type != "ArenaGear") {
+		return mwEquipOutcome{}, errItemNotEquippable
+	}
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		return mwEquipOutcome{}, err
+	}
+	slot := it.Slot
+	cur := equip[slot]
+
+	// Downgrade block: the incoming effective tier must beat the current occupant.
+	incoming := &AdvEquipment{Tier: it.Tier}
+	if it.Type == "ArenaGear" {
+		incoming.ArenaTier = it.Tier
+	} else {
+		incoming.Masterwork = true
+	}
+	if advEffectiveTier(incoming) <= advEffectiveTier(cur) {
+		return mwEquipOutcome{}, errEquipDowngrade
+	}
+
+	// Capture the special occupant to evict, if any, BEFORE the slot write below
+	// mutates cur in place. A plain shop-tier occupant is not an item — it is just
+	// the slot's tier — so it is overwritten, not evicted, the same as the DM confirm
+	// handler and the shop. The actual re-pack happens after the slot write (below),
+	// so it can never duplicate the piece.
+	var evicted *AdvItem
+	if cur != nil && (cur.Masterwork || cur.ArenaTier > 0) {
+		old := AdvItem{Name: cur.Name, Type: "MasterworkGear", Tier: cur.Tier, Slot: slot, SkillSource: cur.SkillSource}
+		if cur.ArenaTier > 0 {
+			old.Type = "ArenaGear"
+		}
+		evicted = &old
+	}
+
+	// Destructive op first: pull the incoming row before writing the slot, so a save
+	// fault can't leave it both worn and in the pack. Restore it on failure.
+	if err := removeAdvInventoryItem(it.ID); err != nil {
+		return mwEquipOutcome{}, err
+	}
+	eq := cur
+	if eq == nil {
+		eq = &AdvEquipment{Slot: slot}
+	}
+	eq.Tier = it.Tier
+	eq.Condition = 100
+	eq.Name = it.Name
+	eq.ActionsUsed = 0
+	if it.Type == "ArenaGear" {
+		eq.Masterwork = false
+		eq.SkillSource = ""
+		eq.ArenaTier = it.Tier
+		eq.ArenaSet = ""
+		if gs := arenaGearByName(it.Name); gs != nil {
+			eq.ArenaSet = gs.SetKey
+		}
+	} else {
+		eq.ArenaTier = 0
+		eq.ArenaSet = ""
+		eq.Masterwork = true
+		eq.SkillSource = it.SkillSource
+	}
+	if err := saveAdvEquipment(uid, eq); err != nil {
+		restored := AdvItem{Name: it.Name, Type: it.Type, Tier: it.Tier, Value: it.Value, Slot: it.Slot, SkillSource: it.SkillSource}
+		if rbErr := addAdvInventoryItem(uid, restored); rbErr != nil {
+			slog.Error("equip: masterwork save failed AND inventory rollback failed",
+				"user", uid, "item", it.Name, "save_err", err, "rollback_err", rbErr)
+		}
+		return mwEquipOutcome{}, err
+	}
+
+	// The slot now holds the incoming piece, so the former occupant is referenced
+	// nowhere — re-packing it now cannot duplicate it. Best-effort: a failure is a
+	// bounded, non-compounding loss we log rather than abort on, since the equip has
+	// already succeeded and aborting would re-run (and re-evict) on the next poll.
+	var swappedBack string
+	if evicted != nil {
+		if err := addAdvInventoryItem(uid, *evicted); err != nil {
+			slog.Error("equip: masterwork equipped but evicted piece failed to return to pack",
+				"user", uid, "evicted", evicted.Name, "err", err)
+		} else {
+			swappedBack = evicted.Name
+		}
+	}
+	return mwEquipOutcome{Name: it.Name, Slot: slot, Tier: it.Tier, Arena: it.Type == "ArenaGear", SwappedBack: swappedBack}, nil
+}
+
+// mwUnequipOutcome is what a masterwork/arena take-off did.
+type mwUnequipOutcome struct {
+	Name string
+	Slot EquipmentSlot
+}
+
+// applyMasterworkUnequip takes a worn masterwork/arena piece off a standard slot,
+// returns it to the pack, and resets the slot to its tier-0 default. A plain
+// shop-tier slot has nothing round-trippable (its tier is not an item), so that is
+// errSlotEmpty — reverting a shop tier is not a take-off. The 5 slot rows are an
+// invariant (PK user_id+slot), so the row is reset, never deleted. Destructive op
+// first — reset the slot, then mint the pack row, restoring the slot on failure —
+// mirroring the magic unequip so a fault can't duplicate the piece.
+func applyMasterworkUnequip(uid id.UserID, slot EquipmentSlot) (mwUnequipOutcome, error) {
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		return mwUnequipOutcome{}, err
+	}
+	cur := equip[slot]
+	if cur == nil || (!cur.Masterwork && cur.ArenaTier == 0) {
+		return mwUnequipOutcome{}, errSlotEmpty
+	}
+	prev := *cur // snapshot for rollback
+
+	def0 := equipmentTiers[slot][0]
+	reset := &AdvEquipment{Slot: slot, Tier: 0, Condition: 100, Name: def0.Name, ActionsUsed: 0, ArenaTier: 0, ArenaSet: "", Masterwork: false, SkillSource: ""}
+	if err := saveAdvEquipment(uid, reset); err != nil {
+		return mwUnequipOutcome{}, err
+	}
+
+	old := AdvItem{Name: cur.Name, Type: "MasterworkGear", Tier: cur.Tier, Slot: slot, SkillSource: cur.SkillSource}
+	if cur.ArenaTier > 0 {
+		old.Type = "ArenaGear"
+	}
+	if err := addAdvInventoryItem(uid, old); err != nil {
+		if rbErr := saveAdvEquipment(uid, &prev); rbErr != nil {
+			slog.Error("equip: masterwork take-off failed AND slot rollback failed",
+				"user", uid, "slot", slot, "add_err", err, "rollback_err", rbErr)
+		}
+		return mwUnequipOutcome{}, err
+	}
+	return mwUnequipOutcome{Name: cur.Name, Slot: slot}, nil
+}
+
+// purchaseEquipmentTier buys a standard slot's tier with euros — the headless twin
+// of advBuyEquipment, minus flavor. It returns a terminal verdict for Pete or
+// retry=true for a transient fault. Money moves once, keyed on the order guid; the
+// web only ever offers the next tier over a PLAIN shop-tier slot (buildEquipSlotViews
+// suppresses the offer on special gear), so there is no occupant to evict here and
+// the whole body is idempotent under a re-offered order.
+func (p *AdventurePlugin) purchaseEquipmentTier(uid id.UserID, slot EquipmentSlot, tier int, guid string) (status, detail string, retry bool) {
+	defs, ok := equipmentTiers[slot]
+	if !ok {
+		return "rejected_not_equippable", "That isn't an equipment slot.", false
+	}
+	if tier < 1 || tier >= len(defs) {
+		// tier 0 is the free default, not a purchase; >= len is past the top tier.
+		return "rejected_max_tier", "That slot is already at the top tier.", false
+	}
+	def := defs[tier]
+
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		return "", "", true
+	}
+	cur := equip[slot]
+	if cur != nil {
+		// Buying a shop tier over a special piece strips its bonus — a downgrade in
+		// practice even when the raw number rises. Take it off first, then buy.
+		if cur.Masterwork || cur.ArenaTier > 0 {
+			return "rejected_downgrade", "Take off your special gear in that slot before buying a tier.", false
+		}
+		if cur.Tier >= def.Tier {
+			return "rejected_downgrade", "You already have that tier or better.", false
+		}
+	}
+
+	price := def.Price
+	if !p.euro.HasExternalTx(guid) {
+		ok, _, err := p.euro.DebitIdem(uid, price, "adventure_equip_upgrade", guid)
+		if err != nil {
+			return "", "", true
+		}
+		if !ok {
+			return "rejected_insufficient_funds", fmt.Sprintf("That upgrade costs €%.0f and you can't cover it.", price), false
+		}
+	}
+
+	eq := &AdvEquipment{Slot: slot, Tier: def.Tier, Condition: 100, Name: def.Name, ActionsUsed: 0}
+	if err := saveAdvEquipment(uid, eq); err != nil {
+		// No refund: the debit is guid-idempotent, so the next poll re-runs this with
+		// the charge already settled and only the (idempotent) slot write left to do.
+		// Refunding here would double-pay once that retry lands the gear.
+		return "", "", true
+	}
+	return "applied", fmt.Sprintf("Upgraded your %s to %s (T%d) for €%.0f.", slot, def.Name, def.Tier, price), false
+}
+
+// repairSlot mends one standard slot's condition with euros — the headless twin of
+// the blacksmith's executeRepair. Idempotent on the order guid: the debit runs
+// once, and setting condition to 100 is itself idempotent, so a re-offered order is
+// safe with no refund.
+func (p *AdventurePlugin) repairSlot(uid id.UserID, slot EquipmentSlot, guid string) (status, detail string, retry bool) {
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		return "", "", true
+	}
+	eq := equip[slot]
+	if eq == nil {
+		return "rejected_not_worn", "There's nothing in that slot to repair.", false
+	}
+	cost := blacksmithRepairCost(eq)
+	if cost <= 0 {
+		// Already full — nothing to charge for. Report it as applied so the order
+		// reaches a terminal state rather than parking.
+		return "applied", "That piece was already at full condition.", false
+	}
+	if !p.euro.HasExternalTx(guid) {
+		ok, _, err := p.euro.DebitIdem(uid, float64(cost), "adventure_repair", guid)
+		if err != nil {
+			return "", "", true
+		}
+		if !ok {
+			return "rejected_insufficient_funds", fmt.Sprintf("The repair costs €%d and you can't cover it.", cost), false
+		}
+	}
+	eq.Condition = 100
+	if err := saveAdvEquipment(uid, eq); err != nil {
+		return "", "", true // retry; the idempotent debit means no double-charge
+	}
+	return "applied", fmt.Sprintf("Repaired your %s for €%d.", eq.Name, cost), false
+}
+
+// buildEquipSlotViews is the owner-only snapshot of the 5 standard slots the web
+// management panel renders from. Worn masterwork/arena pieces surface here (via
+// CanTakeOff), not in the magic Equipped set. An upgrade is offered only over a
+// plain shop-tier slot below max — a special piece is taken off, not shop-upgraded.
+func buildEquipSlotViews(uid id.UserID) []peteclient.EquipSlotView {
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		return nil
+	}
+	var out []peteclient.EquipSlotView
+	for _, slot := range allSlots {
+		eq := equip[slot]
+		if eq == nil {
+			continue
+		}
+		v := peteclient.EquipSlotView{
+			Slot:       string(slot),
+			Name:       eq.Name,
+			Tier:       eq.Tier,
+			Condition:  eq.Condition,
+			Masterwork: eq.Masterwork,
+			ArenaTier:  eq.ArenaTier,
+			CanTakeOff: eq.Masterwork || eq.ArenaTier > 0,
+			RepairCost: blacksmithRepairCost(eq),
+		}
+		if !eq.Masterwork && eq.ArenaTier == 0 && eq.Tier < 5 {
+			next := equipmentTiers[slot][eq.Tier+1]
+			v.NextTier = next.Tier
+			v.NextName = next.Name
+			v.NextPrice = next.Price
+		}
+		out = append(out, v)
+	}
+	return out
+}
+
+// masterworkEquipDetail turns a masterwork/arena equip outcome into the verdict
+// note Pete shows.
+func masterworkEquipDetail(out mwEquipOutcome) string {
+	kind := "masterwork"
+	if out.Arena {
+		kind = "arena"
+	}
+	b := fmt.Sprintf("Now worn in your %s slot (%s T%d).", out.Slot, kind, out.Tier)
+	if out.SwappedBack != "" {
+		b += fmt.Sprintf(" %s went back to your pack.", out.SwappedBack)
+	}
+	return b
+}
+
+// isEquipmentSlot reports whether a slot string names one of the 5 standard slots.
+// The magic DnD slots and the standard slots are disjoint vocabularies, so this
+// alone routes an unequip to the right path.
+func isEquipmentSlot(slot string) bool {
+	for _, s := range allSlots {
+		if string(s) == slot {
+			return true
+		}
+	}
+	return false
+}

internal/plugin/pete_equip_manage_test.go

@@ -0,0 +1,314 @@
+package plugin
+
+import (
+	"testing"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Ask 7: the headless equipment mutators the web equip queue drives. These pin the
+// rules that cross the wire — downgrade block, max tier, insufficient funds,
+// idempotent replay (one debit), masterwork evict/overwrite/take-off — at the
+// gogobee end, on real rows.
+
+// seedEquipPlayer stands up a playable adventurer (player_meta + tier-0 gear) with
+// a euro plugin funded to `bankroll`, and returns the wired AdventurePlugin.
+func seedEquipPlayer(t *testing.T, uid id.UserID, bankroll float64) *AdventurePlugin {
+	t.Helper()
+	if err := createAdvCharacter(uid, "Rurina"); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	euro := &EuroPlugin{}
+	euro.ensureBalance(uid)
+	if bankroll > 0 {
+		euro.Credit(uid, bankroll, "test bankroll")
+	}
+	return &AdventurePlugin{euro: euro}
+}
+
+func slotOf(t *testing.T, uid id.UserID, slot EquipmentSlot) *AdvEquipment {
+	t.Helper()
+	equip, err := loadAdvEquipment(uid)
+	if err != nil {
+		t.Fatalf("loadAdvEquipment: %v", err)
+	}
+	return equip[slot]
+}
+
+// TestPurchaseEquipmentTierHappyAndIdempotentDebit: buying the next tier debits
+// once and raises the slot, and the euro move is keyed on the order guid so a
+// re-offer moves no money. (A re-offer never re-enters this function in prod — the
+// equip_applied_orders ledger short-circuits it — but the guid is the belt to that
+// suspenders, and the retry-after-save-fault path below leans on it directly.)
+func TestPurchaseEquipmentTierHappyAndIdempotentDebit(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@rurina:test")
+	p := seedEquipPlayer(t, uid, 100000)
+
+	before := p.euro.GetBalance(uid)
+	price := equipmentTiers[SlotBoots][1].Price // Dead Man's Boots, €75
+
+	status, _, retry := p.purchaseEquipmentTier(uid, SlotBoots, 1, "guid-up-1")
+	if retry || status != "applied" {
+		t.Fatalf("upgrade = %q retry=%v, want applied", status, retry)
+	}
+	if got := slotOf(t, uid, SlotBoots); got.Tier != 1 || got.Name != equipmentTiers[SlotBoots][1].Name {
+		t.Fatalf("boots slot = %+v, want tier 1", got)
+	}
+	if got := p.euro.GetBalance(uid); got != before-price {
+		t.Fatalf("balance = %.2f, want %.2f (one debit of %.2f)", got, before-price, price)
+	}
+	// The guid is now a settled money move: a replayed debit on it is a no-op.
+	if !p.euro.HasExternalTx("guid-up-1") {
+		t.Fatal("the upgrade debit was not logged under the order guid")
+	}
+	if ok, _, err := p.euro.DebitIdem(uid, price, "adventure_equip_upgrade", "guid-up-1"); err != nil || !ok {
+		t.Fatalf("replayed debit = ok:%v err:%v, want a no-op ok", ok, err)
+	}
+	if got := p.euro.GetBalance(uid); got != before-price {
+		t.Fatalf("replayed debit double-charged: balance = %.2f, want %.2f", got, before-price)
+	}
+
+	// The retry-after-save-fault path: a prior attempt debited but its slot write
+	// never landed, so the slot is still tier 0. The retry must skip the debit
+	// (guid already settled) and finish the write, moving no further money.
+	helmetGUID := "guid-helm"
+	hprice := equipmentTiers[SlotHelmet][1].Price
+	if ok, _, err := p.euro.DebitIdem(uid, hprice, "adventure_equip_upgrade", helmetGUID); err != nil || !ok {
+		t.Fatalf("seed prior debit = ok:%v err:%v", ok, err)
+	}
+	mid := p.euro.GetBalance(uid)
+	status, _, retry = p.purchaseEquipmentTier(uid, SlotHelmet, 1, helmetGUID)
+	if retry || status != "applied" {
+		t.Fatalf("retry after fault = %q retry=%v, want applied", status, retry)
+	}
+	if got := slotOf(t, uid, SlotHelmet); got.Tier != 1 {
+		t.Fatalf("helmet not upgraded on retry: tier %d", got.Tier)
+	}
+	if got := p.euro.GetBalance(uid); got != mid {
+		t.Fatalf("retry re-debited: balance %.2f → %.2f", mid, got)
+	}
+}
+
+// TestPurchaseEquipmentTierRejections: a downgrade, a special-gear slot, the top
+// tier, and an empty wallet all bounce without moving the slot or the money.
+func TestPurchaseEquipmentTierRejections(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@rurina:test")
+	p := seedEquipPlayer(t, uid, 100000)
+
+	// Lift boots to tier 3 so we have something to (not) downgrade from.
+	if s, _, _ := p.purchaseEquipmentTier(uid, SlotBoots, 3, "seed-t3"); s != "applied" {
+		t.Fatalf("seed to tier 3 = %q", s)
+	}
+	// Same tier or lower is a downgrade.
+	if s, _, _ := p.purchaseEquipmentTier(uid, SlotBoots, 3, "g-eq"); s != "rejected_downgrade" {
+		t.Errorf("re-buy same tier = %q, want rejected_downgrade", s)
+	}
+	if s, _, _ := p.purchaseEquipmentTier(uid, SlotBoots, 2, "g-down"); s != "rejected_downgrade" {
+		t.Errorf("buy lower tier = %q, want rejected_downgrade", s)
+	}
+	// Past the top tier.
+	if s, _, _ := p.purchaseEquipmentTier(uid, SlotBoots, 6, "g-max"); s != "rejected_max_tier" {
+		t.Errorf("buy tier 6 = %q, want rejected_max_tier", s)
+	}
+	// A special piece in the slot: buying a plain tier over it strips the bonus.
+	weapon := slotOf(t, uid, SlotWeapon)
+	weapon.Masterwork = true
+	weapon.Tier = 2
+	weapon.Name = "Miner's Masterwork Blade"
+	weapon.SkillSource = "mining"
+	if err := saveAdvEquipment(uid, weapon); err != nil {
+		t.Fatal(err)
+	}
+	if s, _, _ := p.purchaseEquipmentTier(uid, SlotWeapon, 3, "g-special"); s != "rejected_downgrade" {
+		t.Errorf("buy plain over masterwork = %q, want rejected_downgrade", s)
+	}
+
+	// Insufficient funds: a broke player can't buy a €30000 tier-5 weapon.
+	broke := id.UserID("@broke:test")
+	pb := seedEquipPlayer(t, broke, 0)
+	bal := pb.euro.GetBalance(broke)
+	if s, _, _ := pb.purchaseEquipmentTier(broke, SlotWeapon, 5, "g-broke"); s != "rejected_insufficient_funds" {
+		t.Errorf("broke upgrade = %q, want rejected_insufficient_funds", s)
+	}
+	if got := pb.euro.GetBalance(broke); got != bal {
+		t.Errorf("a rejected upgrade moved money: %.2f → %.2f", bal, got)
+	}
+	if got := slotOf(t, broke, SlotWeapon); got.Tier != 0 {
+		t.Errorf("a rejected upgrade changed the slot: tier %d", got.Tier)
+	}
+}
+
+// TestRepairSlotHappyAndNoop: repairing a damaged slot debits the blacksmith cost
+// and restores condition; repairing a full slot is a no-op that charges nothing.
+func TestRepairSlotHappyAndNoop(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@rurina:test")
+	p := seedEquipPlayer(t, uid, 100000)
+
+	weapon := slotOf(t, uid, SlotWeapon)
+	weapon.Condition = 50
+	if err := saveAdvEquipment(uid, weapon); err != nil {
+		t.Fatal(err)
+	}
+	cost := blacksmithRepairCost(weapon)
+	if cost <= 0 {
+		t.Fatalf("expected a positive repair cost, got %d", cost)
+	}
+	before := p.euro.GetBalance(uid)
+
+	status, _, retry := p.repairSlot(uid, SlotWeapon, "guid-rep-1")
+	if retry || status != "applied" {
+		t.Fatalf("repair = %q retry=%v, want applied", status, retry)
+	}
+	if got := slotOf(t, uid, SlotWeapon); got.Condition != 100 {
+		t.Fatalf("condition = %d, want 100", got.Condition)
+	}
+	if got := p.euro.GetBalance(uid); got != before-float64(cost) {
+		t.Fatalf("balance = %.2f, want %.2f (debit %d)", got, before-float64(cost), cost)
+	}
+
+	// Now at full condition: a fresh repair is an applied no-op, no charge.
+	after := p.euro.GetBalance(uid)
+	status, _, _ = p.repairSlot(uid, SlotWeapon, "guid-rep-2")
+	if status != "applied" {
+		t.Fatalf("no-op repair = %q, want applied", status)
+	}
+	if got := p.euro.GetBalance(uid); got != after {
+		t.Errorf("no-op repair charged: %.2f → %.2f", after, got)
+	}
+}
+
+// TestMasterworkEquipEvictsOverwritesAndTakesOff: a masterwork piece equips into a
+// plain slot (overwriting the tier), a better one evicts the special occupant back
+// to the pack, a worse one is blocked, and take-off resets the slot to tier 0.
+func TestMasterworkEquipEvictsOverwritesAndTakesOff(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@rurina:test")
+	seedEquipPlayer(t, uid, 0)
+
+	mw := func(name string, tier int) AdvItem {
+		if err := addAdvInventoryItem(uid, AdvItem{Name: name, Type: "MasterworkGear", Tier: tier, Slot: SlotWeapon, SkillSource: "mining"}); err != nil {
+			t.Fatal(err)
+		}
+		inv, _ := loadAdvInventory(uid)
+		for _, it := range inv {
+			if it.Name == name {
+				return it
+			}
+		}
+		t.Fatalf("just-added item %q not in inventory", name)
+		return AdvItem{}
+	}
+
+	// Equip a T3 masterwork over the tier-0 plain weapon: it overwrites, no eviction.
+	out, err := applyMasterworkEquip(uid, mw("Deepforged Blade", 3))
+	if err != nil {
+		t.Fatalf("equip T3: %v", err)
+	}
+	if out.SwappedBack != "" {
+		t.Errorf("plain occupant should be overwritten, not evicted; got swap %q", out.SwappedBack)
+	}
+	if got := slotOf(t, uid, SlotWeapon); !got.Masterwork || got.Tier != 3 || got.Name != "Deepforged Blade" {
+		t.Fatalf("weapon = %+v, want masterwork T3 Deepforged Blade", got)
+	}
+
+	// A better masterwork (T4) evicts the T3 back to the pack.
+	out, err = applyMasterworkEquip(uid, mw("Sunforged Blade", 4))
+	if err != nil {
+		t.Fatalf("equip T4: %v", err)
+	}
+	if out.SwappedBack != "Deepforged Blade" {
+		t.Errorf("evicted = %q, want Deepforged Blade", out.SwappedBack)
+	}
+	invHas := func(name string) bool {
+		inv, _ := loadAdvInventory(uid)
+		for _, it := range inv {
+			if it.Name == name {
+				return true
+			}
+		}
+		return false
+	}
+	if !invHas("Deepforged Blade") {
+		t.Error("the evicted T3 masterwork is not back in the pack")
+	}
+
+	// A worse masterwork (T2) is a blocked downgrade.
+	if _, err := applyMasterworkEquip(uid, mw("Rusty Masterwork", 2)); err != errEquipDowngrade {
+		t.Errorf("equip worse masterwork err = %v, want errEquipDowngrade", err)
+	}
+
+	// Take off the worn T4: it returns to the pack and the slot resets to tier 0.
+	un, err := applyMasterworkUnequip(uid, SlotWeapon)
+	if err != nil {
+		t.Fatalf("take off: %v", err)
+	}
+	if un.Name != "Sunforged Blade" {
+		t.Errorf("took off %q, want Sunforged Blade", un.Name)
+	}
+	if got := slotOf(t, uid, SlotWeapon); got.Masterwork || got.Tier != 0 || got.Name != equipmentTiers[SlotWeapon][0].Name {
+		t.Fatalf("weapon after take-off = %+v, want tier-0 default", got)
+	}
+	if !invHas("Sunforged Blade") {
+		t.Error("the taken-off masterwork is not back in the pack")
+	}
+
+	// Taking off a plain slot has nothing round-trippable.
+	if _, err := applyMasterworkUnequip(uid, SlotArmor); err != errSlotEmpty {
+		t.Errorf("take off plain slot err = %v, want errSlotEmpty", err)
+	}
+}
+
+// TestBuildEquipSlotViews: the panel snapshot offers an upgrade only over a plain
+// sub-max slot, take-off only on special gear, and a repair cost only when damaged.
+func TestBuildEquipSlotViews(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@rurina:test")
+	seedEquipPlayer(t, uid, 0)
+
+	// Boots: masterwork T3, damaged → take off + repair, no upgrade offer.
+	boots := slotOf(t, uid, SlotBoots)
+	boots.Masterwork = true
+	boots.Tier = 3
+	boots.Name = "The Wandering Sole"
+	boots.Condition = 70
+	if err := saveAdvEquipment(uid, boots); err != nil {
+		t.Fatal(err)
+	}
+	// Helmet: plain T2 → upgrade to T3 offered, no take off, no repair.
+	helmet := slotOf(t, uid, SlotHelmet)
+	helmet.Tier = 2
+	helmet.Name = equipmentTiers[SlotHelmet][2].Name
+	if err := saveAdvEquipment(uid, helmet); err != nil {
+		t.Fatal(err)
+	}
+
+	views := buildEquipSlotViews(uid)
+	bySlot := map[string]struct {
+		takeOff  bool
+		nextTier int
+		repair   int
+	}{}
+	for _, v := range views {
+		bySlot[v.Slot] = struct {
+			takeOff  bool
+			nextTier int
+			repair   int
+		}{v.CanTakeOff, v.NextTier, v.RepairCost}
+	}
+	if len(views) != len(allSlots) {
+		t.Fatalf("got %d slot views, want %d", len(views), len(allSlots))
+	}
+	if b := bySlot["boots"]; !b.takeOff || b.nextTier != 0 || b.repair <= 0 {
+		t.Errorf("boots view = %+v, want take-off, no upgrade, positive repair", b)
+	}
+	if h := bySlot["helmet"]; h.takeOff || h.nextTier != 3 || h.repair != 0 {
+		t.Errorf("helmet view = %+v, want upgrade to T3, no take-off, no repair", h)
+	}
+	// A pristine tier-0 slot: upgrade offered to T1, no take-off, no repair.
+	if w := bySlot["weapon"]; w.takeOff || w.nextTier != 1 || w.repair != 0 {
+		t.Errorf("weapon view = %+v, want upgrade to T1", w)
+	}
+}

internal/plugin/pete_games.go

@@ -0,0 +1,165 @@
+package plugin
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The casino's money loop.
+//
+// Pete runs the games and holds the chips; we hold the euros and are the only
+// one who can move them. A player who buys in or cashes out on games.parodia.dev
+// opens an escrow row over there, and this loop is what turns it into a real
+// balance change over here.
+//
+// It has to be a poll because Pete cannot call us — there is no inbound API on
+// this box and there isn't going to be one. That constraint is what shaped the
+// whole design: money crosses the border twice per *session*, not twice per
+// hand, so a few seconds of poll latency lands on "buying chips…" and never on
+// "deal me in".
+//
+// Every step is idempotent on the escrow guid, because every step can be
+// interrupted in the worst possible place. If we die after DebitIdem and before
+// the verdict is queued, Pete re-offers the row, we claim it again, DebitIdem
+// replays as a no-op and reports the same answer, and the verdict goes out. The
+// player is charged once. That is the only property here that really matters.
+const (
+	// escrowPollInterval — a player is watching a spinner, so this is seconds,
+	// not the 30s the mischief seam gets away with.
+	escrowPollInterval = 3 * time.Second
+
+	// escrowPollTimeout — one full poll-claim-settle pass. Generous: the
+	// alternative to finishing is a claimed row nobody answers.
+	escrowPollTimeout = 30 * time.Second
+
+	reasonInsufficientFunds = "insufficient_funds"
+)
+
+// StartPeteEscrowLoop runs the border forever. Safe to call when the Pete seam
+// is off — it simply never starts.
+func StartPeteEscrowLoop(ctx context.Context, euro *EuroPlugin) {
+	if !peteclient.Enabled() || euro == nil {
+		return
+	}
+	slog.Info("pete games: escrow loop started", "interval", escrowPollInterval)
+	go func() {
+		t := time.NewTicker(escrowPollInterval)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				pollEscrowOnce(ctx, euro)
+			}
+		}
+	}()
+}
+
+// escrowPollOK tracks the poll's health so we log transitions and not a line
+// every three seconds. Pete being down is normal during its redeploys and is not
+// worth shouting about; Pete being down for an hour is.
+var escrowPollOK = true
+
+func pollEscrowOnce(ctx context.Context, euro *EuroPlugin) {
+	ctx, cancel := context.WithTimeout(ctx, escrowPollTimeout)
+	defer cancel()
+
+	pending, err := peteclient.PendingEscrow(ctx)
+	if err != nil {
+		if escrowPollOK {
+			slog.Warn("pete games: escrow poll failed — buy-ins and cash-outs are stalled", "err", err)
+			escrowPollOK = false
+		}
+		return
+	}
+	if !escrowPollOK {
+		slog.Info("pete games: escrow poll recovered")
+		escrowPollOK = true
+	}
+	if len(pending) == 0 {
+		return
+	}
+
+	for _, e := range pending {
+		if ctx.Err() != nil {
+			return
+		}
+		settleEscrow(ctx, euro, e)
+	}
+	// The verdicts are on the durable queue now. Send them at once rather than
+	// waiting up to a sender tick — there is a person at the other end of this.
+	peteclient.Flush(ctx)
+}
+
+// settleEscrow moves the euros for one crossing and queues the answer.
+func settleEscrow(ctx context.Context, euro *EuroPlugin, e peteclient.Escrow) {
+	// Claim first. The claim is what fixes the amount and the player: the poll's
+	// copy of the row is already a few milliseconds stale, and this is money.
+	claimed, err := peteclient.ClaimEscrow(ctx, e.GUID)
+	if err != nil {
+		slog.Warn("pete games: claim failed, will retry", "guid", e.GUID, "err", err)
+		return
+	}
+	// Pete has already decided this one — a stale re-offer that raced our own
+	// earlier verdict. Nothing to do, and nothing went wrong.
+	if claimed.State != "claimed" {
+		slog.Debug("pete games: escrow already decided", "guid", e.GUID, "state", claimed.State)
+		return
+	}
+	if claimed.Amount <= 0 {
+		slog.Error("pete games: escrow with a non-positive amount, refusing",
+			"guid", claimed.GUID, "amount", claimed.Amount)
+		return
+	}
+
+	user := id.UserID(claimed.MatrixUser)
+	amount := float64(claimed.Amount)
+
+	var ok bool
+	var balance float64
+	switch claimed.Kind {
+	case "buyin":
+		ok, balance, err = euro.DebitIdem(user, amount, "games_buyin", claimed.GUID)
+	case "cashout":
+		ok, balance, err = euro.CreditIdem(user, amount, "games_cashout", claimed.GUID)
+	default:
+		// Not a transient failure and not something a retry fixes. Say no, so the
+		// row reaches a terminal state on Pete instead of being re-offered forever.
+		slog.Error("pete games: unknown escrow kind", "guid", claimed.GUID, "kind", claimed.Kind)
+		peteclient.EmitEscrowVerdict(peteclient.EscrowVerdict{
+			GUID: claimed.GUID, OK: false, Reason: "unknown_kind",
+		})
+		return
+	}
+
+	if err != nil {
+		// The money did not move and we don't know that it didn't — so say
+		// nothing. Pete re-offers the row once the claim goes stale, and the guid
+		// makes the retry safe whichever way this actually landed.
+		slog.Error("pete games: euro move failed, leaving the row for a retry",
+			"guid", claimed.GUID, "kind", claimed.Kind, "err", err)
+		return
+	}
+
+	reason := ""
+	if !ok {
+		// The only way DebitIdem says no: the player cannot cover it. A cash-out
+		// has no floor to breach, so this is always a buy-in.
+		reason = reasonInsufficientFunds
+	}
+
+	peteclient.EmitEscrowVerdict(peteclient.EscrowVerdict{
+		GUID:         claimed.GUID,
+		OK:           ok,
+		Reason:       reason,
+		BalanceAfter: balance,
+	})
+	slog.Info("pete games: escrow moved", "guid", claimed.GUID, "user", claimed.MatrixUser,
+		"kind", claimed.Kind, "amount", claimed.Amount, "ok", ok, "balance_after", balance)
+}

internal/plugin/pete_games_test.go

@@ -0,0 +1,222 @@
+package plugin
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// fakePete is Pete's half of the escrow wire: it offers rows, lets us claim
+// them, and records the verdicts we push back. Enough to drive the loop end to
+// end without either real box.
+type fakePete struct {
+	mu       sync.Mutex
+	pending  []peteclient.Escrow
+	claimed  map[string]bool
+	verdicts []peteclient.EscrowVerdict
+	srv      *httptest.Server
+}
+
+func newFakePete(t *testing.T, token string, rows ...peteclient.Escrow) *fakePete {
+	t.Helper()
+	f := &fakePete{pending: rows, claimed: map[string]bool{}}
+
+	mux := http.NewServeMux()
+	auth := func(r *http.Request) bool { return r.Header.Get("Authorization") == "Bearer "+token }
+
+	mux.HandleFunc("GET /api/games/escrow/pending", func(w http.ResponseWriter, r *http.Request) {
+		if !auth(r) {
+			w.WriteHeader(401)
+			return
+		}
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		_ = json.NewEncoder(w).Encode(f.pending)
+	})
+	mux.HandleFunc("POST /api/games/escrow/claim", func(w http.ResponseWriter, r *http.Request) {
+		if !auth(r) {
+			w.WriteHeader(401)
+			return
+		}
+		var req struct{ GUID string }
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		for _, e := range f.pending {
+			if e.GUID != req.GUID {
+				continue
+			}
+			f.claimed[e.GUID] = true
+			e.State = "claimed"
+			_ = json.NewEncoder(w).Encode(e)
+			return
+		}
+		w.WriteHeader(404)
+	})
+	mux.HandleFunc("POST /api/games/escrow/settled", func(w http.ResponseWriter, r *http.Request) {
+		if !auth(r) {
+			w.WriteHeader(401)
+			return
+		}
+		var v peteclient.EscrowVerdict
+		if err := json.NewDecoder(r.Body).Decode(&v); err != nil {
+			w.WriteHeader(400)
+			return
+		}
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		f.verdicts = append(f.verdicts, v)
+		w.WriteHeader(200)
+	})
+
+	f.srv = httptest.NewServer(mux)
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+// wire points the peteclient singleton at the fake and turns the seam on.
+func (f *fakePete) wire(t *testing.T, token string) {
+	t.Helper()
+	t.Setenv("PETE_INGEST_URL", f.srv.URL)
+	t.Setenv("PETE_INGEST_TOKEN", token)
+	t.Setenv("FEATURE_PETE_NEWS", "true")
+	peteclient.Init()
+}
+
+func (f *fakePete) got() []peteclient.EscrowVerdict {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]peteclient.EscrowVerdict(nil), f.verdicts...)
+}
+
+// TestEscrowLoopBuyInDebitsOnceAndReportsIt is the happy path across the border:
+// Pete offers a buy-in, we take the euros, and the verdict lands back on Pete
+// carrying the balance the player now has.
+func TestEscrowLoopBuyInDebitsOnceAndReportsIt(t *testing.T) {
+	euro := newEuroTestDB(t)
+	user := id.UserID("@reala:parodia.dev")
+	seedBalance(t, euro, user, 1000)
+
+	pete := newFakePete(t, "tok", peteclient.Escrow{
+		GUID: "esc-1", MatrixUser: string(user), Kind: "buyin", Amount: 400, State: "requested",
+	})
+	pete.wire(t, "tok")
+
+	pollEscrowOnce(context.Background(), euro)
+
+	if got := euro.GetBalance(user); got != 600 {
+		t.Fatalf("balance = %v, want 600 (1000 less a 400 buy-in)", got)
+	}
+	v := pete.got()
+	if len(v) != 1 || !v[0].OK || v[0].GUID != "esc-1" {
+		t.Fatalf("verdicts = %+v, want one ok verdict for esc-1", v)
+	}
+	if v[0].BalanceAfter != 600 {
+		t.Fatalf("balance_after = %v, want 600", v[0].BalanceAfter)
+	}
+}
+
+// TestEscrowLoopReofferedRowDebitsOnce is the failure this whole design is built
+// around. We move the euros, then die before the verdict is delivered. Pete
+// re-offers the row. The player must not pay twice.
+func TestEscrowLoopReofferedRowDebitsOnce(t *testing.T) {
+	euro := newEuroTestDB(t)
+	user := id.UserID("@twice:parodia.dev")
+	seedBalance(t, euro, user, 1000)
+
+	pete := newFakePete(t, "tok", peteclient.Escrow{
+		GUID: "esc-dup", MatrixUser: string(user), Kind: "buyin", Amount: 250, State: "requested",
+	})
+	pete.wire(t, "tok")
+
+	// Three passes over a row Pete keeps offering, as it would after a crash.
+	for i := 0; i < 3; i++ {
+		pollEscrowOnce(context.Background(), euro)
+	}
+
+	if got := euro.GetBalance(user); got != 750 {
+		t.Fatalf("balance = %v, want 750 — the re-offered row debited more than once", got)
+	}
+	// The verdict is queued under the escrow guid, so it is enqueued once no
+	// matter how many times we decide it. Pete's settle is idempotent anyway,
+	// but the queue is the first line of that defence.
+	if v := pete.got(); len(v) != 1 {
+		t.Fatalf("delivered %d verdicts for one row, want 1: %+v", len(v), v)
+	}
+}
+
+// TestEscrowLoopBrokePlayerIsRejectedCleanly — the debit is refused. Nothing may
+// move, and Pete has to be told why, because the player is staring at a spinner
+// that needs to become a sentence.
+func TestEscrowLoopBrokePlayerIsRejectedCleanly(t *testing.T) {
+	euro := newEuroTestDB(t)
+	user := id.UserID("@broke:parodia.dev")
+	seedBalance(t, euro, user, 10)
+
+	pete := newFakePete(t, "tok", peteclient.Escrow{
+		GUID: "esc-broke", MatrixUser: string(user), Kind: "buyin", Amount: 5000, State: "requested",
+	})
+	pete.wire(t, "tok")
+
+	pollEscrowOnce(context.Background(), euro)
+
+	if got := euro.GetBalance(user); got != 10 {
+		t.Fatalf("balance = %v, want 10 untouched", got)
+	}
+	v := pete.got()
+	if len(v) != 1 || v[0].OK || v[0].Reason != reasonInsufficientFunds {
+		t.Fatalf("verdicts = %+v, want one rejection carrying insufficient_funds", v)
+	}
+}
+
+// TestEscrowLoopCashOutCredits — the way out of the casino.
+func TestEscrowLoopCashOutCredits(t *testing.T) {
+	euro := newEuroTestDB(t)
+	user := id.UserID("@winner:parodia.dev")
+	seedBalance(t, euro, user, 100)
+
+	pete := newFakePete(t, "tok", peteclient.Escrow{
+		GUID: "esc-out", MatrixUser: string(user), Kind: "cashout", Amount: 900, State: "requested",
+	})
+	pete.wire(t, "tok")
+
+	pollEscrowOnce(context.Background(), euro)
+
+	if got := euro.GetBalance(user); got != 1000 {
+		t.Fatalf("balance = %v, want 1000", got)
+	}
+	if v := pete.got(); len(v) != 1 || !v[0].OK || v[0].BalanceAfter != 1000 {
+		t.Fatalf("verdicts = %+v, want one ok cash-out at 1000", v)
+	}
+}
+
+// TestEscrowLoopUnknownKindIsRefusedNotRetried — a row we can't interpret. A
+// silent skip would leave it re-offered forever, so say no and let it reach a
+// terminal state on Pete.
+func TestEscrowLoopUnknownKindIsRefusedNotRetried(t *testing.T) {
+	euro := newEuroTestDB(t)
+	user := id.UserID("@weird:parodia.dev")
+	seedBalance(t, euro, user, 500)
+
+	pete := newFakePete(t, "tok", peteclient.Escrow{
+		GUID: "esc-weird", MatrixUser: string(user), Kind: "tribute", Amount: 100, State: "requested",
+	})
+	pete.wire(t, "tok")
+
+	pollEscrowOnce(context.Background(), euro)
+
+	if got := euro.GetBalance(user); got != 500 {
+		t.Fatalf("balance = %v, want 500 untouched", got)
+	}
+	v := pete.got()
+	if len(v) != 1 || v[0].OK || v[0].Reason != "unknown_kind" {
+		t.Fatalf("verdicts = %+v, want one refusal", v)
+	}
+}

internal/plugin/pete_mischief.go

@@ -0,0 +1,86 @@
+package plugin
+
+// The mischief storefront's game-side loop.
+//
+// A buyer places a hit on Pete's web board; Pete records the intent and waits.
+// We poll for those orders, do the real work against our own ledger — the money,
+// the eligibility, the contract — and hand back a verdict Pete files against the
+// order. Pete has no route into this box, which is why the traffic runs this way:
+// we ask for work, we don't get told about it.
+//
+// The order guid is the idempotency key end to end (see placeWebMischief), so
+// every step here is safe to repeat. That is the whole reason the loop can be
+// this simple: a failed claim just leaves the order pending, and the next tick
+// re-runs it as a no-op. The loop is its own retry, and needs no durable queue.
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"gogobee/internal/peteclient"
+)
+
+const (
+	mischiefPollInterval = 30 * time.Second
+	mischiefPollTimeout  = 20 * time.Second
+)
+
+// peteMischiefTicker polls Pete for storefront orders and fulfils them. Started
+// alongside the other adventure tickers; exits on stopCh.
+func (p *AdventurePlugin) peteMischiefTicker() {
+	if !peteclient.Enabled() {
+		return // no Pete wire configured; the storefront half is simply off
+	}
+	ticker := time.NewTicker(mischiefPollInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-ticker.C:
+			p.pollMischiefOrders()
+		}
+	}
+}
+
+// pollMischiefOrders fetches the pending orders and fulfils each in turn.
+func (p *AdventurePlugin) pollMischiefOrders() {
+	ctx, cancel := context.WithTimeout(context.Background(), mischiefPollTimeout)
+	defer cancel()
+
+	orders, err := peteclient.PendingMischief(ctx)
+	if err != nil {
+		// A Pete that predates the storefront answers 404 here; a wire blip is the
+		// same. Either way there is nothing to do this tick, and the next one tries
+		// again. Debug, not warn — this must be quiet when Pete simply hasn't
+		// shipped the endpoint yet.
+		slog.Debug("mischief: poll failed", "err", err)
+		return
+	}
+
+	for _, order := range orders {
+		p.fulfilMischiefOrder(ctx, order)
+	}
+}
+
+// fulfilMischiefOrder places one order's contract and files the verdict. A
+// transient failure (Retry) is left pending for the next poll; a real verdict is
+// pushed back so the buyer sees why. A failed claim-push is not fatal — the order
+// stays pending and the next poll re-runs it, which the guid makes a no-op.
+func (p *AdventurePlugin) fulfilMischiefOrder(ctx context.Context, order peteclient.MischiefOrder) {
+	res := p.placeWebMischief(order)
+	if res.Retry {
+		return // leave it pending; try again next tick
+	}
+	if err := peteclient.ClaimMischief(ctx, order.GUID, res.Status, res.Detail); err != nil {
+		// The contract is placed (or the buyer refunded) on our side, but Pete
+		// hasn't heard the verdict. It stays pending there and we'll re-offer it;
+		// placeWebMischief will short-circuit on the stamped order guid and we'll
+		// re-file. So this is a warn, not a lost order.
+		slog.Warn("mischief: claim verdict push failed, will re-file next poll",
+			"order", order.GUID, "status", res.Status, "err", err)
+		return
+	}
+	slog.Info("mischief: web order fulfilled", "order", order.GUID, "status", res.Status)
+}

internal/plugin/pete_mischief_test.go

@@ -0,0 +1,194 @@
+package plugin
+
+import (
+	"testing"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/id"
+)
+
+// webMischiefPlugin builds a plugin the web placement path can run against: a
+// euro ledger, a capture sink so DMs go nowhere, and a bare client carrying only
+// a user id — enough for mischiefBuyerMXID to read the homeserver, never used for
+// a real call (DisplayName fast-fails to the localpart, sends hit the sink).
+func webMischiefPlugin(t *testing.T) *AdventurePlugin {
+	t.Helper()
+	p := &AdventurePlugin{euro: NewEuroPlugin(nil)}
+	p.Sink = &captureSink{}
+	// A well-formed client pointed at an unroutable host: mischiefBuyerMXID reads
+	// only its user id (for the homeserver), and the DM courtesy path's lone real
+	// call — GetDisplayName — fails fast against 127.0.0.1:1 and falls back to the
+	// localpart, so nothing here touches a network or hangs.
+	cli, err := mautrix.NewClient("http://127.0.0.1:1", id.UserID("@gogobee:example.org"), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	p.Client = cli
+	return p
+}
+
+func webOrder(guid, buyer, targetToken, tier string, signed bool) peteclient.MischiefOrder {
+	return peteclient.MischiefOrder{
+		GUID: guid, BuyerUsername: buyer, TargetToken: targetToken,
+		TargetName: "Josie", Tier: tier, Signed: signed,
+	}
+}
+
+// TestResolveRosterToken round-trips the one-way board token: gogobee can't
+// invert it, but recomputing every live player's token finds the match, which is
+// how a web order names its mark.
+func TestResolveRosterToken(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@josie:example.org")
+	seedMischiefTarget(t, uid, 5, 60)
+
+	tok := eventToken(uid, "roster")
+	got, ok := resolveRosterToken(tok)
+	if !ok || got != uid {
+		t.Fatalf("resolveRosterToken(%s) = %q, %v; want %s", tok, got, ok, uid)
+	}
+	if _, ok := resolveRosterToken("not-a-real-token"); ok {
+		t.Error("resolveRosterToken matched a token no player owns")
+	}
+}
+
+// TestPlaceWebMischiefHappyPath: a funded buyer, a mark on a live expedition, a
+// tier gogobee offers — a web-sourced contract opens, stamped with the order.
+func TestPlaceWebMischiefHappyPath(t *testing.T) {
+	newMischiefTestDB(t)
+	p := webMischiefPlugin(t)
+
+	target := id.UserID("@josie:example.org")
+	seedMischiefTarget(t, target, 5, 60)
+	buyer := id.UserID("@reala:example.org")
+	p.euro.Credit(buyer, 1000, "test seed")
+
+	order := webOrder("ord-1", "reala", eventToken(target, "roster"), "grunt", false)
+	res := p.placeWebMischief(order)
+
+	if res.Status != mischiefWebPlaced {
+		t.Fatalf("status = %q (%s), want placed", res.Status, res.Detail)
+	}
+	c := mischiefContractByOrderGUID("ord-1")
+	if c == nil {
+		t.Fatal("no contract stamped with the order guid")
+	}
+	if c.Source != "web" || c.TargetID != target || c.BuyerID != buyer {
+		t.Fatalf("contract = %+v", c)
+	}
+	if bal := p.euro.GetBalance(buyer); bal != 960 {
+		t.Errorf("buyer balance = %v, want 960 (1000 - 40 grunt)", bal)
+	}
+}
+
+// TestPlaceWebMischiefIdempotent is the whole point of keying on the order guid:
+// the poll loop retries, so a second placement of the same order must not open a
+// second contract or debit the buyer twice.
+func TestPlaceWebMischiefIdempotent(t *testing.T) {
+	newMischiefTestDB(t)
+	p := webMischiefPlugin(t)
+
+	target := id.UserID("@josie:example.org")
+	seedMischiefTarget(t, target, 5, 60)
+	buyer := id.UserID("@reala:example.org")
+	p.euro.Credit(buyer, 1000, "test seed")
+
+	order := webOrder("ord-dup", "reala", eventToken(target, "roster"), "mob", false)
+	if res := p.placeWebMischief(order); res.Status != mischiefWebPlaced {
+		t.Fatalf("first placement = %q", res.Status)
+	}
+	balAfterFirst := p.euro.GetBalance(buyer)
+
+	// Same order again — the retry.
+	if res := p.placeWebMischief(order); res.Status != mischiefWebPlaced {
+		t.Fatalf("replay = %q, want placed", res.Status)
+	}
+	if bal := p.euro.GetBalance(buyer); bal != balAfterFirst {
+		t.Errorf("replay moved money: balance %v -> %v", balAfterFirst, bal)
+	}
+
+	// Exactly one contract exists for this target.
+	var n int
+	_ = db.Get().QueryRow(`SELECT COUNT(*) FROM mischief_contracts WHERE order_guid = ?`, "ord-dup").Scan(&n)
+	if n != 1 {
+		t.Fatalf("order opened %d contracts, want 1", n)
+	}
+}
+
+// TestPlaceWebMischiefBouncedFunds: a broke buyer is turned away before any money
+// moves — a mischief buy takes no credit, same as the Matrix path.
+func TestPlaceWebMischiefBouncedFunds(t *testing.T) {
+	newMischiefTestDB(t)
+	p := webMischiefPlugin(t)
+
+	target := id.UserID("@josie:example.org")
+	seedMischiefTarget(t, target, 5, 60)
+	buyer := id.UserID("@broke:example.org")
+	p.euro.Credit(buyer, 10, "test seed") // a grunt is 40
+
+	order := webOrder("ord-broke", "broke", eventToken(target, "roster"), "grunt", false)
+	res := p.placeWebMischief(order)
+
+	if res.Status != mischiefWebBouncedFunds {
+		t.Fatalf("status = %q, want bounced_funds", res.Status)
+	}
+	if mischiefContractByOrderGUID("ord-broke") != nil {
+		t.Error("a bounced order still opened a contract")
+	}
+	if bal := p.euro.GetBalance(buyer); bal != 10 {
+		t.Errorf("balance = %v, want 10 untouched (no debt for a mischief buy)", bal)
+	}
+}
+
+// TestPlaceWebMischiefBouncedIneligibleRefunds: a mark who isn't on an expedition
+// can't be hit; the buyer is refunded whole, net zero.
+func TestPlaceWebMischiefBouncedIneligibleRefunds(t *testing.T) {
+	newMischiefTestDB(t)
+	p := webMischiefPlugin(t)
+
+	// A real, alive character but NOT on an expedition — ineligible.
+	idle := id.UserID("@idle:example.org")
+	if err := createAdvCharacter(idle, "idle"); err != nil {
+		t.Fatal(err)
+	}
+	if err := SaveDnDCharacter(&DnDCharacter{
+		UserID: idle, Race: RaceHuman, Class: ClassFighter, Level: 5,
+		HPMax: 40, HPCurrent: 40, ArmorClass: 16,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	buyer := id.UserID("@reala:example.org")
+	p.euro.Credit(buyer, 1000, "test seed")
+
+	order := webOrder("ord-inelig", "reala", eventToken(idle, "roster"), "elite", false)
+	res := p.placeWebMischief(order)
+
+	if res.Status != mischiefWebBouncedIneligible {
+		t.Fatalf("status = %q (%s), want bounced_ineligible", res.Status, res.Detail)
+	}
+	if bal := p.euro.GetBalance(buyer); bal != 1000 {
+		t.Errorf("buyer balance = %v, want 1000 (debited then refunded whole)", bal)
+	}
+}
+
+// TestPlaceWebMischiefSelfTarget: the reconstructed buyer and the resolved target
+// are the same person — refused, like the Matrix path.
+func TestPlaceWebMischiefSelfTarget(t *testing.T) {
+	newMischiefTestDB(t)
+	p := webMischiefPlugin(t)
+
+	me := id.UserID("@reala:example.org")
+	seedMischiefTarget(t, me, 5, 60)
+	p.euro.Credit(me, 1000, "test seed")
+
+	order := webOrder("ord-self", "reala", eventToken(me, "roster"), "grunt", false)
+	if res := p.placeWebMischief(order); res.Status != mischiefWebBouncedIneligible {
+		t.Fatalf("self-target status = %q, want bounced_ineligible", res.Status)
+	}
+	if bal := p.euro.GetBalance(me); bal != 1000 {
+		t.Errorf("self-target moved money: balance %v", bal)
+	}
+}

internal/plugin/pete_offers.go

@@ -0,0 +1,129 @@
+package plugin
+
+// The offer half of the web action queue: what a signed-in owner is allowed to
+// ask for, and what it costs.
+//
+// W5a's two verbs needed none of this — "pull out" and "take your bout" have no
+// arguments and no price. W5b's three do, and the page cannot invent either: the
+// zone list is level-gated and postgame-gated per player, and every price scales
+// with level. So gogobee quotes them here, on the self-detail push that already
+// carries the owner's private panels, and Pete renders the quote without doing
+// any arithmetic of its own.
+//
+// A quote is NOT a permission. It is up to two minutes stale by the time anybody
+// clicks it, so every one of these is re-resolved against the game's own tables
+// when the order lands (performExpeditionStart re-runs availableZonesFor,
+// performBabysitPurchase re-reads the level). What the offer list buys is a page
+// that does not show a button which is certain to be refused.
+
+import (
+	"time"
+
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+// advLoadoutKeys is the order the three presets are offered in — cheapest first,
+// which is also how renderLoadoutPrompt lists them in Matrix.
+var advLoadoutKeys = []SupplyLoadout{LoadoutLean, LoadoutBalanced, LoadoutHeavy}
+
+// loadoutOffersFor prices the three supply presets at a tier. Days is the
+// provisions estimate at that tier's calm daily burn — the same number
+// `!expedition start` prints, and deliberately the pessimistic one: the holiday
+// and Omen freebie packs are added at departure, so a run can outlast its quote
+// but never fall short of it.
+func loadoutOffersFor(tier ZoneTier) []peteclient.LoadoutOffer {
+	out := make([]peteclient.LoadoutOffer, 0, len(advLoadoutKeys))
+	for _, l := range advLoadoutKeys {
+		pp := loadoutPurchase(tier, l)
+		sup := makeSupplies(tier, pp)
+		out = append(out, peteclient.LoadoutOffer{
+			Key:   loadoutName(l),
+			Name:  loadoutName(l),
+			Blurb: loadoutBlurb(l),
+			Cost:  pp.Cost(),
+			Days:  estimateDays(sup.Max, sup.DailyBurn),
+		})
+	}
+	return out
+}
+
+// zoneOffersFor is where this adventurer may set out for right now, priced.
+//
+// It returns nothing at all when they cannot leave — already on an expedition,
+// seated in somebody else's, or mid zone-run. That is not a second permission
+// check duplicating performExpeditionStart's; it is what stops the page offering
+// a departure it can already tell will be refused.
+func zoneOffersFor(uid id.UserID) []peteclient.ZoneOffer {
+	if seated, _ := seatedExpeditionFor(uid); seated != nil {
+		return nil
+	}
+	if existing, _ := getActiveExpedition(uid); existing != nil {
+		return nil
+	}
+	if run, _ := getActiveZoneRun(uid); run != nil {
+		return nil
+	}
+	zones := availableZonesFor(uid, dndLevelForUser(uid))
+	out := make([]peteclient.ZoneOffer, 0, len(zones))
+	for _, z := range zones {
+		out = append(out, peteclient.ZoneOffer{
+			ID:       string(z.ID),
+			Display:  z.Display,
+			Tier:     int(z.Tier),
+			Hook:     z.Hook,
+			Postgame: z.Tier == ZoneTierMythic,
+			Loadouts: loadoutOffersFor(z.Tier),
+		})
+	}
+	return out
+}
+
+// resumeOfferFor is the extracted expedition still waiting to be walked back
+// into. Nil when there is none, when the window has already lapsed, or when the
+// player is out again — a lapsed row is left for the sweeper to reap rather than
+// reaped here, because a push builder should not be quietly ending expeditions.
+func resumeOfferFor(uid id.UserID) *peteclient.ResumeOffer {
+	if existing, _ := getActiveExpedition(uid); existing != nil {
+		return nil
+	}
+	exp, err := getResumableExpedition(uid)
+	if err != nil || exp == nil {
+		return nil
+	}
+	if extractionLapsed(exp, time.Now().UTC()) {
+		return nil
+	}
+	zone, _ := getZone(exp.ZoneID)
+	off := &peteclient.ResumeOffer{
+		ZoneID:   string(exp.ZoneID),
+		Display:  zone.Display,
+		Tier:     int(zone.Tier),
+		Day:      exp.CurrentDay,
+		Loadouts: loadoutOffersFor(zone.Tier),
+	}
+	if exp.CompletedAt != nil {
+		off.ExpiresAt = exp.CompletedAt.Add(extractResumeWindow).Unix()
+	}
+	return off
+}
+
+// babysitOfferFor is the sitter's standing and the two prices they charge. It is
+// pushed even when a sitter is already engaged: "somebody is already looking
+// after your pet until Tuesday" is exactly what the page should say instead of a
+// buy button.
+func babysitOfferFor(adv *AdventureCharacter) *peteclient.BabysitOffer {
+	if adv == nil {
+		return nil
+	}
+	daily := babysitDailyCost(dndLevelForUser(adv.UserID))
+	off := &peteclient.BabysitOffer{
+		Active:    adv.BabysitActive,
+		WeekCost:  daily * 7,
+		MonthCost: daily * 30,
+	}
+	if adv.BabysitActive && adv.BabysitExpiresAt != nil {
+		off.ExpiresAt = adv.BabysitExpiresAt.Unix()
+	}
+	return off
+}

internal/plugin/pete_orders.go

@@ -0,0 +1,486 @@
+package plugin
+
+// The web action queue's game-side loop — the equip queue's sibling, and the
+// first one where the web plays the game rather than dressing the character.
+//
+// An owner, signed in on Pete, asks for something: pull out of a run, take
+// today's swing at the Siege, set out for a zone, walk back into the run they
+// extracted from, hire the pet sitter. Pete records the intent; we poll for it,
+// run the real command path (the same one `!extract`, `!expedition start`,
+// `!resume` and the rest run — not a second implementation of it), and file a
+// verdict Pete shows them.
+//
+// Same non-idempotency problem as equip, with higher stakes: replaying an
+// extraction would end a run the player had already resumed, and replaying a bout
+// would spend a day's swing they never got back. So before touching anything we
+// check the adv_applied_orders ledger — if this order's guid is there, the
+// mutation landed on an earlier tick and we only lost the verdict-ack, so we
+// re-file the stored verdict and mutate nothing.
+//
+// The poll is faster than equip's (15s vs 30s) for one reason: an extraction is
+// the answer to something the player is *watching* go wrong on the who page. A
+// minute of silence there reads as a button that didn't work.
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+const (
+	advOrderPollInterval = 15 * time.Second
+	// A Siege bout runs a full combat and streams its narration to Matrix before
+	// takeSiegeBout returns, so this budget is minutes, not seconds — the equip
+	// path's 20s would abandon a fight that was going fine.
+	advOrderPollTimeout = 5 * time.Minute
+)
+
+// peteAdvOrderTicker polls Pete for web actions and fulfils them. Started
+// alongside the other adventure tickers; exits on stopCh.
+func (p *AdventurePlugin) peteAdvOrderTicker() {
+	if !peteclient.Enabled() {
+		return // no Pete wire configured; the action queue is simply off
+	}
+	ticker := time.NewTicker(advOrderPollInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-ticker.C:
+			p.pollAdvOrders()
+		}
+	}
+}
+
+func (p *AdventurePlugin) pollAdvOrders() {
+	ctx, cancel := context.WithTimeout(context.Background(), advOrderPollTimeout)
+	defer cancel()
+
+	orders, err := peteclient.PendingOrders(ctx)
+	if err != nil {
+		// A Pete predating the queue answers 404; a wire blip looks the same. Quiet
+		// on purpose — this must not spam while Pete hasn't shipped the endpoint.
+		slog.Debug("orders: poll failed", "err", err)
+		return
+	}
+	for _, order := range orders {
+		p.fulfilAdvOrder(ctx, order)
+	}
+}
+
+// fulfilAdvOrder applies one action and files its verdict. A transient failure is
+// left pending for the next poll (no verdict); a permanent one gets a specific
+// rejection. The guid ledger makes a re-offer after a lost ack a no-op that
+// simply re-files the verdict.
+func (p *AdventurePlugin) fulfilAdvOrder(ctx context.Context, order peteclient.AdvOrder) {
+	// Already applied on an earlier tick? Re-file the stored verdict, mutate nothing.
+	if status, detail, ok := advOrderAlreadyApplied(order.GUID); ok {
+		if err := peteclient.VerdictOrder(ctx, order.GUID, status, detail); err != nil {
+			slog.Warn("orders: re-file verdict push failed, will retry next poll",
+				"order", order.GUID, "status", status, "err", err)
+		}
+		return
+	}
+
+	owner, ok := p.equipOwnerMXID(order.OwnerLocalpart)
+	if !ok {
+		// The client isn't up (tests) or the localpart is empty. Not our order to
+		// fail permanently — leave it pending and try again once we can name the owner.
+		slog.Debug("orders: cannot resolve owner, leaving pending", "order", order.GUID, "owner", order.OwnerLocalpart)
+		return
+	}
+
+	status, detail, retry := p.applyAdvOrder(owner, order)
+	if retry {
+		return // transient; leave pending for the next tick
+	}
+
+	// Record the verdict BEFORE pushing it, so a crash after the mutation still
+	// short-circuits next tick and re-files rather than re-applying. Same ordering
+	// and the same reasoning as the equip poller.
+	if err := recordAdvApplied(order.GUID, status, detail); err != nil {
+		slog.Warn("orders: failed to record applied order, leaving pending",
+			"order", order.GUID, "status", status, "err", err)
+		return
+	}
+	if err := peteclient.VerdictOrder(ctx, order.GUID, status, detail); err != nil {
+		slog.Warn("orders: verdict push failed, will re-file next poll",
+			"order", order.GUID, "status", status, "err", err)
+		return
+	}
+	slog.Info("orders: web action fulfilled", "order", order.GUID, "action", order.Action, "status", status)
+}
+
+// applyAdvOrder runs the real action. It returns the terminal status and a human
+// note for Pete, or retry=true for a transient fault that should leave the order
+// pending. It records nothing and pushes nothing — the caller does both.
+//
+// Note what is NOT here: a per-user lock. Almost every verb takes it inside its
+// own shared helper (performExtraction, takeSiegeBout, performResume,
+// performBabysitPurchase), which is what serialises them against the Matrix
+// commands running the very same code. Taking it here too would deadlock on a
+// non-reentrant mutex.
+//
+// The exceptions are the three twins whose Matrix caller already holds the lock
+// across the whole `!expedition` switch and so cannot take it themselves —
+// performExpeditionStart, performExpeditionAbandon and performExpeditionLeave.
+// Their apply wrappers below take it instead. That asymmetry is written down in
+// both places because getting it wrong does not fail loudly: it wedges the
+// player's lock forever and every later adventure command from them hangs. The
+// rule for a new verb is not "web wrappers take the lock" — it is "look at what
+// the Matrix caller does", and the two babysit verbs go the other way.
+func (p *AdventurePlugin) applyAdvOrder(owner id.UserID, order peteclient.AdvOrder) (status, detail string, retry bool) {
+	switch order.Action {
+	case peteclient.AdvOrderExtract:
+		out, err := p.performExtraction(owner)
+		switch {
+		case errors.Is(err, errExtractNoRun):
+			return "rejected_not_running", "You weren't on an expedition.", false
+		case errors.Is(err, errExtractNotLeader):
+			return "rejected_not_leader", "Only the party leader can call the extraction.", false
+		case err != nil:
+			// Every remaining failure here is a DB fault. Leave it pending: nothing
+			// has been written, so the next tick retries cleanly.
+			slog.Warn("orders: extraction failed", "order", order.GUID, "user", owner, "err", err)
+			return "", "", true
+		}
+		return "applied", fmt.Sprintf(
+			"Out of %s on day %d. Loot, XP and coins kept. Say !resume within 7 days to go back in.",
+			out.Zone, out.Day), false
+
+	case peteclient.AdvOrderSiegeJoin:
+		bout, boss, err := p.takeSiegeBout(owner)
+		switch {
+		case errors.Is(err, errSiegeNoBoss):
+			return "rejected_no_siege", "No Siege is camped outside town right now.", false
+		case errors.Is(err, errSiegeNoCharacter):
+			return "rejected_unavailable", "You don't have an adventurer yet.", false
+		case errors.Is(err, errSiegeDead):
+			return "rejected_unavailable", "You're dead. The Siege will have to wait.", false
+		case errors.Is(err, errSiegeAlreadyFought):
+			return "rejected_already_fought", "You've already taken your bout today. One fight per day.", false
+		case err != nil:
+			// A combat that errored persisted nothing terminal, but it may have
+			// written HP. Retry is still right: the once-per-day gate is stamped by
+			// the contribution row, which only lands on a bout that completed.
+			slog.Warn("orders: siege bout failed", "order", order.GUID, "user", owner, "err", err)
+			return "", "", true
+		}
+		// The blow-by-blow went to Matrix; the web gets the same one-line result the
+		// narration closed with, minus its markdown.
+		return "applied", advOrderPlainText(siegeBoutFooter(bout, boss)), false
+
+	case peteclient.AdvOrderExpedition:
+		return p.applyWebExpeditionStart(owner, order)
+
+	case peteclient.AdvOrderResume:
+		return p.applyWebResume(owner, order)
+
+	case peteclient.AdvOrderBabysit:
+		return p.applyWebBabysit(owner, order)
+
+	case peteclient.AdvOrderAbandon:
+		return p.applyWebAbandon(owner)
+
+	case peteclient.AdvOrderLeave:
+		return p.applyWebLeave(owner)
+
+	case peteclient.AdvOrderBabysitCancel:
+		return p.applyWebBabysitCancel(owner)
+
+	default:
+		// Pete validates the action before it ever queues an order, so this is a
+		// contract breach, not a user mistake. Reject permanently rather than spin.
+		return "rejected_unavailable", "Unknown action.", false
+	}
+}
+
+// ---- the three verbs that take arguments and spend coins ------------------------
+//
+// Everything below re-resolves its own arguments against the game's own tables.
+// Pete only ever offers what gogobee quoted it (see pete_offers.go), but a quote
+// is up to two minutes stale and is not a permission — so the zone is looked up
+// again in availableZonesFor, the loadout is priced again at the real tier, and
+// the fee is read again at the real level. A forged param buys nothing.
+//
+// All three are money moves on a retrying wire, so each hands the order guid down
+// as the idempotency key. Nothing here refunds-then-retries: once a refund has
+// happened the guid-keyed debit will not charge again, so a retry would hand over
+// the goods for free. Every failure past the debit is therefore permanent.
+
+// applyWebExpeditionStart sends the owner's adventurer out of town.
+func (p *AdventurePlugin) applyWebExpeditionStart(owner id.UserID, order peteclient.AdvOrder) (status, detail string, retry bool) {
+	if order.Params == nil || order.Params.Zone == "" {
+		return "rejected_unavailable", "That order didn't say where to.", false
+	}
+	// performExpeditionStart is the one headless twin that does NOT take the
+	// per-user lock (its Matrix caller already holds it across the whole
+	// `!expedition` switch), so this is the one order case that has to.
+	userMu := p.advUserLock(owner)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	c, err := LoadDnDCharacter(owner)
+	if err != nil {
+		return "", "", true // a DB fault; nothing written, so the next tick retries cleanly
+	}
+	if c == nil || c.PendingSetup {
+		return "rejected_unavailable", "You don't have an adventurer yet.", false
+	}
+	zoneID, ok := resolveZoneInput(order.Params.Zone, availableZonesFor(owner, c.Level))
+	if !ok {
+		if reason := postgameLockReason(order.Params.Zone, owner, c.Level); reason != "" {
+			return "rejected_zone_locked", advOrderPlainText(reason), false
+		}
+		return "rejected_zone_locked", "That zone isn't open to you right now.", false
+	}
+	zone, _ := getZone(zoneID)
+	// An unknown loadout is refused rather than defaulted. A default here would
+	// spend coins on a pack size the player never picked.
+	loadout, ok := parseLoadoutToken(order.Params.Loadout)
+	if !ok {
+		return "rejected_unavailable", "That isn't a loadout I sell.", false
+	}
+	out, err := p.performExpeditionStart(owner, c, zone, loadoutPurchase(zone.Tier, loadout), order.GUID)
+	if err != nil {
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errExpStartZoneLocked):
+			status = "rejected_zone_locked"
+		case errors.Is(err, errExpStartBusy):
+			status = "rejected_busy"
+		case errors.Is(err, errExpStartBroke):
+			status = "rejected_insufficient_funds"
+		}
+		// Everything else — still resting, a bad pack count, a start that tore
+		// itself down and refunded — is rejected_unavailable, and the detail line
+		// carries the specifics.
+		return status, advOrderPlainText(err.Error()), false
+	}
+	return "applied", fmt.Sprintf(
+		"Out of town, bound for %s, with the %s loadout: %d coins, about %d days of provisions.",
+		out.Zone.Display, loadoutName(loadout), out.Cost, out.Days), false
+}
+
+// applyWebResume walks the owner back into the run they extracted from.
+func (p *AdventurePlugin) applyWebResume(owner id.UserID, order peteclient.AdvOrder) (status, detail string, retry bool) {
+	// The loadout is required here, unlike in Matrix: an empty one asks
+	// performResume for the pick-a-loadout prompt, which is a DM, not a verdict.
+	if order.Params == nil || order.Params.Loadout == "" {
+		return "rejected_unavailable", "That order didn't say what to pack.", false
+	}
+	if _, ok := parseLoadoutToken(order.Params.Loadout); !ok {
+		return "rejected_unavailable", "That isn't a loadout I sell.", false
+	}
+	out, err := p.performResume(owner, order.Params.Loadout, order.GUID)
+	if err != nil {
+		var refusal advRefusal
+		if !errors.As(err, &refusal) {
+			// Not a refusal at all — a DB fault reading expedition state. Nothing
+			// has been written, so leave it pending.
+			slog.Warn("orders: resume failed", "order", order.GUID, "user", owner, "err", err)
+			return "", "", true
+		}
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errResumeBusy):
+			status = "rejected_busy"
+		case errors.Is(err, errResumeNothing), errors.Is(err, errResumeLapsed):
+			status = "rejected_nothing_to_resume"
+		case errors.Is(err, errResumeBroke):
+			status = "rejected_insufficient_funds"
+		}
+		return status, advOrderPlainText(err.Error()), false
+	}
+	return "applied", fmt.Sprintf(
+		"Back into %s on day %d, re-outfitted for %d coins.",
+		out.Zone.Display, out.Day, out.Purchase.Cost()), false
+}
+
+// applyWebBabysit engages the pet sitter for a week or a month.
+func (p *AdventurePlugin) applyWebBabysit(owner id.UserID, order peteclient.AdvOrder) (status, detail string, retry bool) {
+	// The two durations the game sells. Anything else is a contract breach rather
+	// than a user mistake, since Pete offers exactly these two.
+	days := 0
+	if order.Params != nil {
+		days = order.Params.Days
+	}
+	if days != 7 && days != 30 {
+		return "rejected_unavailable", "The sitter works by the week or by the month.", false
+	}
+	out, err := p.performBabysitPurchase(owner, days, order.GUID)
+	if err != nil {
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errBabysitActive):
+			status = "rejected_busy"
+		case errors.Is(err, errBabysitBroke):
+			status = "rejected_insufficient_funds"
+		}
+		return status, advOrderPlainText(err.Error()), false
+	}
+	label := "a week"
+	if out.Days == 30 {
+		label = "a month"
+	}
+	note := fmt.Sprintf("Sitter engaged for %s, %d coins.", label, out.Cost)
+	if out.PetName != "" {
+		note += fmt.Sprintf(" %s is in good hands.", out.PetName)
+	}
+	return "applied", note, false
+}
+
+// ---- the three verbs that take no arguments and spend nothing -------------------
+//
+// Each of these was already named inside a verdict the web shows: "!expedition
+// abandon first", "!expedition leave to walk out alone", "cancel early (no
+// refund)". A page that tells somebody to go and type a command it could have
+// offered them is a page with a hole in it, and these three close it.
+//
+// None of them touches money, so none of them needs an idempotency key — the
+// guid ledger in fulfilAdvOrder is the whole guard, and a replay it somehow got
+// past would be refused honestly ("nothing to abandon") rather than charging
+// anybody twice.
+
+// applyWebAbandon closes the owner's expedition down for good.
+func (p *AdventurePlugin) applyWebAbandon(owner id.UserID) (status, detail string, retry bool) {
+	// performExpeditionAbandon does NOT take the per-user lock (its Matrix caller
+	// holds it across the whole `!expedition` switch), so this has to. See the
+	// note on applyAdvOrder.
+	userMu := p.advUserLock(owner)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	out, err := p.performExpeditionAbandon(owner)
+	if err != nil {
+		var refusal advRefusal
+		if !errors.As(err, &refusal) {
+			// A DB fault reading or writing expedition state. Nothing partial is
+			// left behind that a retry would double up, so leave it pending.
+			slog.Warn("orders: abandon failed", "user", owner, "err", err)
+			return "", "", true
+		}
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errAbandonNothing):
+			status = "rejected_not_running"
+		case errors.Is(err, errAbandonNotLeader):
+			status = "rejected_not_leader"
+		}
+		return status, advOrderPlainText(err.Error()), false
+	}
+	// The extracted case keeps loot and XP, so saying "supplies are forfeit" there
+	// would be a straight lie. Same split the DM makes.
+	if out.Extracted {
+		return "applied", fmt.Sprintf(
+			"You let %s go on day %d. Loot, XP and coins are kept.", out.Zone.Display, out.Day), false
+	}
+	return "applied", fmt.Sprintf(
+		"Expedition in %s abandoned on day %d. Supplies are forfeit.", out.Zone.Display, out.Day), false
+}
+
+// applyWebLeave walks a party member out of somebody else's expedition.
+func (p *AdventurePlugin) applyWebLeave(owner id.UserID) (status, detail string, retry bool) {
+	// Same lock asymmetry as applyWebAbandon.
+	userMu := p.advUserLock(owner)
+	userMu.Lock()
+	defer userMu.Unlock()
+
+	if err := p.performExpeditionLeave(owner); err != nil {
+		var refusal advRefusal
+		if !errors.As(err, &refusal) {
+			slog.Warn("orders: leave failed", "user", owner, "err", err)
+			return "", "", true
+		}
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errLeaveNothing):
+			status = "rejected_not_running"
+		case errors.Is(err, errLeaveIsLeader):
+			status = "rejected_is_leader"
+		}
+		return status, advOrderPlainText(err.Error()), false
+	}
+	return "applied", "You turn back for town. Your supplies stay with the party.", false
+}
+
+// applyWebBabysitCancel dismisses the pet sitter early.
+func (p *AdventurePlugin) applyWebBabysitCancel(owner id.UserID) (status, detail string, retry bool) {
+	// No lock here, and that is not an oversight: performBabysitCancel takes it
+	// itself, because ITS Matrix caller does not. The opposite of the two above.
+	out, err := p.performBabysitCancel(owner)
+	if err != nil {
+		status := "rejected_unavailable"
+		switch {
+		case errors.Is(err, errBabysitNoSitter):
+			status = "rejected_nothing_to_cancel"
+		}
+		return status, advOrderPlainText(err.Error()), false
+	}
+	// The DM prints the sitter's whole record of the stay; a verdict is one line
+	// under a button, so the web gets the fact and the page keeps its shape.
+	note := "Sitter dismissed. No refund — they were already here."
+	if out.PetName != "" {
+		note = fmt.Sprintf("Sitter dismissed. No refund. %s is back in your care.", out.PetName)
+	}
+	return "applied", note, false
+}
+
+// advOrderPlainText strips the Matrix markdown out of a line reused as a web
+// verdict. Pete renders the detail as text, so asterisks and backticks would show
+// up literally. The command hints inside those backticks stay — a verdict that
+// says to type `!expedition abandon` is telling the truth about where the other
+// door is, and the web has no button for it yet.
+func advOrderPlainText(s string) string {
+	out := make([]rune, 0, len(s))
+	for _, r := range s {
+		switch r {
+		case '*', '`':
+			continue
+		case '\n':
+			out = append(out, ' ')
+		default:
+			out = append(out, r)
+		}
+	}
+	return string(out)
+}
+
+// ---- the applied-order ledger --------------------------------------------------
+
+// advOrderAlreadyApplied reports the verdict we filed for an order, if we have
+// already applied it. This is the short-circuit that keeps a re-offered order from
+// re-running its non-idempotent mutation.
+func advOrderAlreadyApplied(guid string) (status, detail string, ok bool) {
+	err := db.Get().QueryRow(
+		`SELECT status, detail FROM adv_applied_orders WHERE guid = ?`, guid,
+	).Scan(&status, &detail)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", "", false
+	}
+	if err != nil {
+		// A read failure sends us down the mutation path and risks re-running an
+		// extraction or a bout, so it is logged loudly. A transient one self-heals:
+		// the mutation is guarded by this same table, so the next poll reads it.
+		slog.Error("orders: applied-ledger read failed", "order", guid, "err", err)
+		return "", "", false
+	}
+	return status, detail, true
+}
+
+// recordAdvApplied stamps an order as applied with the verdict we're about to
+// file. OR IGNORE so a re-file that somehow reaches here can't error on the guid.
+func recordAdvApplied(guid, status, detail string) error {
+	_, err := db.Get().Exec(
+		`INSERT OR IGNORE INTO adv_applied_orders (guid, status, detail) VALUES (?, ?, ?)`,
+		guid, status, detail)
+	return err
+}

internal/plugin/pete_orders_test.go

@@ -0,0 +1,385 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+// W5: the web action queue's game-side half. These pin the two things that would
+// actually hurt in prod — a replayed order re-running a non-idempotent action,
+// and a refusal being reported as a transient fault (which parks the order and
+// leaves the player staring at "asked for…" forever).
+
+// TestAdvOrderLedgerShortCircuitsAReoffer is the regression for the whole class
+// of bug this ledger exists for. A verdict-ack lost on the wire means Pete
+// re-offers an order we have already applied; if that re-offer reached
+// applyAdvOrder it would extract a run the player had resumed, or spend a bout
+// they were saving.
+func TestAdvOrderLedgerShortCircuitsAReoffer(t *testing.T) {
+	newMischiefTestDB(t)
+
+	if _, _, ok := advOrderAlreadyApplied("guid-never-seen"); ok {
+		t.Fatal("an unknown guid reported as already applied")
+	}
+	if err := recordAdvApplied("guid-1", "applied", "Out of the Goblin Warrens on day 3."); err != nil {
+		t.Fatalf("recordAdvApplied: %v", err)
+	}
+	status, detail, ok := advOrderAlreadyApplied("guid-1")
+	if !ok || status != "applied" || !strings.Contains(detail, "Goblin Warrens") {
+		t.Fatalf("ledger read = %q/%q ok=%v, want the stored verdict back", status, detail, ok)
+	}
+	// A second stamp on the same guid must not error or overwrite — the re-file
+	// path can reach it.
+	if err := recordAdvApplied("guid-1", "rejected_not_running", "nonsense"); err != nil {
+		t.Fatalf("re-record: %v", err)
+	}
+	if status, _, _ := advOrderAlreadyApplied("guid-1"); status != "applied" {
+		t.Fatalf("verdict changed under a re-record: %q", status)
+	}
+}
+
+// TestExtractOrderRefusalsAreTerminal: neither refusal may come back as retry.
+// A retried refusal never reaches a verdict, so the order sits pending forever
+// and Pete's strip never stops saying "asked for…".
+func TestExtractOrderRefusalsAreTerminal(t *testing.T) {
+	// W9: was setupZoneRunTestDB, which copies data/gogobee.db and t.Skip()s when
+	// it is missing — and that file is deleted after every local run, so this and
+	// the extraction test below have been green-by-skipping since W5a. Neither
+	// needs a prod row; startExpedition builds everything they touch.
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-extract-none:example.org")
+	defer cleanupExpeditions(uid)
+	p := &AdventurePlugin{}
+
+	status, detail, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g", Action: peteclient.AdvOrderExtract,
+	})
+	if retry {
+		t.Fatal("no-expedition extract asked for a retry; it must be terminal")
+	}
+	if status != "rejected_not_running" || detail == "" {
+		t.Fatalf("status = %q detail = %q, want rejected_not_running with prose", status, detail)
+	}
+}
+
+// TestExtractOrderIsTheSameExtraction: the web verb must run the game's own
+// extraction, not a lookalike. The proof is the state the row lands in —
+// 'extracting' (a resumable limbo) rather than 'abandoned' — plus the day burn
+// and the log line the DM path writes.
+func TestExtractOrderIsTheSameExtraction(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-extract-live:example.org")
+	defer cleanupExpeditions(uid)
+	p := &AdventurePlugin{}
+
+	if _, err := startExpedition(uid, ZoneGoblinWarrens, "", ExpeditionSupplies{
+		Current: 10, Max: 10, DailyBurn: 1, HarshMod: 1, PacksStandard: 1,
+	}); err != nil {
+		t.Fatalf("startExpedition: %v", err)
+	}
+
+	status, detail, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g-extract", Action: peteclient.AdvOrderExtract,
+	})
+	if retry || status != "applied" {
+		t.Fatalf("extract = %q retry=%v, want applied", status, retry)
+	}
+	if !strings.Contains(detail, "resume") {
+		t.Fatalf("verdict %q never mentions the resume window, which is the whole point of an extraction", detail)
+	}
+
+	var dbStatus string
+	var day int
+	if err := db.Get().QueryRow(
+		`SELECT status, current_day FROM dnd_expedition WHERE user_id = ?`, string(uid),
+	).Scan(&dbStatus, &day); err != nil {
+		t.Fatalf("read expedition: %v", err)
+	}
+	if dbStatus != ExpeditionStatusExtracting {
+		t.Fatalf("expedition status = %q, want %q — a web extract must be resumable like the command's",
+			dbStatus, ExpeditionStatusExtracting)
+	}
+	if day != 2 {
+		t.Fatalf("current_day = %d, want 2 — extraction burns the day", day)
+	}
+}
+
+// TestSiegeJoinRefusalsAreTerminal covers the two refusals a bout can hit without
+// running any combat: nothing camped, and a bout already spent today. Both must
+// be terminal for the same reason as the extract refusals, and "already fought"
+// especially — it is the one a double-click produces.
+func TestSiegeJoinRefusalsAreTerminal(t *testing.T) {
+	newMischiefTestDB(t)
+	uid := id.UserID("@web-siege:example.org")
+	p := &AdventurePlugin{}
+
+	status, _, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g1", Action: peteclient.AdvOrderSiegeJoin,
+	})
+	if retry || status != "rejected_no_siege" {
+		t.Fatalf("no-boss bout = %q retry=%v, want rejected_no_siege", status, retry)
+	}
+
+	// Camp a boss and spend the day's bout, then ask again.
+	now := time.Now().UTC()
+	bossID, err := insertWorldBoss("Grelloth", 3, 18000, now.Add(-time.Hour), now.Add(48*time.Hour))
+	if err != nil {
+		t.Fatalf("insertWorldBoss: %v", err)
+	}
+	if err := createAdvCharacter(uid, "Rurina"); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	today := now.Format("2006-01-02")
+	if err := upsertWorldBossContrib(bossID, uid, 250, today); err != nil {
+		t.Fatalf("upsertWorldBossContrib: %v", err)
+	}
+
+	status, detail, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g2", Action: peteclient.AdvOrderSiegeJoin,
+	})
+	if retry || status != "rejected_already_fought" {
+		t.Fatalf("second bout = %q retry=%v, want rejected_already_fought", status, retry)
+	}
+	if detail == "" {
+		t.Fatal("a refusal with no prose leaves the strip saying nothing useful")
+	}
+}
+
+// TestUnknownActionIsRejectedNotRetried: Pete validates the action before it ever
+// queues one, so an unknown verb is a contract breach. Spinning on it would poll
+// the same dead order every 15 seconds forever.
+func TestUnknownActionIsRejectedNotRetried(t *testing.T) {
+	newMischiefTestDB(t)
+	p := &AdventurePlugin{}
+	status, _, retry := p.applyAdvOrder("@x:example.org", peteclient.AdvOrder{
+		GUID: "g", Action: "sell_house",
+	})
+	if retry || !strings.HasPrefix(status, "rejected_") {
+		t.Fatalf("unknown action = %q retry=%v, want a terminal rejection", status, retry)
+	}
+}
+
+// TestAdvOrderPlainText: the Siege verdict is the Matrix footer reused, and Pete
+// renders a verdict as text — so the markdown has to come off or the player reads
+// literal asterisks.
+func TestAdvOrderPlainText(t *testing.T) {
+	got := advOrderPlainText("💥 You deal **412** damage. **Grelloth** has **5,800 / 18,000 HP** left.\nYou stagger out at 1 HP.")
+	if strings.Contains(got, "*") || strings.Contains(got, "\n") {
+		t.Fatalf("plain text still carries markup or a newline: %q", got)
+	}
+	if !strings.Contains(got, "412") || !strings.Contains(got, "Grelloth") {
+		t.Fatalf("plain text lost the facts: %q", got)
+	}
+}
+
+// ── W5b: the three verbs that take arguments and spend coins ───────────────────
+
+// webOrderTestChar builds a character solvent enough to outfit an expedition.
+func webOrderTestChar(t *testing.T, uid id.UserID, level int, coins float64) *AdventurePlugin {
+	t.Helper()
+	if err := createAdvCharacter(uid, "weborder"); err != nil {
+		t.Fatal(err)
+	}
+	c := &DnDCharacter{
+		UserID: uid, Race: RaceHuman, Class: ClassFighter, Level: level,
+		STR: 14, DEX: 12, CON: 14, INT: 10, WIS: 10, CHA: 10,
+		HPMax: 30, HPCurrent: 30, ArmorClass: 14,
+	}
+	if err := SaveDnDCharacter(c); err != nil {
+		t.Fatal(err)
+	}
+	euro := &EuroPlugin{}
+	euro.ensureBalance(uid)
+	if coins > 0 {
+		euro.Credit(uid, coins, "test bankroll")
+	}
+	return &AdventurePlugin{euro: euro}
+}
+
+// A forged zone must buy nothing. Pete only ever offers what gogobee quoted it,
+// but a quote is a stale snapshot and not a permission — so the order path
+// re-resolves against availableZonesFor and refuses anything that isn't there.
+func TestWebExpeditionStartReResolvesTheZone(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-start-forged:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid); cleanupZoneRuns(uid) })
+	p := webOrderTestChar(t, uid, 2, 100000)
+
+	before := p.euro.GetBalance(uid)
+	status, _, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "forged-zone", Action: peteclient.AdvOrderExpedition,
+		Params: &peteclient.AdvOrderParams{Zone: "dragons_lair", Loadout: "lean"},
+	})
+	if retry {
+		t.Fatal("a locked zone asked for a retry; it must be terminal")
+	}
+	if status != "rejected_zone_locked" {
+		t.Fatalf("status = %q, want rejected_zone_locked", status)
+	}
+	if after := p.euro.GetBalance(uid); after != before {
+		t.Fatalf("a refused departure moved money: %.0f -> %.0f", before, after)
+	}
+	if exp, _ := getActiveExpedition(uid); exp != nil {
+		t.Fatal("a refused departure started an expedition anyway")
+	}
+}
+
+// An unknown loadout is refused, never defaulted. Defaulting would spend coins on
+// a pack size the player never picked.
+func TestWebExpeditionStartRefusesAnUnknownLoadout(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-start-loadout:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid); cleanupZoneRuns(uid) })
+	p := webOrderTestChar(t, uid, 2, 100000)
+
+	before := p.euro.GetBalance(uid)
+	status, _, _ := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "bad-loadout", Action: peteclient.AdvOrderExpedition,
+		Params: &peteclient.AdvOrderParams{Zone: string(ZoneGoblinWarrens), Loadout: "enormous"},
+	})
+	if status != "rejected_unavailable" {
+		t.Fatalf("status = %q, want rejected_unavailable", status)
+	}
+	if after := p.euro.GetBalance(uid); after != before {
+		t.Fatalf("a refused loadout moved money: %.0f -> %.0f", before, after)
+	}
+}
+
+// The money test that matters: a re-offered order (verdict-ack lost before the
+// ledger stamped it) must not charge twice, and must not answer "you're already
+// on an expedition" for the expedition it just started.
+func TestWebExpeditionStartChargesOnceOnAReoffer(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-start-idem:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid); cleanupZoneRuns(uid) })
+	p := webOrderTestChar(t, uid, 2, 100000)
+
+	order := peteclient.AdvOrder{
+		GUID: "start-once", Action: peteclient.AdvOrderExpedition,
+		Params: &peteclient.AdvOrderParams{Zone: string(ZoneGoblinWarrens), Loadout: "lean"},
+	}
+	before := p.euro.GetBalance(uid)
+	status, _, retry := p.applyAdvOrder(uid, order)
+	if retry || status != "applied" {
+		t.Fatalf("first apply = %q retry=%v, want applied", status, retry)
+	}
+	afterFirst := p.euro.GetBalance(uid)
+	if afterFirst >= before {
+		t.Fatalf("outfitting cost nothing: %.0f -> %.0f", before, afterFirst)
+	}
+
+	// The re-offer. applyAdvOrder is reached directly here on purpose: the
+	// adv_applied_orders ledger would normally short-circuit it, and this asserts
+	// the layer *underneath* that guard is safe too.
+	status, _, retry = p.applyAdvOrder(uid, order)
+	if retry {
+		t.Fatal("the re-offer asked for a retry")
+	}
+	if status != "applied" {
+		t.Fatalf("re-offer = %q, want applied — the settled debit is what tells a "+
+			"replay apart from a player who really is already out", status)
+	}
+	if after := p.euro.GetBalance(uid); after != afterFirst {
+		t.Fatalf("the re-offer charged again: %.0f -> %.0f", afterFirst, after)
+	}
+}
+
+// Babysit: same replay contract, plus the two durations are the only two sold.
+func TestWebBabysitChargesOnceAndSellsTwoDurations(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-sitter:example.org")
+	p := webOrderTestChar(t, uid, 2, 100000)
+
+	status, _, _ := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "sitter-odd", Action: peteclient.AdvOrderBabysit,
+		Params: &peteclient.AdvOrderParams{Days: 3},
+	})
+	if status != "rejected_unavailable" {
+		t.Fatalf("3-day sitter = %q, want rejected_unavailable", status)
+	}
+
+	order := peteclient.AdvOrder{
+		GUID: "sitter-once", Action: peteclient.AdvOrderBabysit,
+		Params: &peteclient.AdvOrderParams{Days: 7},
+	}
+	before := p.euro.GetBalance(uid)
+	if status, _, _ := p.applyAdvOrder(uid, order); status != "applied" {
+		t.Fatalf("hire = %q, want applied", status)
+	}
+	afterFirst := p.euro.GetBalance(uid)
+	if afterFirst >= before {
+		t.Fatalf("the sitter worked for free: %.0f -> %.0f", before, afterFirst)
+	}
+	if status, _, _ := p.applyAdvOrder(uid, order); status != "applied" {
+		t.Fatalf("re-offer = %q, want applied", status)
+	}
+	if after := p.euro.GetBalance(uid); after != afterFirst {
+		t.Fatalf("the re-offer charged again: %.0f -> %.0f", afterFirst, after)
+	}
+}
+
+// A refusal must never come back as retry: a retried refusal never reaches a
+// verdict, so the order parks and the strip says "asked for…" forever.
+func TestWebMoneyVerbRefusalsAreTerminal(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-broke:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid); cleanupZoneRuns(uid) })
+	p := webOrderTestChar(t, uid, 2, 0)
+
+	for _, tc := range []struct {
+		name  string
+		order peteclient.AdvOrder
+		want  string
+	}{
+		{"broke departure", peteclient.AdvOrder{
+			GUID: "broke-1", Action: peteclient.AdvOrderExpedition,
+			Params: &peteclient.AdvOrderParams{Zone: string(ZoneGoblinWarrens), Loadout: "heavy"},
+		}, "rejected_insufficient_funds"},
+		{"nothing to resume", peteclient.AdvOrder{
+			GUID: "resume-1", Action: peteclient.AdvOrderResume,
+			Params: &peteclient.AdvOrderParams{Loadout: "lean"},
+		}, "rejected_nothing_to_resume"},
+		{"broke sitter", peteclient.AdvOrder{
+			GUID: "broke-2", Action: peteclient.AdvOrderBabysit,
+			Params: &peteclient.AdvOrderParams{Days: 30},
+		}, "rejected_insufficient_funds"},
+	} {
+		status, detail, retry := p.applyAdvOrder(uid, tc.order)
+		if retry {
+			t.Fatalf("%s asked for a retry; it must be terminal", tc.name)
+		}
+		if status != tc.want {
+			t.Fatalf("%s = %q, want %q (detail %q)", tc.name, status, tc.want, detail)
+		}
+		if strings.ContainsAny(detail, "*`") {
+			t.Fatalf("%s verdict still carries Matrix markdown: %q", tc.name, detail)
+		}
+	}
+}
+
+// An order with no params at all is a contract breach, not a user mistake, and
+// must be refused rather than defaulted into spending money.
+func TestWebMoneyVerbsRefuseMissingParams(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@web-noparams:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid); cleanupZoneRuns(uid) })
+	p := webOrderTestChar(t, uid, 2, 100000)
+
+	before := p.euro.GetBalance(uid)
+	for _, action := range []string{
+		peteclient.AdvOrderExpedition, peteclient.AdvOrderResume, peteclient.AdvOrderBabysit,
+	} {
+		status, _, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{GUID: "np-" + action, Action: action})
+		if retry || status != "rejected_unavailable" {
+			t.Fatalf("%s with no params = %q retry=%v, want rejected_unavailable", action, status, retry)
+		}
+	}
+	if after := p.euro.GetBalance(uid); after != before {
+		t.Fatalf("a paramless order moved money: %.0f -> %.0f", before, after)
+	}
+}

internal/plugin/pete_orders_undo_test.go

@@ -0,0 +1,209 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"gogobee/internal/peteclient"
+	"maunium.net/go/mautrix/id"
+)
+
+// W9: the three web verbs that undo something — abandon an expedition, walk out
+// of somebody else's party, send the sitter home.
+//
+// The thing worth pinning here is not the verdict text, it is the LOCK. Each of
+// these three now has a headless twin shared between a Matrix command and the web
+// order path, and the two halves take advUserLock on opposite sides: the two
+// expedition twins cannot take it (their Matrix caller holds it across the whole
+// `!expedition` switch) and their web wrappers must, while the babysit twin takes
+// it itself and its web wrapper must not.
+//
+// Getting either of those backwards does not fail loudly. advUserLock is a plain
+// sync.Mutex, so a second acquire parks the goroutine forever with the deferred
+// Unlock never running — which wedges every later !adventure / !expedition /
+// !zone command from that player, not just the one that deadlocked. That is a
+// bug that shipped once already (see TestExpeditionAliasesDoNotWedgeTheUserLock),
+// so both directions are tested here.
+//
+// NOTE: these two lock tests HANG rather than fail on regression. The timeout is
+// the assertion.
+
+// TestUndoCommandsDoNotWedgeTheUserLock is the Matrix half: `!expedition abandon`
+// and `!expedition leave` reach their twins with the lock already held, so a twin
+// that took it itself would park here.
+func TestUndoCommandsDoNotWedgeTheUserLock(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@w9-cmd-lock:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+
+	for _, sub := range []string{"abandon", "leave"} {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			p := &AdventurePlugin{euro: &EuroPlugin{}}
+			_ = p.handleDnDExpeditionCmd(MessageContext{Sender: uid}, sub)
+		}()
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("!expedition %s never returned: its twin re-took advUserLock", sub)
+		}
+	}
+}
+
+// TestUndoOrdersDoNotWedgeTheUserLock is the web half, and it checks the harder
+// half of the same property: not just that the order returns, but that the lock
+// is FREE afterwards. A wrapper that took the lock around a twin that also takes
+// it would park inside applyAdvOrder; a wrapper that forgot to release would let
+// the order finish and wedge the next command instead, which is the failure that
+// would have been missed by only timing the call.
+func TestUndoOrdersDoNotWedgeTheUserLock(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@w9-order-lock:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+
+	for _, action := range []string{
+		peteclient.AdvOrderAbandon,
+		peteclient.AdvOrderLeave,
+		peteclient.AdvOrderBabysitCancel,
+	} {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			p := &AdventurePlugin{euro: &EuroPlugin{}}
+			p.applyAdvOrder(uid, peteclient.AdvOrder{GUID: "g-" + action, Action: action})
+			// The lock must be back. Taking it here is what catches a wrapper that
+			// returned without unlocking.
+			mu := p.advUserLock(uid)
+			mu.Lock()
+			mu.Unlock()
+		}()
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("order %q never returned or never released advUserLock", action)
+		}
+	}
+}
+
+// TestUndoOrderRefusalsAreTerminal: none of the three may come back as a retry.
+// A retried refusal never reaches a verdict, so the order sits pending forever
+// and the panel never stops saying "asked for…". Each also has to carry prose —
+// the strip prefers gogobee's own sentence over its canned fallback, and an empty
+// detail on a refusal is the one case where the page has nothing to show.
+func TestUndoOrderRefusalsAreTerminal(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@w9-refusals:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+	// A real character with nothing going on. Without one, babysit_cancel refuses
+	// with "no adventurer" and the sitter branch this is meant to cover is never
+	// reached — the first cut of this test passed the wrong assertion for that
+	// reason.
+	if err := createAdvCharacter(uid, "w9refusals"); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	p := &AdventurePlugin{euro: &EuroPlugin{}}
+
+	cases := []struct {
+		action string
+		want   string
+	}{
+		// Nothing to abandon and nothing to leave are the same fact from two
+		// doors, and both are the plain "you aren't on one" answer.
+		{peteclient.AdvOrderAbandon, "rejected_not_running"},
+		{peteclient.AdvOrderLeave, "rejected_not_running"},
+		// No sitter is its own verdict rather than rejected_unavailable: the page
+		// says something specific about it, and "unavailable" reads as a fault.
+		{peteclient.AdvOrderBabysitCancel, "rejected_nothing_to_cancel"},
+	}
+	for _, tc := range cases {
+		status, detail, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+			GUID: "g-" + tc.action, Action: tc.action,
+		})
+		if retry {
+			t.Fatalf("%s asked for a retry on a refusal; it must be terminal", tc.action)
+		}
+		if status != tc.want {
+			t.Fatalf("%s status = %q, want %q", tc.action, status, tc.want)
+		}
+		if strings.TrimSpace(detail) == "" {
+			t.Fatalf("%s refused with no prose; the panel would have nothing to say", tc.action)
+		}
+	}
+}
+
+// TestUndoVerdictsCarryNoMarkdown: every detail line these file is reused from a
+// Matrix sentence, and Pete renders a verdict as text. An asterisk or a backtick
+// left in it shows up literally under the button.
+//
+// The backticks matter more than they look: the leave refusal names `!extract`
+// and `!expedition abandon`, which is the correct thing to say (the web now has a
+// button for one of them and not the other), but it must not say it in markup.
+func TestUndoVerdictsCarryNoMarkdown(t *testing.T) {
+	setupEmptyTestDB(t)
+	uid := id.UserID("@w9-markdown:example")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+	p := &AdventurePlugin{euro: &EuroPlugin{}}
+
+	for _, action := range []string{
+		peteclient.AdvOrderAbandon,
+		peteclient.AdvOrderLeave,
+		peteclient.AdvOrderBabysitCancel,
+	} {
+		_, detail, _ := p.applyAdvOrder(uid, peteclient.AdvOrder{GUID: "g-md-" + action, Action: action})
+		if strings.ContainsAny(detail, "*`\n") {
+			t.Fatalf("%s verdict carries markdown or a newline: %q", action, detail)
+		}
+	}
+}
+
+// TestWebAbandonIsTheGamesOwnAbandon: the web verb must run the real path, not a
+// lookalike. The proof is the state the row lands in — no expedition left at all,
+// as opposed to the 'extracting' limbo an extraction leaves behind — and that the
+// verdict says what became of the supplies, which is the one thing a player who
+// clicked the wrong button needs to be told.
+func TestWebAbandonIsTheGamesOwnAbandon(t *testing.T) {
+	// setupEmptyTestDB, NOT setupZoneRunTestDB: the latter copies data/gogobee.db
+	// and t.Skip()s when it is missing, and that file is deleted after every local
+	// run — so a test written on it is green-by-skipping on any clean checkout.
+	// See the Decisions note in the plan's progress file; W5a's order tests were
+	// silently skipping for exactly this reason.
+	setupEmptyTestDB(t)
+	uid := id.UserID("@w9-abandon-live:example.org")
+	t.Cleanup(func() { cleanupExpeditions(uid) })
+	if err := createAdvCharacter(uid, "w9abandon"); err != nil {
+		t.Fatalf("createAdvCharacter: %v", err)
+	}
+	p := &AdventurePlugin{euro: &EuroPlugin{}}
+
+	if _, err := startExpedition(uid, ZoneGoblinWarrens, "", ExpeditionSupplies{
+		Current: 10, Max: 10, DailyBurn: 1, HarshMod: 1, PacksStandard: 1,
+	}); err != nil {
+		t.Fatalf("startExpedition: %v", err)
+	}
+
+	status, detail, retry := p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g-abandon", Action: peteclient.AdvOrderAbandon,
+	})
+	if retry || status != "applied" {
+		t.Fatalf("abandon = %q retry=%v detail=%q, want applied", status, retry, detail)
+	}
+	if !strings.Contains(strings.ToLower(detail), "supplies") {
+		t.Fatalf("verdict %q never says the supplies are gone, which is the difference from pulling out", detail)
+	}
+	if exp, _, err := activeExpeditionFor(uid); err != nil {
+		t.Fatalf("read expedition: %v", err)
+	} else if exp != nil {
+		t.Fatalf("expedition survived a web abandon with status %q", exp.Status)
+	}
+
+	// And the second click, which is what a stale page produces: a terminal
+	// refusal, never a retry and never a second abandon.
+	status, _, retry = p.applyAdvOrder(uid, peteclient.AdvOrder{
+		GUID: "g-abandon-2", Action: peteclient.AdvOrderAbandon,
+	})
+	if retry || status != "rejected_not_running" {
+		t.Fatalf("re-abandon = %q retry=%v, want a terminal rejected_not_running", status, retry)
+	}
+}

internal/plugin/pete_realm.go

@@ -0,0 +1,633 @@
+package plugin
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+	"sort"
+	"time"
+
+	"gogobee/internal/db"
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// The realm snapshot: the world map, the hall of firsts, and the board.
+//
+// Everything Pete has shown so far is either the present moment (the roster, the
+// Siege bar) or one thing that happened (a dispatch, a run log). None of it says
+// what the realm *is* — that there are thirty-odd named places with a difficulty
+// order, that some of them have never been beaten by anybody, and that the
+// people playing have a history against them. That is what this carries.
+//
+// Snapshot semantics, like the roster and the Siege: pushed whole, replaces
+// Pete's copy, dropped rather than retried on failure. The difference is the
+// clock. The roster is a photograph of where people are standing and is worth
+// re-taking every two minutes; a realm-first is a thing that happened once, ever,
+// and re-deriving the whole ledger plus three aggregate scans at that rate would
+// be pure waste. So this rides the same ticker at a much longer stride.
+const (
+	// realmPushInterval — how often the realm is recomputed and pushed. The
+	// fastest-moving field in the whole snapshot is a zone's occupant list, and a
+	// ten-minute-old answer to "who is in the Sunken Vault" is still a true and
+	// useful one. Everything else moves on the scale of days.
+	realmPushInterval = 10 * time.Minute
+
+	// realmMaxOccupants bounds the per-zone occupant list. A realm has tens of
+	// players; this only stops a pathological case spooling a huge payload.
+	realmMaxOccupants = 50
+)
+
+// realmLastPush is when the realm snapshot last went out. Zero means never, so
+// the first tick after start-up always pushes — an operator restarting the bot
+// should not have to wait ten minutes to see whether the wire works.
+var realmLastPush time.Time
+
+// realmPushOK mirrors rosterPushOK: log the transitions and nothing else.
+var realmPushOK bool
+
+// pushRealm recomputes and sends the realm snapshot, at most once per
+// realmPushInterval however often the ticker calls it.
+func (p *AdventurePlugin) pushRealm() {
+	now := time.Now().UTC()
+	if !realmLastPush.IsZero() && now.Sub(realmLastPush) < realmPushInterval {
+		return
+	}
+
+	snap, err := buildRealmSnapshot(now)
+	if err != nil {
+		slog.Error("realm: build snapshot failed", "err", err)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), rosterPushTimeout)
+	defer cancel()
+
+	if err := peteclient.PushRealm(ctx, snap); err != nil {
+		if realmPushOK {
+			slog.Warn("realm: push failed, realm pages will go stale on Pete", "err", err)
+		} else {
+			slog.Debug("realm: push failed, dropping snapshot", "err", err)
+		}
+		realmPushOK = false
+		// Deliberately NOT stamping realmLastPush: a failed push should be retried
+		// on the next roster tick, not ten minutes from now. The stamp is a
+		// "we already told Pete this" marker, and we didn't.
+		return
+	}
+
+	realmLastPush = now
+	if !realmPushOK {
+		slog.Info("realm: snapshot accepted by Pete — realm pages are publishing",
+			"zones", len(snap.Zones), "firsts", len(snap.Firsts), "standings", len(snap.Standings))
+		realmPushOK = true
+	}
+}
+
+// realmClearStats is the per-zone clear history, read in one pass.
+type realmClearStats struct {
+	clears       int
+	clearers     int
+	firstUser    id.UserID
+	firstClearAt int64
+}
+
+// buildRealmSnapshot assembles the whole realm from the game's own tables.
+//
+// The three aggregate reads are done up front and once each, keyed into maps,
+// rather than per-zone or per-player: this runs against the live DB on a ticker
+// and a query-per-zone loop over a registry that only grows is the kind of thing
+// that is fine until it isn't.
+func buildRealmSnapshot(now time.Time) (peteclient.RealmSnapshot, error) {
+	snap := peteclient.RealmSnapshot{SnapshotAt: now.Unix()}
+
+	clearsByZone, err := loadRealmClearStats()
+	if err != nil {
+		return snap, err
+	}
+	occupantsByZone := loadRealmOccupants()
+
+	// ── Zones ───────────────────────────────────────────────────────────────
+	// zoneOrder is the design-doc ordering and is what the page draws in, so the
+	// realm reads the way it was designed rather than the way a map iterates.
+	for _, zid := range zoneOrder {
+		def, ok := dndZoneRegistry[zid]
+		if !ok {
+			continue
+		}
+		z := peteclient.RealmZone{
+			ID:         string(def.ID),
+			Display:    def.Display,
+			Tier:       int(def.Tier),
+			LevelMin:   def.LevelMin,
+			LevelMax:   def.LevelMax,
+			Faction:    def.Faction,
+			Atmosphere: def.Atmosphere,
+			Postgame:   def.Tier == ZoneTierMythic,
+			Occupants:  occupantsByZone[string(def.ID)],
+		}
+		if st, ok := clearsByZone[string(def.ID)]; ok {
+			z.Clears = st.clears
+			z.Clearers = st.clearers
+			z.FirstClearAt = st.firstClearAt
+			// An opted-out first-clearer keeps the claim and loses the identity —
+			// the Siege contributor rule, and for the same reason. Deleting the
+			// claim outright would leave the zone drawn as never-cleared, which is
+			// a false statement about the realm rather than a withheld one.
+			if !isNewsOptedOut(st.firstUser) {
+				z.FirstClearBy = charName(st.firstUser)
+				if z.FirstClearBy != "" {
+					z.FirstClearToken = eventToken(st.firstUser, "roster")
+				}
+			}
+		}
+		snap.Zones = append(snap.Zones, z)
+	}
+
+	snap.Firsts = loadRealmFirsts(clearsByZone)
+
+	// The three pages must not be able to contradict each other about the same
+	// zone. loadRealmFirsts derives the zone half of the hall from clearsByZone —
+	// the same map the tiles and the board use — but it also carries any ledger
+	// claim with no surviving run behind it, and that case would otherwise draw a
+	// place as never-beaten on the map while the hall named the year it fell.
+	//
+	// So an unbacked claim floors the clear count at one. Deliberately a floor and
+	// not an assignment: where the run history is intact it is the better answer
+	// and this only fills a hole. Nothing is attributed — the zone reads "cleared,
+	// by somebody", which is exactly what is known about it.
+	for i := range snap.Zones {
+		if snap.Zones[i].Clears > 0 {
+			continue
+		}
+		for _, f := range snap.Firsts {
+			if f.Kind == "zone" && f.Target == snap.Zones[i].ID {
+				snap.Zones[i].Clears = 1
+				snap.Zones[i].Clearers = 1
+				break
+			}
+		}
+	}
+
+	snap.Standings, err = loadRealmStandings(clearsByZone)
+	if err != nil {
+		return snap, err
+	}
+	return snap, nil
+}
+
+// loadRealmClearStats reads every zone's clear history in one pass: how many
+// successful runs, how many distinct people managed it, and who did it first.
+//
+// MIN(completed_at) with a bare user_id column is SQLite's bare-column min/max
+// rule — the user_id comes from the same row the minimum came from, so the
+// (zone, first clearer, when) triple is internally consistent. backfillZoneFirsts
+// relies on exactly this and has done since the news seam shipped.
+//
+// completed_at is selected raw as a string and parsed in Go rather than being
+// wrapped in anything: modernc.org/sqlite rebuilds a time.Time from the column's
+// declared type, and passing a DATETIME through MIN() alongside an aggregate is
+// close enough to the COALESCE() trap that it is not worth finding out. The
+// string always parses — it is written by SQLite's own CURRENT_TIMESTAMP.
+//
+// NOTE the absence of `AND abandoned = 0`, which looks like it belongs here and
+// does not. `abandoned` does not mean "the player gave up" — it means the run
+// ROW was retired, and abandonZoneRunByID exists specifically to retire a run
+// whose boss is already dead when the expedition travels onward (see its comment
+// in dnd_zone_run.go). In prod, 30 of the realm's 32 boss kills carry
+// abandoned = 1. Filtering them out drew a map on which almost nothing had ever
+// been beaten, while the hall of firsts — reading a different table — said six
+// zones had been. boss_defeated = 1 is the clear, full stop.
+func loadRealmClearStats() (map[string]realmClearStats, error) {
+	rows, err := db.Get().Query(`
+		SELECT zone_id,
+		       COUNT(*)                AS clears,
+		       COUNT(DISTINCT user_id) AS clearers,
+		       user_id,
+		       MIN(completed_at)
+		  FROM dnd_zone_run
+		 WHERE boss_defeated = 1 AND completed_at IS NOT NULL
+		 GROUP BY zone_id`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := map[string]realmClearStats{}
+	for rows.Next() {
+		var zoneID, userID, completedAt string
+		var st realmClearStats
+		if err := rows.Scan(&zoneID, &st.clears, &st.clearers, &userID, &completedAt); err != nil {
+			return nil, err
+		}
+		st.firstUser = id.UserID(userID)
+		if ts, ok := parseSQLiteTime(completedAt); ok {
+			st.firstClearAt = ts.Unix()
+		}
+		out[zoneID] = st
+	}
+	return out, rows.Err()
+}
+
+// loadRealmOccupants answers "who is in there right now", per zone.
+//
+// Presence is dropped for an opted-out player rather than anonymised. Unlike a
+// first clear it is not part of a tally that stops adding up without them, and
+// it is the same live-location fact the run liveblog refuses to publish — an
+// anonymous "somebody is in the Drowned Star" next to a roster showing exactly
+// one person out on expedition is not an anonymisation.
+//
+// Errors are swallowed to nil: an unreadable expedition table should cost the
+// realm map its occupant dots, not the whole page.
+func loadRealmOccupants() map[string][]peteclient.RealmOccupant {
+	rows, err := db.Get().Query(
+		`SELECT user_id, zone_id, current_day FROM dnd_expedition WHERE status = 'active'`)
+	if err != nil {
+		slog.Error("realm: occupants query", "err", err)
+		return nil
+	}
+	defer rows.Close()
+
+	type live struct {
+		uid    id.UserID
+		zoneID string
+		day    int
+	}
+	var found []live
+	for rows.Next() {
+		var uid, zoneID string
+		var day int
+		if err := rows.Scan(&uid, &zoneID, &day); err != nil {
+			slog.Error("realm: occupants scan", "err", err)
+			return nil
+		}
+		found = append(found, live{id.UserID(uid), zoneID, day})
+	}
+	if err := rows.Err(); err != nil {
+		slog.Error("realm: occupants rows", "err", err)
+		return nil
+	}
+
+	// Names and opt-out are resolved only after the cursor is drained. The pool
+	// is one connection wide and charName reads the DB; resolving inside the loop
+	// is the deadlock W2a shipped and then had to fix.
+	out := map[string][]peteclient.RealmOccupant{}
+	for _, l := range found {
+		if isNewsOptedOut(l.uid) {
+			continue
+		}
+		name := charName(l.uid)
+		if name == "" {
+			continue // never fall back to a Matrix handle on a public page
+		}
+		if len(out[l.zoneID]) >= realmMaxOccupants {
+			continue
+		}
+		out[l.zoneID] = append(out[l.zoneID], peteclient.RealmOccupant{
+			Token: eventToken(l.uid, "roster"),
+			Name:  name,
+			Level: charLevel(l.uid),
+			Day:   l.day,
+		})
+	}
+	for zid := range out {
+		sort.Slice(out[zid], func(i, j int) bool { return out[zid][i].Name < out[zid][j].Name })
+	}
+	return out
+}
+
+// loadRealmFirsts renders news_realm_firsts as a history book.
+//
+// The ledger stores only (kind, target, first_at) — it exists to tier a dispatch,
+// not to remember who. The holder is recovered here from the game's own history:
+// a zone first from the earliest boss-defeating run, a treasure first from the
+// earliest surviving row in adventure_treasures. Both can come back empty — a
+// treasure that was found and later discarded leaves no owner anywhere — and an
+// unattributed first is rendered as one rather than dropped. It still happened.
+// loadRealmFirsts renders the hall of firsts, and it takes the clear stats
+// rather than reading the ledger alone, for two reasons that only showed up
+// against real prod data:
+//
+//  1. news_realm_firsts is INCOMPLETE for zones. It has only been written since
+//     the news seam went live, and the one-shot that seeded it filtered on
+//     `abandoned = 0` — the same wrong filter loadRealmClearStats documents — so
+//     it missed every zone whose clears were all retired runs. In prod it holds 6
+//     zones where the run history knows 9.
+//  2. Its first_at is when the CLAIM was recorded, not when the thing happened.
+//     Every backfilled row in prod carries the same timestamp: the minute the
+//     backfill ran. A history book dated by when somebody wrote it down is not
+//     much of a history book.
+//
+// So the zone half is derived from the run history, which is complete and
+// correctly dated, and the ledger supplies the kinds the run history knows
+// nothing about (treasures, and whatever ships next) plus any zone claim with no
+// surviving run behind it. That also makes the hall agree with the board by
+// construction: both count a zone-first as "you were the first to clear it".
+func loadRealmFirsts(clearsByZone map[string]realmClearStats) []peteclient.RealmFirst {
+	rows, err := db.Get().Query(
+		`SELECT kind, target, first_at FROM news_realm_firsts ORDER BY first_at ASC`)
+	if err != nil {
+		slog.Error("realm: firsts query", "err", err)
+		return nil
+	}
+	defer rows.Close()
+
+	var out []peteclient.RealmFirst
+	for rows.Next() {
+		var f peteclient.RealmFirst
+		if err := rows.Scan(&f.Kind, &f.Target, &f.AtUnix); err != nil {
+			slog.Error("realm: firsts scan", "err", err)
+			return nil
+		}
+		out = append(out, f)
+	}
+	if err := rows.Err(); err != nil {
+		slog.Error("realm: firsts rows", "err", err)
+		return nil
+	}
+
+	// Same discipline as the occupants: the cursor is closed before anything
+	// else touches the database.
+	rows.Close()
+
+	// Drop the ledger's zone rows wherever the run history has the same zone —
+	// it is the better record of both who and when. A claim with no run behind it
+	// survives, unattributed, and is what floors that zone's clear count in
+	// buildRealmSnapshot.
+	kept := out[:0]
+	for _, f := range out {
+		if f.Kind == "zone" {
+			if _, ok := clearsByZone[f.Target]; ok {
+				continue
+			}
+		}
+		kept = append(kept, f)
+	}
+	out = kept
+
+	// The zone half, from the authority the map and the board also use.
+	for zoneID, st := range clearsByZone {
+		zone := zoneOrFallback(ZoneID(zoneID))
+		f := peteclient.RealmFirst{
+			Kind:    "zone",
+			Target:  zoneID,
+			Display: zone.Display,
+			Tier:    int(zone.Tier),
+			AtUnix:  st.firstClearAt,
+		}
+		if !isNewsOptedOut(st.firstUser) {
+			if name := charName(st.firstUser); name != "" {
+				f.Holder = name
+				f.Token = eventToken(st.firstUser, "roster")
+			}
+		}
+		out = append(out, f)
+	}
+
+	for i := range out {
+		switch out[i].Kind {
+		case "zone":
+			if out[i].Display == "" {
+				zone := zoneOrFallback(ZoneID(out[i].Target))
+				out[i].Display = zone.Display
+				out[i].Tier = int(zone.Tier)
+				out[i].Holder, out[i].Token = realmFirstZoneHolder(out[i].Target)
+			}
+		case "treasure":
+			if def := lookupAdvTreasureDef(out[i].Target); def != nil {
+				out[i].Display = def.Name
+				out[i].Tier = def.Tier
+			} else {
+				out[i].Display = out[i].Target
+			}
+			out[i].Holder, out[i].Token = realmFirstTreasureHolder(out[i].Target)
+		default:
+			// A kind nobody has taught this function about still belongs in the
+			// hall — it is a genuine realm-first and the ledger says so. It just
+			// arrives with the raw target as its name, which is the same
+			// degrade-don't-drop rule the unknown event_type inversion settled on.
+			out[i].Display = out[i].Target
+		}
+	}
+
+	// Oldest first: the order it happened in. Pete regroups it newest-year-first
+	// for the page, but the wire carries history in history's order.
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].AtUnix != out[j].AtUnix {
+			return out[i].AtUnix < out[j].AtUnix
+		}
+		return out[i].Target < out[j].Target
+	})
+	return out
+}
+
+// realmFirstZoneHolder names the earliest clearer of a zone. Returns ("", "")
+// when the run history no longer has one, and ("Name", "") when it does but the
+// player has opted out — the claim survives the anonymisation, the link does not.
+func realmFirstZoneHolder(zoneID string) (name, token string) {
+	var userID string
+	err := db.Get().QueryRow(`
+		SELECT user_id
+		  FROM dnd_zone_run
+		 WHERE zone_id = ? AND boss_defeated = 1 AND completed_at IS NOT NULL
+		 ORDER BY completed_at ASC
+		 LIMIT 1`, zoneID).Scan(&userID)
+	if err != nil {
+		if err != sql.ErrNoRows {
+			slog.Error("realm: zone-first holder", "zone", zoneID, "err", err)
+		}
+		return "", ""
+	}
+	uid := id.UserID(userID)
+	if isNewsOptedOut(uid) {
+		return "", ""
+	}
+	name = charName(uid)
+	if name == "" {
+		return "", ""
+	}
+	return name, eventToken(uid, "roster")
+}
+
+// realmFirstTreasureHolder names the earliest holder of a treasure key. A
+// treasure writes one row per bonus, so the MIN is over what may be several rows
+// for the same acquisition; that is fine, they share a timestamp.
+func realmFirstTreasureHolder(key string) (name, token string) {
+	var userID string
+	err := db.Get().QueryRow(`
+		SELECT user_id
+		  FROM adventure_treasures
+		 WHERE treasure_key = ?
+		 ORDER BY acquired_at ASC
+		 LIMIT 1`, key).Scan(&userID)
+	if err != nil {
+		if err != sql.ErrNoRows {
+			slog.Error("realm: treasure-first holder", "key", key, "err", err)
+		}
+		return "", ""
+	}
+	uid := id.UserID(userID)
+	if isNewsOptedOut(uid) {
+		return "", ""
+	}
+	name = charName(uid)
+	if name == "" {
+		return "", ""
+	}
+	return name, eventToken(uid, "roster")
+}
+
+// loadRealmStandings builds the board: one line per living, named, opted-in
+// adventurer, every number a lifetime total.
+//
+// It walks player_meta the way buildRosterSnapshot does, and for the same
+// reason — that is the list of people who exist, and a standings table assembled
+// by grouping the run history instead would silently include characters that have
+// since been deleted or never finished setup.
+func loadRealmStandings(clearsByZone map[string]realmClearStats) ([]peteclient.RealmStanding, error) {
+	rows, err := db.Get().Query(`SELECT user_id FROM player_meta WHERE alive = 1`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var uids []id.UserID
+	for rows.Next() {
+		var uid string
+		if err := rows.Scan(&uid); err != nil {
+			return nil, err
+		}
+		uids = append(uids, id.UserID(uid))
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	rows.Close()
+
+	// Who holds how many realm-firsts, from the same authority the zone column
+	// uses — so a zone's "first cleared by X" and X's firsts count can never
+	// disagree with each other.
+	firstsBy := map[id.UserID]int{}
+	for _, st := range clearsByZone {
+		firstsBy[st.firstUser]++
+	}
+
+	perZone, err := loadRealmPlayerClears()
+	if err != nil {
+		return nil, err
+	}
+	siege := loadRealmSiegeTotals()
+
+	var out []peteclient.RealmStanding
+	for _, uid := range uids {
+		if isNewsOptedOut(uid) {
+			continue // the board omits an opted-out player outright, as it always has
+		}
+		c, err := LoadDnDCharacter(uid)
+		if err != nil || c == nil || c.PendingSetup {
+			continue
+		}
+		name := charName(uid)
+		if name == "" {
+			continue
+		}
+		s := peteclient.RealmStanding{
+			Token:       eventToken(uid, "roster"),
+			Name:        name,
+			Level:       c.Level,
+			ClassRace:   classRaceLabel(c),
+			Firsts:      firstsBy[uid],
+			SiegeDamage: siege[uid].damage,
+			SiegeFights: siege[uid].fights,
+		}
+		for zoneID, n := range perZone[uid] {
+			s.Clears += n
+			s.Zones++
+			if t := int(zoneOrFallback(ZoneID(zoneID)).Tier); t > s.DeepestTier {
+				s.DeepestTier = t
+			}
+		}
+		out = append(out, s)
+	}
+
+	// Ranked here, not on Pete: the ordering is a statement about the game
+	// ("deepest tier beaten, then how much of the realm you have beaten"), and
+	// the game is the thing that gets to make it. Name breaks the tie so the
+	// board is stable between snapshots that are otherwise identical.
+	sort.Slice(out, func(i, j int) bool {
+		a, b := out[i], out[j]
+		switch {
+		case a.DeepestTier != b.DeepestTier:
+			return a.DeepestTier > b.DeepestTier
+		case a.Zones != b.Zones:
+			return a.Zones > b.Zones
+		case a.Clears != b.Clears:
+			return a.Clears > b.Clears
+		case a.Level != b.Level:
+			return a.Level > b.Level
+		default:
+			return a.Name < b.Name
+		}
+	})
+	return out, nil
+}
+
+// loadRealmPlayerClears returns clears[user][zone] = count, in one pass.
+func loadRealmPlayerClears() (map[id.UserID]map[string]int, error) {
+	rows, err := db.Get().Query(`
+		SELECT user_id, zone_id, COUNT(*)
+		  FROM dnd_zone_run
+		 WHERE boss_defeated = 1 AND completed_at IS NOT NULL
+		 GROUP BY user_id, zone_id`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := map[id.UserID]map[string]int{}
+	for rows.Next() {
+		var uid, zoneID string
+		var n int
+		if err := rows.Scan(&uid, &zoneID, &n); err != nil {
+			return nil, err
+		}
+		u := id.UserID(uid)
+		if out[u] == nil {
+			out[u] = map[string]int{}
+		}
+		out[u][zoneID] = n
+	}
+	return out, rows.Err()
+}
+
+type realmSiegeTotal struct{ damage, fights int }
+
+// loadRealmSiegeTotals sums every Siege a player has ever turned up to. Across
+// all bosses, not just the live one — the war room already shows the current
+// muster, and what the board is for is the person who has shown up to all six.
+func loadRealmSiegeTotals() map[id.UserID]realmSiegeTotal {
+	rows, err := db.Get().Query(
+		`SELECT user_id, SUM(damage), SUM(fights) FROM world_boss_contrib GROUP BY user_id`)
+	if err != nil {
+		slog.Error("realm: siege totals query", "err", err)
+		return nil
+	}
+	defer rows.Close()
+
+	out := map[id.UserID]realmSiegeTotal{}
+	for rows.Next() {
+		var uid string
+		var damage, fights int
+		if err := rows.Scan(&uid, &damage, &fights); err != nil {
+			slog.Error("realm: siege totals scan", "err", err)
+			return nil
+		}
+		out[id.UserID(uid)] = realmSiegeTotal{damage, fights}
+	}
+	if err := rows.Err(); err != nil {
+		slog.Error("realm: siege totals rows", "err", err)
+		return nil
+	}
+	return out
+}

internal/plugin/pete_realm_test.go

@@ -0,0 +1,351 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"gogobee/internal/db"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// seedRealmFixture builds a small but realistic realm: two players, three
+// cleared runs across two zones, one live expedition, and the realm-first ledger
+// that the zone clears would have seeded.
+func seedRealmFixture(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	db.Close()
+	if err := db.Init(dir); err != nil {
+		t.Fatalf("db.Init: %v", err)
+	}
+	t.Cleanup(db.Close)
+
+	db.Exec("seed josie", `INSERT INTO player_meta (user_id, display_name, alive) VALUES (?, ?, 1)`,
+		"@josie:x", "Josie")
+	db.Exec("seed quack", `INSERT INTO player_meta (user_id, display_name, alive) VALUES (?, ?, 1)`,
+		"@quack:x", "Quack")
+
+	// The board walks player_meta and then loads a character, so both halves have
+	// to exist: a player_meta row with no character is somebody who never finished
+	// setup, and standings correctly leaves them off.
+	for _, c := range []*DnDCharacter{
+		{UserID: "@josie:x", Race: RaceHuman, Class: ClassFighter, Level: 12,
+			STR: 18, DEX: 14, CON: 16, INT: 10, WIS: 10, CHA: 10,
+			HPMax: 120, HPCurrent: 120, ArmorClass: 18},
+		{UserID: "@quack:x", Race: RaceElf, Class: ClassMage, Level: 8,
+			STR: 8, DEX: 16, CON: 12, INT: 18, WIS: 12, CHA: 10,
+			HPMax: 48, HPCurrent: 48, ArmorClass: 12},
+	} {
+		if err := SaveDnDCharacter(c); err != nil {
+			t.Fatalf("SaveDnDCharacter(%s): %v", c.UserID, err)
+		}
+	}
+
+	// Josie cleared the Warrens first, then again; Quack cleared them later. Only
+	// Josie has been through the Crypt — and it is a deeper tier, which is what
+	// makes the board's depth-before-breadth ordering testable.
+	for _, r := range []struct {
+		runID, user, zone, at string
+	}{
+		{"r1", "@josie:x", string(ZoneGoblinWarrens), "2026-01-10 12:00:00"},
+		{"r2", "@quack:x", string(ZoneGoblinWarrens), "2026-03-02 12:00:00"},
+		{"r3", "@josie:x", string(ZoneGoblinWarrens), "2026-04-05 12:00:00"},
+		{"r4", "@josie:x", string(ZoneCryptValdris), "2026-05-01 12:00:00"},
+	} {
+		db.Exec("seed run", `INSERT INTO dnd_zone_run
+			(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+			VALUES (?, ?, ?, 6, 1, 0, ?)`, r.runID, r.user, r.zone, r.at)
+	}
+	// A retired-but-won run: boss_defeated = 1 with abandoned = 1. This IS a
+	// clear — `abandoned` means the run row was retired (the expedition travelled
+	// on after the kill), not that anybody gave up, and in prod it is how 30 of
+	// the realm's 32 boss kills are stored. The fixture carries one so the
+	// aggregate can never quietly go back to filtering them out.
+	db.Exec("seed retired-win", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r5', '@quack:x', 'crypt_valdris', 6, 1, 1, '2026-05-02 12:00:00')`)
+	// A genuinely unfinished run: no boss, no completion. Not a clear.
+	db.Exec("seed inflight", `INSERT INTO dnd_zone_run
+		(run_id, user_id, zone_id, total_rooms, boss_defeated, abandoned, completed_at)
+		VALUES ('r6', '@quack:x', 'crypt_valdris', 6, 0, 0, NULL)`)
+
+	claimRealmFirst("zone", string(ZoneGoblinWarrens))
+	claimRealmFirst("zone", string(ZoneCryptValdris))
+}
+
+// TestRealmClearStatsPickTheEarliestClearer is the load-bearing query on the
+// whole map: "who first got through here" is the single most interesting fact a
+// zone has, and it has to be the person who was actually first.
+//
+// It leans on SQLite's bare-column min/max rule — the user_id comes from the same
+// row MIN(completed_at) came from — which is the same thing backfillZoneFirsts
+// has relied on since the news seam shipped. If that ever stopped holding, this
+// would attribute somebody else's conquest to whoever the grouping happened to
+// land on, silently.
+func TestRealmClearStatsPickTheEarliestClearer(t *testing.T) {
+	seedRealmFixture(t)
+
+	stats, err := loadRealmClearStats()
+	if err != nil {
+		t.Fatalf("loadRealmClearStats: %v", err)
+	}
+
+	warrens, ok := stats["goblin_warrens"]
+	if !ok {
+		t.Fatal("no stats for goblin_warrens")
+	}
+	if warrens.clears != 3 {
+		t.Errorf("warrens clears = %d, want 3", warrens.clears)
+	}
+	if warrens.clearers != 2 {
+		t.Errorf("warrens clearers = %d, want 2", warrens.clearers)
+	}
+	if warrens.firstUser != id.UserID("@josie:x") {
+		t.Errorf("warrens first clearer = %q, want @josie:x — the earliest run didn't win", warrens.firstUser)
+	}
+
+	// Two clears: Josie's, and Quack's retired-but-won run. The in-flight run is
+	// correctly excluded. A regression to `AND abandoned = 0` shows up here as 1.
+	crypt := stats["crypt_valdris"]
+	if crypt.clears != 2 {
+		t.Errorf("crypt clears = %d, want 2 — a won-then-retired run is a clear, "+
+			"and an in-flight one is not", crypt.clears)
+	}
+	if crypt.firstUser != id.UserID("@josie:x") {
+		t.Errorf("crypt first clearer = %q, want @josie:x", crypt.firstUser)
+	}
+}
+
+// TestOptedOutFirstClearerIsAnonymisedNotErased. The Siege contributor rule,
+// applied to the map: deleting an opted-out clearer's claim would leave the zone
+// drawn as never-cleared, and "nobody has ever come out of there" is the most
+// dramatic thing the page can say. Saying it falsely because somebody chose
+// privacy would be worse than saying nothing.
+func TestOptedOutFirstClearerIsAnonymisedNotErased(t *testing.T) {
+	seedRealmFixture(t)
+	setNewsOptout(id.UserID("@josie:x"), true)
+
+	snap, err := buildRealmSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildRealmSnapshot: %v", err)
+	}
+
+	var warrens *struct {
+		clears    int
+		by, token string
+	}
+	for _, z := range snap.Zones {
+		if z.ID == "goblin_warrens" {
+			warrens = &struct {
+				clears    int
+				by, token string
+			}{z.Clears, z.FirstClearBy, z.FirstClearToken}
+		}
+	}
+	if warrens == nil {
+		t.Fatal("goblin_warrens is not in the snapshot at all")
+	}
+	if warrens.clears != 3 {
+		t.Errorf("clears = %d, want 3 — an opt-out deleted the town's history", warrens.clears)
+	}
+	if warrens.by != "" || warrens.token != "" {
+		t.Errorf("opted-out clearer still named: by=%q token=%q", warrens.by, warrens.token)
+	}
+}
+
+// TestOptedOutPlayerLeavesTheBoardEntirely. Standings follow the board's rule,
+// not the Siege's: an opted-out player is omitted outright. Their level, class
+// and clear count would re-identify them, and unlike a siege contribution there
+// is no shared total that stops adding up without them.
+func TestOptedOutPlayerLeavesTheBoardEntirely(t *testing.T) {
+	seedRealmFixture(t)
+	setNewsOptout(id.UserID("@quack:x"), true)
+
+	snap, err := buildRealmSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildRealmSnapshot: %v", err)
+	}
+	for _, s := range snap.Standings {
+		if s.Name == "Quack" {
+			t.Fatal("an opted-out player is still on the standings board")
+		}
+	}
+}
+
+// TestOccupantsDropOptedOutPlayers. Presence is the strictest case on the page
+// and deliberately stricter than a first clear: "who is in the Crypt of Valdris
+// right now" is the live-location fact the run liveblog refuses to publish at
+// all, so an opted-out player is dropped rather than anonymised.
+func TestOccupantsDropOptedOutPlayers(t *testing.T) {
+	seedRealmFixture(t)
+	db.Exec("seed expedition", `INSERT INTO dnd_expedition
+		(expedition_id, user_id, zone_id, status, current_day)
+		VALUES ('e1', '@josie:x', 'crypt_valdris', 'active', 3)`)
+
+	if occ := loadRealmOccupants(); len(occ["crypt_valdris"]) != 1 {
+		t.Fatalf("opted-in occupant missing: %+v", occ)
+	} else if occ["crypt_valdris"][0].Name != "Josie" || occ["crypt_valdris"][0].Day != 3 {
+		t.Errorf("occupant = %+v, want Josie on day 3", occ["crypt_valdris"][0])
+	}
+
+	setNewsOptout(id.UserID("@josie:x"), true)
+	if occ := loadRealmOccupants(); len(occ["crypt_valdris"]) != 0 {
+		t.Errorf("opted-out player still shows as standing in a zone: %+v", occ["crypt_valdris"])
+	}
+}
+
+// TestStandingsCountFirstsFromTheSameAuthorityTheMapDoes. A zone's "first
+// through: Josie" and Josie's own firsts count come off one map in one pass, so
+// the two can never disagree — which they would if the board recounted the
+// ledger itself and the two queries drifted.
+func TestStandingsCountFirstsFromTheSameAuthorityTheMapDoes(t *testing.T) {
+	seedRealmFixture(t)
+
+	snap, err := buildRealmSnapshot(time.Now().UTC())
+	if err != nil {
+		t.Fatalf("buildRealmSnapshot: %v", err)
+	}
+
+	firstsByName := map[string]int{}
+	for _, s := range snap.Standings {
+		firstsByName[s.Name] = s.Firsts
+	}
+	// Josie was first through both zones; Quack was first through neither.
+	if firstsByName["Josie"] != 2 {
+		t.Errorf("Josie holds %d firsts, want 2", firstsByName["Josie"])
+	}
+	if firstsByName["Quack"] != 0 {
+		t.Errorf("Quack holds %d firsts, want 0", firstsByName["Quack"])
+	}
+
+	named := 0
+	for _, z := range snap.Zones {
+		if z.FirstClearBy == "Josie" {
+			named++
+		}
+	}
+	if named != firstsByName["Josie"] {
+		t.Errorf("the map names Josie on %d zones but the board credits her with %d — "+
+			"the two disagree about the same fact", named, firstsByName["Josie"])
+	}
+}
+
+// TestStandingsRankDeepestFirst. The ordering is the game's statement about what
+// it values, and Pete renders it without renumbering — so it has to be right
+// here. Depth beats breadth: somebody who has put down a Tier 5 boss is ahead of
+// somebody who has cleared the whole of Tier 1 forty times.
+func TestStandingsRankDeepestFirst(t *testing.T) {
+	seedRealmFixture(t)
+
+	rows, err := loadRealmStandings(map[string]realmClearStats{})
+	if err != nil {
+		t.Fatalf("loadRealmStandings: %v", err)
+	}
+	if len(rows) < 2 {
+		t.Fatalf("got %d standings rows, want 2", len(rows))
+	}
+	for i := 1; i < len(rows); i++ {
+		a, b := rows[i-1], rows[i]
+		if a.DeepestTier < b.DeepestTier {
+			t.Errorf("row %d (T%d) sorts above row %d (T%d) — the board is not deepest-first",
+				i-1, a.DeepestTier, i, b.DeepestTier)
+		}
+		if a.DeepestTier == b.DeepestTier && a.Zones < b.Zones {
+			t.Errorf("equal depth but row %d covers %d zones above row %d's %d",
+				i-1, a.Zones, i, b.Zones)
+		}
+	}
+}
+
+// TestFirstsLedgerIsRenderedNotJustCounted. news_realm_firsts has existed since
+// the news seam shipped and has only ever been used to decide a dispatch tier —
+// the ledger itself was never read back. This is the whole point of the hall: it
+// is a history book, and every row needs a name and a date on it.
+func TestFirstsLedgerIsRenderedNotJustCounted(t *testing.T) {
+	seedRealmFixture(t)
+
+	stats, err := loadRealmClearStats()
+	if err != nil {
+		t.Fatalf("loadRealmClearStats: %v", err)
+	}
+	firsts := loadRealmFirsts(stats)
+	if len(firsts) != 2 {
+		t.Fatalf("got %d firsts, want 2", len(firsts))
+	}
+	// Oldest first, which is the order it happened in.
+	if firsts[0].Target != "goblin_warrens" {
+		t.Errorf("ledger order starts with %q, want goblin_warrens", firsts[0].Target)
+	}
+	for _, f := range firsts {
+		if f.Display == "" {
+			t.Errorf("first %q has no display name — it would render as a blank row", f.Target)
+		}
+		if f.Holder != "Josie" {
+			t.Errorf("first %q holder = %q, want Josie (she cleared both zones first)", f.Target, f.Holder)
+		}
+		if f.Token == "" {
+			t.Errorf("first %q has a holder but no token, so the hall can't link to them", f.Target)
+		}
+	}
+}
+
+// TestUnrecoverableFirstStillGetsAnEntry. The ledger records (kind, target,
+// first_at) and nothing else; the holder is recovered at push time from the run
+// history. A treasure found and later discarded leaves no owner anywhere, and
+// that entry has to survive as an unattributed first rather than vanish — it
+// still happened, and the hall is a record of what happened.
+func TestUnrecoverableFirstStillGetsAnEntry(t *testing.T) {
+	seedRealmFixture(t)
+	claimRealmFirst("treasure", "a_hat_nobody_kept")
+
+	var found bool
+	stats, err := loadRealmClearStats()
+	if err != nil {
+		t.Fatalf("loadRealmClearStats: %v", err)
+	}
+	for _, f := range loadRealmFirsts(stats) {
+		if f.Target == "a_hat_nobody_kept" {
+			found = true
+			if f.Holder != "" {
+				t.Errorf("holder = %q, want empty — nothing in the game knows who had it", f.Holder)
+			}
+			if f.Display == "" {
+				t.Error("an unrecoverable first got no display name at all")
+			}
+		}
+	}
+	if !found {
+		t.Error("a first with no recoverable holder was dropped from the ledger entirely")
+	}
+}
+
+// TestRealmPushIsRateLimitedBelowTheRosterTick. The realm rides the 2-minute
+// roster ticker but is aggregate scans over the whole run history, and none of
+// it moves at roster speed. The self-limit is the thing that makes riding that
+// ticker acceptable, so it is worth pinning — and so is the other half: a FAILED
+// push must not stamp the clock, or an outage would be followed by ten minutes
+// of silence instead of a retry on the next tick.
+func TestRealmPushIsRateLimitedBelowTheRosterTick(t *testing.T) {
+	if realmPushInterval <= rosterTickInterval {
+		t.Fatalf("realmPushInterval (%v) is not longer than the roster tick (%v) — "+
+			"the realm would be recomputed every tick", realmPushInterval, rosterTickInterval)
+	}
+
+	// The gate itself: zero means never-pushed and must always go.
+	realmLastPush = time.Time{}
+	t.Cleanup(func() { realmLastPush = time.Time{} })
+	now := time.Now().UTC()
+	if !realmLastPush.IsZero() {
+		t.Fatal("fixture broken")
+	}
+	// A stamp inside the window suppresses; one outside it does not.
+	realmLastPush = now.Add(-realmPushInterval / 2)
+	if now.Sub(realmLastPush) >= realmPushInterval {
+		t.Error("a push half an interval old is not being suppressed")
+	}
+	realmLastPush = now.Add(-realmPushInterval - time.Minute)
+	if now.Sub(realmLastPush) < realmPushInterval {
+		t.Error("a push older than the interval is still being suppressed")
+	}
+}

internal/plugin/pete_roster.go

@@ -2,7 +2,10 @@ package plugin
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
+	"sort"
+	"strings"
 	"time"
 
 	"gogobee/internal/db"
@@ -48,6 +51,19 @@ func (p *AdventurePlugin) peteRosterTicker() {
 			continue // master switch off: the board goes stale on Pete and says so
 		}
 		p.pushRoster()
+		p.pushDetails()
+		p.pushSiege()
+		// Self-rate-limited to realmPushInterval: the realm is aggregate scans
+		// over the whole run history and none of it moves at roster speed.
+		p.pushRealm()
+		p.pushRunBeats()
+		// After the beats, not before: the summary is the last beat of a run's
+		// story and has no business overtaking the log it is about. It is also the
+		// only step here that can talk to the model, which is why it lives on a
+		// ticker at all rather than at the moment a run ends — and why it starts
+		// beside the ticker rather than on it, since a cold model takes longer to
+		// load than the interval between two pushes.
+		p.sweepRunSummariesAsync()
 	}
 }
 
@@ -60,7 +76,7 @@ func (p *AdventurePlugin) peteRosterTicker() {
 var rosterPushOK bool
 
 func (p *AdventurePlugin) pushRoster() {
-	snap, err := buildRosterSnapshot(time.Now().UTC())
+	snap, err := buildRosterSnapshot(time.Now().UTC(), p.euro)
 	if err != nil {
 		slog.Error("roster: build snapshot failed", "err", err)
 		return
@@ -88,6 +104,446 @@ func (p *AdventurePlugin) pushRoster() {
 	}
 }
 
+// detailPushOK mirrors rosterPushOK for the private self-detail push: log the
+// transitions and nothing else.
+var detailPushOK bool
+
+func (p *AdventurePlugin) pushDetails() {
+	snap, err := p.buildDetailSnapshot(time.Now().UTC())
+	if err != nil {
+		slog.Error("roster: build detail snapshot failed", "err", err)
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), rosterPushTimeout)
+	defer cancel()
+
+	if err := peteclient.PushDetails(ctx, snap); err != nil {
+		if detailPushOK {
+			slog.Warn("roster: detail push failed, self-view will go stale on Pete", "err", err)
+		} else {
+			slog.Debug("roster: detail push failed, dropping snapshot", "err", err)
+		}
+		detailPushOK = false
+		return
+	}
+
+	if !detailPushOK {
+		slog.Info("roster: private self-detail accepted by Pete", "players", len(snap.Players))
+		detailPushOK = true
+	}
+}
+
+// rosterDetail assembles the public detail sheet for one adventurer: the combat
+// stats every visitor may see, plus equipped gear. Expedition context (supplies,
+// threat, room) is layered on by the caller when a run is active.
+func rosterDetail(uid id.UserID, c *DnDCharacter) *peteclient.RosterDetail {
+	d := &peteclient.RosterDetail{
+		HPCurrent:  c.HPCurrent,
+		HPMax:      c.HPMax,
+		TempHP:     c.TempHP,
+		ArmorClass: c.ArmorClass,
+		Abilities:  [6]int{c.STR, c.DEX, c.CON, c.INT, c.WIS, c.CHA},
+		Modifiers:  c.Modifiers(),
+		// Unconditional, and this is the whole point of the field: it says this
+		// build knows about party seats, not that this character has any. Making
+		// it conditional would put it straight back in the hole it closes.
+		PartyKnown: true,
+	}
+	if equip, err := loadAdvEquipment(uid); err == nil {
+		for _, slot := range allSlots {
+			e, ok := equip[slot]
+			if !ok || e == nil {
+				continue
+			}
+			d.Gear = append(d.Gear, peteclient.GearItem{
+				Slot:       string(slot),
+				Name:       e.Name,
+				Tier:       e.Tier,
+				Condition:  e.Condition,
+				Masterwork: e.Masterwork,
+			})
+		}
+	}
+	return d
+}
+
+// buildDetailSnapshot assembles the private, owner-only detail set — inventory,
+// vault, house, and pets for every alive player, keyed by localpart. It does NOT
+// skip opted-out players: the news opt-out governs the *public* board, but this
+// data is never shown there — Pete only ever serves it back to the one signed-in
+// owner it belongs to, so hiding a player from it would only deny them their own
+// sheet. The board token rides along so Pete can match owner↔page without ever
+// reversing the one-way token.
+func (p *AdventurePlugin) buildDetailSnapshot(now time.Time) (peteclient.DetailSnapshot, error) {
+	snap := peteclient.DetailSnapshot{SnapshotAt: now.Unix()}
+	rows, err := db.Get().Query(`SELECT user_id FROM player_meta WHERE alive = 1`)
+	if err != nil {
+		return snap, err
+	}
+	var uids []id.UserID
+	for rows.Next() {
+		var uid string
+		if err := rows.Scan(&uid); err != nil {
+			rows.Close()
+			return snap, err
+		}
+		uids = append(uids, id.UserID(uid))
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return snap, err
+	}
+
+	for _, uid := range uids {
+		lp := localpartOf(uid)
+		if lp == "" {
+			continue
+		}
+		adv, err := loadAdvCharacter(uid)
+		if err != nil || adv == nil {
+			continue
+		}
+		pd := peteclient.PlayerDetail{
+			Localpart: lp,
+			Token:     eventToken(uid, "roster"),
+			House: peteclient.HouseView{
+				Tier:        adv.HouseTier,
+				LoanBalance: adv.HouseLoanBalance,
+				Autopay:     adv.HouseAutopay,
+				Rate:        adv.HouseCurrentRate,
+			},
+			Pets: petViews(adv),
+		}
+		if items, err := loadAdvInventory(uid); err == nil {
+			pd.Inventory = itemViews(items)
+			if equipped, err := loadEquippedMagicItems(uid); err == nil {
+				attachInventoryCompares(pd.Inventory, items, equipped)
+			}
+		}
+		if items, err := loadAdvVault(uid); err == nil {
+			pd.Vault = itemViews(items)
+		}
+		pd.Equipped = equippedViews(uid)
+		// Ask 7: the 5 standard slots for the web management panel, plus the euro
+		// balance the upgrade/repair confirm dialogs show. Balance is nil-guarded so
+		// the free-standing tests (which build no euro plugin) still run.
+		pd.Slots = buildEquipSlotViews(uid)
+		if p.euro != nil {
+			pd.Balance = p.euro.GetBalance(uid)
+		}
+		// W5b: what this owner may ask for from the web, priced. See pete_offers.go
+		// on why a quote is not a permission.
+		pd.Zones = zoneOffersFor(uid)
+		pd.Resume = resumeOfferFor(uid)
+		pd.Babysit = babysitOfferFor(adv)
+		snap.Players = append(snap.Players, pd)
+	}
+	return snap, nil
+}
+
+// itemViews renders inventory or vault rows for the private panel, resolving
+// the display facts the row itself doesn't carry.
+//
+// Attuned is always false here and that is not an omission: equipping *moves*
+// the row out of adventure_inventory into magic_item_equipped, so nothing in a
+// backpack can hold a bond. Worn items come from equippedViews instead.
+func itemViews(items []AdvItem) []peteclient.ItemView {
+	if len(items) == 0 {
+		return nil
+	}
+	out := make([]peteclient.ItemView, 0, len(items))
+	for _, it := range items {
+		v := peteclient.ItemView{
+			Name:   it.Name,
+			Type:   it.Type,
+			Tier:   it.Tier,
+			Value:  it.Value,
+			Temper: it.Temper,
+			Slot:   string(it.Slot),
+		}
+		// SkillSource is dual-use: a real skill name on masterwork gear, an
+		// internal registry pointer on magic-item rows. Only the former is a
+		// fact about the item; the latter is plumbing and stays home.
+		if !strings.HasPrefix(it.SkillSource, "magic_item:") {
+			v.SkillSource = it.SkillSource
+		}
+		if mi, ok := magicItemFromAdvItem(it); ok {
+			eff := temperedItem(mi, it.Temper)
+			v.Slot = string(eff.Slot)
+			v.Desc = eff.Desc
+			v.Effect = magicItemEffectSummary(eff)
+			v.Attunement = eff.Attunement
+			// The row id is the equip handle: a slotted magic item is the one thing
+			// the web equip path can wear, so only it carries an id. Mundane gear (the
+			// branch below) and unslotted curios get none, so no Equip button. This
+			// runs for vault rows too — a vault magic item would carry an id — but Pete
+			// offers the button on the backpack panel alone, so that's inert, not a leak.
+			if eff.Slot != "" {
+				v.ID = it.ID
+			}
+		} else if it.Slot != "" {
+			// Shop equipment resolves by (slot, tier) — Name is decorative.
+			v.Desc = equipmentDefByTier(it.Slot, it.Tier).Description
+			// A masterwork/arena piece carries a real slot, so it can be worn from the
+			// web (into a standard slot) — give it the equip handle. Plain shop gear in
+			// the pack stays button-less: its slot is just a category, not a wearable.
+			if it.Type == "MasterworkGear" || it.Type == "ArenaGear" {
+				v.ID = it.ID
+			}
+		}
+		out = append(out, v)
+	}
+	return out
+}
+
+// attachInventoryCompares fills the Compare card on every backpack magic item —
+// the ones that carry an equip id, which is exactly the set the web Equip button
+// acts on (equippedViews/vault rows are excluded by construction). views and items
+// are index-aligned: itemViews appends one view per item and skips none.
+func attachInventoryCompares(views []peteclient.ItemView, items []AdvItem, equipped map[DnDSlot]EquippedMagicItem) {
+	for i := range views {
+		if views[i].ID == 0 {
+			continue // no equip id → mundane gear or unslotted curio → no button, no compare
+		}
+		mi, ok := magicItemFromAdvItem(items[i])
+		if !ok || mi.Slot == "" {
+			continue
+		}
+		views[i].Compare = magicItemCompare(mi, items[i].Temper, equipped)
+	}
+}
+
+// magicItemCompare pairs a candidate backpack item against whatever is worn in
+// the slot it would equip into (mi.Slot — the same slot applyMagicEquip targets,
+// so the card describes the trade the Equip button actually makes). The diff is
+// over *tempered* effects on both sides; bond availability decides the inert case.
+func magicItemCompare(cand MagicItem, temper int, equipped map[DnDSlot]EquippedMagicItem) *peteclient.ItemCompare {
+	if cand.Slot == "" {
+		return nil
+	}
+	candEff := magicItemEffectFor(temperedItem(cand, temper))
+
+	worn, wornExists := equipped[cand.Slot]
+	if wornExists && worn.Item.ID == "" {
+		wornExists = false // an empty EquippedMagicItem is not a real occupant
+	}
+
+	// An empty slot compares against neutral: DamageReductMult is a multiplier, so
+	// its neutral is 1.0, not the zero value (0 would read as -100% damage taken).
+	wornEff := magicItemEffect{DamageReductMult: 1.0}
+	vsName := ""
+	if wornExists {
+		wornEff = magicItemEffectFor(worn.Effective())
+		vsName = worn.Effective().Name
+	}
+	deltas := magicItemDeltas(candEff, wornEff)
+
+	// Inert: the item wants a bond and none is free. Equipping evicts the slot's
+	// occupant first, so an attuned occupant frees its own bond — count post-swap.
+	inert := false
+	if cand.Attunement {
+		bonds := countAttunedMagicItems(equipped)
+		if wornExists && worn.Attuned {
+			bonds--
+		}
+		inert = bonds >= dndMagicItemAttuneLimit
+	}
+
+	return &peteclient.ItemCompare{
+		Verdict: compareVerdict(deltas, !wornExists, inert),
+		VsName:  vsName,
+		VsSlot:  string(cand.Slot),
+		Deltas:  deltas,
+	}
+}
+
+// compareVerdict classifies a set of deltas by strict dominance. Different stats
+// are not fungible — the engine can't say +3% damage beats -4 HP — so a mixed
+// result is a sidegrade with no winner claimed, which is the whole reason the
+// card exists. inert and new override the stat verdict.
+func compareVerdict(deltas []peteclient.ItemDelta, empty, inert bool) string {
+	if inert {
+		return "inert" // wearing it does nothing until a bond frees; stat diff is moot
+	}
+	if empty {
+		return "new"
+	}
+	if len(deltas) == 0 {
+		return "same"
+	}
+	gains, losses := 0, 0
+	for _, d := range deltas {
+		if d.Better {
+			gains++
+		} else {
+			losses++
+		}
+	}
+	switch {
+	case losses == 0:
+		return "upgrade"
+	case gains == 0:
+		return "downgrade"
+	default:
+		return "sidegrade"
+	}
+}
+
+// magicItemDeltas returns one entry per stat that visibly changes between the
+// candidate and the worn item. It diffs the structured effect fields, never the
+// summary string (which drops zero fields and would lose deltas). A change too
+// small to show at the rendered precision is omitted, so the verdict matches what
+// the player sees.
+func magicItemDeltas(cand, worn magicItemEffect) []peteclient.ItemDelta {
+	var d []peteclient.ItemDelta
+
+	// DamageBonus / DamageReductMult are fractions rendered as whole percents.
+	if pct := (cand.DamageBonus - worn.DamageBonus) * 100; roundedPct(pct) != 0 {
+		d = append(d, peteclient.ItemDelta{Label: "damage", Better: pct > 0, Text: signedPct(pct, "damage")})
+	}
+	// DamageReductMult is a multiplier on damage TAKEN, so lower is better. Express
+	// the change as damage taken: a positive number means you take more (worse).
+	if taken := (cand.DamageReductMult - worn.DamageReductMult) * 100; roundedPct(taken) != 0 {
+		d = append(d, peteclient.ItemDelta{Label: "defense", Better: taken < 0, Text: signedPct(taken, "damage taken")})
+	}
+	if diff := cand.FlatDmgStart - worn.FlatDmgStart; diff != 0 {
+		d = append(d, peteclient.ItemDelta{Label: "opening", Better: diff > 0, Text: signedInt(diff, "opening damage")})
+	}
+	if diff := cand.MaxHP - worn.MaxHP; diff != 0 {
+		d = append(d, peteclient.ItemDelta{Label: "hp", Better: diff > 0, Text: signedInt(diff, "HP")})
+	}
+	if cand.InitiativeBias != worn.InitiativeBias {
+		faster := cand.InitiativeBias > worn.InitiativeBias
+		text := "slower to act"
+		if faster {
+			text = "faster to act"
+		}
+		d = append(d, peteclient.ItemDelta{Label: "speed", Better: faster, Text: text})
+	}
+	return d
+}
+
+// roundedPct is the whole-percent a delta renders as; used to drop sub-percent
+// noise so the verdict never disagrees with the displayed chips.
+func roundedPct(v float64) int {
+	if v < 0 {
+		return int(v - 0.5)
+	}
+	return int(v + 0.5)
+}
+
+func signedPct(v float64, noun string) string { return fmt.Sprintf("%+d%% %s", roundedPct(v), noun) }
+
+func signedInt(v int, noun string) string { return fmt.Sprintf("%+d %s", v, noun) }
+
+// equippedViews returns the magic items the player is actually wearing. This is
+// the only place Attuned means anything: the bond lives on the equipped row, and
+// with a cap of dndMagicItemAttuneLimit a worn item can be inert.
+func equippedViews(uid id.UserID) []peteclient.ItemView {
+	equipped, err := loadEquippedMagicItems(uid)
+	if err != nil || len(equipped) == 0 {
+		return nil
+	}
+	out := make([]peteclient.ItemView, 0, len(equipped))
+	for _, e := range equipped {
+		eff := e.Effective()
+		out = append(out, peteclient.ItemView{
+			Name:       eff.Name,
+			Type:       string(eff.Kind),
+			Value:      int64(eff.Value),
+			Temper:     e.Temper,
+			Slot:       string(e.Slot),
+			Desc:       eff.Desc,
+			Effect:     magicItemEffectSummary(eff),
+			Attunement: eff.Attunement,
+			Attuned:    e.Attuned,
+		})
+	}
+	// Map iteration is random; the panel must not reshuffle every 60s poll.
+	sort.Slice(out, func(i, j int) bool { return out[i].Slot < out[j].Slot })
+	return out
+}
+
+// petViews returns the player's live pet slots. A pet that was chased away is
+// omitted — it isn't with them right now, and the self-view shows the present.
+//
+// XPNeeded rides along so the web can draw the progress toward the next level.
+// It is the engine's number, not Pete's: the curve steps by level band and a
+// copy of it on the web side would be a second answer to "how close is my dog"
+// that drifts the first time the band moves.
+func petViews(adv *AdventureCharacter) []peteclient.PetView {
+	var out []peteclient.PetView
+	if adv.PetType != "" && !adv.PetChasedAway {
+		out = append(out, peteclient.PetView{
+			Type: adv.PetType, Name: adv.PetName, Level: adv.PetLevel,
+			XP: adv.PetXP, XPNeeded: petXPNeededCenti(adv.PetLevel),
+			ArmorTier: adv.PetArmorTier,
+		})
+	}
+	if adv.Pet2Type != "" && !adv.Pet2ChasedAway {
+		out = append(out, peteclient.PetView{
+			Type: adv.Pet2Type, Name: adv.Pet2Name, Level: adv.Pet2Level,
+			XP: adv.Pet2XP, XPNeeded: petXPNeededCenti(adv.Pet2Level),
+			ArmorTier: adv.Pet2ArmorTier,
+		})
+	}
+	return out
+}
+
+// partySeatViews describes who is on this expedition for the public detail page.
+// Returns nil for a solo run: expeditionParty always hands back at least the
+// leader, and a "party" of one chair is a worse thing to draw than nothing.
+//
+// The opt-out rule is the Siege contributor's, not the realm occupant's: a seat
+// belonging to an opted-out player is kept and anonymised. Deleting it would
+// make a party of three read as a pair, and the numbers beside it — the supply
+// burn, the threat, the enemy scaling — all felt three bodies. What an unnamed
+// seat discloses is that somebody else is down there, which the zone and day on
+// this same page already say about everyone in the party.
+//
+// Levels come from a per-seat character load. Parties cap at three and the
+// companion needs no load at all, so this is at most two extra reads for a
+// player who is actually in one.
+func partySeatViews(exp *Expedition) []peteclient.PartySeatView {
+	seats, err := expeditionParty(exp.ID, exp.UserID)
+	if err != nil {
+		slog.Debug("pete: party seats unavailable", "expedition", exp.ID, "err", err)
+		return nil
+	}
+	if len(seats) < 2 {
+		return nil // solo, or a roster that only holds its leader
+	}
+	out := make([]peteclient.PartySeatView, 0, len(seats))
+	for _, s := range seats {
+		if s.Kind == SeatCompanion {
+			// The hireling is named unconditionally: he is not a player, has no
+			// board row to link to and no privacy to protect.
+			out = append(out, peteclient.PartySeatView{
+				Kind: "companion", Name: companionDisplayName,
+			})
+			continue
+		}
+		kind := "member"
+		if s.Kind == SeatLeader {
+			kind = "leader"
+		}
+		v := peteclient.PartySeatView{Kind: kind}
+		if !isNewsOptedOut(s.UserID) {
+			v.Name = charName(s.UserID)
+			if v.Name != "" {
+				// Token only alongside a name: a link to a page that says who they are
+				// would undo the anonymising below all by itself.
+				v.Token = eventToken(s.UserID, "roster")
+				if c, cerr := LoadDnDCharacter(s.UserID); cerr == nil && c != nil {
+					v.Level = c.Level
+				}
+			}
+		}
+		out = append(out, v)
+	}
+	return out
+}
+
 // buildRosterSnapshot assembles the complete board.
 //
 // Complete is the contract: Pete *replaces* its board with this, so anyone we
@@ -96,8 +552,8 @@ func (p *AdventurePlugin) pushRoster() {
 // anonymized. A standing row showing class + level + zone is trivially
 // re-identifiable (there is one level-14 cleric), so "an adventurer" would have
 // been a fig leaf; absence is the only honest option.
-func buildRosterSnapshot(now time.Time) (peteclient.RosterSnapshot, error) {
-	snap := peteclient.RosterSnapshot{SnapshotAt: now.Unix()}
+func buildRosterSnapshot(now time.Time, euro *EuroPlugin) (peteclient.RosterSnapshot, error) {
+	snap := peteclient.RosterSnapshot{SnapshotAt: now.Unix(), Tiers: mischiefTierCatalog()}
 
 	// Both DATETIME columns selected raw and folded in Go — NOT COALESCE()'d in
 	// SQL. modernc.org/sqlite rebuilds a time.Time from the column's *declared*
@@ -133,6 +589,22 @@ func buildRosterSnapshot(now time.Time) (peteclient.RosterSnapshot, error) {
 	}
 
 	for _, pl := range players {
+		// The buyer's own advisory balance rides along in a separate keyspace,
+		// keyed by localpart (their sign-in name), and is collected *before* the
+		// opt-out skip: opt-out hides a player from the public board, but their own
+		// balance is private on Pete — only ever read for the user asking about
+		// themselves — so there is no reason to deny an opted-out player the
+		// storefront's affordability hint. localpart is lowercase, matching how the
+		// buyer signs in and how a web order's username is resolved back to an MXID.
+		if euro != nil {
+			if lp := localpartOf(pl.uid); lp != "" {
+				snap.Balances = append(snap.Balances, peteclient.MischiefBalance{
+					Username: lp,
+					Euro:     euro.GetBalance(pl.uid),
+				})
+			}
+		}
+
 		if isNewsOptedOut(pl.uid) {
 			continue
 		}
@@ -156,7 +628,15 @@ func buildRosterSnapshot(now time.Time) (peteclient.RosterSnapshot, error) {
 			Status:    "idle",
 		}
 
-		if exp, _ := getActiveExpedition(pl.uid); exp != nil {
+		e.Detail = rosterDetail(pl.uid, c)
+
+		// activeExpeditionFor, not getActiveExpedition: the latter keys on
+		// dnd_expedition.user_id and is blind to members, so a player seated on
+		// somebody else's run has been reading as "idle in town" on the public board
+		// for the whole life of N3 parties — standing in a tier-4 dungeon. The
+		// expedition it resolves to is the leader's row, which is the right answer:
+		// a party shares one clock, one supply pool and one run.
+		if exp, _, _ := activeExpeditionFor(pl.uid); exp != nil {
 			zone := zoneOrFallback(exp.ZoneID)
 			e.Status = "expedition"
 			e.Zone = zone.Display
@@ -166,6 +646,17 @@ func buildRosterSnapshot(now time.Time) (peteclient.RosterSnapshot, error) {
 					e.Region = r.Name
 				}
 			}
+			if e.Detail != nil {
+				e.Detail.Supplies = int(exp.Supplies.Current)
+				e.Detail.ThreatLevel = exp.ThreatLevel
+				e.Detail.Party = partySeatViews(exp)
+				if exp.RunID != "" {
+					if run, rerr := getZoneRun(exp.RunID); rerr == nil && run != nil && run.TotalRooms > 0 {
+						e.Detail.Room = fmt.Sprintf("%d / %d", run.CurrentRoom+1, run.TotalRooms)
+						e.Detail.Map = buildRosterMap(run)
+					}
+				}
+			}
 		} else if pl.lastAction != nil {
 			if h := int(now.Sub(*pl.lastAction).Hours()); h > 0 {
 				e.IdleHours = h
@@ -175,3 +666,112 @@ func buildRosterSnapshot(now time.Time) (peteclient.RosterSnapshot, error) {
 	}
 	return snap, nil
 }
+
+// buildRosterMap computes the fog-of-war cut of a run's zone graph for the
+// public roster. It sends every visited node with its true kind, plus the
+// one-hop frontier — the destinations of edges leading out of visited nodes,
+// with their kind withheld as "unknown". Edges are directed and stored by
+// from-node, so "one hop out of a visited node" is exactly g.Edges[visited].
+// A frontier node's edges are NOT walked, so nothing past the first closed
+// door reaches the wire — "view source to find the boss room" is not fog of
+// war. Node Label/Content never leave the game box.
+//
+// Output order is deterministic (visited-path order, then frontier in
+// discovery order) so an unchanged run produces a byte-identical snapshot and
+// the roster push does not churn.
+func buildRosterMap(run *DungeonRun) *peteclient.RosterMap {
+	g, ok := loadZoneGraph(run.ZoneID)
+	if !ok || len(run.VisitedNodes) == 0 {
+		return nil
+	}
+
+	// Unique visited nodes in path order — VisitedNodes repeats on backtrack.
+	orderedVisited := make([]string, 0, len(run.VisitedNodes))
+	seen := make(map[string]bool, len(run.VisitedNodes))
+	for _, id := range run.VisitedNodes {
+		if !seen[id] {
+			seen[id] = true
+			orderedVisited = append(orderedVisited, id)
+		}
+	}
+
+	m := &peteclient.RosterMap{
+		ZoneID:      string(run.ZoneID),
+		CurrentNode: run.CurrentNode,
+		Visited:     orderedVisited,
+	}
+
+	// Visited nodes first, in path order, with their real kind.
+	emitted := make(map[string]bool, len(orderedVisited))
+	for _, id := range orderedVisited {
+		emitted[id] = true
+		if n, ok := g.Nodes[id]; ok {
+			m.Nodes = append(m.Nodes, peteclient.RosterMapNode{ID: id, Kind: string(n.Kind)})
+		}
+	}
+
+	// Frontier: destinations of edges out of visited nodes, kind withheld.
+	// Walk visited in path order so the frontier order is stable.
+	for _, from := range orderedVisited {
+		for _, edge := range g.Edges[from] {
+			lock := edge.Lock
+			if lock == LockNone {
+				lock = "" // an open door needs no mark; omitempty drops it
+			}
+			m.Edges = append(m.Edges, peteclient.RosterMapEdge{
+				From: edge.From,
+				To:   edge.To,
+				Lock: string(lock),
+			})
+			if !seen[edge.To] && !emitted[edge.To] {
+				emitted[edge.To] = true
+				m.Nodes = append(m.Nodes, peteclient.RosterMapNode{ID: edge.To, Kind: "unknown"})
+			}
+		}
+	}
+	return m
+}
+
+// resolveRosterToken maps a board token back to the adventurer it names. The
+// token is a one-way HMAC (eventToken), so it can't be inverted — instead we
+// recompute every live player's token and match. The salt is DB-persisted, so a
+// token minted before a restart still resolves after one. O(players) per call,
+// which is nothing at realm scale and only runs when a web order is being placed.
+func resolveRosterToken(token string) (id.UserID, bool) {
+	if token == "" {
+		return "", false
+	}
+	rows, err := db.Get().Query(`SELECT user_id FROM player_meta WHERE alive = 1`)
+	if err != nil {
+		return "", false
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var uid string
+		if err := rows.Scan(&uid); err != nil {
+			continue
+		}
+		if eventToken(id.UserID(uid), "roster") == token {
+			return id.UserID(uid), true
+		}
+	}
+	return "", false
+}
+
+// mischiefTierCatalog is the storefront price list, pushed on every tick so the
+// web shop always renders gogobee's current prices — a fee retune here reaches
+// Pete within a snapshot, and Pete never hardcodes a number of its own. The
+// signed fee is the same +25% sink a Matrix buyer pays to put their name on it.
+func mischiefTierCatalog() []peteclient.MischiefTier {
+	out := make([]peteclient.MischiefTier, 0, len(mischiefTiers))
+	for _, t := range mischiefTiers {
+		out = append(out, peteclient.MischiefTier{
+			Key:       t.Key,
+			Display:   t.Display,
+			Fee:       t.Fee,
+			SignedFee: mischiefSignedFee(t.Fee),
+			Blurb:     t.Blurb,
+		})
+	}
+	return out
+}

internal/plugin/pete_roster_map_test.go

@@ -0,0 +1,137 @@
+package plugin
+
+import (
+	"testing"
+)
+
+// mapFixtureGraph registers a small branching graph and returns a cleanup.
+//
+//	n1(entry) --none--------> n2(exploration) --key_required--> n4(boss)
+//	   \--perception_check--> n3(trap) ------------------------/
+//
+// n4 is reachable two ways; the validator wants a single entry and a reachable
+// boss, which this satisfies.
+func mapFixtureGraph(t *testing.T) ZoneID {
+	t.Helper()
+	const zid ZoneID = "map_test_zone"
+	g := ZoneGraph{
+		ZoneID: zid,
+		Entry:  "n1",
+		Boss:   "n4",
+		Nodes: map[string]ZoneNode{
+			"n1": {NodeID: "n1", ZoneID: zid, Kind: NodeKindEntry, IsEntry: true, Label: "The Gate"},
+			"n2": {NodeID: "n2", ZoneID: zid, Kind: NodeKindExploration, Label: "Dusty Hall"},
+			"n3": {NodeID: "n3", ZoneID: zid, Kind: NodeKindTrap, Label: "Spiked Pit"},
+			"n4": {NodeID: "n4", ZoneID: zid, Kind: NodeKindBoss, IsBoss: true, Label: "Throne of Bone"},
+		},
+		Edges: map[string][]ZoneEdge{
+			"n1": {
+				{From: "n1", To: "n2", Lock: LockNone, Weight: 1},
+				{From: "n1", To: "n3", Lock: LockPerception, Weight: 1},
+			},
+			"n2": {{From: "n2", To: "n4", Lock: LockKey, Weight: 1}},
+			"n3": {{From: "n3", To: "n4", Lock: LockNone, Weight: 1}},
+		},
+	}
+	registerZoneGraph(g)
+	t.Cleanup(func() { delete(zoneGraphRegistry, zid) })
+	return zid
+}
+
+func TestBuildRosterMap_FogOfWar(t *testing.T) {
+	zid := mapFixtureGraph(t)
+	run := &DungeonRun{
+		ZoneID:       zid,
+		CurrentNode:  "n2",
+		VisitedNodes: []string{"n1", "n2"},
+		TotalRooms:   4,
+	}
+	m := buildRosterMap(run)
+	if m == nil {
+		t.Fatal("buildRosterMap returned nil for a visited run")
+	}
+	if m.ZoneID != string(zid) || m.CurrentNode != "n2" {
+		t.Fatalf("header wrong: %+v", m)
+	}
+
+	kinds := map[string]string{}
+	for _, n := range m.Nodes {
+		if _, dup := kinds[n.ID]; dup {
+			t.Errorf("node %q emitted twice", n.ID)
+		}
+		kinds[n.ID] = n.Kind
+	}
+
+	// Visited nodes carry their true kind.
+	if kinds["n1"] != "entry" || kinds["n2"] != "exploration" {
+		t.Errorf("visited kinds wrong: %v", kinds)
+	}
+	// Frontier nodes are present but their kind is withheld.
+	if kinds["n3"] != "unknown" {
+		t.Errorf("n3 is one hop out of n1 and must be unknown, got %q", kinds["n3"])
+	}
+	if kinds["n4"] != "unknown" {
+		t.Errorf("n4 (the boss) is one hop out of n2 and must be unknown, got %q", kinds["n4"])
+	}
+
+	// The map must never leak a room the player has not reached a door to.
+	// n4 is a real boss node, but reachable only as frontier — its kind stays
+	// hidden. A node past a frontier door (there is none deeper here) must not
+	// appear at all; assert exactly four nodes.
+	if len(m.Nodes) != 4 {
+		t.Fatalf("want 4 nodes (2 visited + 2 frontier), got %d: %+v", len(m.Nodes), m.Nodes)
+	}
+
+	// Edges out of visited nodes only. n3->n4 must NOT appear: n3 is frontier,
+	// not visited, so walking its doors would leak structure past the fog.
+	var edgeKeys []string
+	for _, e := range m.Edges {
+		edgeKeys = append(edgeKeys, e.From+"->"+e.To+":"+e.Lock)
+	}
+	want := map[string]bool{
+		"n1->n2:":                 true, // LockNone dropped to ""
+		"n1->n3:perception_check": true,
+		"n2->n4:key_required":     true,
+	}
+	if len(edgeKeys) != len(want) {
+		t.Fatalf("want %d edges, got %v", len(want), edgeKeys)
+	}
+	for _, k := range edgeKeys {
+		if !want[k] {
+			t.Errorf("unexpected edge %q (n3->n4 would be a fog leak)", k)
+		}
+	}
+}
+
+func TestBuildRosterMap_EmptyRunIsNil(t *testing.T) {
+	zid := mapFixtureGraph(t)
+	// A run that has visited nothing yet has no map to show.
+	if m := buildRosterMap(&DungeonRun{ZoneID: zid}); m != nil {
+		t.Errorf("empty VisitedNodes should yield nil, got %+v", m)
+	}
+	// An unknown zone (no graph, no legacy fallback row) yields nil, not a panic.
+	if m := buildRosterMap(&DungeonRun{ZoneID: "no_such_zone", VisitedNodes: []string{"x"}}); m != nil {
+		t.Errorf("unknown zone should yield nil, got %+v", m)
+	}
+}
+
+func TestBuildRosterMap_BacktrackDedup(t *testing.T) {
+	zid := mapFixtureGraph(t)
+	// VisitedNodes is an ordered set that repeats on backtrack: n1,n2,n1.
+	run := &DungeonRun{
+		ZoneID:       zid,
+		CurrentNode:  "n1",
+		VisitedNodes: []string{"n1", "n2", "n1"},
+	}
+	m := buildRosterMap(run)
+	seen := map[string]int{}
+	for _, n := range m.Nodes {
+		seen[n.ID]++
+	}
+	if seen["n1"] != 1 {
+		t.Errorf("backtracked node n1 emitted %d times, want 1", seen["n1"])
+	}
+	if len(m.Visited) != 2 {
+		t.Errorf("Visited should dedup to [n1 n2], got %v", m.Visited)
+	}
+}

internal/plugin/pete_roster_party_test.go

@@ -0,0 +1,264 @@
+package plugin
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"gogobee/internal/peteclient"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// TestSeatedMemberIsNotIdleInTown is the gap W7 closes. The board resolved an
+// expedition with getActiveExpedition, which keys on dnd_expedition.user_id — so
+// a party member, who owns no row of their own, read as "idle in town" while
+// standing in a dungeon. The regression is silent: the page renders fine, it just
+// says the wrong thing about where somebody is.
+func TestSeatedMemberIsNotIdleInTown(t *testing.T) {
+	newBoredomTestDB(t)
+	now := time.Now().UTC()
+	old := now.Add(-30 * time.Hour)
+
+	leader := id.UserID("@leader:test")
+	member := id.UserID("@member:test")
+	seedRosterPlayer(t, leader, "Josie", &old, &old)
+	seedRosterPlayer(t, member, "Camcast", &old, &old)
+
+	seedExpedition(t, "exp-shared", leader, "active")
+	seatLeaderFixture(t, "exp-shared")
+	if err := joinParty("exp-shared", member); err != nil {
+		t.Fatalf("joinParty: %v", err)
+	}
+
+	snap, err := buildRosterSnapshot(now, nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	byName := map[string]int{}
+	for i, a := range snap.Adventurers {
+		byName[a.Name] = i
+	}
+	for _, name := range []string{"Josie", "Camcast"} {
+		i, ok := byName[name]
+		if !ok {
+			t.Fatalf("%s is not on the board", name)
+		}
+		if got := snap.Adventurers[i].Status; got != "expedition" {
+			t.Errorf("%s status = %q, want expedition", name, got)
+		}
+		if snap.Adventurers[i].Zone == "" {
+			t.Errorf("%s is on an expedition with no zone named", name)
+		}
+	}
+}
+
+// TestPartySeatsNameTheWholeRoster covers the shape of the seat list: leader
+// first, every human named with a linkable token, and the hireling named without
+// one (he has no board row to link to).
+func TestPartySeatsNameTheWholeRoster(t *testing.T) {
+	newBoredomTestDB(t)
+	now := time.Now().UTC()
+	old := now.Add(-30 * time.Hour)
+
+	leader := id.UserID("@leader:test")
+	member := id.UserID("@member:test")
+	seedRosterPlayer(t, leader, "Josie", &old, &old)
+	seedRosterPlayer(t, member, "Camcast", &old, &old)
+
+	seedExpedition(t, "exp-shared", leader, "active")
+	seatLeaderFixture(t, "exp-shared")
+	if err := joinParty("exp-shared", member); err != nil {
+		t.Fatalf("joinParty: %v", err)
+	}
+	if err := joinParty("exp-shared", companionUserID()); err != nil {
+		t.Fatalf("hire companion: %v", err)
+	}
+
+	seats := seatsForOwner(t, now, "Josie")
+	if len(seats) != 3 {
+		t.Fatalf("party has %d seats, want 3: %+v", len(seats), seats)
+	}
+	if seats[0].Kind != "leader" || seats[0].Name != "Josie" {
+		t.Errorf("first seat = %+v, want the leader Josie", seats[0])
+	}
+	if seats[0].Token == "" || seats[0].Level == 0 {
+		t.Errorf("leader seat is unlinkable or levelless: %+v", seats[0])
+	}
+	var companion, human int
+	for _, s := range seats {
+		switch s.Kind {
+		case "companion":
+			companion++
+			if s.Name != companionDisplayName {
+				t.Errorf("companion seat named %q, want %q", s.Name, companionDisplayName)
+			}
+			if s.Token != "" {
+				t.Errorf("companion seat carries a board token %q; he has no board row", s.Token)
+			}
+		case "leader", "member":
+			human++
+			if s.Name == "" || s.Token == "" {
+				t.Errorf("human seat %+v is missing its name/token pair", s)
+			}
+		default:
+			t.Errorf("unknown seat kind %q", s.Kind)
+		}
+	}
+	if companion != 1 || human != 2 {
+		t.Errorf("seats = %d human + %d companion, want 2 + 1", human, companion)
+	}
+}
+
+// TestSoloRunPublishesNoParty: expeditionParty always hands back at least the
+// leader, so a naive render would draw every solo player a party of one.
+func TestSoloRunPublishesNoParty(t *testing.T) {
+	newBoredomTestDB(t)
+	now := time.Now().UTC()
+	old := now.Add(-30 * time.Hour)
+
+	solo := id.UserID("@solo:test")
+	seedRosterPlayer(t, solo, "Josie", &old, &old)
+	seedExpedition(t, "exp-solo", solo, "active")
+
+	if seats := seatsForOwner(t, now, "Josie"); seats != nil {
+		t.Errorf("solo run published a party of %d: %+v", len(seats), seats)
+	}
+
+	// And with only the leader seated, which is what the roster table looks like
+	// between materialising and the first invite landing.
+	seatLeaderFixture(t, "exp-solo")
+	if seats := seatsForOwner(t, now, "Josie"); seats != nil {
+		t.Errorf("leader-only roster published a party of %d: %+v", len(seats), seats)
+	}
+}
+
+// TestOptedOutSeatIsAnonymisedNotDropped is the privacy contract for this
+// surface, and it is deliberately NOT the board's rule. The board omits an
+// opted-out player outright; a party seat is anonymised, because a party of three
+// that renders as a pair is a false statement about the run everyone can see the
+// supply burn and threat level of.
+func TestOptedOutSeatIsAnonymisedNotDropped(t *testing.T) {
+	newBoredomTestDB(t)
+	now := time.Now().UTC()
+	old := now.Add(-30 * time.Hour)
+
+	leader := id.UserID("@leader:test")
+	hidden := id.UserID("@hidden:test")
+	seedRosterPlayer(t, leader, "Josie", &old, &old)
+	seedRosterPlayer(t, hidden, "Quack", &old, &old)
+	setNewsOptout(hidden, true)
+
+	seedExpedition(t, "exp-shared", leader, "active")
+	seatLeaderFixture(t, "exp-shared")
+	if err := joinParty("exp-shared", hidden); err != nil {
+		t.Fatalf("joinParty: %v", err)
+	}
+
+	seats := seatsForOwner(t, now, "Josie")
+	if len(seats) != 2 {
+		t.Fatalf("party has %d seats, want 2 — an opted-out seat was dropped, not anonymised: %+v",
+			len(seats), seats)
+	}
+	for _, s := range seats {
+		if s.Name == "Quack" {
+			t.Error("an opted-out player is named on a party roster")
+		}
+	}
+	var blank int
+	for _, s := range seats {
+		if s.Name == "" {
+			blank++
+			if s.Token != "" || s.Level != 0 {
+				t.Errorf("anonymised seat still carries a token or level: %+v", s)
+			}
+		}
+	}
+	if blank != 1 {
+		t.Errorf("%d anonymous seats, want exactly 1", blank)
+	}
+}
+
+// TestPartyKnownIsSetOnEverySheet pins the capability flag Pete's abandon button
+// hangs off. Party is omitempty, so a solo run and a game box too old to know what
+// a seat is both reach Pete as an empty slice; the flag is what tells them apart.
+// It is a fact about this build, so it must be true on a sheet with no party on it
+// at all — a conditional party_known reads as "this player is solo" and puts the
+// flag back in the hole it was added to close.
+func TestPartyKnownIsSetOnEverySheet(t *testing.T) {
+	newBoredomTestDB(t)
+	now := time.Now().UTC()
+	old := now.Add(-30 * time.Hour)
+
+	intown := id.UserID("@intown:test")
+	solo := id.UserID("@solo:test")
+	leader := id.UserID("@leader:test")
+	member := id.UserID("@member:test")
+	seedRosterPlayer(t, intown, "Nonk", &old, &old)
+	seedRosterPlayer(t, solo, "Quack", &old, &old)
+	seedRosterPlayer(t, leader, "Josie", &old, &old)
+	seedRosterPlayer(t, member, "Camcast", &old, &old)
+
+	seedExpedition(t, "exp-solo", solo, "active")
+	seedExpedition(t, "exp-shared", leader, "active")
+	seatLeaderFixture(t, "exp-shared")
+	if err := joinParty("exp-shared", member); err != nil {
+		t.Fatalf("joinParty: %v", err)
+	}
+
+	snap, err := buildRosterSnapshot(now, nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	var seen int
+	for _, a := range snap.Adventurers {
+		if a.Detail == nil {
+			t.Fatalf("%s has no detail sheet to carry the flag", a.Name)
+		}
+		seen++
+		if !a.Detail.PartyKnown {
+			t.Errorf("%s (%s, %d seats) published party_known=false; this build knows what a seat is",
+				a.Name, a.Status, len(a.Detail.Party))
+		}
+	}
+	if seen != 4 {
+		t.Fatalf("checked %d sheets, want 4 — a case went missing", seen)
+	}
+
+	// The wire name is the contract: Pete decodes party_known and withholds the
+	// abandon button when it is absent, so a rename here fails silently and only
+	// on the far side.
+	blob, err := json.Marshal(&peteclient.RosterDetail{PartyKnown: true})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if !strings.Contains(string(blob), `"party_known":true`) {
+		t.Errorf("detail sheet serialised without party_known: %s", blob)
+	}
+	// And it must not be omitempty: an absent key is Pete's fail-closed answer,
+	// which a false flag has to keep meaning.
+	if blob, err = json.Marshal(&peteclient.RosterDetail{}); err != nil {
+		t.Fatalf("marshal: %v", err)
+	} else if !strings.Contains(string(blob), `"party_known":false`) {
+		t.Errorf("party_known is omitempty; false must stay on the wire: %s", blob)
+	}
+}
+
+// seatsForOwner pulls one named adventurer's published party out of a whole
+// snapshot, which is the only way to reach it — Party rides RosterDetail, so this
+// also proves the wiring in buildRosterSnapshot and not just partySeatViews.
+func seatsForOwner(t *testing.T, now time.Time, name string) []peteclient.PartySeatView {
+	t.Helper()
+	snap, err := buildRosterSnapshot(now, nil)
+	if err != nil {
+		t.Fatalf("buildRosterSnapshot: %v", err)
+	}
+	for _, a := range snap.Adventurers {
+		if a.Name == name && a.Detail != nil {
+			return a.Detail.Party
+		}
+	}
+	t.Fatalf("%s is not on the board with a detail sheet", name)
+	return nil
+}

internal/plugin/pete_roster_test.go

@@ -1,6 +1,7 @@
 package plugin
 
 import (
+	"sort"
 	"testing"
 	"time"
 
@@ -49,7 +50,7 @@ func TestRosterSnapshotReadsTheClock(t *testing.T) {
 	// Never acted at all: the fold falls through to created_at.
 	seedRosterPlayer(t, "@never:test", "Camcast", &old, nil)
 
-	snap, err := buildRosterSnapshot(now)
+	snap, err := buildRosterSnapshot(now, nil)
 	if err != nil {
 		t.Fatalf("buildRosterSnapshot: %v", err)
 	}
@@ -94,7 +95,7 @@ func TestRosterOmitsOptedOut(t *testing.T) {
 	seedRosterPlayer(t, "@hidden:test", "Quack", &old, &old)
 	setNewsOptout("@hidden:test", true)
 
-	snap, err := buildRosterSnapshot(now)
+	snap, err := buildRosterSnapshot(now, nil)
 	if err != nil {
 		t.Fatalf("buildRosterSnapshot: %v", err)
 	}
@@ -125,3 +126,101 @@ func TestRosterTokenIsNotAnEventToken(t *testing.T) {
 		t.Error("board token not stable — the row would churn identity every snapshot")
 	}
 }
+
+// pickMagicItem returns a registry item matching want, so these tests read the
+// real registry rather than pinning an item ID that a later SRD dump could drop.
+func pickMagicItem(t *testing.T, want func(MagicItem) bool) MagicItem {
+	t.Helper()
+	var ids []string
+	for id := range magicItemRegistry {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids) // map order is random; a flaky pick is a flaky test
+	for _, id := range ids {
+		if mi := magicItemRegistry[id]; want(mi) {
+			return mi
+		}
+	}
+	t.Skip("no registry item matches this shape")
+	return MagicItem{}
+}
+
+// TestItemViewsKeepsTheRegistryPointerHome is the leak guard. SkillSource is two
+// different things depending on the row: a player-facing skill name on
+// masterwork gear ("mining"), and the internal "magic_item:<id>" pointer that
+// resolves an inventory row back to the registry. Only the first is a fact about
+// the item. Sending the second would put gogobee's internal IDs on a page, and
+// Pete would have no way to tell them apart to filter them out.
+func TestItemViewsKeepsTheRegistryPointerHome(t *testing.T) {
+	newBoredomTestDB(t)
+	mi := pickMagicItem(t, func(m MagicItem) bool { return m.Desc != "" && m.Slot != "" })
+
+	views := itemViews([]AdvItem{
+		{Name: mi.Name, Type: "magic_item", Tier: 3, Value: 100,
+			SkillSource: "magic_item:" + mi.ID},
+		{Name: "Miner's Pick", Type: "MasterworkGear", Tier: 3, Value: 300,
+			Slot: SlotWeapon, SkillSource: "mining"},
+	})
+
+	if views[0].SkillSource != "" {
+		t.Errorf("the magic_item registry pointer went out on the wire: %q", views[0].SkillSource)
+	}
+	if views[0].Desc != mi.Desc {
+		t.Errorf("desc = %q, want the registry's %q", views[0].Desc, mi.Desc)
+	}
+	if views[0].Effect == "" {
+		t.Error("a magic item should carry the engine's own effect summary")
+	}
+	if views[1].SkillSource != "mining" {
+		t.Errorf("masterwork skill source = %q, want it kept", views[1].SkillSource)
+	}
+}
+
+// TestItemViewsNeverClaimABackpackBond: equipping *moves* the row out of
+// adventure_inventory into magic_item_equipped, so nothing in a backpack can
+// hold a bond. Attuned must stay false here whatever the item wants, or the
+// panel tells a player an unworn item is working for them.
+func TestItemViewsNeverClaimABackpackBond(t *testing.T) {
+	newBoredomTestDB(t)
+	mi := pickMagicItem(t, func(m MagicItem) bool { return m.Attunement && m.Slot != "" })
+
+	v := itemViews([]AdvItem{{Name: mi.Name, Type: "magic_item", Tier: 3,
+		SkillSource: "magic_item:" + mi.ID}})[0]
+
+	if !v.Attunement {
+		t.Error("an attunement item should say it wants a bond")
+	}
+	if v.Attuned {
+		t.Error("a backpack item claimed a bond it cannot hold")
+	}
+}
+
+// TestEquippedViewsCarryBondState: the worn set is the only place Attuned means
+// anything, and the only way the page can show that a worn item is sitting inert
+// against the cap of three.
+func TestEquippedViewsCarryBondState(t *testing.T) {
+	newBoredomTestDB(t)
+	uid := id.UserID("@josie:example.org")
+	mi := pickMagicItem(t, func(m MagicItem) bool { return m.Attunement && m.Slot != "" })
+
+	if err := equipMagicItem(uid, mi.Slot, mi.ID, false, 0); err != nil {
+		t.Fatalf("equip: %v", err)
+	}
+	views := equippedViews(uid)
+	if len(views) != 1 {
+		t.Fatalf("equipped views = %d, want 1", len(views))
+	}
+	if views[0].Attuned {
+		t.Error("an inert worn item was reported as bonded")
+	}
+	if views[0].Slot != string(mi.Slot) {
+		t.Errorf("slot = %q, want %q", views[0].Slot, mi.Slot)
+	}
+
+	if err := equipMagicItem(uid, mi.Slot, mi.ID, true, 0); err != nil {
+		t.Fatalf("re-equip bonded: %v", err)
+	}
+	if !equippedViews(uid)[0].Attuned {
+		t.Error("a bonded worn item was reported as inert")
+	}
+}