fix(campaigns): delete universes in dependency order

Co-authored-by: multica-agent <github@multica.ai>

README.md

@@ -18,6 +18,8 @@ To verify the complete hosted-Supabase multiplayer path (two temporary email acc
 
 Before starting either process, the root commands check the Supabase schema. If it is missing and `SUPABASE_DB_URL` is configured, they transactionally create all D&G tables, functions, triggers, indexes, and policies from `supabase/bootstrap.sql`. Copy the **Session pooler** URI from the Supabase Dashboard **Connect** panel into the root `.env` and replace the password placeholder with the URL-encoded database password. The database URL is server-only and must never use a `NUXT_PUBLIC_` prefix.
 
+Existing campaigns are upgraded automatically to ruleset version 2 by `pnpm db:ensure`. The migration preserves every round, narration, current HP, inventory, and status; adds the SRD 5.2.1 character rules profile; and records one `migrate_ruleset` audit entry per campaign. Migrated characters retain compatibility with their previous proficiency hints, while newly created characters use explicit server-owned skill, expertise, and saving-throw proficiencies.
+
 The web and worker commands both load this root `.env` file explicitly. Environment variables supplied by Railway or CI take precedence over values in the file.
 
 The UI can be built without credentials. A running Nitro server and every worker process require `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, `NUXT_PUBLIC_SUPABASE_URL`, and `NUXT_PUBLIC_SUPABASE_ANON_KEY`; startup fails with a clear error when required server credentials are missing. Redis is optional: when `REDIS_URL` is absent, the worker safely claims jobs from the Supabase `ai_jobs` outbox using short database leases and retries failed jobs up to three times.
@@ -41,7 +43,7 @@ Use Node.js 18.20.5 or newer. The lockfile pins the web toolchain to the Node 18
 - Worlds are private by default.
 - Content is limited to 13+; explicit sexual content and sexual content involving minors are rejected.
 - AI responses are parsed against strict schemas.
-- AI can propose checks and events, but cannot directly set dice outcomes or mechanical values.
+- AI can propose checks and events, but cannot directly set dice outcomes, proficiency, temporary HP, death saves, resources, or other mechanical values.
 - SRD-derived work must retain the attribution in `LEGAL.md`.
 
 ## Production services

apps/web/components/AppShell.vue

@@ -1,6 +1,17 @@
 <script setup lang="ts">
 defineProps<{ section?: string }>()
+const emit = defineEmits<{
+  campaignAction: [payload: { action: 'rename' | 'delete'; campaignId: string }]
+}>()
 const { session, restore } = useDngAuth()
+const route = useRoute()
+const router = useRouter()
+const contextMenu = ref<HTMLElement | null>(null)
+const contextOpen = ref(false)
+const contextX = ref(0)
+const contextY = ref(0)
+const contextCampaignId = ref('')
+const contextCampaignTitle = ref('')
 onMounted(() => void restore())
 
 const initials = computed(() => {
@@ -12,10 +23,73 @@ const avatarUrl = computed(() => {
   const value = session.value?.user.user_metadata?.avatar_url
   return typeof value === 'string' && value ? value : ''
 })
+
+function closeContextMenu() {
+  contextOpen.value = false
+  contextCampaignId.value = ''
+  contextCampaignTitle.value = ''
+}
+
+async function openContextMenu(event: MouseEvent) {
+  event.preventDefault()
+  const campaign = event.target instanceof Element
+    ? event.target.closest<HTMLElement>('[data-context-campaign]')
+    : null
+  contextCampaignId.value = campaign?.dataset.contextCampaign ?? ''
+  contextCampaignTitle.value = campaign?.dataset.contextLabel ?? ''
+  contextX.value = event.clientX
+  contextY.value = event.clientY
+  contextOpen.value = true
+
+  await nextTick()
+  const bounds = contextMenu.value?.getBoundingClientRect()
+  if (!bounds) return
+  contextX.value = Math.max(12, Math.min(contextX.value, window.innerWidth - bounds.width - 12))
+  contextY.value = Math.max(12, Math.min(contextY.value, window.innerHeight - bounds.height - 12))
+}
+
+function runCampaignAction(action: 'rename' | 'delete') {
+  const campaignId = contextCampaignId.value
+  closeContextMenu()
+  if (campaignId) emit('campaignAction', { action, campaignId })
+}
+
+async function openAccountSection(section: 'identity' | 'settings') {
+  closeContextMenu()
+  await navigateTo({ path: '/profile', hash: `#${section}` })
+}
+
+function goBack() {
+  closeContextMenu()
+  if (window.history.length > 1) router.back()
+  else void navigateTo('/dashboard')
+}
+
+function closeFromPointer(event: PointerEvent) {
+  if (contextOpen.value && event.target instanceof Node && !contextMenu.value?.contains(event.target)) closeContextMenu()
+}
+
+function closeFromKeyboard(event: KeyboardEvent) {
+  if (event.key === 'Escape') closeContextMenu()
+}
+
+onMounted(() => {
+  document.addEventListener('pointerdown', closeFromPointer)
+  document.addEventListener('keydown', closeFromKeyboard)
+  window.addEventListener('resize', closeContextMenu)
+  window.addEventListener('scroll', closeContextMenu, true)
+})
+onBeforeUnmount(() => {
+  document.removeEventListener('pointerdown', closeFromPointer)
+  document.removeEventListener('keydown', closeFromKeyboard)
+  window.removeEventListener('resize', closeContextMenu)
+  window.removeEventListener('scroll', closeContextMenu, true)
+})
+watch(() => route.fullPath, closeContextMenu)
 </script>
 
 <template>
-  <div class="shell">
+  <div class="shell" @contextmenu="openContextMenu">
     <header class="topbar">
       <AppMark />
       <div class="topbar-center"><span class="status-dot" /> PRIVATE ALPHA <b v-if="section">/ {{ section }}</b></div>
@@ -28,9 +102,35 @@ const avatarUrl = computed(() => {
       </div>
     </header>
     <main><slot /></main>
+    <Teleport to="body">
+      <nav
+        v-if="contextOpen"
+        ref="contextMenu"
+        class="context-menu"
+        :style="{ left: `${contextX}px`, top: `${contextY}px` }"
+        aria-label="Site actions"
+        role="menu"
+        @contextmenu.prevent
+      >
+        <header>
+          <small>{{ contextCampaignId ? 'UNIVERSE CONTROL' : 'D&G COMMANDS' }}</small>
+          <strong>{{ contextCampaignTitle || 'QUICK ACCESS' }}</strong>
+        </header>
+        <div v-if="contextCampaignId" class="context-group">
+          <button role="menuitem" @click="runCampaignAction('rename')"><span>✎</span> RENAME UNIVERSE</button>
+          <button class="danger" role="menuitem" @click="runCampaignAction('delete')"><span>×</span> DELETE UNIVERSE</button>
+        </div>
+        <div class="context-group">
+          <button role="menuitem" @click="openAccountSection('identity')"><span>◎</span> EDIT PROFILE</button>
+          <button role="menuitem" @click="goBack"><span>←</span> PREVIOUS PAGE</button>
+          <button role="menuitem" @click="openAccountSection('settings')"><span>⚙</span> SETTINGS</button>
+        </div>
+        <footer><i /> PRIVATE ALPHA / SECURE</footer>
+      </nav>
+    </Teleport>
   </div>
 </template>
 
 <style scoped>
-.shell{min-height:100vh}.topbar{position:sticky;top:0;z-index:20;height:76px;padding:0 clamp(18px,4vw,64px);display:grid;grid-template-columns:1fr auto 1fr;align-items:center;border-bottom:1px solid var(--line);background:rgba(10,10,10,.9);backdrop-filter:blur(18px)}.topbar-center{font:500 10px/1 var(--mono);color:var(--muted);letter-spacing:.18em}.topbar-center b{color:var(--ink);font-weight:500}.status-dot{display:inline-block;width:6px;height:6px;margin-right:8px;border-radius:50%;background:var(--acid);box-shadow:0 0 12px var(--acid)}.topbar-actions{justify-self:end;display:flex;align-items:center;gap:14px}.icon-link{display:grid;place-items:center;width:36px;height:36px;border:1px solid var(--line);color:var(--muted);text-decoration:none}.avatar{position:relative;overflow:hidden;display:grid;place-items:center;width:36px;height:36px;padding:0;border:0;border-radius:50%;background:var(--acid);color:#0a0a0a;text-decoration:none;font:700 10px var(--mono)}.avatar img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover}.avatar span{position:relative}@media(max-width:700px){.topbar{grid-template-columns:1fr auto}.topbar-center{display:none}}
+.shell{min-height:100vh}.topbar{position:sticky;top:0;z-index:20;height:76px;padding:0 clamp(18px,4vw,64px);display:grid;grid-template-columns:1fr auto 1fr;align-items:center;border-bottom:1px solid var(--line);background:rgba(10,10,10,.9);backdrop-filter:blur(18px)}.topbar-center{font:500 10px/1 var(--mono);color:var(--muted);letter-spacing:.18em}.topbar-center b{color:var(--ink);font-weight:500}.status-dot{display:inline-block;width:6px;height:6px;margin-right:8px;border-radius:50%;background:var(--acid);box-shadow:0 0 12px var(--acid)}.topbar-actions{justify-self:end;display:flex;align-items:center;gap:14px}.icon-link{display:grid;place-items:center;width:36px;height:36px;border:1px solid var(--line);color:var(--muted);text-decoration:none}.avatar{position:relative;overflow:hidden;display:grid;place-items:center;width:36px;height:36px;padding:0;border:0;border-radius:50%;background:var(--acid);color:#0a0a0a;text-decoration:none;font:700 10px var(--mono)}.avatar img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover}.avatar span{position:relative}.context-menu{position:fixed;z-index:2000;width:min(286px,calc(100vw - 24px));border:1px solid #3c3c37;background:rgba(10,10,9,.98);color:var(--ink);box-shadow:0 24px 70px rgba(0,0,0,.68);backdrop-filter:blur(18px)}.context-menu header{display:grid;gap:7px;padding:17px 18px 15px;border-bottom:1px solid var(--line);background:linear-gradient(120deg,rgba(217,247,95,.08),transparent 70%)}.context-menu header small{color:var(--acid);font:600 7px var(--mono);letter-spacing:.17em}.context-menu header strong{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font:600 12px var(--display);letter-spacing:-.02em}.context-group{padding:6px;border-bottom:1px solid var(--line)}.context-group button{width:100%;min-height:40px;display:grid;grid-template-columns:28px 1fr;align-items:center;padding:0 10px;border:0;background:transparent;color:#c4c4bd;text-align:left;font:600 8px var(--mono);letter-spacing:.11em}.context-group button span{color:var(--acid);font:500 15px var(--mono)}.context-group button:hover,.context-group button:focus-visible{background:#171715;color:var(--ink);filter:none}.context-group button.danger{color:#e5aaa0}.context-group button.danger span{color:#ff8875}.context-menu footer{padding:11px 15px;color:#6e6e68;font:500 6px var(--mono);letter-spacing:.14em}.context-menu footer i{display:inline-block;width:5px;height:5px;margin-right:7px;border-radius:50%;background:var(--acid);box-shadow:0 0 8px var(--acid)}@media(max-width:700px){.topbar{grid-template-columns:1fr auto}.topbar-center{display:none}}
 </style>

apps/web/components/CoauthorWorldPreview.vue

@@ -29,7 +29,7 @@ function updateInventory(companion: CharacterDraft, event: Event) {
       <section class="wide private-truth"><label>PRIVATE GM TRUTH</label><textarea v-model="draft.hiddenThreat" rows="4" /><small>This hidden threat or goal is visible only to the owner and the Groundkeeper.</small></section>
       <section class="wide"><label>KEY PEOPLE</label><div class="entities"><article v-for="npc in draft.npcs" :key="npc.id"><small>NPC</small><input v-model="npc.name"><textarea v-model="npc.summary" rows="3" /></article></div></section>
       <section class="wide"><label>FACTIONS</label><div class="entities two"><article v-for="faction in draft.factions" :key="faction.id"><small>FACTION</small><input v-model="faction.name"><textarea v-model="faction.summary" rows="3" /></article></div></section>
-      <section class="wide"><label>AI COMPANIONS</label><p class="section-note">These universe-specific heroes join the campaign automatically.</p><div class="entities companion-grid"><article v-for="(companion, index) in draft.companions" :key="index" class="companion-card"><small>AI HERO</small><input v-model="companion.name" maxlength="80" aria-label="Companion name"><textarea v-model="companion.concept" maxlength="600" rows="4" aria-label="Companion concept" /><div class="companion-stats"><label>HP<input v-model.number="companion.hp" type="number" min="1" :max="companion.maxHp"></label><label>MAX<input v-model.number="companion.maxHp" type="number" min="1" max="100"></label><label>DEF<input v-model.number="companion.defense" type="number" min="1" max="40"></label><label>PROF<input v-model.number="companion.proficiency" type="number" min="1" max="10"></label><label v-for="ability in (['str','dex','con','int','wis','cha'] as const)" :key="ability">{{ ability }}<input v-model.number="companion.abilities[ability]" type="number" min="1" max="30"></label></div><label class="inventory-label">INVENTORY<input :value="companion.inventory.join(', ')" maxlength="800" @input="updateInventory(companion, $event)"></label><details><summary>VOICE & PERSONALITY</summary><input v-model="companion.persona.voice" maxlength="240" placeholder="Voice"><input v-model="companion.persona.motivation" maxlength="300" placeholder="Motivation"><input v-model="companion.persona.flaw" maxlength="300" placeholder="Flaw"><input v-model="companion.persona.bond" maxlength="300" placeholder="Bond"></details></article></div></section>
+      <section class="wide"><label>AI COMPANIONS</label><p class="section-note">These universe-specific heroes join the campaign automatically.</p><div class="entities companion-grid"><article v-for="(companion, index) in draft.companions" :key="index" class="companion-card"><small>AI HERO</small><input v-model="companion.name" maxlength="80" aria-label="Companion name"><textarea v-model="companion.concept" maxlength="600" rows="4" aria-label="Companion concept" /><div class="companion-stats"><label>HP<input v-model.number="companion.hp" type="number" min="1" :max="companion.maxHp"></label><label>MAX<input v-model.number="companion.maxHp" type="number" min="1" max="100"></label><label>AC<input v-model.number="companion.defense" type="number" min="1" max="40"></label><label>PROF<input v-model.number="companion.proficiency" type="number" min="1" max="10"></label><label v-for="ability in (['str','dex','con','int','wis','cha'] as const)" :key="ability">{{ ability }}<input v-model.number="companion.abilities[ability]" type="number" min="1" max="30"></label></div><label class="inventory-label">INVENTORY<input :value="companion.inventory.join(', ')" maxlength="800" @input="updateInventory(companion, $event)"></label><details><summary>VOICE & PERSONALITY</summary><input v-model="companion.persona.voice" maxlength="240" placeholder="Voice"><input v-model="companion.persona.motivation" maxlength="300" placeholder="Motivation"><input v-model="companion.persona.flaw" maxlength="300" placeholder="Flaw"><input v-model="companion.persona.bond" maxlength="300" placeholder="Bond"></details></article></div></section>
       <section><label>OPENING SCENE</label><textarea v-model="draft.openingScene" rows="6" /></section>
       <section><label>CONTENT BOUNDARIES</label><div v-for="(_, index) in draft.contentBoundaries" :key="index" class="boundary"><input v-model="draft.contentBoundaries[index]"><button type="button" aria-label="Remove boundary" @click="draft.contentBoundaries.splice(index, 1)">×</button></div><button class="add" type="button" @click="draft.contentBoundaries.push('')">＋ ADD BOUNDARY</button></section>
     </div>

apps/web/composables/useDemo.ts

@@ -17,9 +17,9 @@ const defaultWorld: WorldStarter = {
     { id: 'fac_quiet', kind: 'faction', name: 'The Quiet Choir', summary: 'Pilgrims who believe signals can remember the dead.', tags: ['mystic'], secrets: [] },
   ],
   companions: [
-    { name: 'Rook-7', concept: 'A security intelligence in a weathered rescue frame.', abilities: { str: 16, dex: 11, con: 15, int: 10, wis: 12, cha: 8 }, hp: 15, maxHp: 15, defense: 15, proficiency: 2, inventory: ['Arc baton', 'Emergency beacon'], persona: { voice: 'Direct and protective.', motivation: 'Keep the crew alive long enough to learn the truth.', flaw: 'Treats uncertainty as a threat.', bond: 'The Orison crew gave Rook a second purpose.' } },
+    { name: 'Rook-7', concept: 'A security intelligence in a weathered rescue frame.', abilities: { str: 16, dex: 11, con: 15, int: 10, wis: 12, cha: 8 }, hp: 15, maxHp: 15, defense: 15, proficiency: 2, inventory: ['Arc baton', 'Emergency beacon'], skillProficiencies: ['athletics', 'intimidation', 'perception', 'survival'], skillExpertise: [], savingThrowProficiencies: ['str', 'con'], persona: { voice: 'Direct and protective.', motivation: 'Keep the crew alive long enough to learn the truth.', flaw: 'Treats uncertainty as a threat.', bond: 'The Orison crew gave Rook a second purpose.' } },
-    { name: 'Sable Thread', concept: 'A probabilistic navigator who reads possible futures as tangled routes.', abilities: { str: 8, dex: 14, con: 10, int: 16, wis: 13, cha: 11 }, hp: 10, maxHp: 10, defense: 13, proficiency: 2, inventory: ['Route prism', 'Vacuum line'], persona: { voice: 'Careful, elliptical, and precise.', motivation: 'Find the future in which everyone returns.', flaw: 'Can hesitate when too many paths look viable.', bond: 'Trusts the party to choose what prediction cannot.' } },
+    { name: 'Sable Thread', concept: 'A probabilistic navigator who reads possible futures as tangled routes.', abilities: { str: 8, dex: 14, con: 10, int: 16, wis: 13, cha: 11 }, hp: 10, maxHp: 10, defense: 13, proficiency: 2, inventory: ['Route prism', 'Vacuum line'], skillProficiencies: ['arcana', 'investigation', 'perception', 'stealth'], skillExpertise: ['investigation'], savingThrowProficiencies: ['dex', 'int'], persona: { voice: 'Careful, elliptical, and precise.', motivation: 'Find the future in which everyone returns.', flaw: 'Can hesitate when too many paths look viable.', bond: 'Trusts the party to choose what prediction cannot.' } },
-    { name: 'Morrow Coil', concept: 'A former relay technician rebuilt around experimental signal hardware.', abilities: { str: 11, dex: 12, con: 13, int: 14, wis: 10, cha: 13 }, hp: 12, maxHp: 12, defense: 12, proficiency: 2, inventory: ['Signal probe', 'Insulated field coat'], persona: { voice: 'Warm humor under technical jargon.', motivation: 'Prove the relay can be understood instead of destroyed.', flaw: 'Cannot leave a broken machine alone.', bond: 'Believes this party is the last honest crew in the sector.' } },
+    { name: 'Morrow Coil', concept: 'A former relay technician rebuilt around experimental signal hardware.', abilities: { str: 11, dex: 12, con: 13, int: 14, wis: 10, cha: 13 }, hp: 12, maxHp: 12, defense: 12, proficiency: 2, inventory: ['Signal probe', 'Insulated field coat'], skillProficiencies: ['arcana', 'history', 'investigation', 'persuasion'], skillExpertise: [], savingThrowProficiencies: ['int', 'cha'], persona: { voice: 'Warm humor under technical jargon.', motivation: 'Prove the relay can be understood instead of destroyed.', flaw: 'Cannot leave a broken machine alone.', bond: 'Believes this party is the last honest crew in the sector.' } },
   ],
   hook: 'Dock with the silent relay, locate the source of the impossible distress call, and decide whether its warning should be believed.',
   hiddenThreat: 'A causality fracture is teaching the relay to choose which future becomes real.',
@@ -41,7 +41,7 @@ export function useDemo() {
   const history = useState<Array<{ type: 'narration' | 'action' | 'roll'; author: string; body: string; meta?: string }>>('history', () => [
     { type: 'narration', author: 'GROUNDKEEPER', body: defaultWorld.openingScene, meta: 'ROUND 03 · NOW' },
     { type: 'action', author: 'MARA VALE', body: 'I ask the Orison to isolate the transmission and compare the voiceprint to mine.', meta: 'READY' },
-    { type: 'roll', author: 'SYSTEM CHECK', body: 'Intelligence check · 1d20 + 3 = 17', meta: 'SUCCESS · DC 14' },
+    { type: 'roll', author: 'SYSTEM CHECK', body: 'Intelligence check · 1d20 + 1 = 15', meta: 'SUCCESS · DC 14' },
   ])
   const currentAction = useState('current-action', () => '')
   const ready = useState('ready', () => false)

apps/web/pages/campaign/[id].vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { CharacterDraft } from '@dng/shared'
+import { skillKeys, type CharacterDraft, type SkillKey } from '@dng/shared'
 
 type AbilityKey = 'str' | 'dex' | 'con' | 'int' | 'wis' | 'cha'
 type Controller = 'human' | 'ai' | 'delegated'
@@ -36,6 +36,8 @@ const createKind = ref<'human' | 'ai'>('human')
 const characterForm = reactive({
   name: '', concept: '', hp: 12, maxHp: 12, defense: 12, proficiency: 2,
   abilities: { str: 10, dex: 10, con: 10, int: 10, wis: 10, cha: 10 } as Record<AbilityKey, number>,
+  skillProficiencies: [] as SkillKey[], skillExpertise: [] as SkillKey[],
+  savingThrowProficiencies: [] as AbilityKey[],
   persona: { voice: '', motivation: '', flaw: '', bond: '' },
 })
 const inventoryText = ref('')
@@ -74,7 +76,7 @@ const timeline = computed(() => {
     })),
     ...payload.value.diceRolls.map(roll => ({
       id: `roll-${roll.id}`, type: 'roll', at: roll.created_at ?? '', label: 'SERVER ROLL',
-      meta: roll.success === null || roll.success === undefined ? roll.check_kind : roll.success ? 'SUCCESS' : 'FAILED',
+      meta: rollMeta(roll),
       body: `${roll.formula} · [${(roll.rolls ?? []).join(', ')}] ${signed(Number(roll.modifier ?? 0))} = ${roll.total}`,
     })),
     ...payload.value.events.map(event => ({
@@ -89,6 +91,29 @@ function signed(value: number) {
   return value >= 0 ? `+ ${value}` : `− ${Math.abs(value)}`
 }
 
+function abilityModifier(score: number) {
+  return Math.floor((Number(score) - 10) / 2)
+}
+
+function abilityLabel(score: number) {
+  const modifier = abilityModifier(score)
+  return modifier >= 0 ? `+${modifier}` : String(modifier)
+}
+
+function rollMeta(roll: Record<string, any>) {
+  if (roll.success === null || roll.success === undefined) return String(roll.check_kind ?? 'ROLL').toUpperCase()
+  const kept = Number(roll.kept?.[0])
+  const outcome = roll.check_kind === 'attack' && kept === 20
+    ? 'CRITICAL HIT'
+    : roll.check_kind === 'attack' && kept === 1
+      ? 'CRITICAL MISS'
+      : roll.success ? 'SUCCESS' : 'FAILED'
+  const target = roll.difficulty === null || roll.difficulty === undefined
+    ? ''
+    : ` · ${roll.check_kind === 'attack' ? 'AC' : 'DC'} ${roll.difficulty}`
+  return `${outcome}${target}`
+}
+
 function initials(name: string) {
   return name.split(/\s+/).map(part => part[0]).join('').slice(0, 2).toUpperCase()
 }
@@ -210,6 +235,9 @@ async function suggestCharacter() {
     characterForm.defense = suggestion.defense
     characterForm.proficiency = suggestion.proficiency
     characterForm.abilities = { ...suggestion.abilities }
+    characterForm.skillProficiencies = [...suggestion.skillProficiencies]
+    characterForm.skillExpertise = [...suggestion.skillExpertise]
+    characterForm.savingThrowProficiencies = [...suggestion.savingThrowProficiencies]
     characterForm.persona = { ...suggestion.persona }
     inventoryText.value = suggestion.inventory.join('\n')
   } catch (error) {
@@ -228,13 +256,20 @@ async function createCharacter() {
       abilities: characterForm.abilities, hp: characterForm.hp, maxHp: characterForm.maxHp,
       defense: characterForm.defense, proficiency: characterForm.proficiency,
       inventory: inventoryText.value.split(/\n|,/).map(item => item.trim()).filter(Boolean).slice(0, 50),
-      statuses: [], persona: characterForm.persona,
+      statuses: [],
+      skillProficiencies: characterForm.skillProficiencies,
+      skillExpertise: characterForm.skillExpertise.filter(skill => characterForm.skillProficiencies.includes(skill)),
+      savingThrowProficiencies: characterForm.savingThrowProficiencies,
+      persona: characterForm.persona,
     },
   }))
   if (success) {
     showCharacterForm.value = false
     characterForm.name = ''
     characterForm.concept = ''
+    characterForm.skillProficiencies = []
+    characterForm.skillExpertise = []
+    characterForm.savingThrowProficiencies = []
     inventoryText.value = ''
     characterForm.persona = { voice: '', motivation: '', flaw: '', bond: '' }
   }
@@ -274,7 +309,8 @@ onBeforeUnmount(() => {
           <textarea v-model="characterForm.concept" required maxlength="600" placeholder="Concept, role, personality" />
           <button type="button" class="ai-draft" :disabled="suggestingCharacter || mutating" @click="suggestCharacter">{{ suggestingCharacter ? 'COAUTHOR IS DRAFTING…' : '✦ DRAFT WITH AI' }}</button>
           <div class="ability-editor"><label v-for="key in (['str','dex','con','int','wis','cha'] as AbilityKey[])" :key="key"><span>{{ key }}</span><input v-model.number="characterForm.abilities[key]" type="number" min="1" max="30"></label></div>
-          <div class="stat-editor"><label>HP <input v-model.number="characterForm.hp" type="number" min="1" :max="characterForm.maxHp"></label><label>MAX <input v-model.number="characterForm.maxHp" type="number" min="1"></label><label>DEF <input v-model.number="characterForm.defense" type="number" min="1" max="40"></label></div>
+          <div class="stat-editor"><label>HP <input v-model.number="characterForm.hp" type="number" min="1" :max="characterForm.maxHp"></label><label>MAX <input v-model.number="characterForm.maxHp" type="number" min="1"></label><label>AC <input v-model.number="characterForm.defense" type="number" min="1" max="40"></label></div>
+          <details class="proficiency-editor"><summary>SRD PROFICIENCIES</summary><small>SKILLS</small><div><label v-for="skill in skillKeys" :key="skill"><input v-model="characterForm.skillProficiencies" type="checkbox" :value="skill">{{ skill }}</label></div><small>SAVING THROWS</small><div><label v-for="ability in (['str','dex','con','int','wis','cha'] as AbilityKey[])" :key="ability"><input v-model="characterForm.savingThrowProficiencies" type="checkbox" :value="ability">{{ ability }}</label></div><small>EXPERTISE</small><div><label v-for="skill in characterForm.skillProficiencies" :key="skill"><input v-model="characterForm.skillExpertise" type="checkbox" :value="skill">{{ skill }}</label></div></details>
           <textarea v-model="inventoryText" maxlength="800" placeholder="Starting items, one per line" />
           <details class="persona-editor"><summary>VOICE & PERSONALITY</summary><input v-model="characterForm.persona.voice" maxlength="240" placeholder="Voice"><input v-model="characterForm.persona.motivation" maxlength="300" placeholder="Motivation"><input v-model="characterForm.persona.flaw" maxlength="300" placeholder="Flaw"><input v-model="characterForm.persona.bond" maxlength="300" placeholder="Bond"></details>
           <button class="acid-button" :disabled="mutating">{{ mutating ? 'CREATING…' : 'ADD TO PARTY' }}</button>
@@ -285,8 +321,8 @@ onBeforeUnmount(() => {
         </article>
         <section v-if="myCharacter" class="sheet">
           <small>YOUR CHARACTER</small><h2>{{ myCharacter.name }}</h2><p>{{ myCharacter.concept }}</p>
-          <div class="vitals"><span><b>{{ myCharacter.hp }}</b>/{{ myCharacter.max_hp }} HP</span><span><b>{{ myCharacter.defense }}</b> DEF</span></div>
+          <div class="vitals"><span><b>{{ myCharacter.hp }}</b>/{{ myCharacter.max_hp }} HP<span v-if="myCharacter.rules_state?.temporaryHp"> + {{ myCharacter.rules_state.temporaryHp }} TEMP</span></span><span><b>{{ myCharacter.defense }}</b> AC</span><span v-if="myCharacter.rules_state"><b>{{ myCharacter.rules_state.level }}</b> LEVEL</span></div>
-          <div class="abilities"><span v-for="(score,key) in myCharacter.abilities" :key="key"><small>{{ key }}</small><b>{{ score }}</b></span></div>
+          <div class="abilities"><span v-for="(score,key) in myCharacter.abilities" :key="key"><small>{{ key }} {{ abilityLabel(Number(score)) }}</small><b>{{ score }}</b></span></div>
         </section>
       </aside>
 
@@ -320,7 +356,7 @@ onBeforeUnmount(() => {
         <section class="ai-order"><small>AI TURN ORDER</small><p v-if="!payload.characters.some(character=>character.controller!=='human')">No AI heroes in this party.</p><div v-for="(character,index) in payload.characters.filter(character=>character.controller!=='human')" :key="character.id"><b>{{ String(index+1).padStart(2,'0') }}</b><span>{{ character.name }}<small>{{ character.controller === 'delegated' ? 'Temporary stand-in' : 'Acts after all humans' }}</small></span></div></section>
         <button v-if="isOwner && currentRound?.status==='open'" class="force-button" :disabled="mutating" @click="forceRound">CONTINUE WITHOUT WAITING <span>↗</span></button>
         <button v-if="isOwner && currentRound?.status==='failed'" class="force-button" :disabled="mutating" @click="retryFailedRound">RETRY FAILED ROUND <span>↗</span></button>
-        <div class="mechanics-note"><i /> Dice, HP and mechanical state are resolved by the server and recorded in the campaign log.</div>
+        <div class="mechanics-note"><i /> SRD 5.2.1 RULES V{{ campaign?.ruleset_version ?? 2 }} · D20 tests, proficiency, conditions, damage and mechanical state are resolved by the server and recorded in the campaign log.</div>
       </aside>
     </div>
   </AppShell>
@@ -338,6 +374,7 @@ onBeforeUnmount(() => {
 .takeover-toggle{margin-top:7px;padding:4px 6px;border:1px solid var(--line);background:transparent;color:var(--muted);font:500 6px var(--mono);text-align:left}
 .takeover-toggle.enabled{border-color:var(--acid-dim);color:var(--acid)}
 .ai-draft{min-height:34px;border:1px solid var(--acid-dim);background:rgba(207,255,70,.04);color:var(--acid);font:600 7px var(--mono);letter-spacing:.1em}.persona-editor{border:1px solid var(--line);padding:9px}.persona-editor summary{cursor:pointer;color:var(--muted);font:600 7px var(--mono);letter-spacing:.1em}.persona-editor input{margin-top:7px}
+.proficiency-editor{border:1px solid var(--line);padding:9px}.proficiency-editor summary,.proficiency-editor>small{color:var(--muted);font:600 7px var(--mono);letter-spacing:.1em}.proficiency-editor>small{display:block;margin:10px 0 5px;color:var(--acid)}.proficiency-editor>div{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:4px}.proficiency-editor label{display:flex;gap:5px;align-items:center;overflow-wrap:anywhere;color:var(--muted);font:500 6px var(--mono);letter-spacing:0}.proficiency-editor input{width:auto;margin:0;padding:0}
 .members article{display:grid;grid-template-columns:6px minmax(0,1fr);align-items:center}
 .member-profile{display:grid;grid-template-columns:30px minmax(0,1fr);gap:9px;align-items:center;color:var(--ink);text-decoration:none}
 .member-profile>span:last-child{display:flex;min-width:0;flex-direction:column}

apps/web/pages/campaign/demo.vue

@@ -5,6 +5,11 @@ const forceOpen = ref(false)
 const errorMessage = ref('')
 const submittedActionIndex = ref<number | null>(null)
 
+function abilityLabel(score: number) {
+  const modifier = Math.floor((Number(score) - 10) / 2)
+  return modifier >= 0 ? `+${modifier}` : String(modifier)
+}
+
 async function submitAction() {
   if (!currentAction.value.trim() || submitting.value || ready.value) return
   submitting.value = true
@@ -67,8 +72,8 @@ async function continueRound() {
         </article>
         <div class="character-sheet">
           <small>ACTIVE CHARACTER</small><h2>{{ characters[0]?.name }}</h2><p>{{ characters[0]?.concept }}</p>
-          <div class="vitals"><span><b>{{ characters[0]?.hp }}</b>/{{ characters[0]?.maxHp }} HP</span><span><b>{{ characters[0]?.defense }}</b> DEF</span></div>
+          <div class="vitals"><span><b>{{ characters[0]?.hp }}</b>/{{ characters[0]?.maxHp }} HP</span><span><b>{{ characters[0]?.defense }}</b> AC</span></div>
-          <div class="abilities"><span v-for="(score,key) in characters[0]?.abilities" :key="key"><small>{{ key }}</small><b>{{ score }}</b></span></div>
+          <div class="abilities"><span v-for="(score,key) in characters[0]?.abilities" :key="key"><small>{{ key }} {{ abilityLabel(score) }}</small><b>{{ score }}</b></span></div>
           <details><summary>INVENTORY</summary><ul><li v-for="item in characters[0]?.inventory" :key="item">{{ item }}</li></ul></details>
         </div>
       </aside>

apps/web/pages/dashboard.vue

@@ -21,6 +21,8 @@ const campaigns = ref<CampaignRow[]>([])
 const drafts = ref<DraftSession[]>([])
 const loading = ref(true)
 const error = ref('')
+const renamingCampaignId = ref<string | null>(null)
+const newName = ref('')
 
 const visibleCampaigns = computed(() => filter.value === 'active'
   ? campaigns.value.filter(campaign => campaign.status === 'active')
@@ -41,6 +43,34 @@ function draftSummary(draft: DraftSession) {
     || 'Continue your conversation with the coauthor.'
 }
 
+function openRename(campaign: CampaignRow) {
+  renamingCampaignId.value = campaign.id
+  newName.value = campaign.title
+}
+
+function handleCampaignAction(payload: { action: 'rename' | 'delete'; campaignId: string }) {
+  const campaign = campaigns.value.find(item => item.id === payload.campaignId)
+  if (!campaign) return
+  if (payload.action === 'rename') openRename(campaign)
+  else void requestDelete(campaign)
+}
+
+async function confirmRename() {
+  if (!renamingCampaignId.value || !newName.value.trim()) return
+  try {
+    await api(`/api/v1/campaigns/${renamingCampaignId.value}`, { method: 'PATCH', body: { title: newName.value } })
+    campaigns.value = campaigns.value.map(c => c.id === renamingCampaignId.value ? { ...c, title: newName.value.trim(), updated_at: new Date().toISOString() } : c)
+  } catch { /* handled silently */ } finally { renamingCampaignId.value = null; newName.value = '' }
+}
+
+async function requestDelete(campaign: CampaignRow) {
+  if (!confirm(`Delete "${campaign.title}"? This cannot be undone.`)) return
+  try {
+    await api(`/api/v1/campaigns/${campaign.id}`, { method: 'DELETE' })
+    campaigns.value = campaigns.value.filter(c => c.id !== campaign.id)
+  } catch { /* handled silently — refresh on next mount */ }
+}
+
 onMounted(async () => {
   try {
     await auth.restore()
@@ -60,7 +90,7 @@ onMounted(async () => {
 </script>
 
 <template>
-  <AppShell section="COMMAND DECK">
+  <AppShell section="COMMAND DECK" @campaign-action="handleCampaignAction">
     <div class="dash-wrap noise">
       <section class="dash-head">
         <div><p class="kicker">WELCOME BACK, {{ displayName.toUpperCase() }}</p><h1>YOUR UNIVERSES<span>.</span></h1><p>Every world remembers where you left it.</p></div>
@@ -75,7 +105,14 @@ onMounted(async () => {
       <section class="world-grid">
         <p v-if="loading" class="load-state">RECEIVING PRIVATE CAMPAIGNS…</p>
         <p v-else-if="error" class="load-state error">{{ error }} <NuxtLink to="/auth/sign-in">SIGN IN AGAIN</NuxtLink></p>
-        <NuxtLink v-for="campaign in visibleCampaigns" :key="campaign.id" :to="`/campaign/${campaign.id}`" class="world-card active-world">
+        <NuxtLink
+          v-for="campaign in visibleCampaigns"
+          :key="campaign.id"
+          :to="`/campaign/${campaign.id}`"
+          class="world-card active-world"
+          :data-context-campaign="campaign.id"
+          :data-context-label="campaign.title"
+        >
           <div class="world-art"><div class="eclipse" /><span>{{ campaign.status.toUpperCase() }} CAMPAIGN</span></div>
           <div class="world-info"><small>PRIVATE MULTIPLAYER</small><h2>{{ campaign.title }}</h2><p>{{ campaign.current_scene }}</p><div><b>CONTINUE STORY</b><span>{{ new Date(campaign.updated_at).toLocaleDateString() }}</span></div></div>
         </NuxtLink>
@@ -90,6 +127,19 @@ onMounted(async () => {
 
       <section class="system-strip"><span><i /> AI COAUTHOR READY</span><span>SERVER DICE <b>ONLINE</b></span><span>PRIVATE BY DEFAULT</span></section>
     </div>
+
+    <Teleport to="body">
+      <dialog v-if="renamingCampaignId" class="rename-dialog" open @close.stop="">
+        <form @submit.prevent="confirmRename" class="rename-panel">
+          <small>RENAME UNIVERSE</small>
+          <input v-model="newName" required maxlength="200" autofocus placeholder="Universe name" aria-label="New universe name" />
+          <div class="rename-actions">
+            <button type="button" class="ghost-button" @click="renamingCampaignId = null; newName = ''">CANCEL</button>
+            <button class="acid-button" type="submit">SAVE</button>
+          </div>
+        </form>
+      </dialog>
+    </Teleport>
   </AppShell>
 </template>
 
@@ -130,6 +180,13 @@ onMounted(async () => {
 .system-strip{margin-top:32px;padding:18px 0;border-top:1px solid var(--line);display:flex;justify-content:space-between;font:500 8px var(--mono);letter-spacing:.12em;color:var(--muted)}
 .system-strip i{display:inline-block;width:6px;height:6px;background:var(--acid);border-radius:50%;margin-right:8px}
 .system-strip b{color:var(--acid)}
+.rename-dialog{position:fixed;inset:0;margin:auto;z-index:1000;width:min(440px,calc(100vw - 40px));padding:0;border:1px solid var(--line);background:#0a0a0a;color:var(--ink);box-shadow:0 60px 120px rgba(0,0,0,.7);font-family:inherit;display:grid}
+.rename-dialog::backdrop{background:rgba(0,0,0,.55)}
+.rename-panel{padding:32px;display:grid;gap:18px}
+.rename-panel small{font:600 8px var(--mono);letter-spacing:.18em;color:var(--acid)}
+.rename-panel input{box-sizing:border-box;width:100%;min-height:48px;padding:0 14px;border:1px solid var(--line);background:#0e0e0d;color:var(--ink);font:12px var(--body);outline:none}
+.rename-panel input:focus{border-color:var(--acid)}
+.rename-actions{display:flex;justify-content:flex-end;gap:10px}
 @media(max-width:1050px){.world-grid{grid-template-columns:1fr}}
 @media(max-width:850px){.dash-head{align-items:start;flex-direction:column}.active-world{grid-template-columns:1fr}.world-art{min-height:280px}.system-strip{gap:16px;flex-wrap:wrap}}
 @media(max-width:520px){.dash-head h1{font-size:clamp(34px,12vw,52px)}.create-button{width:100%;justify-content:center}.filter-row>span{display:none}.world-info,.new-card{padding:28px}.active-world{min-height:580px}.world-info div{align-items:flex-start;flex-direction:column}.system-strip{flex-direction:column}}

apps/web/pages/profile/index.vue

@@ -204,14 +204,14 @@ onBeforeUnmount(clearPreview)
         </aside>
 
         <div class="profile-forms">
-          <form class="profile-panel" @submit.prevent="saveProfile">
+          <form id="identity" class="profile-panel" @submit.prevent="saveProfile">
             <header><span>01</span><div><small>PUBLIC IDENTITY</small><h2>NAME & DESCRIPTION</h2></div></header>
             <label>DISPLAY NAME<input v-model="displayName" required minlength="1" maxlength="80" autocomplete="name" placeholder="How your party knows you"></label>
             <label>PROFILE DESCRIPTION<textarea v-model="description" maxlength="500" rows="7" placeholder="Tell your party who you are, what you enjoy playing, or what kind of stories you seek." /><span>{{ description.length }} / 500</span></label>
             <button class="acid-button" :disabled="saving || !displayName.trim()">{{ saving ? 'SAVING PROFILE…' : avatarFile ? 'SAVE PROFILE & PICTURE →' : 'SAVE PROFILE →' }}</button>
           </form>
 
-          <form class="profile-panel" @submit.prevent="changePassword">
+          <form id="settings" class="profile-panel" @submit.prevent="changePassword">
             <header><span>02</span><div><small>SECURITY</small><h2>PASSWORD MANAGER</h2></div></header>
             <p class="panel-copy">Choose a new password for this account. Your current signed-in session authorizes the change.</p>
             <div class="password-grid"><label>NEW PASSWORD<input v-model="password" type="password" minlength="8" autocomplete="new-password" placeholder="At least 8 characters"></label><label>CONFIRM PASSWORD<input v-model="passwordConfirmation" type="password" minlength="8" autocomplete="new-password" placeholder="Repeat new password"></label></div>

apps/web/server/api/v1/campaigns/[id].delete.ts

@@ -0,0 +1,17 @@
+import { deleteStageTwoCampaign, requireCampaignAccess, stageTwoApiError, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+import { requireStageTwoUser } from '~/server/utils/stage-two-supabase'
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(event.context.params?.id ?? '')
+    const { campaign, owner } = await requireCampaignAccess(campaignId, user.id, true)
+    if (!owner) throw createError({ statusCode: 403, statusMessage: 'Only the campaign owner can delete it.' })
+
+    const worldId = stageTwoUuid(campaign.world_id, 'world id')
+    await deleteStageTwoCampaign(campaignId, worldId)
+    return { success: true }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id].get.ts

@@ -16,7 +16,7 @@ export default defineEventHandler(async (event) => {
         `campaign_members?select=id,user_id,role,active,ai_takeover_allowed,joined_at&campaign_id=eq.${campaignId}&order=joined_at.asc`,
       ),
       stageTwoDatabase<Array<Record<string, unknown>>>(
-        `characters?select=id,campaign_id,user_id,name,concept,controller,abilities,hp,max_hp,defense,proficiency,inventory,statuses,persona,created_at&campaign_id=eq.${campaignId}&order=created_at.asc`,
+        `characters?select=id,campaign_id,user_id,name,concept,controller,abilities,hp,max_hp,defense,proficiency,inventory,statuses,persona,rules_state,created_at&campaign_id=eq.${campaignId}&order=created_at.asc`,
       ),
       stageTwoDatabase<Array<Record<string, unknown>>>(
         `rounds?select=id,campaign_id,number,status,forced_by,narration,next_prompt,queued_at,resolved_at,error,created_at&campaign_id=eq.${campaignId}&status=eq.open&order=number.desc&limit=1`,

apps/web/server/api/v1/campaigns/[id].patch.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoSafeText, stageTwoApiError, stageTwoDatabase, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+import { requireStageTwoUser } from '~/server/utils/stage-two-supabase'
+
+const PatchBodySchema = z.object({
+  title: z.string().trim().min(1).max(200),
+}).strict()
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(event.context.params?.id ?? '')
+    await requireCampaignAccess(campaignId, user.id, true)
+    const body = PatchBodySchema.parse(await readBody(event))
+    requireStageTwoSafeText(body.title)
+
+    const campaigns = await stageTwoDatabase<Array<Record<string, unknown>>>(`campaigns?id=eq.${campaignId}&limit=1`, {
+      method: 'PATCH',
+      body: JSON.stringify({ title: body.title, updated_at: new Date().toISOString() }),
+      prefer: 'return=representation',
+    })
+    if (!campaigns[0]) throw createError({ statusCode: 404, statusMessage: 'Campaign not found.' })
+    return { campaign: campaigns[0] }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/characters.post.ts

@@ -1,4 +1,4 @@
-import { AbilityScoresSchema } from '@dng/shared'
+import { AbilityKeySchema, AbilityScoresSchema, SkillKeySchema } from '@dng/shared'
 import { z } from 'zod'
 import { requireCampaignAccess, requireStageTwoSafeText, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
 
@@ -13,8 +13,15 @@ const BodySchema = z.object({
   proficiency: z.number().int().min(1).max(10).default(2),
   inventory: z.array(z.string().trim().min(1).max(120)).max(50).default([]),
   statuses: z.array(z.string().trim().min(1).max(80)).max(12).default([]),
+  skillProficiencies: z.array(SkillKeySchema).max(8).default([]),
+  skillExpertise: z.array(SkillKeySchema).max(4).default([]),
+  savingThrowProficiencies: z.array(AbilityKeySchema).max(3).default([]),
   persona: z.record(z.string(), z.unknown()).default({}),
-}).strict().refine(value => value.hp <= value.maxHp, { message: 'hp must not exceed maxHp', path: ['hp'] })
+}).strict()
+  .refine(value => value.hp <= value.maxHp, { message: 'hp must not exceed maxHp', path: ['hp'] })
+  .refine(value => value.skillExpertise.every(skill => value.skillProficiencies.includes(skill)), {
+    message: 'expertise requires skill proficiency', path: ['skillExpertise'],
+  })
 
 export default defineEventHandler(async (event) => {
   try {
@@ -26,7 +33,7 @@ export default defineEventHandler(async (event) => {
       throw createError({ statusCode: 403, statusMessage: 'Only the campaign owner can add AI heroes.' })
     }
     requireStageTwoSafeText([body.name, body.concept, ...body.inventory, ...body.statuses, JSON.stringify(body.persona)].join('\n'))
-    const characterId = await stageTwoRpc<string>('stage_four_create_character', {
+    const characterId = await stageTwoRpc<string>('stage_five_create_character', {
       p_campaign_id: campaignId,
       p_actor_id: user.id,
       p_controller: body.controller,
@@ -40,6 +47,21 @@ export default defineEventHandler(async (event) => {
       p_inventory: body.inventory,
       p_statuses: body.statuses,
       p_persona: body.persona,
+      p_rules_state: {
+        version: 2,
+        level: 1,
+        skillProficiencies: body.skillProficiencies,
+        skillExpertise: body.skillExpertise,
+        savingThrowProficiencies: body.savingThrowProficiencies,
+        temporaryHp: 0,
+        deathSaves: { successes: 0, failures: 0 },
+        exhaustion: 0,
+        damageResistances: [],
+        damageVulnerabilities: [],
+        damageImmunities: [],
+        resources: { hitDice: { current: 1, max: 1, recovery: 'longRest' } },
+        legacyProficiencyFallback: false,
+      },
     })
     const rows = await stageTwoDatabase<Array<Record<string, unknown>>>(
       `characters?select=*&id=eq.${characterId}&campaign_id=eq.${campaignId}&limit=1`,

apps/web/server/api/v1/campaigns/[id]/characters/suggest.post.ts

@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
     if (!world) throw createError({ statusCode: 404, statusMessage: 'Campaign world not found.' })
 
     const completion = buildJsonCompletion(useRuntimeConfig(), {
-      system: `You create an original, editable Dungeons & Ground character draft for a private 13+ TTRPG campaign. Adapt archetype, equipment and voice to the supplied genre, but always use STR, DEX, CON, INT, WIS and CHA. Keep an alpha hero grounded: ability scores 7–16, max HP 8–20, Defense 10–16, proficiency 2. Give 2–5 useful starting items and a distinctive persona. Never use protected franchise characters. Return only the requested JSON.`,
+      system: `You create an original, editable Dungeons & Ground character draft for a private 13+ SRD 5.2.1 TTRPG campaign. Adapt archetype, equipment and voice to the supplied genre, but always use STR, DEX, CON, INT, WIS and CHA. Keep an alpha hero grounded: ability scores 7–16, max HP 8–20, Armor Class (AC) 10–16, proficiency 2. Choose exactly four fitting skill proficiencies and two saving throw proficiencies; expertise may contain at most one of the chosen skills. Give 2–5 useful starting items and a distinctive persona. Never use protected franchise characters. Return only the requested JSON.`,
       messages: [{
         role: 'user',
         content: JSON.stringify({

apps/web/server/api/v1/campaigns/index.get.ts

@@ -8,7 +8,7 @@ export default defineEventHandler(async (event) => {
     )
     const filters = [`owner_id.eq.${user.id}`, ...memberships.map(item => `id.eq.${item.campaign_id}`)]
     const campaigns = await stageTwoDatabase<Array<Record<string, unknown>>>(
-      `campaigns?select=id,world_id,owner_id,title,current_scene,next_prompt,status,created_at,updated_at&or=(${filters.join(',')})&order=updated_at.desc`,
+      `campaigns?select=id,world_id,owner_id,title,current_scene,next_prompt,status,ruleset_version,created_at,updated_at&or=(${filters.join(',')})&order=updated_at.desc`,
     )
     return { campaigns }
   } catch (error) {

apps/web/server/utils/stage-two-supabase.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { stageTwoDatabase } from './stage-two-supabase'
+import { deleteStageTwoCampaign, stageTwoDatabase } from './stage-two-supabase'
 
 describe('stage-two Supabase client', () => {
   afterEach(() => vi.unstubAllGlobals())
@@ -48,4 +48,64 @@ describe('stage-two Supabase client', () => {
       Authorization: 'Bearer header.payload.signature',
     })
   })
+
+  it('deletes a campaign before deleting its orphaned world', async () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({
+      supabaseUrl: 'https://example.supabase.co',
+      supabaseServiceRoleKey: 'service-role-key',
+      public: { supabaseAnonKey: 'anon-key' },
+    }))
+    const fetchMock = vi.fn(async (url: URL, init?: RequestInit) => {
+      if (url.pathname === '/rest/v1/ai_usage') return new Response(null, { status: 204 })
+      if (url.pathname === '/rest/v1/campaigns' && init?.method === 'DELETE') {
+        return Response.json([{ id: '11111111-1111-4111-8111-111111111111' }])
+      }
+      if (url.pathname === '/rest/v1/campaigns') return Response.json([])
+      if (url.pathname === '/rest/v1/worlds') return new Response(null, { status: 204 })
+      return new Response(null, { status: 404 })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await deleteStageTwoCampaign(
+      '11111111-1111-4111-8111-111111111111',
+      '22222222-2222-4222-8222-222222222222',
+    )
+
+    expect(fetchMock.mock.calls.map(([url, init]) => [
+      (url as URL).pathname,
+      (url as URL).search,
+      init?.method ?? 'GET',
+    ])).toEqual([
+      ['/rest/v1/ai_usage', '?campaign_id=eq.11111111-1111-4111-8111-111111111111', 'PATCH'],
+      ['/rest/v1/campaigns', '?select=id&id=eq.11111111-1111-4111-8111-111111111111', 'DELETE'],
+      ['/rest/v1/campaigns', '?select=id&world_id=eq.22222222-2222-4222-8222-222222222222&limit=1', 'GET'],
+      ['/rest/v1/worlds', '?id=eq.22222222-2222-4222-8222-222222222222', 'DELETE'],
+    ])
+  })
+
+  it('keeps a world that is still used by another campaign', async () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({
+      supabaseUrl: 'https://example.supabase.co',
+      supabaseServiceRoleKey: 'service-role-key',
+      public: { supabaseAnonKey: 'anon-key' },
+    }))
+    const fetchMock = vi.fn(async (url: URL, init?: RequestInit) => {
+      if (url.pathname === '/rest/v1/ai_usage') return new Response(null, { status: 204 })
+      if (url.pathname === '/rest/v1/campaigns' && init?.method === 'DELETE') {
+        return Response.json([{ id: '11111111-1111-4111-8111-111111111111' }])
+      }
+      if (url.pathname === '/rest/v1/campaigns') {
+        return Response.json([{ id: '33333333-3333-4333-8333-333333333333' }])
+      }
+      return new Response(null, { status: 404 })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await deleteStageTwoCampaign(
+      '11111111-1111-4111-8111-111111111111',
+      '22222222-2222-4222-8222-222222222222',
+    )
+
+    expect(fetchMock).toHaveBeenCalledTimes(3)
+  })
 })

apps/web/server/utils/stage-two-supabase.ts

@@ -123,6 +123,32 @@ export async function requireCampaignAccess(campaignId: string, userId: string,
   return { campaign, owner: false, memberId: members[0].id }
 }
 
+export async function deleteStageTwoCampaign(campaignId: string, worldId: string): Promise<void> {
+  // Usage is retained for account history, but its restrictive foreign key
+  // must no longer point at the campaign being removed.
+  await stageTwoDatabase(`ai_usage?campaign_id=eq.${campaignId}`, {
+    method: 'PATCH',
+    body: JSON.stringify({ campaign_id: null }),
+  })
+
+  // Campaign-owned rows use ON DELETE CASCADE. Deleting the parent lets
+  // Postgres remove them in dependency-safe order in a single statement.
+  const deleted = await stageTwoDatabase<Array<{ id: string }>>(
+    `campaigns?select=id&id=eq.${campaignId}`,
+    { method: 'DELETE', prefer: 'return=representation' },
+  )
+  if (!deleted[0]) throw createError({ statusCode: 404, statusMessage: 'Campaign not found.' })
+
+  const otherCampaigns = await stageTwoDatabase<Array<{ id: string }>>(
+    `campaigns?select=id&world_id=eq.${worldId}&limit=1`,
+  )
+  if (!otherCampaigns[0]) {
+    // World entities cascade from the world; confirmed coauthor sessions are
+    // retained and automatically clear their world reference.
+    await stageTwoDatabase(`worlds?id=eq.${worldId}`, { method: 'DELETE' })
+  }
+}
+
 export function stageTwoApiError(error: unknown): never {
   if (error && typeof error === 'object' && 'statusCode' in error) throw error
   if (error instanceof StageTwoDatabaseError) {

apps/worker/src/ai.test.ts

@@ -17,6 +17,9 @@ const worldFixture = () => ({
     defense: 12,
     proficiency: 2,
     inventory: ['Field kit'],
+    skillProficiencies: ['arcana', 'investigation', 'perception', 'survival'],
+    skillExpertise: ['investigation'],
+    savingThrowProficiencies: ['int', 'wis'],
     persona: { voice: 'Distinctive and clear.', motivation: 'Help the party.', flaw: 'Has a private agenda.', bond: 'Believes in the party.' },
   })),
   hook: 'A sufficiently long hook that immediately gives the party something to investigate.',

apps/worker/src/ai.ts

@@ -89,7 +89,7 @@ async function structuredRequest<T>(name: string, schema: JsonSchema, messages:
 export async function generateWorld(messages: Array<{ role: 'user' | 'assistant'; content: string }>): Promise<WorldStarter> {
   assert13Plus(...messages.map(message => message.content))
   const world = await structuredRequest('world_starter', WorldStarterSchema.toJSONSchema(), [
-    { role: 'system', content: 'You are the Dungeons & Ground world coauthor. Create an original 13+ private TTRPG setting in any requested genre. Never use protected settings or characters. Return exactly three NPCs, two factions, and three distinct persistent AI companion heroes created specifically for this universe. Give each companion complete playable mechanics, useful genre-appropriate equipment, and a persona that produces interesting party choices without overriding the human player. Make the opening immediately playable.' },
+    { role: 'system', content: 'You are the Dungeons & Ground world coauthor. Create an original 13+ private SRD 5.2.1 TTRPG setting in any requested genre. Never use protected settings or characters. Return exactly three NPCs, two factions, and three distinct persistent AI companion heroes created specifically for this universe. Give each companion complete playable mechanics, exactly four fitting skill proficiencies, exactly two saving throw proficiencies, no more than one expertise chosen from their proficient skills, useful genre-appropriate equipment, and a persona that produces interesting party choices without overriding the human player. Make the opening immediately playable.' },
     ...messages,
   ], value => WorldStarterSchema.parse(value))
   // Moderate the entire typed object, including entity summaries, secrets and
@@ -100,7 +100,7 @@ export async function generateWorld(messages: Array<{ role: 'user' | 'assistant'
 
 export async function planRound(input: RoundContext): Promise<RoundPlan> {
   const plan = await structuredRequest('round_plan', RoundPlanSchema.toJSONSchema(), [
-    { role: 'system', content: 'You plan one asynchronous TTRPG round. Human intents are authoritative and happen first. Then provide at most one action for each supplied aiCharacter, in the supplied order; never create AI actions for human-controlled characters. You may request checks and propose story events. Never invent dice results and never directly mutate mechanical state. The server owns rules, HP, inventory, statuses and randomness.' },
+    { role: 'system', content: 'You plan one asynchronous SRD 5.2.1 TTRPG round. Human intents are authoritative and happen first. Then provide at most one action for each supplied aiCharacter, in the supplied order; never create AI actions for human-controlled characters. Request a d20 test only when the outcome is uncertain: ability, skill, savingThrow, deathSavingThrow, attack, or initiative. Skill checks require a skill and DC; saving throws require an ability and DC; attacks require an active targetId and use that target\'s server-owned Armor Class. Character rules profiles—not you—own proficiency, expertise, temporary HP, death saves, exhaustion, resistances and limited resources. Request a deathSavingThrow only for an unstable actor at 0 HP. Request separate damage or healing dice only after an applicable action; every damage event needs its SRD damageType. A resource event may consume only a named resource present on the character. A rest event uses item short or long. Never invent dice results and never directly mutate mechanical state. The server applies conditions, resistance, vulnerability, immunity, critical damage, HP and randomness.' },
     { role: 'user', content: JSON.stringify(input) },
   ], value => RoundPlanSchema.parse(value))
   assert13Plus(JSON.stringify(plan.aiActions), JSON.stringify(plan.proposedEvents))

apps/worker/src/index.ts

@@ -1,7 +1,7 @@
 import './env'
 import { Worker } from 'bullmq'
 import IORedis from 'ioredis'
-import { applyMechanicalEvents, bindMechanicalEventsToRolls, resolveCheck } from '@dng/game-engine'
+import { applyMechanicalEvents, bindMechanicalEventsToRolls, resolveChecks } from '@dng/game-engine'
 import { CharacterSchema, PlayerIntentSchema, makeId } from '@dng/shared'
 import { generateWorld, narrateRound, planRound, summarizeStory } from './ai'
 import { buildActionSequence, buildRoundContext, sanitizeRoundMemory, shouldUpdateStorySummary, validateAndOrderRoundPlan } from './orchestration'
@@ -135,7 +135,8 @@ if (!supabaseUrl || !serviceKey) {
     const characters = rawCharacters.map(row => CharacterSchema.parse({
       id: row.id, name: row.name, concept: row.concept, controller: row.controller,
       userId: row.user_id, abilities: row.abilities, hp: row.hp, maxHp: row.max_hp,
-      defense: row.defense, proficiency: row.proficiency, inventory: row.inventory, statuses: row.statuses, persona: row.persona,
+      defense: row.defense, proficiency: row.proficiency, inventory: row.inventory, statuses: row.statuses,
+      persona: row.persona, rules: row.rules_state,
     }))
     const intents = rawIntents.map(row => PlayerIntentSchema.parse({
       id: row.id, roundId: row.round_id, memberId: row.member_id, characterId: row.character_id,
@@ -153,15 +154,11 @@ if (!supabaseUrl || !serviceKey) {
       })),
     })
     const plan = validateAndOrderRoundPlan(await planRound(context), context)
-    const rolls = plan.checks.map(check => {
+    const rolls = resolveChecks(plan.checks, characters)
-      const actor = characters.find(character => character.id === check.actorId)
-      if (!actor) throw new Error(`Unknown check actor ${check.actorId}`)
-      return resolveCheck(check, actor)
-    })
     const permittedEvents = bindMechanicalEventsToRolls(plan.proposedEvents, rolls)
     const resolution = await narrateRound({ context, actionSequence: buildActionSequence(context, plan), rolls, permittedEvents })
     const safeEvents = resolution.events.filter(event => permittedEvents.some(permitted => JSON.stringify(permitted) === JSON.stringify(event)))
-    const applied = applyMechanicalEvents(characters, safeEvents)
+    const applied = applyMechanicalEvents(characters, safeEvents, rolls)
     const shouldSummarize = shouldUpdateStorySummary(Number(round.number))
     const summary = shouldSummarize
       ? await summarizeStory({
@@ -170,7 +167,7 @@ if (!supabaseUrl || !serviceKey) {
         })
       : null
 
-    await databaseRequest(job.claimToken ? 'rpc/commit_claimed_round_resolution' : 'rpc/commit_round_resolution', {
+    await databaseRequest(job.claimToken ? 'rpc/commit_claimed_srd_round_resolution' : 'rpc/commit_srd_round_resolution', {
       method: 'POST',
       body: JSON.stringify({
         p_round_id: round.id,
@@ -178,7 +175,13 @@ if (!supabaseUrl || !serviceKey) {
         p_next_prompt: resolution.nextPrompt,
         p_rolls: rolls,
         p_events: safeEvents,
-        p_character_states: applied.characters.map(character => ({ id: character.id, hp: character.hp, inventory: character.inventory, statuses: character.statuses })),
+        p_character_states: applied.characters.map(character => ({
+          id: character.id,
+          hp: character.hp,
+          inventory: character.inventory,
+          statuses: character.statuses,
+          rulesState: character.rules,
+        })),
         p_memory: sanitizeRoundMemory(resolution.memory),
         p_idempotency_key: job.id,
         ...(job.claimToken ? { p_worker_id: job.claimToken } : {}),

apps/worker/src/orchestration.test.ts

@@ -41,6 +41,21 @@ describe('round orchestration', () => {
     }, context)).toThrow('Unknown check actor outsider')
   })
 
+  it('requires complete SRD check inputs before rolling', () => {
+    const context = buildRoundContext({
+      scene: 'Scene', recentRounds: [], intents: [],
+      characters: [character('hero', 'human'), character('foe', 'ai')], memories: [],
+    })
+    const basePlan = { aiActions: [], proposedEvents: [], relevantMemoryQueries: [] }
+
+    expect(() => validateAndOrderRoundPlan({
+      ...basePlan, checks: [{ actorId: 'hero', kind: 'skill', mode: 'normal', reason: 'Search' }],
+    }, context)).toThrow('Skill checks require a skill')
+    expect(() => validateAndOrderRoundPlan({
+      ...basePlan, checks: [{ actorId: 'hero', kind: 'attack', mode: 'normal', reason: 'Strike' }],
+    }, context)).toThrow('Attack rolls require a target')
+  })
+
   it('schedules durable story summaries every third completed round', () => {
     expect([1, 2, 3, 4, 5, 6].filter(shouldUpdateStorySummary)).toEqual([3, 6])
   })

apps/worker/src/orchestration.ts

@@ -64,13 +64,24 @@ export function validateAndOrderRoundPlan(planInput: unknown, context: RoundCont
   for (const check of plan.checks) {
     if (!characterIds.has(check.actorId)) throw new Error(`Unknown check actor ${check.actorId}`)
     if (check.targetId && !characterIds.has(check.targetId)) throw new Error(`Unknown check target ${check.targetId}`)
+    if (check.kind === 'skill' && !check.skill) throw new Error('Skill checks require a skill')
+    if (['ability', 'savingThrow'].includes(check.kind) && !check.ability) throw new Error(`${check.kind} checks require an ability`)
+    if (['ability', 'skill', 'savingThrow'].includes(check.kind) && check.difficulty === undefined) {
+      throw new Error(`${check.kind} checks require a Difficulty Class`)
+    }
+    if (check.kind === 'deathSavingThrow' && check.targetId) throw new Error('Death saving throws cannot target another character')
+    if (check.kind === 'attack' && !check.targetId) throw new Error('Attack rolls require a target')
+    if (['damage', 'healing'].includes(check.kind) && !check.targetId) throw new Error(`${check.kind} rolls require a target`)
   }
   for (const event of plan.proposedEvents) {
     if (event.actorId && !characterIds.has(event.actorId)) throw new Error(`Unknown event actor ${event.actorId}`)
     if (event.targetId && !characterIds.has(event.targetId)) throw new Error(`Unknown event target ${event.targetId}`)
-    if (['damage', 'healing', 'inventory', 'status'].includes(event.type) && !event.targetId) {
+    if (['damage', 'healing', 'inventory', 'status', 'temporaryHp', 'resource', 'rest'].includes(event.type) && !event.targetId) {
       throw new Error(`${event.type} event requires a target`)
     }
+    if (event.type === 'damage' && !event.damageType) throw new Error('damage events require a damage type')
+    if (event.type === 'resource' && !event.item) throw new Error('resource events require a resource name')
+    if (event.type === 'rest' && !['short', 'long'].includes(String(event.item))) throw new Error('rest events require short or long')
   }
 
   const aiActions = plan.aiActions

packages/game-engine/src/index.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { abilityModifier, applyMechanicalEvents, bindMechanicalEventsToRolls, resolveCheck, shouldCloseRound, type RandomSource } from './index'
+import { abilityModifier, applyMechanicalEvents, bindMechanicalEventsToRolls, proficiencyBonus, resolveCheck, resolveChecks, shouldCloseRound, type RandomSource } from './index'
 import type { Character } from '@dng/shared'
 
 const fixed: RandomSource = { integer: () => 12 }
@@ -18,7 +18,7 @@ describe('game engine', () => {
   it('keeps dice server-owned and auditable', () => {
     const roll = resolveCheck({ actorId: 'hero', kind: 'ability', ability: 'dex', difficulty: 15, mode: 'normal', reason: 'Leap' }, hero, fixed)
     expect(roll.rolls).toEqual([12])
-    expect(roll.total).toBe(17)
+    expect(roll.total).toBe(15)
     expect(roll.success).toBe(true)
     expect(roll.id).toMatch(/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i)
   })
@@ -30,10 +30,60 @@ describe('game engine', () => {
       hero,
       { integer: () => values.shift()! },
     )
-    expect(roll.formula).toBe('2d20kl1+5')
+    expect(roll.formula).toBe('2d20kl1+3')
     expect(roll.kept).toEqual([4])
   })
 
+  it('applies proficiency only to proficient skills and saving throws', () => {
+    const perception = resolveCheck({
+      actorId: 'hero', kind: 'skill', skill: 'perception', proficient: true,
+      difficulty: 12, mode: 'normal', reason: 'Spot an ambush',
+    }, hero, fixed)
+    const constitutionSave = resolveCheck({
+      actorId: 'hero', kind: 'savingThrow', ability: 'con', proficient: false,
+      difficulty: 12, mode: 'normal', reason: 'Endure poison',
+    }, hero, fixed)
+
+    expect(perception.modifier).toBe(1)
+    expect(constitutionSave.modifier).toBe(1)
+  })
+
+  it('uses server-owned Armor Class and natural attack outcomes', () => {
+    const target: Character = { ...hero, id: 'target', defense: 30 }
+    const naturalTwenty = resolveCheck({
+      actorId: 'hero', targetId: 'target', kind: 'attack', ability: 'str',
+      difficulty: 1, mode: 'normal', reason: 'Sword strike',
+    }, hero, { integer: () => 20 }, target)
+    const naturalOne = resolveCheck({
+      actorId: 'hero', targetId: 'target', kind: 'attack', ability: 'str',
+      difficulty: 1, mode: 'normal', reason: 'Sword strike',
+    }, hero, { integer: () => 1 }, { ...target, defense: 1 })
+
+    expect(naturalTwenty.difficulty).toBe(30)
+    expect(naturalTwenty.success).toBe(true)
+    expect(naturalOne.difficulty).toBe(1)
+    expect(naturalOne.success).toBe(false)
+  })
+
+  it('skips damage on a miss and doubles only critical damage dice', () => {
+    const target: Character = { ...hero, id: 'target', defense: 14 }
+    const checks = [
+      { actorId: 'hero', targetId: 'target', kind: 'attack' as const, ability: 'str' as const, mode: 'normal' as const, reason: 'Sword strike' },
+      { actorId: 'hero', targetId: 'target', kind: 'damage' as const, dice: '1d6+2', mode: 'normal' as const, reason: 'Sword damage' },
+    ]
+
+    const missed = resolveChecks(checks, [hero, target], { integer: () => 1 })
+    expect(missed).toHaveLength(1)
+    expect(missed[0]?.checkKind).toBe('attack')
+
+    const values = [20, 4, 5]
+    const critical = resolveChecks(checks, [hero, target], { integer: () => values.shift()! })
+    expect(critical).toHaveLength(2)
+    expect(critical[1]?.formula).toBe('2d6+2')
+    expect(critical[1]?.rolls).toEqual([4, 5])
+    expect(critical[1]?.total).toBe(11)
+  })
+
   it('replaces model-proposed damage with the authoritative roll total', () => {
     const damage = resolveCheck(
       { actorId: 'hero', targetId: 'target', kind: 'damage', dice: '1d6+2', mode: 'normal', reason: 'Strike' },
@@ -41,13 +91,13 @@ describe('game engine', () => {
       { integer: () => 4 },
     )
     const events = bindMechanicalEventsToRolls([
-      { type: 'damage', actorId: 'hero', targetId: 'target', value: 999, item: null, description: 'Strike' },
+      { type: 'damage', actorId: 'hero', targetId: 'target', value: 999, item: null, damageType: 'slashing', description: 'Strike' },
     ], [damage])
     expect(events[0]?.value).toBe(6)
   })
 
   it('clamps mechanical state', () => {
-    const result = applyMechanicalEvents([hero], [{ type: 'damage', actorId: null, targetId: 'hero', value: 99, item: null, description: 'Catastrophic hit' }])
+    const result = applyMechanicalEvents([hero], [{ type: 'damage', actorId: null, targetId: 'hero', value: 99, item: null, damageType: 'force', description: 'Catastrophic hit' }])
     expect(result.characters[0]?.hp).toBe(0)
     expect(result.audit).toHaveLength(1)
   })
@@ -57,4 +107,73 @@ describe('game engine', () => {
     expect(shouldCloseRound(['a', 'b'], ['a', 'b'])).toBe(true)
     expect(shouldCloseRound(['a', 'b'], [], true)).toBe(true)
   })
+
+  it('derives proficiency and expertise from the server-owned rules profile', () => {
+    const trained: Character = {
+      ...hero,
+      rules: {
+        version: 2, level: 9, skillProficiencies: ['perception'], skillExpertise: ['perception'],
+        savingThrowProficiencies: ['con'], temporaryHp: 0, deathSaves: { successes: 0, failures: 0 },
+        exhaustion: 1, damageResistances: [], damageVulnerabilities: [], damageImmunities: [],
+        resources: {}, legacyProficiencyFallback: false,
+      },
+    }
+    const roll = resolveCheck({
+      actorId: 'hero', kind: 'skill', skill: 'perception', proficient: false,
+      difficulty: 10, mode: 'normal', reason: 'Notice the rune',
+    }, trained, fixed)
+
+    expect(proficiencyBonus(9)).toBe(4)
+    // WIS -1 + expertise 8 - exhaustion 2.
+    expect(roll.modifier).toBe(5)
+  })
+
+  it('applies resistance, temporary HP, zero-HP state and healing recovery', () => {
+    const guarded: Character = {
+      ...hero,
+      hp: 4,
+      rules: {
+        version: 2, level: 1, skillProficiencies: [], skillExpertise: [], savingThrowProficiencies: [],
+        temporaryHp: 2, deathSaves: { successes: 0, failures: 0 }, exhaustion: 0,
+        damageResistances: ['fire'], damageVulnerabilities: [], damageImmunities: [],
+        resources: {}, legacyProficiencyFallback: false,
+      },
+    }
+    const damaged = applyMechanicalEvents([guarded], [{
+      type: 'damage', actorId: null, targetId: 'hero', value: 12, item: null,
+      damageType: 'fire', description: 'Flames engulf the hero',
+    }]).characters[0]!
+    expect(damaged.rules?.temporaryHp).toBe(0)
+    expect(damaged.hp).toBe(0)
+    expect(damaged.statuses).toContain('unconscious')
+
+    const healed = applyMechanicalEvents([damaged], [{
+      type: 'healing', actorId: null, targetId: 'hero', value: 4, item: null,
+      damageType: null, description: 'An ally restores the hero',
+    }]).characters[0]!
+    expect(healed.hp).toBe(4)
+    expect(healed.statuses).not.toContain('unconscious')
+  })
+
+  it('tracks natural death-save outcomes without model-authored state changes', () => {
+    const dying: Character = {
+      ...hero,
+      hp: 0,
+      statuses: ['unconscious'],
+      rules: {
+        version: 2, level: 1, skillProficiencies: [], skillExpertise: [], savingThrowProficiencies: [],
+        temporaryHp: 0, deathSaves: { successes: 0, failures: 0 }, exhaustion: 0,
+        damageResistances: [], damageVulnerabilities: [], damageImmunities: [],
+        resources: {}, legacyProficiencyFallback: false,
+      },
+    }
+    const deathRoll = resolveCheck({
+      actorId: 'hero', kind: 'deathSavingThrow', mode: 'normal', reason: 'Cling to life',
+    }, dying, { integer: () => 20 })
+    const recovered = applyMechanicalEvents([dying], [], [deathRoll]).characters[0]!
+
+    expect(recovered.hp).toBe(1)
+    expect(recovered.statuses).not.toContain('unconscious')
+    expect(recovered.rules?.deathSaves).toEqual({ successes: 0, failures: 0 })
+  })
 })

packages/game-engine/src/index.ts

@@ -1,5 +1,5 @@
 import { randomInt, randomUUID } from 'node:crypto'
-import type { AbilityKey, Character, CheckRequest, DiceRoll, ProposedEvent } from '@dng/shared'
+import type { AbilityKey, Character, CharacterRules, CheckRequest, DamageType, DiceRoll, ProposedEvent, SkillKey } from '@dng/shared'
 
 export interface RandomSource {
   integer(min: number, max: number): number
@@ -16,6 +16,11 @@ export function abilityModifier(score: number): number {
   return Math.floor((score - 10) / 2)
 }
 
+export function proficiencyBonus(level: number): number {
+  if (!Number.isInteger(level) || level < 1 || level > 20) throw new Error('Character level must be between 1 and 20')
+  return 2 + Math.floor((level - 1) / 4)
+}
+
 export function rollDice(formula: string, random: RandomSource = secureRandom) {
   const match = /^(\d+)d(\d+)(?:([+-])(\d+))?$/.exec(formula)
   if (!match) throw new Error(`Unsupported dice formula: ${formula}`)
@@ -51,13 +56,95 @@ export function bindMechanicalEventsToRolls(events: ProposedEvent[], rolls: Dice
   })
 }
 
+const skillAbilities: Record<SkillKey, AbilityKey> = {
+  acrobatics: 'dex',
+  animalHandling: 'wis',
+  arcana: 'int',
+  athletics: 'str',
+  deception: 'cha',
+  history: 'int',
+  insight: 'wis',
+  intimidation: 'cha',
+  investigation: 'int',
+  medicine: 'wis',
+  nature: 'int',
+  perception: 'wis',
+  performance: 'cha',
+  persuasion: 'cha',
+  religion: 'int',
+  sleightOfHand: 'dex',
+  stealth: 'dex',
+  survival: 'wis',
+}
+
 function abilityForCheck(request: CheckRequest): AbilityKey {
+  if (request.kind === 'skill' && request.skill) return skillAbilities[request.skill]
   if (request.ability) return request.ability
   if (request.kind === 'initiative') return 'dex'
   return 'str'
 }
 
-export function resolveCheck(request: CheckRequest, actor: Character, random: RandomSource = secureRandom): DiceRoll {
+function usesProficiency(request: CheckRequest): boolean {
+  // The alpha treats ordinary weapon attacks as proficient unless the planner
+  // explicitly marks an improvised or unfamiliar attack otherwise.
+  if (request.kind === 'attack') return request.proficient !== false
+  return request.proficient === true
+}
+
+function proficiencyMultiplier(request: CheckRequest, actor: Character): number {
+  const rules = actor.rules
+  if (!rules) return usesProficiency(request) ? 1 : 0
+  if (request.kind === 'skill' && request.skill) {
+    if (rules.skillExpertise.includes(request.skill)) return 2
+    if (rules.skillProficiencies.includes(request.skill)) return 1
+    return rules.legacyProficiencyFallback && request.proficient === true ? 1 : 0
+  }
+  if (request.kind === 'savingThrow' && request.ability) {
+    if (rules.savingThrowProficiencies.includes(request.ability)) return 1
+    return rules.legacyProficiencyFallback && request.proficient === true ? 1 : 0
+  }
+  if (request.kind === 'attack') return request.proficient === false ? 0 : 1
+  return rules.legacyProficiencyFallback && request.proficient === true ? 1 : 0
+}
+
+function normalizedStatuses(character: Character): Set<string> {
+  return new Set(character.statuses.map(status => status.trim().toLowerCase()))
+}
+
+function effectiveRollMode(request: CheckRequest, actor: Character, target?: Character): CheckRequest['mode'] {
+  let advantage = request.mode === 'advantage' ? 1 : 0
+  let disadvantage = request.mode === 'disadvantage' ? 1 : 0
+  const actorStatuses = normalizedStatuses(actor)
+  const targetStatuses = target ? normalizedStatuses(target) : new Set<string>()
+
+  if (['ability', 'skill', 'attack'].includes(request.kind) && actorStatuses.has('poisoned')) disadvantage += 1
+  if (request.kind === 'attack') {
+    if (actorStatuses.has('blinded') || actorStatuses.has('restrained') || actorStatuses.has('prone')) disadvantage += 1
+    if (actorStatuses.has('invisible')) advantage += 1
+    if (targetStatuses.has('blinded') || targetStatuses.has('restrained') || targetStatuses.has('paralyzed')
+      || targetStatuses.has('petrified') || targetStatuses.has('stunned') || targetStatuses.has('unconscious')) advantage += 1
+    if (targetStatuses.has('invisible')) disadvantage += 1
+  }
+  if (request.kind === 'savingThrow' && request.ability === 'dex' && actorStatuses.has('restrained')) disadvantage += 1
+
+  if (advantage && disadvantage) return 'normal'
+  if (advantage) return 'advantage'
+  if (disadvantage) return 'disadvantage'
+  return 'normal'
+}
+
+function automaticallyFailedSave(request: CheckRequest, actor: Character): boolean {
+  if (request.kind !== 'savingThrow' || !request.ability || !['str', 'dex'].includes(request.ability)) return false
+  const statuses = normalizedStatuses(actor)
+  return ['paralyzed', 'petrified', 'stunned', 'unconscious'].some(status => statuses.has(status))
+}
+
+export function resolveCheck(
+  request: CheckRequest,
+  actor: Character,
+  random: RandomSource = secureRandom,
+  target?: Character,
+): DiceRoll {
   if (request.kind === 'damage' || request.kind === 'healing') {
     const rolled = rollDice(request.dice ?? '1d6', random)
     return {
@@ -78,56 +165,243 @@ export function resolveCheck(request: CheckRequest, actor: Character, random: Ra
     }
   }
 
+  if (request.kind === 'deathSavingThrow') {
+    const statuses = normalizedStatuses(actor)
+    if (actor.hp !== 0 || statuses.has('stable') || statuses.has('dead')) {
+      throw new Error('Death saving throws require an unstable character at 0 HP')
+    }
+    const result = random.integer(1, 20)
+    return {
+      id: randomUUID(), checkKind: request.kind, formula: '1d20', rolls: [result], kept: [result],
+      modifier: 0, total: result, difficulty: 10, success: result >= 10,
+      actorId: actor.id, targetId: null, createdAt: new Date().toISOString(),
+    }
+  }
+
   const ability = abilityForCheck(request)
-  const diceCount = request.mode === 'normal' ? 1 : 2
+  const mode = effectiveRollMode(request, actor, target)
+  const diceCount = mode === 'normal' ? 1 : 2
   const rolls = Array.from({ length: diceCount }, () => random.integer(1, 20))
-  const keptValue = request.mode === 'advantage' ? Math.max(...rolls) : request.mode === 'disadvantage' ? Math.min(...rolls) : rolls[0]!
+  const keptValue = mode === 'advantage' ? Math.max(...rolls) : mode === 'disadvantage' ? Math.min(...rolls) : rolls[0]!
-  const modifier = abilityModifier(actor.abilities[ability]) + actor.proficiency
+  const proficiency = actor.rules ? proficiencyBonus(actor.rules.level) : actor.proficiency
+  const exhaustionPenalty = actor.rules ? actor.rules.exhaustion * 2 : 0
+  const modifier = abilityModifier(actor.abilities[ability]) + proficiency * proficiencyMultiplier(request, actor) - exhaustionPenalty
   const total = keptValue + modifier
-  const difficulty = request.difficulty ?? null
+  if (request.kind === 'attack' && (!request.targetId || !target || target.id !== request.targetId)) {
+    throw new Error('Attack rolls require the active target character')
+  }
+  const difficulty = request.kind === 'attack' ? target!.defense : request.difficulty ?? null
+  const automaticAttackOutcome = request.kind === 'attack'
+    ? keptValue === 20 ? true : keptValue === 1 ? false : null
+    : null
+  const automaticSaveOutcome = automaticallyFailedSave(request, actor) ? false : null
   return {
     id: randomUUID(),
     checkKind: request.kind,
-    formula: request.mode === 'normal'
+    formula: mode === 'normal'
       ? `1d20${modifier >= 0 ? '+' : ''}${modifier}`
-      : `2d20${request.mode === 'advantage' ? 'kh1' : 'kl1'}${modifier >= 0 ? '+' : ''}${modifier}`,
+      : `2d20${mode === 'advantage' ? 'kh1' : 'kl1'}${modifier >= 0 ? '+' : ''}${modifier}`,
     rolls,
     kept: [keptValue],
     modifier,
     total,
     difficulty,
-    success: difficulty === null ? null : total >= difficulty,
+    success: difficulty === null ? null : automaticAttackOutcome ?? automaticSaveOutcome ?? total >= difficulty,
     actorId: actor.id,
     targetId: request.targetId ?? null,
     createdAt: new Date().toISOString(),
   }
 }
 
+function criticalDamageFormula(formula: string): string {
+  const match = /^(\d+)d(\d+)(?:([+-])(\d+))?$/.exec(formula)
+  if (!match) throw new Error(`Unsupported dice formula: ${formula}`)
+  const modifier = match[3] ? `${match[3]}${match[4]}` : ''
+  return `${Number(match[1]) * 2}d${match[2]}${modifier}`
+}
+
+/**
+ * Resolves an ordered round plan while enforcing attack-to-damage rules.
+ * A missed attack never rolls damage; a natural 20 doubles only the damage
+ * dice and not the flat modifier.
+ */
+export function resolveChecks(
+  requests: CheckRequest[],
+  characters: Character[],
+  random: RandomSource = secureRandom,
+): DiceRoll[] {
+  const rolls: DiceRoll[] = []
+
+  for (const originalRequest of requests) {
+    const actor = characters.find(character => character.id === originalRequest.actorId)
+    if (!actor) throw new Error(`Unknown check actor ${originalRequest.actorId}`)
+    const target = originalRequest.targetId
+      ? characters.find(character => character.id === originalRequest.targetId)
+      : undefined
+
+    let request = originalRequest
+    if (request.kind === 'damage') {
+      const attack = [...rolls].reverse().find(roll =>
+        roll.checkKind === 'attack'
+        && roll.actorId === request.actorId
+        && roll.targetId === request.targetId,
+      )
+      if (attack?.success === false) continue
+      if (attack?.kept[0] === 20) {
+        request = { ...request, dice: criticalDamageFormula(request.dice ?? '1d6') }
+      }
+    }
+
+    rolls.push(resolveCheck(request, actor, random, target))
+  }
+
+  return rolls
+}
+
 export interface AppliedState {
   characters: Character[]
   audit: Array<{ event: ProposedEvent; before: unknown; after: unknown }>
 }
 
-export function applyMechanicalEvents(characters: Character[], events: ProposedEvent[]): AppliedState {
+function cloneRules(rules: CharacterRules | undefined): CharacterRules | undefined {
-  const next = characters.map(character => ({ ...character, inventory: [...character.inventory], statuses: [...character.statuses] }))
+  return rules ? structuredClone(rules) : undefined
+}
+
+function addStatus(character: Character, status: string): void {
+  if (!character.statuses.some(current => current.toLowerCase() === status.toLowerCase())) character.statuses.push(status)
+}
+
+function removeStatus(character: Character, status: string): void {
+  character.statuses = character.statuses.filter(current => current.toLowerCase() !== status.toLowerCase())
+}
+
+function adjustedDamage(value: number, damageType: DamageType | null | undefined, rules: CharacterRules | undefined): number {
+  let damage = Math.max(0, value)
+  if (!damageType || !rules) return damage
+  if (rules.damageImmunities.includes(damageType)) return 0
+  if (rules.damageResistances.includes(damageType)) damage = Math.floor(damage / 2)
+  if (rules.damageVulnerabilities.includes(damageType)) damage *= 2
+  return damage
+}
+
+function applyDeathSavingThrows(characters: Character[], rolls: DiceRoll[]): void {
+  for (const roll of rolls.filter(candidate => candidate.checkKind === 'deathSavingThrow')) {
+    const character = characters.find(candidate => candidate.id === roll.actorId)
+    if (!character?.rules || character.hp !== 0 || normalizedStatuses(character).has('dead')) continue
+    const natural = roll.kept[0]
+    if (natural === 20) {
+      character.hp = 1
+      character.rules.deathSaves = { successes: 0, failures: 0 }
+      removeStatus(character, 'unconscious')
+      removeStatus(character, 'stable')
+      continue
+    }
+    if (roll.success) character.rules.deathSaves.successes = Math.min(3, character.rules.deathSaves.successes + 1)
+    else character.rules.deathSaves.failures = Math.min(3, character.rules.deathSaves.failures + (natural === 1 ? 2 : 1))
+
+    if (character.rules.deathSaves.successes >= 3) {
+      character.rules.deathSaves = { successes: 0, failures: 0 }
+      addStatus(character, 'stable')
+    }
+    if (character.rules.deathSaves.failures >= 3) {
+      removeStatus(character, 'unconscious')
+      removeStatus(character, 'stable')
+      addStatus(character, 'dead')
+    }
+  }
+}
+
+function applyRest(character: Character, rest: string): void {
+  if (!character.rules || normalizedStatuses(character).has('dead')) return
+  const longRest = rest.toLowerCase() === 'long'
+  for (const resource of Object.values(character.rules.resources)) {
+    if (longRest ? resource.recovery !== 'none' : resource.recovery === 'shortRest') resource.current = resource.max
+  }
+  if (!longRest || character.hp < 1) return
+  character.hp = character.maxHp
+  character.rules.temporaryHp = 0
+  character.rules.exhaustion = Math.max(0, character.rules.exhaustion - 1)
+  character.rules.deathSaves = { successes: 0, failures: 0 }
+}
+
+export function applyMechanicalEvents(characters: Character[], events: ProposedEvent[], rolls: DiceRoll[] = []): AppliedState {
+  const next = characters.map(character => ({
+    ...character,
+    inventory: [...character.inventory],
+    statuses: [...character.statuses],
+    rules: cloneRules(character.rules),
+  }))
   const audit: AppliedState['audit'] = []
 
+  applyDeathSavingThrows(next, rolls)
+
   for (const event of events) {
-    if (!['damage', 'healing', 'inventory', 'status'].includes(event.type)) continue
+    if (!['damage', 'healing', 'inventory', 'status', 'temporaryHp', 'resource', 'rest'].includes(event.type)) continue
     const target = next.find(character => character.id === event.targetId)
     if (!target) throw new Error(`Unknown event target: ${event.targetId}`)
     const before = structuredClone(target)
 
-    if (event.type === 'damage') target.hp = Math.max(0, target.hp - Math.max(0, event.value ?? 0))
+    if (event.type === 'damage') {
-    if (event.type === 'healing') target.hp = Math.min(target.maxHp, target.hp + Math.max(0, event.value ?? 0))
+      const damage = adjustedDamage(event.value ?? 0, event.damageType, target.rules)
+      const priorHp = target.hp
+      const absorbed = Math.min(target.rules?.temporaryHp ?? 0, damage)
+      if (target.rules) target.rules.temporaryHp -= absorbed
+      const hpDamage = damage - absorbed
+      const remainingDamageAtZero = Math.max(0, hpDamage - priorHp)
+      const criticalAtZero = priorHp === 0 && rolls.some(roll =>
+        roll.checkKind === 'attack'
+        && roll.actorId === event.actorId
+        && roll.targetId === event.targetId
+        && roll.kept[0] === 20,
+      )
+      target.hp = Math.max(0, priorHp - hpDamage)
+      if (target.hp === 0 && !normalizedStatuses(target).has('dead')) {
+        if (remainingDamageAtZero >= target.maxHp) {
+          removeStatus(target, 'unconscious')
+          removeStatus(target, 'stable')
+          addStatus(target, 'dead')
+        } else {
+          addStatus(target, 'unconscious')
+          if (priorHp === 0 && target.rules) {
+            removeStatus(target, 'stable')
+            target.rules.deathSaves.failures = Math.min(3, target.rules.deathSaves.failures + (criticalAtZero ? 2 : 1))
+            if (target.rules.deathSaves.failures >= 3) {
+              removeStatus(target, 'unconscious')
+              addStatus(target, 'dead')
+            }
+          }
+        }
+      }
+    }
+    if (event.type === 'healing' && !normalizedStatuses(target).has('dead')) {
+      target.hp = Math.min(target.maxHp, target.hp + Math.max(0, event.value ?? 0))
+      if (target.hp > 0) {
+        removeStatus(target, 'unconscious')
+        removeStatus(target, 'stable')
+        if (target.rules) target.rules.deathSaves = { successes: 0, failures: 0 }
+      }
+    }
     if (event.type === 'inventory' && event.item) {
       if ((event.value ?? 1) >= 0 && !target.inventory.includes(event.item)) target.inventory.push(event.item)
       if ((event.value ?? 1) < 0) target.inventory = target.inventory.filter(item => item !== event.item)
     }
     if (event.type === 'status' && event.item) {
-      if ((event.value ?? 1) >= 0 && !target.statuses.includes(event.item)) target.statuses.push(event.item)
+      if (event.item.toLowerCase() === 'exhaustion' && target.rules) {
-      if ((event.value ?? 1) < 0) target.statuses = target.statuses.filter(status => status !== event.item)
+        target.rules.exhaustion = Math.max(0, Math.min(6, target.rules.exhaustion + (event.value ?? 1)))
+        if (target.rules.exhaustion >= 6) addStatus(target, 'dead')
+      } else {
+        if ((event.value ?? 1) >= 0) addStatus(target, event.item)
+        if ((event.value ?? 1) < 0) removeStatus(target, event.item)
       }
+    }
+    if (event.type === 'temporaryHp' && target.rules) {
+      target.rules.temporaryHp = Math.max(target.rules.temporaryHp, Math.max(0, event.value ?? 0))
+    }
+    if (event.type === 'resource' && event.item && target.rules?.resources[event.item]) {
+      const resource = target.rules.resources[event.item]!
+      resource.current = Math.max(0, Math.min(resource.max, resource.current + (event.value ?? -1)))
+    }
+    if (event.type === 'rest' && event.item) applyRest(target, event.item)
     audit.push({ event, before, after: structuredClone(target) })
   }
 

packages/shared/src/character.test.ts

@@ -10,6 +10,9 @@ const draft = {
   defense: 13,
   proficiency: 2,
   inventory: ['Signal lens', 'Field toolkit'],
+  skillProficiencies: ['arcana', 'history', 'investigation', 'perception'],
+  skillExpertise: ['investigation'],
+  savingThrowProficiencies: ['int', 'wis'],
   persona: {
     voice: 'Precise, with dry humor.',
     motivation: 'Prove the relay is speaking from the future.',

packages/shared/src/index.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { PlayerIntentSchema } from './index'
+import { CharacterRulesSchema, CheckRequestSchema, PlayerIntentSchema } from './index'
 
 describe('shared database contracts', () => {
   it('accepts PostgREST timestamptz values with an explicit UTC offset', () => {
@@ -16,4 +16,33 @@ describe('shared database contracts', () => {
 
     expect(intent.ready).toBe(true)
   })
+
+  it('accepts typed SRD d20 tests', () => {
+    expect(CheckRequestSchema.parse({
+      actorId: 'hero', kind: 'skill', skill: 'perception', proficient: true,
+      difficulty: 15, mode: 'advantage', reason: 'Search the trapped hall',
+    })).toMatchObject({ kind: 'skill', skill: 'perception', proficient: true })
+
+    expect(CheckRequestSchema.parse({
+      actorId: 'hero', kind: 'savingThrow', ability: 'wis', proficient: false,
+      difficulty: 13, mode: 'normal', reason: 'Resist the whisper',
+    })).toMatchObject({ kind: 'savingThrow', ability: 'wis' })
+  })
+
+  it('validates versioned SRD character mechanics', () => {
+    const rules = CharacterRulesSchema.parse({
+      version: 2,
+      level: 5,
+      skillProficiencies: ['perception'],
+      skillExpertise: ['perception'],
+      savingThrowProficiencies: ['wis'],
+      resources: { focus: { current: 2, max: 3, recovery: 'shortRest' } },
+    })
+    expect(rules.temporaryHp).toBe(0)
+    expect(rules.deathSaves).toEqual({ successes: 0, failures: 0 })
+    expect(() => CharacterRulesSchema.parse({
+      ...rules,
+      skillExpertise: ['stealth'],
+    })).toThrow('expertise requires skill proficiency')
+  })
 })

packages/shared/src/index.ts

@@ -10,6 +10,70 @@ export const abilityKeys = ['str', 'dex', 'con', 'int', 'wis', 'cha'] as const
 export const AbilityKeySchema = z.enum(abilityKeys)
 export type AbilityKey = z.infer<typeof AbilityKeySchema>
 
+export const skillKeys = [
+  'acrobatics', 'animalHandling', 'arcana', 'athletics', 'deception', 'history',
+  'insight', 'intimidation', 'investigation', 'medicine', 'nature', 'perception',
+  'performance', 'persuasion', 'religion', 'sleightOfHand', 'stealth', 'survival',
+] as const
+export const SkillKeySchema = z.enum(skillKeys)
+export type SkillKey = z.infer<typeof SkillKeySchema>
+
+export const damageTypeKeys = [
+  'acid', 'bludgeoning', 'cold', 'fire', 'force', 'lightning', 'necrotic',
+  'piercing', 'poison', 'psychic', 'radiant', 'slashing', 'thunder',
+] as const
+export const DamageTypeSchema = z.enum(damageTypeKeys)
+export type DamageType = z.infer<typeof DamageTypeSchema>
+
+export const conditionKeys = [
+  'blinded', 'charmed', 'deafened', 'frightened', 'grappled', 'incapacitated',
+  'invisible', 'paralyzed', 'petrified', 'poisoned', 'prone', 'restrained',
+  'stunned', 'unconscious', 'stable', 'dead',
+] as const
+export const ConditionKeySchema = z.enum(conditionKeys)
+export type ConditionKey = z.infer<typeof ConditionKeySchema>
+
+export const CharacterResourceSchema = z.object({
+  current: z.number().int().min(0),
+  max: z.number().int().min(0),
+  recovery: z.enum(['none', 'shortRest', 'longRest']).default('longRest'),
+}).strict().refine(value => value.current <= value.max, {
+  message: 'resource current value must not exceed its maximum',
+  path: ['current'],
+})
+
+/**
+ * Versioned SRD mechanics that older campaigns did not persist. The legacy
+ * fallback is explicit so migrated games keep their previous proficiency
+ * behavior without allowing it in newly-authored rules profiles.
+ */
+export const CharacterRulesSchema = z.object({
+  version: z.literal(2),
+  level: z.number().int().min(1).max(20).default(1),
+  skillProficiencies: z.array(SkillKeySchema).max(18).default([]),
+  skillExpertise: z.array(SkillKeySchema).max(18).default([]),
+  savingThrowProficiencies: z.array(AbilityKeySchema).max(6).default([]),
+  temporaryHp: z.number().int().min(0).max(999).default(0),
+  deathSaves: z.object({
+    successes: z.number().int().min(0).max(3),
+    failures: z.number().int().min(0).max(3),
+  }).strict().default({ successes: 0, failures: 0 }),
+  exhaustion: z.number().int().min(0).max(6).default(0),
+  damageResistances: z.array(DamageTypeSchema).max(13).default([]),
+  damageVulnerabilities: z.array(DamageTypeSchema).max(13).default([]),
+  damageImmunities: z.array(DamageTypeSchema).max(13).default([]),
+  resources: z.record(z.string().trim().min(1).max(80), CharacterResourceSchema).default({}),
+  legacyProficiencyFallback: z.boolean().default(false),
+}).strict().superRefine((value, context) => {
+  const trained = new Set(value.skillProficiencies)
+  for (const skill of value.skillExpertise) {
+    if (!trained.has(skill)) {
+      context.addIssue({ code: 'custom', message: 'expertise requires skill proficiency', path: ['skillExpertise'] })
+    }
+  }
+})
+export type CharacterRules = z.infer<typeof CharacterRulesSchema>
+
 export const AbilityScoresSchema = z.object({
   str: z.number().int().min(1).max(30),
   dex: z.number().int().min(1).max(30),
@@ -47,6 +111,9 @@ export const CharacterDraftSchema = z.object({
   defense: z.number().int().min(1).max(40),
   proficiency: z.number().int().min(1).max(10),
   inventory: z.array(z.string().trim().min(1).max(120)).max(12),
+  skillProficiencies: z.array(SkillKeySchema).max(8).default([]),
+  skillExpertise: z.array(SkillKeySchema).max(4).default([]),
+  savingThrowProficiencies: z.array(AbilityKeySchema).max(3).default([]),
   persona: CharacterPersonaSchema,
 }).strict().refine(value => value.hp <= value.maxHp, {
   message: 'hp must not exceed maxHp',
@@ -84,6 +151,7 @@ export const CharacterSchema = z.object({
   inventory: z.array(z.string().max(120)).max(50).default([]),
   statuses: z.array(z.string().max(80)).max(12).default([]),
   persona: z.record(z.string(), z.unknown()).optional(),
+  rules: CharacterRulesSchema.optional(),
 })
 export type Character = z.infer<typeof CharacterSchema>
 
@@ -121,12 +189,15 @@ export type RoundContext = z.infer<typeof RoundContextSchema>
 
 export const CheckRequestSchema = z.object({
   actorId: z.string().min(1),
-  kind: z.enum(['ability', 'attack', 'initiative', 'damage', 'healing']),
+  kind: z.enum(['ability', 'skill', 'savingThrow', 'deathSavingThrow', 'attack', 'initiative', 'damage', 'healing']),
   ability: AbilityKeySchema.optional(),
+  skill: SkillKeySchema.optional(),
+  proficient: z.boolean().optional(),
   difficulty: z.number().int().min(1).max(40).optional(),
   targetId: z.string().optional(),
   mode: z.enum(['normal', 'advantage', 'disadvantage']).default('normal'),
   dice: z.string().regex(/^\d+d\d+(?:[+-]\d+)?$/).optional(),
+  damageType: DamageTypeSchema.optional(),
   reason: z.string().min(1).max(500),
 })
 export type CheckRequest = z.infer<typeof CheckRequestSchema>
@@ -148,11 +219,12 @@ export const DiceRollSchema = z.object({
 export type DiceRoll = z.infer<typeof DiceRollSchema>
 
 export const ProposedEventSchema = z.object({
-  type: z.enum(['narrative', 'relationship', 'quest', 'inventory', 'status', 'damage', 'healing']),
+  type: z.enum(['narrative', 'relationship', 'quest', 'inventory', 'status', 'damage', 'healing', 'temporaryHp', 'resource', 'rest']),
   actorId: z.string().nullable().default(null),
   targetId: z.string().nullable().default(null),
   value: z.number().int().nullable().default(null),
   item: z.string().max(120).nullable().default(null),
+  damageType: DamageTypeSchema.nullable().default(null),
   description: z.string().min(1).max(1000),
 })
 export type ProposedEvent = z.infer<typeof ProposedEventSchema>

supabase/bootstrap.sql

@@ -2780,6 +2780,363 @@ grant execute on function public.dng_schema_version() to service_role;
 
 notify pgrst, 'reload schema';
 
+-- ============================================================================
+-- 0012_versioned_srd_rules.sql
+-- ============================================================================
+
+-- Introduce a versioned SRD 5.2.1 rules profile without rebuilding campaigns.
+-- Existing narrative, rounds, HP, inventory and statuses remain untouched.
+
+alter table public.campaigns
+  add column if not exists ruleset_version smallint;
+
+insert into public.audit_entries(
+  campaign_id, actor_id, action, entity_type, entity_id, before_state, after_state
+)
+select
+  campaign.id,
+  campaign.owner_id,
+  'migrate_ruleset',
+  'campaign',
+  campaign.id,
+  jsonb_build_object('rulesetVersion', coalesce(campaign.ruleset_version, 1)),
+  jsonb_build_object(
+    'rulesetVersion', 2,
+    'ruleset', 'SRD 5.2.1 alpha',
+    'preserved', jsonb_build_array('rounds', 'history', 'hp', 'inventory', 'statuses')
+  )
+from public.campaigns campaign
+where coalesce(campaign.ruleset_version, 1) < 2;
+
+update public.campaigns
+set ruleset_version = 2
+where ruleset_version is null or ruleset_version < 2;
+
+alter table public.campaigns
+  alter column ruleset_version set default 2,
+  alter column ruleset_version set not null;
+
+alter table public.campaigns
+  drop constraint if exists campaigns_ruleset_version_supported;
+alter table public.campaigns
+  add constraint campaigns_ruleset_version_supported check (ruleset_version = 2);
+
+alter table public.characters
+  add column if not exists rules_state jsonb;
+
+-- Compatibility is deliberate: migrated heroes retain the old planner hint
+-- only until their profile is explicitly edited. Newly-authored profiles use
+-- server-owned skill/save lists and set this flag to false.
+update public.characters character
+set rules_state = jsonb_build_object(
+  'version', 2,
+  'level', case
+    when character.proficiency <= 2 then 1
+    when character.proficiency = 3 then 5
+    when character.proficiency = 4 then 9
+    when character.proficiency = 5 then 13
+    else 17
+  end,
+  'skillProficiencies', '[]'::jsonb,
+  'skillExpertise', '[]'::jsonb,
+  'savingThrowProficiencies', '[]'::jsonb,
+  'temporaryHp', 0,
+  'deathSaves', jsonb_build_object('successes', 0, 'failures', 0),
+  'exhaustion', 0,
+  'damageResistances', '[]'::jsonb,
+  'damageVulnerabilities', '[]'::jsonb,
+  'damageImmunities', '[]'::jsonb,
+  'resources', jsonb_build_object(
+    'hitDice', jsonb_build_object('current', 1, 'max', 1, 'recovery', 'longRest')
+  ),
+  'legacyProficiencyFallback', true
+)
+where character.rules_state is null;
+
+alter table public.characters
+  alter column rules_state set default '{
+    "version":2,
+    "level":1,
+    "skillProficiencies":[],
+    "skillExpertise":[],
+    "savingThrowProficiencies":[],
+    "temporaryHp":0,
+    "deathSaves":{"successes":0,"failures":0},
+    "exhaustion":0,
+    "damageResistances":[],
+    "damageVulnerabilities":[],
+    "damageImmunities":[],
+    "resources":{"hitDice":{"current":1,"max":1,"recovery":"longRest"}},
+    "legacyProficiencyFallback":true
+  }'::jsonb,
+  alter column rules_state set not null;
+
+alter table public.characters
+  drop constraint if exists characters_rules_state_v2;
+alter table public.characters
+  add constraint characters_rules_state_v2 check (
+    jsonb_typeof(rules_state) = 'object'
+    and rules_state->>'version' = '2'
+    and (rules_state->>'level')::integer between 1 and 20
+    and jsonb_typeof(rules_state->'skillProficiencies') = 'array'
+    and jsonb_typeof(rules_state->'skillExpertise') = 'array'
+    and jsonb_typeof(rules_state->'savingThrowProficiencies') = 'array'
+    and (rules_state->>'temporaryHp')::integer between 0 and 999
+    and jsonb_typeof(rules_state->'deathSaves') = 'object'
+    and (rules_state->'deathSaves'->>'successes')::integer between 0 and 3
+    and (rules_state->'deathSaves'->>'failures')::integer between 0 and 3
+    and (rules_state->>'exhaustion')::integer between 0 and 6
+    and jsonb_typeof(rules_state->'damageResistances') = 'array'
+    and jsonb_typeof(rules_state->'damageVulnerabilities') = 'array'
+    and jsonb_typeof(rules_state->'damageImmunities') = 'array'
+    and jsonb_typeof(rules_state->'resources') = 'object'
+    and jsonb_typeof(rules_state->'legacyProficiencyFallback') = 'boolean'
+  );
+
+-- Older world drafts gain deterministic proficiency data so a newly-started
+-- campaign is fully on rules v2 even when its universe predates this migration.
+update public.worlds world
+set starter_companions = coalesce((
+  select jsonb_agg(
+    companion.value || case companion.position
+      when 1 then '{"skillProficiencies":["acrobatics","perception","stealth","survival"],"skillExpertise":[],"savingThrowProficiencies":["dex","wis"]}'::jsonb
+      when 2 then '{"skillProficiencies":["athletics","intimidation","perception","survival"],"skillExpertise":[],"savingThrowProficiencies":["str","con"]}'::jsonb
+      else '{"skillProficiencies":["arcana","history","investigation","perception"],"skillExpertise":["investigation"],"savingThrowProficiencies":["int","wis"]}'::jsonb
+    end
+    order by companion.position
+  )
+  from jsonb_array_elements(world.starter_companions) with ordinality as companion(value, position)
+), '[]'::jsonb)
+where jsonb_typeof(world.starter_companions) = 'array';
+
+update public.coauthor_sessions session
+set generated_world = jsonb_set(
+  session.generated_world,
+  '{companions}',
+  coalesce((
+    select jsonb_agg(
+      companion.value || case companion.position
+        when 1 then '{"skillProficiencies":["acrobatics","perception","stealth","survival"],"skillExpertise":[],"savingThrowProficiencies":["dex","wis"]}'::jsonb
+        when 2 then '{"skillProficiencies":["athletics","intimidation","perception","survival"],"skillExpertise":[],"savingThrowProficiencies":["str","con"]}'::jsonb
+        else '{"skillProficiencies":["arcana","history","investigation","perception"],"skillExpertise":["investigation"],"savingThrowProficiencies":["int","wis"]}'::jsonb
+      end
+      order by companion.position
+    )
+    from jsonb_array_elements(session.generated_world->'companions') with ordinality as companion(value, position)
+  ), '[]'::jsonb),
+  true
+)
+where session.generated_world is not null
+  and jsonb_typeof(session.generated_world->'companions') = 'array';
+
+create or replace function public.stage_two_create_campaign(
+  p_world_id uuid,
+  p_owner_id uuid,
+  p_title text
+) returns uuid language plpgsql security definer set search_path = '' as $$
+declare
+  v_world public.worlds%rowtype;
+  v_campaign_id uuid;
+  v_owner_name text;
+  v_companion jsonb;
+begin
+  if p_title is null or char_length(btrim(p_title)) not between 3 and 100 then
+    raise exception 'campaign title must be between 3 and 100 characters';
+  end if;
+  select * into v_world from public.worlds
+  where id = p_world_id and owner_id = p_owner_id and status = 'confirmed' for share;
+  if not found then raise exception 'confirmed world not found'; end if;
+  if jsonb_typeof(v_world.starter_companions) <> 'array'
+     or jsonb_array_length(v_world.starter_companions) = 0 then
+    raise exception 'confirmed world has no AI companions';
+  end if;
+
+  select nullif(btrim(display_name), '') into v_owner_name
+  from public.profiles where id = p_owner_id;
+  v_owner_name := left(coalesce(v_owner_name, 'Wayfinder'), 80);
+
+  insert into public.campaigns(world_id, owner_id, title, current_scene, next_prompt, status, ruleset_version)
+  values (p_world_id, p_owner_id, btrim(p_title), coalesce(v_world.opening_scene, v_world.premise), 'What do you do?', 'active', 2)
+  returning id into v_campaign_id;
+  insert into public.campaign_members(campaign_id, user_id, role)
+  values (v_campaign_id, p_owner_id, 'owner');
+
+  insert into public.characters(
+    campaign_id, user_id, name, concept, controller, abilities, hp, max_hp,
+    defense, proficiency, inventory, statuses, persona, rules_state
+  ) values (
+    v_campaign_id, p_owner_id, v_owner_name,
+    left('An adaptable protagonist ready to confront the opening mystery of ' || v_world.title || '.', 600),
+    'human'::public.character_controller,
+    '{"str":10,"dex":12,"con":12,"int":11,"wis":13,"cha":10}'::jsonb,
+    12, 12, 12, 2,
+    '["Field kit","Personal keepsake"]'::jsonb,
+    '[]'::jsonb,
+    jsonb_build_object(
+      'voice', 'Defined by the player.',
+      'motivation', 'Discover what the opening scene is hiding.',
+      'flaw', 'Still learning what this world demands.',
+      'bond', 'Protect the party through the first danger.'
+    ),
+    '{
+      "version":2,"level":1,
+      "skillProficiencies":["investigation","perception","persuasion","survival"],
+      "skillExpertise":[],"savingThrowProficiencies":["dex","wis"],
+      "temporaryHp":0,"deathSaves":{"successes":0,"failures":0},"exhaustion":0,
+      "damageResistances":[],"damageVulnerabilities":[],"damageImmunities":[],
+      "resources":{"hitDice":{"current":1,"max":1,"recovery":"longRest"}},
+      "legacyProficiencyFallback":false
+    }'::jsonb
+  );
+
+  for v_companion in select * from jsonb_array_elements(v_world.starter_companions) loop
+    insert into public.characters(
+      campaign_id, user_id, name, concept, controller, abilities, hp, max_hp,
+      defense, proficiency, inventory, statuses, persona, rules_state
+    ) values (
+      v_campaign_id, null, v_companion->>'name', v_companion->>'concept',
+      'ai'::public.character_controller, v_companion->'abilities',
+      (v_companion->>'hp')::integer, (v_companion->>'maxHp')::integer,
+      (v_companion->>'defense')::integer, (v_companion->>'proficiency')::integer,
+      v_companion->'inventory', '[]'::jsonb, v_companion->'persona',
+      jsonb_build_object(
+        'version', 2, 'level', 1,
+        'skillProficiencies', coalesce(v_companion->'skillProficiencies', '[]'::jsonb),
+        'skillExpertise', coalesce(v_companion->'skillExpertise', '[]'::jsonb),
+        'savingThrowProficiencies', coalesce(v_companion->'savingThrowProficiencies', '[]'::jsonb),
+        'temporaryHp', 0, 'deathSaves', jsonb_build_object('successes', 0, 'failures', 0),
+        'exhaustion', 0, 'damageResistances', '[]'::jsonb,
+        'damageVulnerabilities', '[]'::jsonb, 'damageImmunities', '[]'::jsonb,
+        'resources', jsonb_build_object('hitDice', jsonb_build_object('current', 1, 'max', 1, 'recovery', 'longRest')),
+        'legacyProficiencyFallback', false
+      )
+    );
+  end loop;
+
+  insert into public.rounds(campaign_id, number) values (v_campaign_id, 1);
+  return v_campaign_id;
+end;
+$$;
+
+create or replace function public.stage_five_create_character(
+  p_campaign_id uuid,
+  p_actor_id uuid,
+  p_controller text,
+  p_name text,
+  p_concept text,
+  p_abilities jsonb,
+  p_hp integer,
+  p_max_hp integer,
+  p_defense integer,
+  p_proficiency integer,
+  p_inventory jsonb,
+  p_statuses jsonb,
+  p_persona jsonb,
+  p_rules_state jsonb
+) returns uuid language plpgsql security definer set search_path = '' as $$
+declare
+  v_character_id uuid;
+begin
+  if coalesce(jsonb_typeof(p_rules_state), '') <> 'object' or p_rules_state->>'version' <> '2' then
+    raise exception 'a version 2 rules profile is required';
+  end if;
+  v_character_id := public.stage_four_create_character(
+    p_campaign_id, p_actor_id, p_controller, p_name, p_concept, p_abilities,
+    p_hp, p_max_hp, p_defense, p_proficiency, p_inventory, p_statuses, p_persona
+  );
+  update public.characters set rules_state = p_rules_state where id = v_character_id;
+  return v_character_id;
+end;
+$$;
+
+create or replace function public.apply_srd_character_rules(
+  p_round_id uuid,
+  p_character_states jsonb
+) returns void language plpgsql security definer set search_path = '' as $$
+declare
+  v_campaign_id uuid;
+  v_state jsonb;
+  v_character_id uuid;
+  v_seen uuid[] := '{}';
+begin
+  select campaign_id into v_campaign_id from public.rounds where id = p_round_id;
+  if not found then raise exception 'round not found'; end if;
+  if coalesce(jsonb_typeof(p_character_states), '') <> 'array' then
+    raise exception 'character states must be an array';
+  end if;
+  for v_state in select * from jsonb_array_elements(p_character_states) loop
+    v_character_id := (v_state->>'id')::uuid;
+    if v_character_id = any(v_seen) then raise exception 'duplicate character state for %', v_character_id; end if;
+    v_seen := array_append(v_seen, v_character_id);
+    if coalesce(jsonb_typeof(v_state->'rulesState'), '') <> 'object'
+       or v_state->'rulesState'->>'version' <> '2' then
+      raise exception 'character % has an invalid rules profile', v_character_id;
+    end if;
+    update public.characters
+    set rules_state = v_state->'rulesState'
+    where id = v_character_id and campaign_id = v_campaign_id;
+    if not found then raise exception 'character % is outside the round campaign', v_character_id; end if;
+  end loop;
+end;
+$$;
+
+create or replace function public.commit_srd_round_resolution(
+  p_round_id uuid,
+  p_narration text,
+  p_next_prompt text,
+  p_rolls jsonb,
+  p_events jsonb,
+  p_character_states jsonb,
+  p_memory jsonb,
+  p_idempotency_key text
+) returns void language plpgsql security definer set search_path = '' as $$
+begin
+  if exists (select 1 from public.rounds where id = p_round_id and status = 'resolved') then return; end if;
+  perform public.commit_round_resolution(
+    p_round_id, p_narration, p_next_prompt, p_rolls, p_events,
+    p_character_states, p_memory, p_idempotency_key
+  );
+  perform public.apply_srd_character_rules(p_round_id, p_character_states);
+end;
+$$;
+
+create or replace function public.commit_claimed_srd_round_resolution(
+  p_round_id uuid,
+  p_narration text,
+  p_next_prompt text,
+  p_rolls jsonb,
+  p_events jsonb,
+  p_character_states jsonb,
+  p_memory jsonb,
+  p_idempotency_key text,
+  p_worker_id text
+) returns void language plpgsql security definer set search_path = '' as $$
+begin
+  perform public.commit_claimed_round_resolution(
+    p_round_id, p_narration, p_next_prompt, p_rolls, p_events,
+    p_character_states, p_memory, p_idempotency_key, p_worker_id
+  );
+  perform public.apply_srd_character_rules(p_round_id, p_character_states);
+end;
+$$;
+
+create or replace function public.dng_schema_version()
+returns integer language sql stable security definer set search_path = '' as $$
+  select 12;
+$$;
+
+revoke all on function public.stage_five_create_character(uuid, uuid, text, text, text, jsonb, integer, integer, integer, integer, jsonb, jsonb, jsonb, jsonb) from public, anon, authenticated;
+revoke all on function public.apply_srd_character_rules(uuid, jsonb) from public, anon, authenticated;
+revoke all on function public.commit_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text) from public, anon, authenticated;
+revoke all on function public.commit_claimed_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text, text) from public, anon, authenticated;
+revoke all on function public.dng_schema_version() from public, anon, authenticated;
+grant execute on function public.stage_five_create_character(uuid, uuid, text, text, text, jsonb, integer, integer, integer, integer, jsonb, jsonb, jsonb, jsonb) to service_role;
+grant execute on function public.commit_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text) to service_role;
+grant execute on function public.commit_claimed_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text, text) to service_role;
+grant execute on function public.dng_schema_version() to service_role;
+
+notify pgrst, 'reload schema';
+
 
 do $$
 begin
@@ -2804,7 +3161,7 @@ begin
   if to_regprocedure('public.stage_four_create_character(uuid,uuid,text,text,text,jsonb,integer,integer,integer,integer,jsonb,jsonb,jsonb)') is null then
     raise exception 'D&G bootstrap verification failed: character creation RPC is missing';
   end if;
-  if public.dng_schema_version() <> 11 then
+  if public.dng_schema_version() <> 12 then
     raise exception 'D&G bootstrap verification failed: unexpected schema version';
   end if;
 end;

supabase/migrations/0012_versioned_srd_rules.sql

@@ -0,0 +1,352 @@
+-- Introduce a versioned SRD 5.2.1 rules profile without rebuilding campaigns.
+-- Existing narrative, rounds, HP, inventory and statuses remain untouched.
+
+alter table public.campaigns
+  add column if not exists ruleset_version smallint;
+
+insert into public.audit_entries(
+  campaign_id, actor_id, action, entity_type, entity_id, before_state, after_state
+)
+select
+  campaign.id,
+  campaign.owner_id,
+  'migrate_ruleset',
+  'campaign',
+  campaign.id,
+  jsonb_build_object('rulesetVersion', coalesce(campaign.ruleset_version, 1)),
+  jsonb_build_object(
+    'rulesetVersion', 2,
+    'ruleset', 'SRD 5.2.1 alpha',
+    'preserved', jsonb_build_array('rounds', 'history', 'hp', 'inventory', 'statuses')
+  )
+from public.campaigns campaign
+where coalesce(campaign.ruleset_version, 1) < 2;
+
+update public.campaigns
+set ruleset_version = 2
+where ruleset_version is null or ruleset_version < 2;
+
+alter table public.campaigns
+  alter column ruleset_version set default 2,
+  alter column ruleset_version set not null;
+
+alter table public.campaigns
+  drop constraint if exists campaigns_ruleset_version_supported;
+alter table public.campaigns
+  add constraint campaigns_ruleset_version_supported check (ruleset_version = 2);
+
+alter table public.characters
+  add column if not exists rules_state jsonb;
+
+-- Compatibility is deliberate: migrated heroes retain the old planner hint
+-- only until their profile is explicitly edited. Newly-authored profiles use
+-- server-owned skill/save lists and set this flag to false.
+update public.characters character
+set rules_state = jsonb_build_object(
+  'version', 2,
+  'level', case
+    when character.proficiency <= 2 then 1
+    when character.proficiency = 3 then 5
+    when character.proficiency = 4 then 9
+    when character.proficiency = 5 then 13
+    else 17
+  end,
+  'skillProficiencies', '[]'::jsonb,
+  'skillExpertise', '[]'::jsonb,
+  'savingThrowProficiencies', '[]'::jsonb,
+  'temporaryHp', 0,
+  'deathSaves', jsonb_build_object('successes', 0, 'failures', 0),
+  'exhaustion', 0,
+  'damageResistances', '[]'::jsonb,
+  'damageVulnerabilities', '[]'::jsonb,
+  'damageImmunities', '[]'::jsonb,
+  'resources', jsonb_build_object(
+    'hitDice', jsonb_build_object('current', 1, 'max', 1, 'recovery', 'longRest')
+  ),
+  'legacyProficiencyFallback', true
+)
+where character.rules_state is null;
+
+alter table public.characters
+  alter column rules_state set default '{
+    "version":2,
+    "level":1,
+    "skillProficiencies":[],
+    "skillExpertise":[],
+    "savingThrowProficiencies":[],
+    "temporaryHp":0,
+    "deathSaves":{"successes":0,"failures":0},
+    "exhaustion":0,
+    "damageResistances":[],
+    "damageVulnerabilities":[],
+    "damageImmunities":[],
+    "resources":{"hitDice":{"current":1,"max":1,"recovery":"longRest"}},
+    "legacyProficiencyFallback":true
+  }'::jsonb,
+  alter column rules_state set not null;
+
+alter table public.characters
+  drop constraint if exists characters_rules_state_v2;
+alter table public.characters
+  add constraint characters_rules_state_v2 check (
+    jsonb_typeof(rules_state) = 'object'
+    and rules_state->>'version' = '2'
+    and (rules_state->>'level')::integer between 1 and 20
+    and jsonb_typeof(rules_state->'skillProficiencies') = 'array'
+    and jsonb_typeof(rules_state->'skillExpertise') = 'array'
+    and jsonb_typeof(rules_state->'savingThrowProficiencies') = 'array'
+    and (rules_state->>'temporaryHp')::integer between 0 and 999
+    and jsonb_typeof(rules_state->'deathSaves') = 'object'
+    and (rules_state->'deathSaves'->>'successes')::integer between 0 and 3
+    and (rules_state->'deathSaves'->>'failures')::integer between 0 and 3
+    and (rules_state->>'exhaustion')::integer between 0 and 6
+    and jsonb_typeof(rules_state->'damageResistances') = 'array'
+    and jsonb_typeof(rules_state->'damageVulnerabilities') = 'array'
+    and jsonb_typeof(rules_state->'damageImmunities') = 'array'
+    and jsonb_typeof(rules_state->'resources') = 'object'
+    and jsonb_typeof(rules_state->'legacyProficiencyFallback') = 'boolean'
+  );
+
+-- Older world drafts gain deterministic proficiency data so a newly-started
+-- campaign is fully on rules v2 even when its universe predates this migration.
+update public.worlds world
+set starter_companions = coalesce((
+  select jsonb_agg(
+    companion.value || case companion.position
+      when 1 then '{"skillProficiencies":["acrobatics","perception","stealth","survival"],"skillExpertise":[],"savingThrowProficiencies":["dex","wis"]}'::jsonb
+      when 2 then '{"skillProficiencies":["athletics","intimidation","perception","survival"],"skillExpertise":[],"savingThrowProficiencies":["str","con"]}'::jsonb
+      else '{"skillProficiencies":["arcana","history","investigation","perception"],"skillExpertise":["investigation"],"savingThrowProficiencies":["int","wis"]}'::jsonb
+    end
+    order by companion.position
+  )
+  from jsonb_array_elements(world.starter_companions) with ordinality as companion(value, position)
+), '[]'::jsonb)
+where jsonb_typeof(world.starter_companions) = 'array';
+
+update public.coauthor_sessions session
+set generated_world = jsonb_set(
+  session.generated_world,
+  '{companions}',
+  coalesce((
+    select jsonb_agg(
+      companion.value || case companion.position
+        when 1 then '{"skillProficiencies":["acrobatics","perception","stealth","survival"],"skillExpertise":[],"savingThrowProficiencies":["dex","wis"]}'::jsonb
+        when 2 then '{"skillProficiencies":["athletics","intimidation","perception","survival"],"skillExpertise":[],"savingThrowProficiencies":["str","con"]}'::jsonb
+        else '{"skillProficiencies":["arcana","history","investigation","perception"],"skillExpertise":["investigation"],"savingThrowProficiencies":["int","wis"]}'::jsonb
+      end
+      order by companion.position
+    )
+    from jsonb_array_elements(session.generated_world->'companions') with ordinality as companion(value, position)
+  ), '[]'::jsonb),
+  true
+)
+where session.generated_world is not null
+  and jsonb_typeof(session.generated_world->'companions') = 'array';
+
+create or replace function public.stage_two_create_campaign(
+  p_world_id uuid,
+  p_owner_id uuid,
+  p_title text
+) returns uuid language plpgsql security definer set search_path = '' as $$
+declare
+  v_world public.worlds%rowtype;
+  v_campaign_id uuid;
+  v_owner_name text;
+  v_companion jsonb;
+begin
+  if p_title is null or char_length(btrim(p_title)) not between 3 and 100 then
+    raise exception 'campaign title must be between 3 and 100 characters';
+  end if;
+  select * into v_world from public.worlds
+  where id = p_world_id and owner_id = p_owner_id and status = 'confirmed' for share;
+  if not found then raise exception 'confirmed world not found'; end if;
+  if jsonb_typeof(v_world.starter_companions) <> 'array'
+     or jsonb_array_length(v_world.starter_companions) = 0 then
+    raise exception 'confirmed world has no AI companions';
+  end if;
+
+  select nullif(btrim(display_name), '') into v_owner_name
+  from public.profiles where id = p_owner_id;
+  v_owner_name := left(coalesce(v_owner_name, 'Wayfinder'), 80);
+
+  insert into public.campaigns(world_id, owner_id, title, current_scene, next_prompt, status, ruleset_version)
+  values (p_world_id, p_owner_id, btrim(p_title), coalesce(v_world.opening_scene, v_world.premise), 'What do you do?', 'active', 2)
+  returning id into v_campaign_id;
+  insert into public.campaign_members(campaign_id, user_id, role)
+  values (v_campaign_id, p_owner_id, 'owner');
+
+  insert into public.characters(
+    campaign_id, user_id, name, concept, controller, abilities, hp, max_hp,
+    defense, proficiency, inventory, statuses, persona, rules_state
+  ) values (
+    v_campaign_id, p_owner_id, v_owner_name,
+    left('An adaptable protagonist ready to confront the opening mystery of ' || v_world.title || '.', 600),
+    'human'::public.character_controller,
+    '{"str":10,"dex":12,"con":12,"int":11,"wis":13,"cha":10}'::jsonb,
+    12, 12, 12, 2,
+    '["Field kit","Personal keepsake"]'::jsonb,
+    '[]'::jsonb,
+    jsonb_build_object(
+      'voice', 'Defined by the player.',
+      'motivation', 'Discover what the opening scene is hiding.',
+      'flaw', 'Still learning what this world demands.',
+      'bond', 'Protect the party through the first danger.'
+    ),
+    '{
+      "version":2,"level":1,
+      "skillProficiencies":["investigation","perception","persuasion","survival"],
+      "skillExpertise":[],"savingThrowProficiencies":["dex","wis"],
+      "temporaryHp":0,"deathSaves":{"successes":0,"failures":0},"exhaustion":0,
+      "damageResistances":[],"damageVulnerabilities":[],"damageImmunities":[],
+      "resources":{"hitDice":{"current":1,"max":1,"recovery":"longRest"}},
+      "legacyProficiencyFallback":false
+    }'::jsonb
+  );
+
+  for v_companion in select * from jsonb_array_elements(v_world.starter_companions) loop
+    insert into public.characters(
+      campaign_id, user_id, name, concept, controller, abilities, hp, max_hp,
+      defense, proficiency, inventory, statuses, persona, rules_state
+    ) values (
+      v_campaign_id, null, v_companion->>'name', v_companion->>'concept',
+      'ai'::public.character_controller, v_companion->'abilities',
+      (v_companion->>'hp')::integer, (v_companion->>'maxHp')::integer,
+      (v_companion->>'defense')::integer, (v_companion->>'proficiency')::integer,
+      v_companion->'inventory', '[]'::jsonb, v_companion->'persona',
+      jsonb_build_object(
+        'version', 2, 'level', 1,
+        'skillProficiencies', coalesce(v_companion->'skillProficiencies', '[]'::jsonb),
+        'skillExpertise', coalesce(v_companion->'skillExpertise', '[]'::jsonb),
+        'savingThrowProficiencies', coalesce(v_companion->'savingThrowProficiencies', '[]'::jsonb),
+        'temporaryHp', 0, 'deathSaves', jsonb_build_object('successes', 0, 'failures', 0),
+        'exhaustion', 0, 'damageResistances', '[]'::jsonb,
+        'damageVulnerabilities', '[]'::jsonb, 'damageImmunities', '[]'::jsonb,
+        'resources', jsonb_build_object('hitDice', jsonb_build_object('current', 1, 'max', 1, 'recovery', 'longRest')),
+        'legacyProficiencyFallback', false
+      )
+    );
+  end loop;
+
+  insert into public.rounds(campaign_id, number) values (v_campaign_id, 1);
+  return v_campaign_id;
+end;
+$$;
+
+create or replace function public.stage_five_create_character(
+  p_campaign_id uuid,
+  p_actor_id uuid,
+  p_controller text,
+  p_name text,
+  p_concept text,
+  p_abilities jsonb,
+  p_hp integer,
+  p_max_hp integer,
+  p_defense integer,
+  p_proficiency integer,
+  p_inventory jsonb,
+  p_statuses jsonb,
+  p_persona jsonb,
+  p_rules_state jsonb
+) returns uuid language plpgsql security definer set search_path = '' as $$
+declare
+  v_character_id uuid;
+begin
+  if coalesce(jsonb_typeof(p_rules_state), '') <> 'object' or p_rules_state->>'version' <> '2' then
+    raise exception 'a version 2 rules profile is required';
+  end if;
+  v_character_id := public.stage_four_create_character(
+    p_campaign_id, p_actor_id, p_controller, p_name, p_concept, p_abilities,
+    p_hp, p_max_hp, p_defense, p_proficiency, p_inventory, p_statuses, p_persona
+  );
+  update public.characters set rules_state = p_rules_state where id = v_character_id;
+  return v_character_id;
+end;
+$$;
+
+create or replace function public.apply_srd_character_rules(
+  p_round_id uuid,
+  p_character_states jsonb
+) returns void language plpgsql security definer set search_path = '' as $$
+declare
+  v_campaign_id uuid;
+  v_state jsonb;
+  v_character_id uuid;
+  v_seen uuid[] := '{}';
+begin
+  select campaign_id into v_campaign_id from public.rounds where id = p_round_id;
+  if not found then raise exception 'round not found'; end if;
+  if coalesce(jsonb_typeof(p_character_states), '') <> 'array' then
+    raise exception 'character states must be an array';
+  end if;
+  for v_state in select * from jsonb_array_elements(p_character_states) loop
+    v_character_id := (v_state->>'id')::uuid;
+    if v_character_id = any(v_seen) then raise exception 'duplicate character state for %', v_character_id; end if;
+    v_seen := array_append(v_seen, v_character_id);
+    if coalesce(jsonb_typeof(v_state->'rulesState'), '') <> 'object'
+       or v_state->'rulesState'->>'version' <> '2' then
+      raise exception 'character % has an invalid rules profile', v_character_id;
+    end if;
+    update public.characters
+    set rules_state = v_state->'rulesState'
+    where id = v_character_id and campaign_id = v_campaign_id;
+    if not found then raise exception 'character % is outside the round campaign', v_character_id; end if;
+  end loop;
+end;
+$$;
+
+create or replace function public.commit_srd_round_resolution(
+  p_round_id uuid,
+  p_narration text,
+  p_next_prompt text,
+  p_rolls jsonb,
+  p_events jsonb,
+  p_character_states jsonb,
+  p_memory jsonb,
+  p_idempotency_key text
+) returns void language plpgsql security definer set search_path = '' as $$
+begin
+  if exists (select 1 from public.rounds where id = p_round_id and status = 'resolved') then return; end if;
+  perform public.commit_round_resolution(
+    p_round_id, p_narration, p_next_prompt, p_rolls, p_events,
+    p_character_states, p_memory, p_idempotency_key
+  );
+  perform public.apply_srd_character_rules(p_round_id, p_character_states);
+end;
+$$;
+
+create or replace function public.commit_claimed_srd_round_resolution(
+  p_round_id uuid,
+  p_narration text,
+  p_next_prompt text,
+  p_rolls jsonb,
+  p_events jsonb,
+  p_character_states jsonb,
+  p_memory jsonb,
+  p_idempotency_key text,
+  p_worker_id text
+) returns void language plpgsql security definer set search_path = '' as $$
+begin
+  perform public.commit_claimed_round_resolution(
+    p_round_id, p_narration, p_next_prompt, p_rolls, p_events,
+    p_character_states, p_memory, p_idempotency_key, p_worker_id
+  );
+  perform public.apply_srd_character_rules(p_round_id, p_character_states);
+end;
+$$;
+
+create or replace function public.dng_schema_version()
+returns integer language sql stable security definer set search_path = '' as $$
+  select 12;
+$$;
+
+revoke all on function public.stage_five_create_character(uuid, uuid, text, text, text, jsonb, integer, integer, integer, integer, jsonb, jsonb, jsonb, jsonb) from public, anon, authenticated;
+revoke all on function public.apply_srd_character_rules(uuid, jsonb) from public, anon, authenticated;
+revoke all on function public.commit_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text) from public, anon, authenticated;
+revoke all on function public.commit_claimed_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text, text) from public, anon, authenticated;
+revoke all on function public.dng_schema_version() from public, anon, authenticated;
+grant execute on function public.stage_five_create_character(uuid, uuid, text, text, text, jsonb, integer, integer, integer, integer, jsonb, jsonb, jsonb, jsonb) to service_role;
+grant execute on function public.commit_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text) to service_role;
+grant execute on function public.commit_claimed_srd_round_resolution(uuid, text, text, jsonb, jsonb, jsonb, jsonb, text, text) to service_role;
+grant execute on function public.dng_schema_version() to service_role;
+
+notify pgrst, 'reload schema';